From 93309d7b76f9969c0bd3d96166d8fbaaa821bfe5 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 8 Nov 2025 17:57:04 +0100
Subject: [PATCH 001/831] gst_all_1.gst-plugins-bad: don't build with gtk3 by
 default

---
 pkgs/development/libraries/gstreamer/bad/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 5bee93cb5124..5e5ed2f8eb43 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -108,7 +108,8 @@
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
-  guiSupport ? true,
+  # causes gtk4 to depend on gtk3 and makes little sense
+  guiSupport ? false,
   gst-plugins-bad,
   apple-sdk_gstreamer,
 }:
@@ -356,8 +357,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (!gst-plugins-base.glEnabled) [
     "-Dgl=disabled"
   ]
-  ++ lib.optionals (!gst-plugins-base.waylandEnabled || !guiSupport) [
+  ++ lib.optionals (!guiSupport) [
     "-Dgtk3=disabled" # Wayland-based GTK sink
+  ]
+  ++ lib.optionals (!gst-plugins-base.waylandEnabled) [
     "-Dwayland=disabled"
   ]
   ++ lib.optionals (!gst-plugins-base.glEnabled) [

From 40092a228d3a850f924a0f3cc723fb39bac15752 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Nov 2025 12:28:17 +0000
Subject: [PATCH 002/831] libnice: 0.1.22 -> 0.1.23

---
 pkgs/by-name/li/libnice/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 6d2361b25d2e..99b58d0dc778 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libnice";
-  version = "0.1.22";
+  version = "0.1.23";
 
   outputs = [
     "bin"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
-    hash = "sha256-pfckzwnq5QxBp1FxQdidpKYeyerKMtpKAHP67VQXrX4=";
+    hash = "sha256-YY/E6N45O3GbFkHB2O7AGCbU050VrekmedIhx/Xk5w0=";
   };
 
   patches = [

From 470cbe3d39b8b46ec2d49c2cfc7aced1e7e7e542 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 25 Jan 2026 00:28:38 +0000
Subject: [PATCH 003/831] byacc: 20241231 -> 20260126

---
 pkgs/by-name/by/byacc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/by/byacc/package.nix b/pkgs/by-name/by/byacc/package.nix
index 8da6559f602b..12b19dd74a14 100644
--- a/pkgs/by-name/by/byacc/package.nix
+++ b/pkgs/by-name/by/byacc/package.nix
@@ -6,14 +6,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "byacc";
-  version = "20241231";
+  version = "20260126";
 
   src = fetchurl {
     urls = [
       "https://invisible-mirror.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
       "https://invisible-island.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
     ];
-    hash = "sha256-GSwvrgSNTn9RS6RRYn+cTmEnZQmfgZwZGR+f3j5glnM=";
+    hash = "sha256-thjF+0TC9fBIhD25D30bJPePR7B5E8jHuoyULT6ySwA=";
   };
 
   configureFlags = [

From 2ae3d0ab89adf70a97711ac661e6ec9d0c9c2512 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 11 Feb 2026 12:40:01 +0000
Subject: [PATCH 004/831] sord: 0.16.20 -> 0.16.22

---
 pkgs/by-name/so/sord/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/so/sord/package.nix b/pkgs/by-name/so/sord/package.nix
index 75f9e48de010..3c00f7edc721 100644
--- a/pkgs/by-name/so/sord/package.nix
+++ b/pkgs/by-name/so/sord/package.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sord";
-  version = "0.16.20";
+  version = "0.16.22";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "drobilla";
     repo = "sord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+f3dxhcxVoub+KeI5c5/J87SVvAawrm5cZgo2qogdRM=";
+    hash = "sha256-XrtYKc/7oD/4XrWduokILeWgNIY0QrRDj36s50LOK80=";
   };
 
   outputs = [

From 222a2527d2dd16a0a24053cd99bfd96e7dc042c8 Mon Sep 17 00:00:00 2001
From: Rohit Singh <Rohit1.Singh@deshaw.com>
Date: Fri, 13 Feb 2026 08:38:23 -0500
Subject: [PATCH 005/831] awscli2: replace vendored certs

---
 pkgs/by-name/aw/awscli2/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/aw/awscli2/package.nix b/pkgs/by-name/aw/awscli2/package.nix
index 7557d14a22b6..2a08fc333968 100644
--- a/pkgs/by-name/aw/awscli2/package.nix
+++ b/pkgs/by-name/aw/awscli2/package.nix
@@ -12,6 +12,7 @@
   awscli2,
   addBinToPathHook,
   writableTmpDirAsHomeHook,
+  cacert,
 }:
 
 let
@@ -81,6 +82,8 @@ py.pkgs.buildPythonApplication rec {
     # with a configure script, but we don't as we provide all of the packages
     # through PYTHONPATH
     sed -i '/pip>=/d' requirements/bootstrap.txt
+
+    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt awscli/botocore/cacert.pem
   '';
 
   nativeBuildInputs = [

From c110df0ccebea65a1e2715ec8974fa0511f25684 Mon Sep 17 00:00:00 2001
From: Rohit Singh <Rohit1.Singh@deshaw.com>
Date: Fri, 13 Feb 2026 08:38:35 -0500
Subject: [PATCH 006/831] python3Packages.botocore: replace vendored certs

---
 pkgs/development/python-modules/botocore/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/botocore/default.nix b/pkgs/development/python-modules/botocore/default.nix
index 9164bcd76bb9..810b95dfb660 100644
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   awscrt,
+  cacert,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -29,6 +30,10 @@ buildPythonPackage rec {
     hash = "sha256-avuv1uXKMeSr3SL+BI9XW8tDCQM/dlXFn590di3S03k=";
   };
 
+  postPatch = ''
+    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt botocore/cacert.pem
+  '';
+
   build-system = [
     setuptools
   ];

From b3ebd1069ea3132b7de8f42e148e58af17448c9e Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Tue, 17 Feb 2026 16:53:19 +0000
Subject: [PATCH 007/831] pkgsMusl.nix: fix build

---
 .../package-management/nix/modular/src/libexpr/package.nix    | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
index 79cb2c93e259..5e5edd94871d 100644
--- a/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
@@ -37,6 +37,10 @@ mkMesonLibrary (finalAttrs: {
 
   workDir = ./.;
 
+  hardeningDisable = lib.optionals stdenv.hostPlatform.isMusl [
+    "fortify"
+  ];
+
   nativeBuildInputs = [
     bison
     flex

From c4831d5909c65bbd71b42951dc6d3d15066950aa Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 29 Jan 2026 22:21:13 +0100
Subject: [PATCH 008/831] abseil-cpp: add pkg-config validation

---
 pkgs/by-name/ab/abseil-cpp_202505/package.nix | 216 +++++++++++++++++-
 pkgs/by-name/ab/abseil-cpp_202508/package.nix | 107 ++++++++-
 2 files changed, 321 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ab/abseil-cpp_202505/package.nix b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
index c1884d4a953d..f85b5b2f95ab 100644
--- a/pkgs/by-name/ab/abseil-cpp_202505/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
@@ -6,6 +6,8 @@
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
+  testers,
+  validatePkgConfig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -30,10 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    validatePkgConfig
+  ];
 
   buildInputs = [ gtest ];
 
+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
@@ -41,5 +52,208 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.GaetanLepage ];
+    pkgConfigModules = [
+      "absl_log_internal_check_op"
+      "absl_absl_check"
+      "absl_strerror"
+      "absl_common_policy_traits"
+      "absl_graphcycles_internal"
+      "absl_raw_hash_set"
+      "absl_random_internal_entropy_pool"
+      "absl_time_zone"
+      "absl_prefetch"
+      "absl_compressed_tuple"
+      "absl_nullability"
+      "absl_vlog_is_on"
+      "absl_utf8_for_code_point"
+      "absl_base_internal"
+      "absl_bad_variant_access"
+      "absl_flags_parse"
+      "absl_exponential_biased"
+      "absl_log_internal_nullstream"
+      "absl_log_internal_structured_proto"
+      "absl_log_internal_check_impl"
+      "absl_tracing_internal"
+      "absl_random_bit_gen_ref"
+      "absl_meta"
+      "absl_random_distributions"
+      "absl_numeric"
+      "absl_flat_hash_set"
+      "absl_random_internal_randen_hwaes_impl"
+      "absl_malloc_internal"
+      "absl_layout"
+      "absl_type_traits"
+      "absl_random_internal_mock_helpers"
+      "absl_log_streamer"
+      "absl_function_ref"
+      "absl_log"
+      "absl_dynamic_annotations"
+      "absl_non_temporal_memcpy"
+      "absl_random_internal_randen"
+      "absl_stacktrace"
+      "absl_log_internal_globals"
+      "absl_log_internal_strip"
+      "absl_atomic_hook"
+      "absl_flags_usage_internal"
+      "absl_log_internal_voidify"
+      "absl_synchronization"
+      "absl_debugging_internal"
+      "absl_bind_front"
+      "absl_crc_internal"
+      "absl_random_internal_platform"
+      "absl_flags_path_util"
+      "absl_hash_testing"
+      "absl_flags_commandlineflag_internal"
+      "absl_hashtable_debug"
+      "absl_hashtablez_sampler"
+      "absl_random_internal_randen_engine"
+      "absl_log_globals"
+      "absl_optional"
+      "absl_crc_cpu_detect"
+      "absl_demangle_internal"
+      "absl_node_hash_map"
+      "absl_core_headers"
+      "absl_statusor"
+      "absl_str_format_internal"
+      "absl_crc32c"
+      "absl_cordz_update_scope"
+      "absl_cordz_handle"
+      "absl_log_internal_nullguard"
+      "absl_numeric_representation"
+      "absl_log_internal_log_impl"
+      "absl_raw_hash_set_resize_impl"
+      "absl_random_internal_distribution_test_util"
+      "absl_kernel_timeout_internal"
+      "absl_random_internal_uniform_helper"
+      "absl_random_seed_sequences"
+      "absl_cordz_info"
+      "absl_spy_hash_state"
+      "absl_vlog_config_internal"
+      "absl_flags_program_name"
+      "absl_hashtable_debug_hooks"
+      "absl_crc_cord_state"
+      "absl_decode_rust_punycode"
+      "absl_debugging"
+      "absl_overload"
+      "absl_config"
+      "absl_random_internal_fast_uniform_bits"
+      "absl_raw_hash_map"
+      "absl_random_internal_randen_hwaes"
+      "absl_bad_any_cast"
+      "absl_variant"
+      "absl_has_ostream_operator"
+      "absl_span"
+      "absl_btree"
+      "absl_random_internal_distribution_caller"
+      "absl_failure_signal_handler"
+      "absl_any"
+      "absl_poison"
+      "absl_str_format"
+      "absl_cord"
+      "absl_random_internal_wide_multiply"
+      "absl_random_internal_pcg_engine"
+      "absl_flags_internal"
+      "absl_check"
+      "absl_random_internal_seed_material"
+      "absl_log_flags"
+      "absl_no_destructor"
+      "absl_low_level_hash"
+      "absl_hashtable_control_bytes"
+      "absl_periodic_sampler"
+      "absl_log_internal_format"
+      "absl_log_initialize"
+      "absl_random_internal_generate_real"
+      "absl_raw_logging_internal"
+      "absl_inlined_vector"
+      "absl_log_internal_log_sink_set"
+      "absl_log_internal_flags"
+      "absl_flat_hash_map"
+      "absl_scoped_mock_log"
+      "absl_cordz_functions"
+      "absl_random_mocking_bit_gen"
+      "absl_fast_type_id"
+      "absl_sample_recorder"
+      "absl_log_internal_message"
+      "absl_bits"
+      "absl_random_seed_gen_exception"
+      "absl_log_sink_registry"
+      "absl_flags_marshalling"
+      "absl_leak_check"
+      "absl_examine_stack"
+      "absl_status_matchers"
+      "absl_flags_commandlineflag"
+      "absl_absl_vlog_is_on"
+      "absl_any_invocable"
+      "absl_cleanup_internal"
+      "absl_log_severity"
+      "absl_random_internal_salted_seed_seq"
+      "absl_flags_config"
+      "absl_log_structured"
+      "absl_die_if_null"
+      "absl_fixed_array"
+      "absl_cord_internal"
+      "absl_endian"
+      "absl_strings_internal"
+      "absl_symbolize"
+      "absl_log_internal_config"
+      "absl_absl_log"
+      "absl_memory"
+      "absl_container_common"
+      "absl_compare"
+      "absl_civil_time"
+      "absl_int128"
+      "absl_log_internal_append_truncated"
+      "absl_cordz_statistics"
+      "absl_log_internal_fnmatch"
+      "absl_flags"
+      "absl_non_temporal_arm_intrinsics"
+      "absl_random_internal_traits"
+      "absl_base"
+      "absl_algorithm_container"
+      "absl_hash"
+      "absl_log_internal_conditions"
+      "absl_time"
+      "absl_node_slot_policy"
+      "absl_errno_saver"
+      "absl_random_internal_randen_slow"
+      "absl_charset"
+      "absl_bounded_utf8_length_sequence"
+      "absl_city"
+      "absl_bad_optional_access"
+      "absl_random_internal_nonsecure_base"
+      "absl_flags_usage"
+      "absl_utility"
+      "absl_iterator_traits_internal"
+      "absl_spinlock_wait"
+      "absl_pretty_function"
+      "absl_algorithm"
+      "absl_log_sink"
+      "absl_status"
+      "absl_demangle_rust"
+      "absl_node_hash_set"
+      "absl_hash_policy_traits"
+      "absl_flags_private_handle_accessor"
+      "absl_cord_test_helpers"
+      "absl_strings"
+      "absl_log_internal_proto"
+      "absl_inlined_vector_internal"
+      "absl_iterator_traits_test_helper_internal"
+      "absl_random_random"
+      "absl_flags_reflection"
+      "absl_scoped_set_env"
+      "absl_throw_delegate"
+      "absl_hash_function_defaults"
+      "absl_weakly_mixed_integer"
+      "absl_cleanup"
+      "absl_random_internal_iostream_state_saver"
+      "absl_cordz_sample_token"
+      "absl_cordz_update_tracker"
+      "absl_string_view"
+      "absl_hash_container_defaults"
+      "absl_random_internal_fastmath"
+      "absl_log_internal_structured"
+      "absl_container_memory"
+      "absl_log_entry"
+    ];
   };
 })
diff --git a/pkgs/by-name/ab/abseil-cpp_202508/package.nix b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
index 5419ae381c67..7a808df2670a 100644
--- a/pkgs/by-name/ab/abseil-cpp_202508/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
@@ -6,6 +6,8 @@
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
+  testers,
+  validatePkgConfig,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,10 +37,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    validatePkgConfig
+  ];
 
   buildInputs = [ gtest ];
 
+  passthru.tests = {
+    pkg-config = testers.hasPkgConfigModules {
+      package = finalAttrs.finalPackage.dev;
+    };
+  };
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";
@@ -46,5 +57,99 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.GaetanLepage ];
+    pkgConfigModules = [
+      "absl_base"
+      "absl_city"
+      "absl_civil_time"
+      "absl_cord_internal"
+      "absl_cord"
+      "absl_cordz_functions"
+      "absl_cordz_handle"
+      "absl_cordz_info"
+      "absl_cordz_sample_token"
+      "absl_crc_cord_state"
+      "absl_crc_cpu_detect"
+      "absl_crc_internal"
+      "absl_crc32c"
+      "absl_debugging_internal"
+      "absl_decode_rust_punycode"
+      "absl_demangle_internal"
+      "absl_demangle_rust"
+      "absl_die_if_null"
+      "absl_examine_stack"
+      "absl_exponential_biased"
+      "absl_failure_signal_handler"
+      "absl_flags_commandlineflag_internal"
+      "absl_flags_commandlineflag"
+      "absl_flags_config"
+      "absl_flags_internal"
+      "absl_flags_marshalling"
+      "absl_flags_parse"
+      "absl_flags_private_handle_accessor"
+      "absl_flags_program_name"
+      "absl_flags_reflection"
+      "absl_flags_usage_internal"
+      "absl_flags_usage"
+      "absl_graphcycles_internal"
+      "absl_hash"
+      "absl_hashtable_profiler"
+      "absl_hashtablez_sampler"
+      "absl_int128"
+      "absl_kernel_timeout_internal"
+      "absl_leak_check"
+      "absl_log_entry"
+      "absl_log_flags"
+      "absl_log_globals"
+      "absl_log_initialize"
+      "absl_log_internal_check_op"
+      "absl_log_internal_conditions"
+      "absl_log_internal_fnmatch"
+      "absl_log_internal_format"
+      "absl_log_internal_globals"
+      "absl_log_internal_log_sink_set"
+      "absl_log_internal_message"
+      "absl_log_internal_nullguard"
+      "absl_log_internal_proto"
+      "absl_log_internal_structured_proto"
+      "absl_log_severity"
+      "absl_log_sink"
+      "absl_malloc_internal"
+      "absl_periodic_sampler"
+      "absl_poison"
+      "absl_profile_builder"
+      "absl_random_distributions"
+      "absl_random_internal_distribution_test_util"
+      "absl_random_internal_entropy_pool"
+      "absl_random_internal_platform"
+      "absl_random_internal_randen_hwaes_impl"
+      "absl_random_internal_randen_hwaes"
+      "absl_random_internal_randen_slow"
+      "absl_random_internal_randen"
+      "absl_random_internal_seed_material"
+      "absl_random_seed_gen_exception"
+      "absl_random_seed_sequences"
+      "absl_raw_hash_set"
+      "absl_raw_logging_internal"
+      "absl_scoped_mock_log"
+      "absl_scoped_set_env"
+      "absl_spinlock_wait"
+      "absl_stacktrace"
+      "absl_status_matchers"
+      "absl_status"
+      "absl_statusor"
+      "absl_str_format_internal"
+      "absl_strerror"
+      "absl_string_view"
+      "absl_strings_internal"
+      "absl_strings"
+      "absl_symbolize"
+      "absl_synchronization"
+      "absl_throw_delegate"
+      "absl_time_zone"
+      "absl_time"
+      "absl_tracing_internal"
+      "absl_utf8_for_code_point"
+      "absl_vlog_config_internal"
+    ];
   };
 })

From 2c5281616010ee627abf04761500335941b4cc55 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Tue, 27 Jan 2026 16:11:01 +0000
Subject: [PATCH 009/831] prefetch-npm-deps: support file: scheme for
 dependencies

Fixes #484067
---
 .../node/prefetch-npm-deps/default.nix        | 22 +++++++++++++++++++
 .../node/prefetch-npm-deps/src/main.rs        | 10 +++++++++
 .../node/prefetch-npm-deps/src/parse/mod.rs   | 14 +++++++-----
 3 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/pkgs/build-support/node/prefetch-npm-deps/default.nix b/pkgs/build-support/node/prefetch-npm-deps/default.nix
index bfa8fb863e4b..8bbbe4e10312 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/default.nix
+++ b/pkgs/build-support/node/prefetch-npm-deps/default.nix
@@ -195,6 +195,28 @@
 
           hash = "sha256-QGObVDd9qVtf/U78+ayP6RHVWsU+HXhg70BFblQ1PZs=";
         };
+
+        # Test lockfiles with file: dependencies
+        fileDependenciesV1 = makeTest {
+          name = "file-dependencies-lockfile-v1";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/elbywan/wretch/970b19e0fcc3dd219b9f3fc247d8f34cc01979c6/package-lock.json";
+            hash = "sha256-3vTMxc9M2TeiclUFYbG5eTzavSAXjAzz6N5v/1VM4Bc=";
+          };
+
+          hash = "sha256-4wTohTVWF49iQvdaUxNhwplfTVb53yFnAaUVA2xIXrc=";
+        };
+        fileDependenciesV3 = makeTest {
+          name = "file-dependencies-lockfile-v3";
+
+          src = fetchurl {
+            url = "https://raw.githubusercontent.com/alam00000/bentopdf/146e3f07d4111e309d0b29bb949e78e44454be3b/package-lock.json";
+            hash = "sha256-9Ea5ctJYbClxStYNhSfSpsO/P99/4CQK58PLK5e6PoQ=";
+          };
+
+          hash = "sha256-1xWkzAzZXd9f4sY9xFHLfj482ZCs2oKFJ79C+Iy7RFY=";
+        };
       };
 
     meta = {
diff --git a/pkgs/build-support/node/prefetch-npm-deps/src/main.rs b/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
index 2882aee9ec20..b65db0492c3e 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
+++ b/pkgs/build-support/node/prefetch-npm-deps/src/main.rs
@@ -238,6 +238,7 @@ fn fixup_lockfile(
                 .values_mut()
             {
                 if let Some(Value::String(resolved)) = package.get("resolved")
+                    && !resolved.starts_with("file:")
                     && let Some(Value::String(integrity)) = package.get("integrity")
                 {
                     if resolved.starts_with("git+") {
@@ -286,6 +287,7 @@ fn fixup_v1_deps(
             .as_object()
             .expect("v1 dep must be object")
             .get("resolved")
+            && !resolved.starts_with("file:")
             && let Some(Value::String(integrity)) = dep
                 .as_object()
                 .expect("v1 dep must be object")
@@ -509,6 +511,10 @@ mod tests {
                     "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                     "integrity": "sha512-aaa"
                 },
+                "baz": {
+                    "resolved": "file:baz.tar.gz",
+                    "integrity": "sha512-bbb"
+                },
                 "foo-bad": {
                     "resolved": "foo",
                     "integrity": "sha1-foo"
@@ -534,6 +540,10 @@ mod tests {
                 "bar": {
                     "resolved": "git+ssh://git@github.com/NixOS/nixpkgs.git",
                 },
+                "baz": {
+                    "resolved": "file:baz.tar.gz",
+                    "integrity": "sha512-bbb"
+                },
                 "foo-bad": {
                     "resolved": "foo",
                     "integrity": "sha512-foo"
diff --git a/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs b/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
index 3e6f5019ea33..6f76dd7f59df 100644
--- a/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
+++ b/pkgs/build-support/node/prefetch-npm-deps/src/parse/mod.rs
@@ -25,10 +25,10 @@ pub fn lockfile(
     let mut packages = lock::packages(content)
         .context("failed to extract packages from lockfile")?
         .into_par_iter()
-        .map(|p| {
+        .filter_map(|p| {
             let n = p.name.clone().unwrap();
 
-            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}"))
+            Package::from_lock(p).with_context(|| format!("failed to parse data for {n}")).transpose()
         })
         .collect::<anyhow::Result<Vec<_>>>()?;
 
@@ -124,7 +124,7 @@ enum Specifics {
 }
 
 impl Package {
-    fn from_lock(pkg: lock::Package) -> anyhow::Result<Package> {
+    fn from_lock(pkg: lock::Package) -> anyhow::Result<Option<Package>> {
         let mut resolved = match pkg
             .resolved
             .expect("at this point, packages should have URLs")
@@ -133,6 +133,10 @@ impl Package {
             UrlOrString::String(_) => panic!("at this point, all packages should have URLs"),
         };
 
+        if resolved.scheme() == "file" {
+            return Ok(None);
+        }
+
         let specifics = match get_hosted_git_url(&resolved)? {
             Some(hosted) => {
                 let body = util::get_url_body_with_retry(&hosted)?;
@@ -174,12 +178,12 @@ impl Package {
             },
         };
 
-        Ok(Package {
+        Ok(Some(Package {
             name: pkg.name.unwrap(),
             version: pkg.version,
             url: resolved,
             specifics,
-        })
+        }))
     }
 
     pub fn tarball(&self) -> anyhow::Result<Vec<u8>> {

From f33cf3c09ed6c4345ca13f46df17012fda9d46c4 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 19 Mar 2026 09:10:11 +0100
Subject: [PATCH 010/831] meson.setupHook: fix enableParallelChecking

Previously, this controlled the parallelism of building the tests.
The tests were then always run in parallel.  Fix so
enableParallelBuilding controls building, and enableParallelChecking
controls the test run.

Fixes: bb73d9a0ceb2 ("meson: support enableParallelChecking")
---
 pkgs/by-name/me/meson/setup-hook.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/me/meson/setup-hook.sh b/pkgs/by-name/me/meson/setup-hook.sh
index a9feb15eedd3..4eac58193142 100644
--- a/pkgs/by-name/me/meson/setup-hook.sh
+++ b/pkgs/by-name/me/meson/setup-hook.sh
@@ -63,16 +63,22 @@ mesonCheckPhase() {
         flagsArray+=("--timeout-multiplier=0")
     fi
 
-    # Parallel checking is enabled by default.
+    # Parallel building is enabled by default.
     local buildCores=1
-    if [ "${enableParallelChecking-1}" ]; then
+    if [ "${enableParallelBuilding-1}" ]; then
         buildCores="$NIX_BUILD_CORES"
     fi
 
     TERM=dumb ninja -j"$buildCores" $ninjaFlags "${ninjaFlagsArray[@]}" meson-test-prereq
 
+    # Parallel checking is enabled by default.
+    local testCores=1
+    if [ "${enableParallelChecking-1}" ]; then
+        testCores="$NIX_BUILD_CORES"
+    fi
+
     echoCmd 'mesonCheckPhase flags' "${flagsArray[@]}"
-    meson test --no-rebuild --print-errorlogs --max-lines=1000000 "${flagsArray[@]}"
+    meson test -j"$testCores" --no-rebuild --print-errorlogs --max-lines=1000000 "${flagsArray[@]}"
 
     runHook postCheck
 }

From 9088b3d1674994911e0d24c851fb46cca48871a0 Mon Sep 17 00:00:00 2001
From: znaniye <zn4niye@proton.me>
Date: Thu, 16 Oct 2025 14:28:11 -0300
Subject: [PATCH 011/831] python3Packages.paramiko: invoke is a required
 dependency

---
 pkgs/development/python-modules/paramiko/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 156fae9d96d0..6350ba2e5a8a 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -30,6 +30,7 @@ buildPythonPackage rec {
   dependencies = [
     bcrypt
     cryptography
+    invoke
     pynacl
   ];
 
@@ -39,7 +40,6 @@ buildPythonPackage rec {
       gssapi
     ];
     ed25519 = [ ];
-    invoke = [ invoke ];
   };
 
   nativeCheckInputs = [

From b6254c48df9b757515242f80d7f78a598333b941 Mon Sep 17 00:00:00 2001
From: znaniye <zn4niye@proton.me>
Date: Thu, 16 Oct 2025 15:43:36 -0300
Subject: [PATCH 012/831] duplicity: remove invoke from dependencies

invoke is not a required dependency of duplicity.
It does not appear in upstream's requirements.txt nor pyproject.toml:
- https://gitlab.com/duplicity/duplicity/-/blob/dev/requirements.txt
- https://gitlab.com/duplicity/duplicity/-/blob/dev/pyproject.toml
---
 pkgs/by-name/du/duplicity/package.nix | 25 +++++++++++--------------
 1 file changed, 11 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/du/duplicity/package.nix b/pkgs/by-name/du/duplicity/package.nix
index 7cdb8eff47f2..8e7b8698a1a4 100644
--- a/pkgs/by-name/du/duplicity/package.nix
+++ b/pkgs/by-name/du/duplicity/package.nix
@@ -75,20 +75,17 @@ let
       glib
     ];
 
-    pythonPath =
-      with python3.pkgs;
-      [
-        b2sdk
-        boto3
-        idna
-        pygobject3
-        fasteners
-        paramiko
-        pexpect
-        # Currently marked as broken.
-        # pydrive2
-      ]
-      ++ paramiko.optional-dependencies.invoke;
+    pythonPath = with python3.pkgs; [
+      b2sdk
+      boto3
+      idna
+      pygobject3
+      fasteners
+      paramiko
+      pexpect
+      # Currently marked as broken.
+      # pydrive2
+    ];
 
     nativeCheckInputs = [
       gnupg # Add 'gpg' to PATH.

From 23c46c60c0dca1e971425b43903dd87ea206e674 Mon Sep 17 00:00:00 2001
From: Null Terminator <nullterminator0@protonmail.com>
Date: Sat, 28 Feb 2026 16:30:18 +0300
Subject: [PATCH 013/831] bintools-wrapper: use `tr` for uppercase

Since bash's parameter expansion for uppercase creates invalid
identifiers in certain locales (like Turkish), it is more ideal
to use `tr` for locale-agnostic string substitution.
---
 pkgs/build-support/bintools-wrapper/setup-hook.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/bintools-wrapper/setup-hook.sh b/pkgs/build-support/bintools-wrapper/setup-hook.sh
index 93aa7825f9a9..1d67e65baf20 100644
--- a/pkgs/build-support/bintools-wrapper/setup-hook.sh
+++ b/pkgs/build-support/bintools-wrapper/setup-hook.sh
@@ -60,7 +60,8 @@ do
     if
         PATH=$_PATH type -p "@targetPrefix@${cmd}" > /dev/null
     then
-        export "${cmd^^}${role_post}=@targetPrefix@${cmd}";
+        upper_case="$(echo "$cmd" | tr "a-z" "A-Z")"
+        export "${upper_case}${role_post}=@targetPrefix@${cmd}";
     fi
 done
 

From f6da9198396a515d12e2f9d41bc7d6b45aa28209 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 4 Apr 2026 02:07:15 +0700
Subject: [PATCH 014/831] gbenchmark: 1.9.4 -> 1.9.5

---
 pkgs/by-name/gb/gbenchmark/package.nix | 35 +++++++++++++++++---------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index 6cc1617193ee..6c9097d041d7 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -5,18 +5,19 @@
   cmake,
   ninja,
   gtest,
+  glibcLocales,
   prometheus-cpp,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gbenchmark";
-  version = "1.9.4";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-P7wJcKkIBoWtN9FCRticpBzYbEZPq71a0iW/2oDTZRU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Mm4pG7zMB00iof32CxreoNBFnduPZTMp3reHMCIAFPQ=";
   };
 
   nativeBuildInputs = [
@@ -26,20 +27,30 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
+  nativeCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ glibcLocales ];
+
   cmakeFlags = [
     (lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false)
     (lib.cmakeBool "BENCHMARK_ENABLE_WERROR" false)
   ];
 
-  # We ran into issues with gtest 1.8.5 conditioning on
-  # `#if __has_cpp_attribute(maybe_unused)`, which was, for some
-  # reason, going through even when C++14 was being used and
-  # breaking the build on Darwin by triggering errors about using
-  # C++17 features.
-  #
-  # This might be a problem with our Clang, as it does not reproduce
-  # with Xcode, but we just work around it by silencing the warning.
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++17-attribute-extensions";
+  env = {
+    # We ran into issues with gtest 1.8.5 conditioning on
+    # `#if __has_cpp_attribute(maybe_unused)`, which was, for some
+    # reason, going through even when C++14 was being used and
+    # breaking the build on Darwin by triggering errors about using
+    # C++17 features.
+    #
+    # This might be a problem with our Clang, as it does not reproduce
+    # with Xcode, but we just work around it by silencing the warning.
+    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++17-attribute-extensions";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    # For test:locale_impermeability_test
+    LANG = "en_US.UTF-8";
+    LC_ALL = "en_US.UTF-8";
+    LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
+  };
 
   # Tests fail on 32-bit due to not enough precision
   doCheck = stdenv.hostPlatform.is64bit;

From 63ac700b307cfca805d642d85a459e8c3371526b Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 4 Apr 2026 02:08:06 +0700
Subject: [PATCH 015/831] gbenchmark: add miniharinn as a maintainer

---
 pkgs/by-name/gb/gbenchmark/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index 6c9097d041d7..9d21e2c8a84b 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -64,6 +64,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/google/benchmark";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux ++ lib.platforms.darwin ++ lib.platforms.freebsd;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ miniharinn ];
   };
 })

From 68ee0a8e0e154d5a31018fe69053e5f17012fbe5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Apr 2026 12:51:19 +0000
Subject: [PATCH 016/831] libcbor: 0.13.0 -> 0.14.0

---
 pkgs/by-name/li/libcbor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libcbor/package.nix b/pkgs/by-name/li/libcbor/package.nix
index c2445e7d8965..f4a3790f9bbe 100644
--- a/pkgs/by-name/li/libcbor/package.nix
+++ b/pkgs/by-name/li/libcbor/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcbor";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "PJK";
     repo = "libcbor";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ePgVR7VHXWKqOShuAEQG3BJ08W2aZS/vfcPUCqTw7X4=";
+    hash = "sha256-zjajNtj4jKbt3pLjfLrgtYljyMDYJtnzAC5JPdt+Wys=";
   };
 
   outputs = [

From 216e73bd0ffce505b23e5396c8ae6304d9149a04 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Apr 2026 06:16:54 +0000
Subject: [PATCH 017/831] cmocka: 2.0.1 -> 2.0.2

---
 pkgs/by-name/cm/cmocka/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cm/cmocka/package.nix b/pkgs/by-name/cm/cmocka/package.nix
index 34cb30c206b1..cae6effbbfbd 100644
--- a/pkgs/by-name/cm/cmocka/package.nix
+++ b/pkgs/by-name/cm/cmocka/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cmocka";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchurl {
     url = "https://cmocka.org/files/${lib.versions.majorMinor finalAttrs.version}/cmocka-${finalAttrs.version}.tar.xz";
-    hash = "sha256-PzUzOCuimrOr9cT0snt50WXw31HqWH3nSbEbaLQBkYA=";
+    hash = "sha256-OfkvNmvfPxoCr02nW0pcUt9sn35zbH1l3hMoP58O9BY=";
   };
 
   patches = [

From 8b7658bfa57bcc361bdb7d79c80f9cf0bde62db0 Mon Sep 17 00:00:00 2001
From: beviu <contact@beviu.com>
Date: Wed, 15 Apr 2026 15:45:27 +0200
Subject: [PATCH 018/831] installer/nixos-generate-config: use lib.getExe

---
 nixos/modules/installer/tools/tools.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index 086d8971d466..f3f60dfbdd49 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -30,15 +30,15 @@ let
     name = "nixos-generate-config";
     src = ./nixos-generate-config.pl;
     replacements = {
-      perl = "${
+      perl = lib.getExe (
         pkgs.perl.withPackages (p: [
           p.FileSlurp
           p.ConfigIniFiles
         ])
-      }/bin/perl";
+      );
       hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
-      detectvirt = "${config.systemd.package}/bin/systemd-detect-virt";
-      btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
+      detectvirt = lib.getExe' config.systemd.package "systemd-detect-virt";
+      btrfs = lib.getExe pkgs.btrfs-progs;
       inherit (config.system.nixos-generate-config) configuration desktopConfiguration flake;
       xserverEnabled = config.services.xserver.enable;
     };

From 623ec633ba806be11031a0cd1760649edd9d5c3a Mon Sep 17 00:00:00 2001
From: beviu <contact@beviu.com>
Date: Wed, 15 Apr 2026 16:07:29 +0200
Subject: [PATCH 019/831] nixos-generate-config: substitute bcachefs

For systems where the package is marked as broken, use `false` instead.
The Perl script checks for a non-zero exit status, so it will handle it
as if the command failed.
---
 nixos/modules/installer/tools/nixos-generate-config.pl | 2 +-
 nixos/modules/installer/tools/tools.nix                | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/installer/tools/nixos-generate-config.pl b/nixos/modules/installer/tools/nixos-generate-config.pl
index 3d0f4a9f7d86..96d0d68e5c93 100644
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -505,7 +505,7 @@ EOF
     # This should work for single and multi-device systems.
     # still needs subvolume support
     if ($fsType eq "bcachefs") {
-        my ($status, @info) = runCommand("bcachefs fs usage $rootDir$mountPoint");
+        my ($status, @info) = runCommand("@bcachefs@ fs usage $rootDir$mountPoint");
         my $UUID = $info[0];
 
         if ($status == 0 && $UUID =~ /^Filesystem:[ \t\n]*([0-9a-z-]+)/) {
diff --git a/nixos/modules/installer/tools/tools.nix b/nixos/modules/installer/tools/tools.nix
index f3f60dfbdd49..6ce3e2839371 100644
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -38,6 +38,11 @@ let
       );
       hostPlatformSystem = pkgs.stdenv.hostPlatform.system;
       detectvirt = lib.getExe' config.systemd.package "systemd-detect-virt";
+      bcachefs =
+        if pkgs.bcachefs-tools.meta.broken then
+          lib.getExe' pkgs.coreutils "false"
+        else
+          lib.getExe pkgs.bcachefs-tools;
       btrfs = lib.getExe pkgs.btrfs-progs;
       inherit (config.system.nixos-generate-config) configuration desktopConfiguration flake;
       xserverEnabled = config.services.xserver.enable;

From e7d1fca56e9878d4f7e70ad1b8678e913a4b2316 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 18 Apr 2026 21:57:26 +0100
Subject: [PATCH 020/831] netpbm: 11.13.3 -> 11.14.0

---
 pkgs/by-name/ne/netpbm/c23.patch   | 63 ------------------------------
 pkgs/by-name/ne/netpbm/package.nix | 11 ++----
 2 files changed, 3 insertions(+), 71 deletions(-)
 delete mode 100644 pkgs/by-name/ne/netpbm/c23.patch

diff --git a/pkgs/by-name/ne/netpbm/c23.patch b/pkgs/by-name/ne/netpbm/c23.patch
deleted file mode 100644
index c7712f0ba230..000000000000
--- a/pkgs/by-name/ne/netpbm/c23.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From cde10364f1b59098fa2fbcacbdba88c7bbab4848 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Sun, 22 Feb 2026 12:06:15 +0100
-Subject: [PATCH] Remove function declarators without prototypes
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-These are no longer valid in C23 — they prototype the function as
-taking no arguments, and now cause compilation errors when building
-for non-Glibc systems.
-
-getenv is part of the C standard, so should be universally present,
-and getopt is part of POSIX, so conflicting prototypes should be a
-thing of the past.  Similar changes have been made in upstream gnulib.
----
- converter/other/fiasco/getopt.c | 3 +--
- converter/other/fiasco/getopt.h | 7 -------
- 2 files changed, 1 insertion(+), 9 deletions(-)
-
-diff --git a/converter/other/fiasco/getopt.c b/converter/other/fiasco/getopt.c
-index 65c206c3..565fac28 100644
---- a/converter/other/fiasco/getopt.c
-+++ b/converter/other/fiasco/getopt.c
-@@ -44,6 +44,7 @@
- 
- #include <string.h>
- #include <stdio.h>
-+#include <stdlib.h>
- 
- /* Comment out all this code if we are using the GNU C Library, and are not
-    actually compiling the library itself.  This code is part of the GNU C
-@@ -203,8 +204,6 @@ static char *posixly_correct;
- /* Avoid depending on library functions or files
-    whose names are inconsistent.  */
- 
--char *getenv ();
--
- static char *
- my_index (str, chr)
-      const char *str;
-diff --git a/converter/other/fiasco/getopt.h b/converter/other/fiasco/getopt.h
-index 3c735e3d..08138da4 100644
---- a/converter/other/fiasco/getopt.h
-+++ b/converter/other/fiasco/getopt.h
-@@ -95,14 +95,7 @@ struct option
- #define optional_argument       2
- 
- #if defined (__STDC__) && __STDC__
--#ifdef __GNU_LIBRARY__
--/* Many other libraries have conflicting prototypes for getopt, with
--   differences in the consts, in stdlib.h.  To avoid compilation
--   errors, only prototype getopt for the GNU C library.  */
- extern int getopt (int argc, char *const *argv, const char *shortopts);
--#else /* not __GNU_LIBRARY__ */
--extern int getopt ();
--#endif /* __GNU_LIBRARY__ */
- extern int getopt_long (int argc, char *const *argv, const char *shortopts,
-                         const struct option *longopts, int *longind);
- extern int getopt_long_only (int argc, char *const *argv,
--- 
-2.52.0
-
diff --git a/pkgs/by-name/ne/netpbm/package.nix b/pkgs/by-name/ne/netpbm/package.nix
index f7841cfe54bf..0b6ea0555c86 100644
--- a/pkgs/by-name/ne/netpbm/package.nix
+++ b/pkgs/by-name/ne/netpbm/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.13.3";
+  version = "11.14.0";
 
   outputs = [
     "bin"
@@ -31,15 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "5164";
-    sha256 = "sha256-3teRW9oucwv0+V+eyLVvh8Y2NtrFoyIt1JWoC2gyVgM=";
+    rev = "5182";
+    sha256 = "sha256-VbVN08WVXQYXlEBK1yIKj5aIWWaBhim4rQc68ViA/vA=";
   };
 
-  patches = [
-    # Sent to maintainer 2026-02-22.
-    ./c23.patch
-  ];
-
   nativeBuildInputs = [
     pkg-config
     flex

From 2b8ae0a0f1e2a1c302cab306ee8926f0214f71ba Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Sun, 19 Apr 2026 11:08:58 +0800
Subject: [PATCH 021/831] openssl*: enable strictDeps and __structuredAttrs

---
 pkgs/development/libraries/openssl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 2401b143436e..029085b841a6 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -378,8 +378,8 @@ let
 
       passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
-      strictDeps = lib.versionAtLeast version "4.0";
-      __structuredAttrs = lib.versionAtLeast version "4.0";
+      strictDeps = true;
+      __structuredAttrs = true;
 
       meta = {
         homepage = "https://www.openssl.org/";

From 40041739c7dc0885be77d3dc259b10354ed9d189 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 19 Apr 2026 09:05:18 +0100
Subject: [PATCH 022/831] elfutils: 0.194 -> 0.195

Changes: https://www.mail-archive.com/elfutils-devel@sourceware.org/msg09139.html
---
 pkgs/by-name/el/elfutils/package.nix          | 11 +----
 .../test-run-sysroot-reliability.patch        | 44 -------------------
 2 files changed, 2 insertions(+), 53 deletions(-)
 delete mode 100644 pkgs/by-name/el/elfutils/test-run-sysroot-reliability.patch

diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index 10d00afecf70..4a73d364c75c 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -28,11 +28,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation (finalAttrs: {
   pname = "elfutils";
-  version = "0.194";
+  version = "0.195";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${finalAttrs.version}/elfutils-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-CeL/Az05uqiziKLX+8U5C/3pmuO3xnx9qvdDP7zw8B4=";
+    hash = "sha256-N2Kf338fPcKBjhOPyiuAlBd9bC0PcB07tlClYSGNwCY=";
   };
 
   patches = [
@@ -57,13 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strndupa.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "sha256-7daehJj1t0wPtQzTv+/Rpuqqs5Ng/EYnZzrcf2o/Lb0=";
     })
-    (fetchpatch {
-      name = "fix-aarch64_attributes.patch";
-      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=b27adc5262e807f341ca0a4910ce04294144f79a";
-      hash = "sha256-hksO5HXL9Jv5E4o2rI4NAgQp+4z+Lg7Wn/AdW7fpr0c=";
-    })
-    # https://patchwork.sourceware.org/project/elfutils/patch/20251205145241.1165646-1-arnout@bzzt.net/
-    ./test-run-sysroot-reliability.patch
   ]
   ++ lib.optionals stdenv.hostPlatform.isMusl [ ./musl-error_h.patch ];
 
diff --git a/pkgs/by-name/el/elfutils/test-run-sysroot-reliability.patch b/pkgs/by-name/el/elfutils/test-run-sysroot-reliability.patch
deleted file mode 100644
index 6e5b5890a758..000000000000
--- a/pkgs/by-name/el/elfutils/test-run-sysroot-reliability.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-commit 898804bed022d1ef26e5c0b12550f87fc86f29ed
-Author: Arnout Engelen <arnout@bzzt.net>
-Date:   Thu Dec 4 21:42:40 2025 +0100
-
-    tests: improve reliability of run-sysroot.sh
-    
-    Previously, the 'second' test would test the `RESOLVE_IN_ROOT` feature
-    when the current libc supports it, even when the currently running
-    kernel did not yet support it.
-    
-    Signed-off-by: Arnout Engelen <arnout@bzzt.net>
-
-diff --git a/tests/run-sysroot.sh b/tests/run-sysroot.sh
-index fe302446..d2041e8a 100755
---- a/tests/run-sysroot.sh
-+++ b/tests/run-sysroot.sh
-@@ -46,10 +46,14 @@ TID 431185:
- #8  0x0000aaaae56127f0 _start
- EOF
- 
--HAVE_OPENAT2=$(grep '^#define HAVE_OPENAT2_RESOLVE_IN_ROOT' \
--                    ${abs_builddir}/../config.h | awk '{print $3}')
-+libc_has_openat2_resolve_in_root() {
-+  grep '^#define HAVE_OPENAT2_RESOLVE_IN_ROOT' ${abs_builddir}/../config.h | awk '{print $3}'
-+}
-+kernel_has_openat2_resolve_in_root() {
-+  printf "%s\n%s" "5.6.0" "$(uname -r)" | sort -V -C
-+}
- 
--if [[ "$HAVE_OPENAT2" = 1 ]]; then
-+if libc_has_openat2_resolve_in_root && kernel_has_openat2_resolve_in_root; then
-     # Change the layout of files in sysroot to test symlink escape scenario
-     rm -f "${tmpdir}/sysroot/bin"
-     mkdir "${tmpdir}/sysroot/bin"
-@@ -57,7 +61,8 @@ if [[ "$HAVE_OPENAT2" = 1 ]]; then
-     ln -s /bin/bash "${tmpdir}/sysroot/usr/bin/bash"
- 
-     # Check that stack with --sysroot generates correct backtrace even if target
--    # binary is actually absolute symlink pointing outside of sysroot directory
-+    # binary is actually absolute symlink to be interpreted relative to the sysroot
-+    # directory
-     testrun "${abs_top_builddir}"/src/stack --core "${tmpdir}/core.bash" \
- 	    --sysroot "${tmpdir}/sysroot" >"${tmpdir}/stack.out"
- 

From 95f82fa6e711b63f1b94ba2b30ba9bfd0f2e46ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 16:03:41 +0000
Subject: [PATCH 023/831] fluidsynth: 2.5.3 -> 2.5.4

---
 pkgs/by-name/fl/fluidsynth/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/fluidsynth/package.nix b/pkgs/by-name/fl/fluidsynth/package.nix
index 78b37719df78..3bb34d87c60d 100644
--- a/pkgs/by-name/fl/fluidsynth/package.nix
+++ b/pkgs/by-name/fl/fluidsynth/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k8IHS6Mh1b1iMSuBg3svlf7A2dsg6VHEKqlDhvyJnbo=";
+    hash = "sha256-uL9K2Bc5PA6qm/QVFvEUDyGBst9L/sNP0+HculCWCZk=";
     fetchSubmodules = true;
   };
 

From c1fde5e8adc88ec9a133913b2b67c61b1a4d666e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 20 Apr 2026 20:06:21 +0000
Subject: [PATCH 024/831] game-music-emu: 0.6.4 -> 0.6.5

---
 pkgs/by-name/ga/game-music-emu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ga/game-music-emu/package.nix b/pkgs/by-name/ga/game-music-emu/package.nix
index 54eee2b237f9..f660fde43654 100644
--- a/pkgs/by-name/ga/game-music-emu/package.nix
+++ b/pkgs/by-name/ga/game-music-emu/package.nix
@@ -8,14 +8,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "0.6.4";
+  version = "0.6.5";
   pname = "game-music-emu";
 
   src = fetchFromGitHub {
     owner = "libgme";
     repo = "game-music-emu";
     tag = finalAttrs.version;
-    hash = "sha256-qGNWFFUUjv2R5e/nQrriAyDJCARISqNB8e5/1zEJ3fk=";
+    hash = "sha256-zn1t0oDj8hz/sfbG7lrstkv2Kf6cL7zAEMpIu9X4dyQ=";
   };
   nativeBuildInputs = [
     cmake

From 4ec33b014efb87a9a6997bdf8bdd4e9f62790272 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 20 Apr 2026 21:40:13 +0100
Subject: [PATCH 025/831] md4c: 0.5.2 -> 0.5.3

Changes: https://github.com/mity/md4c/compare/release-0.5.2...release-0.5.3
---
 pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch | 44 -------------------
 pkgs/by-name/md/md4c/package.nix              | 11 +----
 2 files changed, 2 insertions(+), 53 deletions(-)
 delete mode 100644 pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch

diff --git a/pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch b/pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch
deleted file mode 100644
index e0e9f3d96b2b..000000000000
--- a/pkgs/by-name/md/md4c/0001-fix-pkgconfig.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 0ab8f5a6ee305cf4edcebfdc7b9eb5f98302de75 Mon Sep 17 00:00:00 2001
-From: Leif Middelschulte <Leif.Middelschulte@klsmartin.com>
-Date: Fri, 17 Sep 2021 16:16:17 +0200
-Subject: [PATCH] pc.in: use _FULL_ variable variants
-
-Nix' cmake packaging handler replaces the CMAKE_INSTALL_INCLUDEDIR
-with the absolute path. Which break package
-portability (i.e. `prefix`-usage).
----
- src/md4c-html.pc.in | 6 ++----
- src/md4c.pc.in      | 6 ++----
- 2 files changed, 4 insertions(+), 8 deletions(-)
-
-diff --git a/src/md4c-html.pc.in b/src/md4c-html.pc.in
-index 504bb52..fec7df4 100644
---- a/src/md4c-html.pc.in
-+++ b/src/md4c-html.pc.in
-@@ -1,7 +1,5 @@
--prefix=@CMAKE_INSTALL_PREFIX@
--exec_prefix=@CMAKE_INSTALL_PREFIX@
--libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
--includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
- 
- Name: @PROJECT_NAME@ HTML renderer
- Description: Markdown to HTML converter library.
-diff --git a/src/md4c.pc.in b/src/md4c.pc.in
-index cd8842d..b5d81f8 100644
---- a/src/md4c.pc.in
-+++ b/src/md4c.pc.in
-@@ -1,7 +1,5 @@
--prefix=@CMAKE_INSTALL_PREFIX@
--exec_prefix=@CMAKE_INSTALL_PREFIX@
--libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
--includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
-+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
- 
- Name: @PROJECT_NAME@
- Description: Markdown parser library with a SAX-like callback-based interface.
--- 
-2.31.0
-
diff --git a/pkgs/by-name/md/md4c/package.nix b/pkgs/by-name/md/md4c/package.nix
index 10fe4712b78d..32fad6ff5a2a 100644
--- a/pkgs/by-name/md/md4c/package.nix
+++ b/pkgs/by-name/md/md4c/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "md4c";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "mity";
     repo = "md4c";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-2/wi7nJugR8X2J9FjXJF1UDnbsozGoO7iR295/KSJng=";
+    hash = "sha256-rsNJlNLsmTEiAARqQ5TovNWmHNikMiRi8eEyn8o43ao=";
   };
 
   outputs = [
@@ -24,13 +24,6 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
-  patches = [
-    # We set CMAKE_INSTALL_LIBDIR to the absolute path in $out, so prefix and
-    # exec_prefix cannot be $out, too
-    # Use CMake's _FULL_ variables instead of `prefix` concatenation.
-    ./0001-fix-pkgconfig.patch
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

From 4f72341536ca5fdb7520328e835802476a897f1b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 21 Apr 2026 22:07:04 +0100
Subject: [PATCH 026/831] valgrind: 3.26.0 -> 3.27.0

Changes: https://valgrind.org/docs/manual/dist.news.html
---
 pkgs/by-name/va/valgrind/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index 8c3a2ca3db1e..caf76027d8ee 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.26.0";
+  version = "3.27.0";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-jVTHFwKRBvFkSq2vgCq5aS5T2T3QFcvRnnQZDrpha9c=";
+    hash = "sha256-W1k33oJX7o9RaY6nG5cRrc6YBhqgfapKaF78OvkhW+8=";
   };
 
   patches = [

From f20fda6d42187f1c54896b1356941472cc844972 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 22 Apr 2026 12:28:28 +0000
Subject: [PATCH 027/831] gnused: 4.9 -> 4.10

---
 pkgs/tools/text/gnused/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 6effd6d9f41d..7f1cfe514425 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnused";
-  version = "4.9";
+  version = "4.10";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.xz";
-    sha256 = "sha256-biJrcy4c1zlGStaGK9Ghq6QteYKSLaelNRljHSSXUYE=";
+    sha256 = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
   };
 
   outputs = [

From 75eb347675416d3bdb8d0b9b2324b18b540a3607 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 22 Apr 2026 21:28:31 +0100
Subject: [PATCH 028/831] libmpc: 1.4.0 -> 1.4.1

Changes: https://www.multiprecision.org/
---
 pkgs/by-name/li/libmpc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libmpc/package.nix b/pkgs/by-name/li/libmpc/package.nix
index 35328cc0023c..908ff90ff44a 100644
--- a/pkgs/by-name/li/libmpc/package.nix
+++ b/pkgs/by-name/li/libmpc/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmpc";
-  version = "1.4.0"; # to avoid clash with the MPD client
+  version = "1.4.1"; # to avoid clash with the MPD client
 
   src = fetchurl {
     url = "mirror://gnu/mpc/mpc-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MhCzpUaxywDClso2CJHXdA7m/wbesCono1sgzTwLsaU=";
+    hash = "sha256-kSBM0y8WS9O3yZLUpqjOZRlRGq2rMPeLaYLQv41z6TE=";
   };
 
   strictDeps = true;

From 9dbaf2b09f8e512f13c68ff4c583103f14c84fa7 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 24 Apr 2026 21:47:15 +0100
Subject: [PATCH 029/831] libhwy: 1.3.0 -> 1.4.0

Changes: https://github.com/google/highway/releases/tag/1.4.0
---
 pkgs/by-name/li/libhwy/package.nix | 21 ++-------------------
 1 file changed, 2 insertions(+), 19 deletions(-)

diff --git a/pkgs/by-name/li/libhwy/package.nix b/pkgs/by-name/li/libhwy/package.nix
index d78d12faf698..fc60dbff5d0a 100644
--- a/pkgs/by-name/li/libhwy/package.nix
+++ b/pkgs/by-name/li/libhwy/package.nix
@@ -5,36 +5,19 @@
   ninja,
   gtest,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libhwy";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "highway";
     rev = version;
-    hash = "sha256-8QOk96Y3GIIvBUGIDikMgTylx8y5aCyr68/TP5w5ha4=";
+    hash = "sha256-YUYZO9KLffczjwIz3mBBceD6oM1giLCFLDHgDCevdRA=";
   };
 
-  patches = [
-    # Apply upstream workaround for gcc-15 bug:
-    #   https://github.com/google/highway/issues/2813
-    #   https://github.com/google/highway/pull/2824
-    (fetchpatch {
-      name = "gcc-15-clone-hack-prerequisite.patch";
-      url = "https://github.com/google/highway/commit/3b680cde3a556bead9cc23c8f595d07a44d5a0d5.patch";
-      hash = "sha256-8xBPuhsifalhzKgeEOQq6yZw2NWas+SFQrNIaMicRnY=";
-    })
-    (fetchpatch {
-      name = "gcc-15-clone-hack.patch";
-      url = "https://github.com/google/highway/commit/5af21b8a9078330a3d7456d855e69245bb87bc7a.patch";
-      hash = "sha256-hC/oEdxHsdZKlLFIw929ZHjffPURGzk9jiKz6iGSLkY=";
-    })
-  ];
-
   hardeningDisable = lib.optionals stdenv.hostPlatform.isAarch64 [
     # aarch64-specific code gets:
     # __builtin_clear_padding not supported for variable length aggregates

From 02ddf0a084f082c1f9bdd8b8f16fae66d0f8ae14 Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Sat, 25 Apr 2026 17:57:58 +0900
Subject: [PATCH 030/831] libxslt: fixup cmake so it can properly find lib
 outputs

---
 pkgs/by-name/li/libxslt/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/li/libxslt/package.nix b/pkgs/by-name/li/libxslt/package.nix
index 6de4895cf7bc..da39812157a4 100644
--- a/pkgs/by-name/li/libxslt/package.nix
+++ b/pkgs/by-name/li/libxslt/package.nix
@@ -78,6 +78,9 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     moveToOutput bin/xslt-config "$dev"
     moveToOutput lib/xsltConf.sh "$dev"
+
+    substituteInPlace "$dev/lib/cmake/libxslt/libxslt-config.cmake" \
+      --replace-fail '"''${PACKAGE_PREFIX_DIR}/lib"' "\"$out/lib\""
   ''
   + lib.optionalString pythonSupport ''
     mkdir -p $py/nix-support

From a0329b88aed371b01b272c79b63f7097e66f8315 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 25 Apr 2026 10:15:21 +0100
Subject: [PATCH 031/831] libmicrohttpd: 1.0.2 -> 1.0.5

---
 pkgs/development/libraries/libmicrohttpd/1.0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libmicrohttpd/1.0.nix b/pkgs/development/libraries/libmicrohttpd/1.0.nix
index 8070e78356c7..138f80ca444c 100644
--- a/pkgs/development/libraries/libmicrohttpd/1.0.nix
+++ b/pkgs/development/libraries/libmicrohttpd/1.0.nix
@@ -1,10 +1,10 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix rec {
-  version = "1.0.2";
+  version = "1.0.5";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/libmicrohttpd-${version}.tar.gz";
-    hash = "sha256-3zJPzQg0F12rB0gxM5Atl3SmBb+imAJfaYgyiP0gqMc=";
+    hash = "sha256-tG0A9Y76b0l7l9LngsTuZjAdQS3dhV3TBoUYs6LNPqI=";
   };
 }

From 2ba029a78e1fc8804152a62e4202215264554b6c Mon Sep 17 00:00:00 2001
From: Liam Murphy <liampm32@gmail.com>
Date: Sun, 26 Apr 2026 12:09:41 +1000
Subject: [PATCH 032/831] openblas: 0.3.32 -> 0.3.33

This release fixes build failures for linbox on aarch64
(https://hydra.nixos.org/build/327030681,
https://hydra.nixos.org/build/327030680); see
https://github.com/OpenMathLib/OpenBLAS/issues/5763.
---
 .../libraries/science/math/openblas/default.nix      | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 6274578cfcdf..716d330c28e3 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -170,7 +170,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openblas";
-  version = "0.3.32";
+  version = "0.3.33";
 
   outputs = [
     "out"
@@ -181,7 +181,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenMathLib";
     repo = "OpenBLAS";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-D0Wu5Ew72aTqSjj970yOfAwPg1T4Qm6zmpaGlQ/5Q1k=";
+    hash = "sha256-EArf0K2Gs+w8IRD5wkMOQv79e8yMoTgQfa9kzjXKn3Y=";
   };
 
   patches = [
@@ -190,13 +190,13 @@ stdenv.mkDerivation (finalAttrs: {
     # INCLUDEDIR already fixed in upstream HEAD & significant refactor
     # to config gen so not PRing changes
     ./cmake-include-fixes.patch
-    # Fix build on LoongArch (error: '_Float16' is not supported on this target)
+    # This was an attempted fix for the below commit but still leaves some scipy tests failing.
     (fetchpatch {
-      url = "https://github.com/OpenMathLib/OpenBLAS/commit/7086a1b075ca317e12cfe79d40a32ad342a30496.patch";
-      hash = "sha256-pA3HK2f2MJr/+h/uale7edIYk/KH194EscYFcsujPXY=";
+      url = "https://github.com/OpenMathLib/OpenBLAS/commit/e3ce4623c299068bbd47c35ee87aab334bac73b1.patch";
+      revert = true;
+      hash = "sha256-WrP3RCDk/EbpqVOw9XGLnFI+6/bBGJTIrt2TRYGLVQ4=";
     })
     # This commit led to miscompilation of certain ASIMD extensions code paths.
-    # There was an attempted fix in upstream but this still leaves some scipy tests failing.
     (fetchpatch {
       url = "https://github.com/OpenMathLib/OpenBLAS/commit/3f6e928d34aca977bd5d4191e6d2c2338a342.patch";
       revert = true;

From 57cd8cc8a3a34e5d97b64885973eef72dbfd24ef Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 26 Apr 2026 10:32:26 +0100
Subject: [PATCH 033/831] mpg123: 1.33.4 -> 1.33.5

Changes: https://mpg123.org/#2026-04-25
---
 pkgs/applications/audio/mpg123/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/mpg123/default.nix b/pkgs/applications/audio/mpg123/default.nix
index df13df07a978..e46a14127710 100644
--- a/pkgs/applications/audio/mpg123/default.nix
+++ b/pkgs/applications/audio/mpg123/default.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.4";
+  version = "1.33.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-OujJ/4Cpe/wOIuifvNdGh+yk/B2zFbEmB/J/ActaR9k=";
+    hash = "sha256-DX68jaCv88o4PIxrWmrb5ALuW7JWaFuMVJnzpzn51t0=";
   };
 
   outputs = [

From 7bd3d8daf2081be2a6a0aa44b54f0df58f95c7d4 Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Wed, 29 Apr 2026 14:51:08 +0200
Subject: [PATCH 034/831] doctest: 2.5.0 -> 2.5.2

Diff: https://github.com/doctest/doctest/compare/v2.5.0...v2.5.2

Changelog: https://github.com/doctest/doctest/releases/tag/v2.5.2
---
 pkgs/by-name/do/doctest/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/doctest/package.nix b/pkgs/by-name/do/doctest/package.nix
index f6ffd1b9e559..cbea1dcba749 100644
--- a/pkgs/by-name/do/doctest/package.nix
+++ b/pkgs/by-name/do/doctest/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doctest";
-  version = "2.5.0";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7t/eknv7VtHoBgcuJmI07x//HIyqzE9HUuH5u2y7X8A=";
+    hash = "sha256-4jW6xPFCFxk1l47EkSUVojhycrtluPhOc5Adf/25R7M=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -27,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   meta = {
+    changelog = "https://github.com/doctest/doctest/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/doctest/doctest";
     description = "Fastest feature-rich C++11/14/17/20 single-header testing framework";
     platforms = lib.platforms.all;

From b0af552236ff2e10d2fd7c3de4819079062c8055 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 1 May 2026 13:58:01 +0200
Subject: [PATCH 035/831] assimp: 6.0.4 -> 6.0.5

changelog: https://github.com/assimp/assimp/blob/master/CHANGES.md

diff: https://github.com/assimp/assimp/compare/v6.0.4...v6.0.5
---
 pkgs/by-name/as/assimp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/as/assimp/package.nix b/pkgs/by-name/as/assimp/package.nix
index 717fd1a0746f..24769c4a231c 100644
--- a/pkgs/by-name/as/assimp/package.nix
+++ b/pkgs/by-name/as/assimp/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "assimp";
-  version = "6.0.4";
+  version = "6.0.5";
   outputs = [
     "out"
     "lib"
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "assimp";
     repo = "assimp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ryTgsN0z9BZBz7i9aUMKuneN5oqfxpduwJlb+Q0q3Mk=";
+    hash = "sha256-QWBi1pl5C76UtPhB6SmFipm9oEdnfhELMT3MqfV6oxg=";
   };
 
   postPatch = ''

From fc513d020b35545da312241125fa5cb60b3d4a0f Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Fri, 30 Jan 2026 17:32:55 +0100
Subject: [PATCH 036/831] nixos/systemd-lib: use structuredAttrs instead of
 passAsFile for makeUnit

---
 nixos/lib/systemd-lib.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/nixos/lib/systemd-lib.nix b/nixos/lib/systemd-lib.nix
index 8397eca39c51..9f5ec37e5270 100644
--- a/nixos/lib/systemd-lib.nix
+++ b/nixos/lib/systemd-lib.nix
@@ -76,16 +76,13 @@ rec {
         {
           preferLocalBuild = true;
           allowSubstitutes = false;
-          # unit.text can be null. But variables that are null listed in
-          # passAsFile are ignored by nix, resulting in no file being created,
-          # making the mv operation fail.
-          text = optionalString (unit.text != null) unit.text;
-          passAsFile = [ "text" ];
+          text = unit.text or "";
+          __structuredAttrs = true;
         }
         ''
           name=${shellEscape name}
           mkdir -p "$out/$(dirname -- "$name")"
-          mv "$textPath" "$out/$name"
+          printf "%s" "$text" > "$out/$name"
         ''
     else
       pkgs.runCommand "unit-${mkPathSafeName name}-disabled"

From 06b17cff7d67f07779cc4b2adae419012c90f677 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 1 May 2026 15:40:47 +0000
Subject: [PATCH 037/831] libapparmor: 4.1.7 -> 5.0.0

---
 pkgs/by-name/li/libapparmor/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libapparmor/package.nix b/pkgs/by-name/li/libapparmor/package.nix
index 9290ebfa7044..7cfb71447ceb 100644
--- a/pkgs/by-name/li/libapparmor/package.nix
+++ b/pkgs/by-name/li/libapparmor/package.nix
@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "4.1.7";
+  version = "5.0.0";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yjqdUwHkQ1uiPKPZQVf/o8tGixQeIKNMOIYo4aVK7N0=";
+    hash = "sha256-seEREIc83alEPyZGD/GY48hjpqiw3QENnqYsdjHOGgs=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

From f0847890f4303c4c69c3c252eb183bf60fc46a45 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 1 May 2026 21:34:04 +0100
Subject: [PATCH 038/831] srt: 1.5.4 -> 1.5.5

Changes: https://github.com/Haivision/srt/releases/tag/v1.5.5
---
 pkgs/by-name/sr/srt/package.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/sr/srt/package.nix b/pkgs/by-name/sr/srt/package.nix
index a5190b8b6d36..d02efdc3d4e6 100644
--- a/pkgs/by-name/sr/srt/package.nix
+++ b/pkgs/by-name/sr/srt/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   openssl,
   windows,
@@ -10,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "srt";
-  version = "1.5.4";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-NLy9GuP4OT/kKAIIDXSHtsmaBzXRuFohFM/aM+46cao=";
+    sha256 = "sha256-hOkLlmtF9dKqXZTjAeBntkkg5WsmsZN6DKhyakoIF1k=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -29,12 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   patches = [
-    # Fix the build with CMake 4.
-    (fetchpatch {
-      name = "srt-fix-cmake-4.patch";
-      url = "https://github.com/Haivision/srt/commit/0def1b1a1094fc57752f241250e9a1aed71bbffd.patch";
-      hash = "sha256-dnBGNut+I9trkQzr81Wo36O2Pt7d2gsjA1buJBegPMM=";
-    })
   ]
   ++ lib.optionals stdenv.hostPlatform.isMinGW [
     ./no-msvc-compat-headers.patch

From feb7c9ff7812521077ce8ac75c0cdc8f5de31152 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 1 May 2026 21:53:30 +0200
Subject: [PATCH 039/831] libressl_4_3: init at 4.3.1

I also added expiration date comments on all of them, because I always
spend some time chasing what the support dates are, and it would save
maintainer time to be able to see what to do with these branches.
---
 pkgs/by-name/li/libressl/default.nix | 13 +++++++++++++
 pkgs/top-level/all-packages.nix      |  1 +
 2 files changed, 14 insertions(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 7a266936f6c4..7a7408243433 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -111,13 +111,17 @@ let
         identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "openbsd" version;
       };
     };
+
   # https://github.com/libressl/portable/pull/1206
+  # This got merged in February 2026 and is included as of LibreSSL 4.3.0.
   common-cmake-install-full-dirs-patch = fetchpatch {
     url = "https://github.com/libressl/portable/commit/a15ea0710398eaeed3be53cf643e80a1e80c981d.patch";
     hash = "sha256-Mlf4SrGCCqALQicbGtmVGdkdfcE8DEGYkOuVyG2CozM=";
   };
 in
 {
+  # 4.1 was released April 2025 and became unsupported on April 28, 2026,
+  # one year after the release of OpenBSD 7.7.
   libressl_4_1 = generic {
     version = "4.1.2";
     hash = "sha256-+6Ti+ip/UjBt96OJlwoQ6YuX6w7bKZqf252/SZmcYeE=";
@@ -137,6 +141,8 @@ in
     ];
   };
 
+  # 4.2 was released October 2025 and will become unsupported on October 22,
+  # 2026, one year after the release of OpenBSD 7.8.
   libressl_4_2 = generic {
     version = "4.2.1";
     hash = "sha256-bVwvWFg1iOp5H0yGRQBAcdAN+lVKW/eIoAbKHrWr1ws=";
@@ -144,4 +150,11 @@ in
       common-cmake-install-full-dirs-patch
     ];
   };
+
+  # 4.3 was released April 2026 and will become unsupported one year after the
+  # release of OpenBSD 7.9.
+  libressl_4_3 = generic {
+    version = "4.3.1";
+    hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
+  };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 52f3e94da50a..4fc3a62e8955 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7003,6 +7003,7 @@ with pkgs;
   inherit (callPackages ../by-name/li/libressl { })
     libressl_4_1
     libressl_4_2
+    libressl_4_3
     ;
 
   openssl = openssl_3_6;

From 0bfe3de9edd95a12bd7049dcd03055d796124a31 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 1 May 2026 22:07:13 +0200
Subject: [PATCH 040/831] libressl_4_1: delete unsupported package

LibreSSL branches are supported for one year after the OpenBSD release
in which they are included. LibreSSL 4.1 was part of OpenBSD 7.7, which
was released on April 28, 2025, so it's end of life now.
---
 pkgs/by-name/li/libressl/default.nix | 21 ---------------------
 pkgs/top-level/all-packages.nix      |  1 -
 2 files changed, 22 deletions(-)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 7a7408243433..8d6f40f61c01 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -120,27 +120,6 @@ let
   };
 in
 {
-  # 4.1 was released April 2025 and became unsupported on April 28, 2026,
-  # one year after the release of OpenBSD 7.7.
-  libressl_4_1 = generic {
-    version = "4.1.2";
-    hash = "sha256-+6Ti+ip/UjBt96OJlwoQ6YuX6w7bKZqf252/SZmcYeE=";
-    # Fixes build on loongarch64
-    # https://github.com/libressl/portable/pull/1184
-    postPatch = ''
-      mkdir -p include/arch/loongarch64
-      cp ${
-        fetchurl {
-          url = "https://github.com/libressl/portable/raw/refs/tags/v4.1.0/include/arch/loongarch64/opensslconf.h";
-          hash = "sha256-68dw5syUy1z6GadCMR4TR9+0UQX6Lw/CbPWvjHGAhgo=";
-        }
-      } include/arch/loongarch64/opensslconf.h
-    '';
-    patches = [
-      common-cmake-install-full-dirs-patch
-    ];
-  };
-
   # 4.2 was released October 2025 and will become unsupported on October 22,
   # 2026, one year after the release of OpenBSD 7.8.
   libressl_4_2 = generic {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4fc3a62e8955..06c6e70e5817 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7001,7 +7001,6 @@ with pkgs;
   zunclient = with python313Packages; toPythonApplication python-zunclient;
 
   inherit (callPackages ../by-name/li/libressl { })
-    libressl_4_1
     libressl_4_2
     libressl_4_3
     ;

From 16656233905ab0ff2fa329c86593cb925094b1e7 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 1 May 2026 22:08:40 +0200
Subject: [PATCH 041/831] libressl: add ruuda as maintainer

I've been keeping this package up to date over the past few years, since
I run a webserver that depends on it. I'd be happy to be co-maintainer
for it, and hopefully reduce the load on others.
---
 pkgs/by-name/li/libressl/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 8d6f40f61c01..fba1c17d5180 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -96,6 +96,7 @@ let
         maintainers = with lib.maintainers; [
           thoughtpolice
           fpletz
+          ruuda
         ];
         inherit knownVulnerabilities;
 

From c74cade494dc95a74dd75099bf700e9bab5deb35 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Fri, 1 May 2026 22:51:35 +0200
Subject: [PATCH 042/831] libressl: enable strictDeps and __structuredAttrs

---
 pkgs/by-name/li/libressl/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index fba1c17d5180..a4ac4000d452 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -23,6 +23,9 @@ let
       pname = "libressl";
       inherit version;
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       src = fetchurl {
         url = "mirror://openbsd/LibreSSL/libressl-${version}.tar.gz";
         inherit hash;

From 63147b12a5831e23ce5e88f5f9a35fe8997e9978 Mon Sep 17 00:00:00 2001
From: ElXreno <elxreno@gmail.com>
Date: Sat, 25 Apr 2026 16:00:45 +0300
Subject: [PATCH 043/831] openldap: skip flaky syncreplication tests

---
 pkgs/by-name/op/openldap/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/op/openldap/package.nix b/pkgs/by-name/op/openldap/package.nix
index e40648724340..9e1457ef6572 100644
--- a/pkgs/by-name/op/openldap/package.nix
+++ b/pkgs/by-name/op/openldap/package.nix
@@ -122,6 +122,8 @@ stdenv.mkDerivation (finalAttrs: {
     # https://bugs.openldap.org/show_bug.cgi?id=8623
     rm -f tests/scripts/test022-ppolicy
 
+    rm -f tests/scripts/test*-sync*
+
     rm -f tests/scripts/test063-delta-multiprovider
 
     # https://bugs.openldap.org/show_bug.cgi?id=10009

From 21622bac70c240e85777be65c5b65bac6c3f3553 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 3 May 2026 06:56:18 +0000
Subject: [PATCH 044/831] freetype: 2.14.2 -> 2.14.3

---
 pkgs/by-name/fr/freetype/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/freetype/package.nix b/pkgs/by-name/fr/freetype/package.nix
index 6146ce0d8cc1..fcace2938756 100644
--- a/pkgs/by-name/fr/freetype/package.nix
+++ b/pkgs/by-name/fr/freetype/package.nix
@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
-  version = "2.14.2";
+  version = "2.14.3";
 
   src =
     let
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "mirror://savannah/freetype/freetype-${version}.tar.xz";
-      sha256 = "sha256-S2Lcq0ySChqGA2mTMiGBQ2LmmeJvVXklFtZx5v9VteE=";
+      sha256 = "sha256-NrxPHMQTM1No7mVsQq/KZcWjmH6HaMwozxG6d154Wl8=";
     };
 
   propagatedBuildInputs = [

From efdf5458bd1bbff0bb38dba4b05ac1766ecd9590 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 3 May 2026 11:17:29 -0700
Subject: [PATCH 045/831] python3Packages.mistune: 3.2.0 -> 3.2.1

Diff: https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1

Changelog: https://github.com/lepture/mistune/blob/v3.2.1/docs/changes.rst
---
 pkgs/development/python-modules/mistune/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mistune/default.nix b/pkgs/development/python-modules/mistune/default.nix
index a130857e1a71..8cdfa4023ded 100644
--- a/pkgs/development/python-modules/mistune/default.nix
+++ b/pkgs/development/python-modules/mistune/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mistune";
-  version = "3.2.0";
+  version = "3.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "mistune";
     tag = "v${version}";
-    hash = "sha256-rUEZNVuMT5+GsMakrkK6rshKSKtTTN72kK92AmQ8bl8=";
+    hash = "sha256-8AEEh/SWAk/Esq0jAoZGLw1FIQUw6C5Xq8CgnI2fjv0=";
   };
 
   build-system = [ setuptools ];

From b926d50aaf166585c1395092adbdaaa7b572632b Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Sat, 2 May 2026 01:28:38 -0700
Subject: [PATCH 046/831] minimal-bootstrap: reduce bootstrap time

---
 pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix        | 5 ++++-
 pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix   | 5 ++++-
 pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix       | 1 +
 pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix     | 4 ++++
 pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix    | 5 ++++-
 pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix | 1 +
 6 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
index 090b939acd7f..3146c350dddb 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
@@ -127,7 +127,10 @@ bash.runCommand "${pname}-${version}"
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
     export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
-    export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CFLAGS="-O1"
+    export CXXFLAGS="-O1"
+    export CFLAGS_FOR_TARGET="-O0 -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CXXFLAGS_FOR_TARGET="$CFLAGS_FOR_TARGET"
     export C_INCLUDE_PATH="${musl}/include"
     export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
     export LIBRARY_PATH="${musl}/lib"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
index 0f442367f72f..9eb873ea0da5 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
@@ -130,7 +130,10 @@ bash.runCommand "${pname}-${version}"
 
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
-    export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CFLAGS="-O1"
+    export CXXFLAGS="-O1"
+    export CFLAGS_FOR_TARGET="-O0 -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CXXFLAGS_FOR_TARGET="$CFLAGS_FOR_TARGET"
     export C_INCLUDE_PATH="${musl}/include"
     export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
     export LIBRARY_PATH="${musl}/lib"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
index d9c37f5a0562..7c533e2d0d5b 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
@@ -110,6 +110,7 @@ bash.runCommand "${pname}-${version}"
 
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
+    export CFLAGS="-O2"
     export C_INCLUDE_PATH="${tinycc.libs}/include:$(pwd)/mpfr/src"
     export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
index 890098aa66b9..eb8da7723f98 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
@@ -126,6 +126,10 @@ bash.runCommand "${pname}-${version}"
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
     export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CFLAGS="-O1 -pipe"
+    export CXXFLAGS="-O1 -pipe"
+    export CFLAGS_FOR_TARGET="-O0"
+    export CXXFLAGS_FOR_TARGET="-O0"
 
     bash ./configure \
       --prefix=$out \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
index e55acf5caecd..287f894626e0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
@@ -124,7 +124,10 @@ bash.runCommand "${pname}-${version}"
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
     export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
-    export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CFLAGS="-O1"
+    export CXXFLAGS="-O1"
+    export CFLAGS_FOR_TARGET="-O0 -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+    export CXXFLAGS_FOR_TARGET="$CFLAGS_FOR_TARGET"
     export LIBRARY_PATH="${musl}/lib"
 
     bash ./configure \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
index a9694d349f5e..b1df854db276 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
@@ -98,6 +98,7 @@ bash.runCommand "${pname}-${version}"
     cd build
     # libstdc++.so is built against musl and fails to link
     export CXX=false
+    export CFLAGS="-O1"
     bash ../configure \
       --prefix=$out \
       --build=${buildPlatform.config} \

From 6014579a95320d82b7d483ac2392d4a134541685 Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Mon, 30 Mar 2026 17:03:04 +0800
Subject: [PATCH 047/831] clang, cc-wrapper: make wrapper flang-aware

Build on the initial LLVM Flang wrapper work by exposing the needed clang passthru and teaching cc-wrapper about flang-specific flag handling.

Co-authored-by: stove <stove@rivosinc.com>
Co-authored-by: acture <acture@gmail.com>
Co-authored-by: Emily <hello@emily.moe>
Co-authored-by: Philip Taron <philip.taron@gmail.com>
---
 .../cc-wrapper/add-clang-cc-cflags-before.sh  |  2 +-
 pkgs/build-support/cc-wrapper/add-flags.sh    |  2 +
 pkgs/build-support/cc-wrapper/cc-wrapper.sh   | 18 +++++++--
 pkgs/build-support/cc-wrapper/default.nix     | 40 ++++++++++++-------
 .../compilers/llvm/common/clang/default.nix   |  6 ++-
 5 files changed, 48 insertions(+), 20 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
index 865e0d054820..d5515604c0bc 100644
--- a/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
+++ b/pkgs/build-support/cc-wrapper/add-clang-cc-cflags-before.sh
@@ -36,6 +36,6 @@ elif [[ $0 != *cpp ]]; then
     fi
 fi
 
-if [[ "@darwinMinVersion@" ]]; then
+if [[ "@darwinMinVersion@" ]] && [ "@isFlang@" != 1 ]; then
     extraBefore+=(-Werror=unguarded-availability)
 fi
diff --git a/pkgs/build-support/cc-wrapper/add-flags.sh b/pkgs/build-support/cc-wrapper/add-flags.sh
index a86f65d03f97..4b9f71af4eab 100644
--- a/pkgs/build-support/cc-wrapper/add-flags.sh
+++ b/pkgs/build-support/cc-wrapper/add-flags.sh
@@ -11,6 +11,8 @@ var_templates_list=(
     NIX_CXXSTDLIB_COMPILE
     NIX_CXXSTDLIB_LINK
     NIX_GNATFLAGS_COMPILE
+    NIX_FFLAGS_COMPILE
+    NIX_FFLAGS_COMPILE_BEFORE
 )
 var_templates_bool=(
     NIX_ENFORCE_NO_NATIVE
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 246c1b1f65f6..2d36278b59fa 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -44,7 +44,7 @@ while (( "$n" < "$nParams" )); do
 
     case "$p" in
         -[cSEM] | -MM) dontLink=1 ;;
-        -cc1) cc1=1 ;;
+        -cc1 | -fc1 ) cc1=1 ;;
         -nostdinc) cInclude=0 cxxInclude=0 ;;
         -nostdinc++) cxxInclude=0 ;;
         -nostdlib) cxxLibrary=0 ;;
@@ -185,9 +185,19 @@ fi
 
 source @out@/nix-support/add-hardening.sh
 
-# Add the flags for the C compiler proper.
-extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_COMPILE_@suffixSalt@)
-extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
+# Add the flags for the compiler proper. Flang reads its user-supplied
+# flags from the Fortran-specific NIX_FFLAGS_COMPILE channel so that
+# C-only flags injected by setup hooks (e.g. -frandom-seed= from
+# reproducible-builds.sh, which Flang does not accept) never reach the
+# Fortran driver. This mirrors the NIX_GNATFLAGS_COMPILE channel that
+# the Ada/GNAT wrapper uses for the same reason.
+if [ "@isFlang@" = 1 ]; then
+    extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_FFLAGS_COMPILE_@suffixSalt@)
+    extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_FFLAGS_COMPILE_BEFORE_@suffixSalt@)
+else
+    extraAfter=(${hardeningCFlagsAfter[@]+"${hardeningCFlagsAfter[@]}"} $NIX_CFLAGS_COMPILE_@suffixSalt@)
+    extraBefore=(${hardeningCFlagsBefore[@]+"${hardeningCFlagsBefore[@]}"} $NIX_CFLAGS_COMPILE_BEFORE_@suffixSalt@)
+fi
 
 if [ "$dontLink" != 1 ]; then
     linkType=$(checkLinkType $NIX_LDFLAGS_BEFORE_@suffixSalt@ "${params[@]}" ${NIX_CFLAGS_LINK_@suffixSalt@:-} $NIX_LDFLAGS_@suffixSalt@)
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 10175e91a070..237476818bec 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -26,6 +26,7 @@
   nixSupport ? { },
   isGNU ? false,
   isClang ? cc.isClang or false,
+  isFlang ? cc.isFlang or false,
   isZig ? cc.isZig or false,
   isArocc ? cc.isArocc or false,
   isCcache ? cc.isCcache or false,
@@ -385,7 +386,9 @@ let
   #
   # TODO: Drop `mangle-NIX_STORE-in-__FILE__.patch` from GCC and make
   # this unconditional once the upstream bug is fixed.
-  useMacroPrefixMap = !isGNU;
+  useMacroPrefixMap = !isGNU && !isFlang;
+  systemIncludeFlag = if isFlang || isArocc then "-I" else "-idirafter";
+  fortifyIncludeFlag = if isFlang then "-I" else "-isystem";
 in
 
 assert includeFortifyHeaders' -> fortify-headers != null;
@@ -573,10 +576,18 @@ stdenvNoCC.mkDerivation {
   ''
 
   + optionalString cc.langFortran or false ''
-    wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
-    ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
-    ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
-    export named_fc=${targetPrefix}gfortran
+    if [ -e $ccPath/${targetPrefix}gfortran ]; then
+      wrap ${targetPrefix}gfortran $wrapper $ccPath/${targetPrefix}gfortran
+      ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}g77
+      ln -sv ${targetPrefix}gfortran $out/bin/${targetPrefix}f77
+      export named_fc=${targetPrefix}gfortran
+    elif [ -e $ccPath/${targetPrefix}flang ]; then
+      wrap ${targetPrefix}flang $wrapper $ccPath/${targetPrefix}flang
+      export named_fc=${targetPrefix}flang
+    elif [ -e $ccPath/flang ]; then
+      wrap ${targetPrefix}flang $wrapper $ccPath/flang
+      export named_fc=${targetPrefix}flang
+    fi
   ''
 
   + optionalString cc.langGo or false ''
@@ -712,9 +723,7 @@ stdenvNoCC.mkDerivation {
         echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
       ''
       + ''
-        include "-${
-          if isArocc then "I" else "idirafter"
-        }" "${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
+        include "${systemIncludeFlag}" "${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
       ''
       + optionalString isGNU ''
         for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
@@ -722,9 +731,9 @@ stdenvNoCC.mkDerivation {
         done
       ''
       + optionalString (libc.w32api or null != null) ''
-        echo '-idirafter ${lib.getDev libc.w32api}${
+        include "${systemIncludeFlag}" "${lib.getDev libc.w32api}${
           libc.incdir or "/include/w32api"
-        }' >> $out/nix-support/libc-cflags
+        }" >> $out/nix-support/libc-cflags
       ''
       + ''
 
@@ -739,7 +748,7 @@ stdenvNoCC.mkDerivation {
       # like option that forces the libc headers before all -idirafter,
       # hence -isystem here.
       + optionalString includeFortifyHeaders' ''
-        include -isystem "${fortify-headers}/include" >> $out/nix-support/libc-cflags
+        include "${fortifyIncludeFlag}" "${fortify-headers}/include" >> $out/nix-support/libc-cflags
       ''
     )
 
@@ -760,7 +769,7 @@ stdenvNoCC.mkDerivation {
     # already knows how to find its own libstdc++, and adding
     # additional -isystem flags will confuse gfortran (see
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
-    + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
+    + optionalString (libcxx == null && isClang && useGccForLibs && (cc.langCC or false)) ''
       for dir in ${gccForLibs}/include/c++/*; do
         include -cxx-isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
@@ -827,6 +836,7 @@ stdenvNoCC.mkDerivation {
       optionalString
         (
           (cc.isClang or false)
+          && !isFlang
           && !(cc.isROCm or false)
           && !targetPlatform.isDarwin
           && !targetPlatform.isAndroid
@@ -861,7 +871,8 @@ stdenvNoCC.mkDerivation {
       let
         enable_fp = !targetPlatform.isx86_32 && !targetPlatform.isS390;
         enable_leaf_fp =
-          enable_fp
+          !isFlang
+          && enable_fp
           && (
             targetPlatform.isx86_64
             || targetPlatform.isAarch64
@@ -927,7 +938,7 @@ stdenvNoCC.mkDerivation {
     # well with multi line flags, so make the flags single line again
     + ''
       for flags in "$out/nix-support"/*flags*; do
-        substituteInPlace "$flags" --replace $'\n' ' '
+        substituteInPlace "$flags" --replace-quiet $'\n' ' '
       done
 
       substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
@@ -973,6 +984,7 @@ stdenvNoCC.mkDerivation {
 
   env = {
     inherit isClang;
+    inherit isFlang;
 
     # for substitution in utils.bash
     # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
diff --git a/pkgs/development/compilers/llvm/common/clang/default.nix b/pkgs/development/compilers/llvm/common/clang/default.nix
index e3ef79039539..f3b8f52bcfa3 100644
--- a/pkgs/development/compilers/llvm/common/clang/default.nix
+++ b/pkgs/development/compilers/llvm/common/clang/default.nix
@@ -16,6 +16,7 @@
   fixDarwinDylibNames,
   enableManpages ? false,
   enableClangToolsExtra ? true,
+  extraPatches ? [ ],
   devExtraCmakeFlags ? [ ],
   replaceVars,
   getVersionFile,
@@ -73,7 +74,8 @@ stdenv.mkDerivation (
       ];
       stripLen = 1;
       hash = "sha256-1NKej08R9SPlbDY/5b0OKUsHjX07i9brR84yXiPwi7E=";
-    });
+    })
+    ++ extraPatches;
 
     nativeBuildInputs = [
       cmake
@@ -189,6 +191,8 @@ stdenv.mkDerivation (
     passthru = {
       inherit libllvm;
       isClang = true;
+      langC = true;
+      langCC = true;
       hardeningUnsupportedFlagsByTargetPlatform =
         targetPlatform:
         [ "fortify3" ]

From 324f837bf1a8cd5f1378501cedeb9b80f037081b Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Mon, 30 Mar 2026 17:03:25 +0800
Subject: [PATCH 048/831] flang-rt: add runtime package

Add a standalone derivation for LLVM's flang-rt runtime libraries
(libFortranRuntime, libFortranDecimal). flang-rt is a runtimes-style
package: building it requires running a working flang binary at *build*
time, but the produced libraries are linked into derivations targeting
the *host*.

The runtime is therefore wired up using `buildFlang`, sourced from
`buildLlvmPackages.flang-unwrapped` so that the build-platform flang
(spliced via the LLVM package set) compiles the runtime, while the
resulting libraries are still produced for the host platform. This
mirrors the existing `buildLlvmTools.tblgen` / `buildLlvmPackages.tblgen`
pattern used elsewhere in the LLVM package set.

`unwrapped` rather than the wrapped flang is used because flang-rt's
CMake glue invokes the compiler directly and does not need (or want)
Nix's cc-wrapper resource-dir and rpath plumbing during the runtime
build.

flang-rt only consumes LLVM's CMake helpers and the build-time flang;
it does not link against MLIR or libclang, so neither MLIR_DIR nor
CLANG_DIR is passed and the unused empty `dev` output is omitted.

Co-authored-by: stove <stove@rivosinc.com>
Co-authored-by: acture <acture@gmail.com>
---
 .../llvm/common/flang-rt/default.nix          | 81 +++++++++++++++++++
 1 file changed, 81 insertions(+)
 create mode 100644 pkgs/development/compilers/llvm/common/flang-rt/default.nix

diff --git a/pkgs/development/compilers/llvm/common/flang-rt/default.nix b/pkgs/development/compilers/llvm/common/flang-rt/default.nix
new file mode 100644
index 000000000000..01a1d6ca8584
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/flang-rt/default.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  llvm_meta,
+  monorepoSrc,
+  runCommand,
+  cmake,
+  libllvm,
+  ninja,
+  python3,
+  buildFlang,
+  version,
+}:
+let
+
+  minDarwinVersion = "10.12";
+  effectiveDarwinVersion =
+    if stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion minDarwinVersion then
+      minDarwinVersion
+    else
+      stdenv.hostPlatform.darwinMinVersion;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "flang-rt";
+  inherit version;
+
+  src =
+    runCommand "${finalAttrs.pname}-src-${version}"
+      {
+        inherit (monorepoSrc) passthru;
+      }
+      ''
+        mkdir -p "$out"
+        cp -r ${monorepoSrc}/cmake "$out"
+
+        mkdir -p "$out/llvm"
+        cp -r ${monorepoSrc}/llvm/cmake "$out/llvm"
+        cp -r ${monorepoSrc}/llvm/utils "$out/llvm"
+        cp -r ${monorepoSrc}/third-party "$out"
+
+        cp -r ${monorepoSrc}/${finalAttrs.pname} "$out"
+        cp -r ${monorepoSrc}/flang "$out"
+        cp -r ${monorepoSrc}/runtimes "$out"
+      '';
+
+  sourceRoot = "${finalAttrs.src.name}/runtimes";
+
+  outputs = [ "out" ];
+
+  nativeBuildInputs = [
+    buildFlang
+    cmake
+    ninja
+    python3
+  ];
+  buildInputs = [
+    libllvm
+  ];
+
+  env = lib.optionalAttrs stdenv.isDarwin {
+    MACOSX_DEPLOYMENT_TARGET = effectiveDarwinVersion;
+    NIX_CFLAGS_COMPILE = "-mmacosx-version-min=${effectiveDarwinVersion}";
+  };
+
+  cmakeFlags = [
+    (lib.cmakeFeature "LLVM_DEFAULT_TARGET_TRIPLE" stdenv.hostPlatform.config)
+    (lib.cmakeFeature "CMAKE_Fortran_COMPILER" "${buildFlang}/bin/flang")
+    (lib.cmakeBool "CMAKE_Fortran_COMPILER_WORKS" true)
+    (lib.cmakeBool "CMAKE_Fortran_COMPILER_SUPPORTS_F90" true)
+    (lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm")
+    (lib.cmakeFeature "LLVM_ENABLE_RUNTIMES" "flang-rt")
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    (lib.cmakeFeature "CMAKE_OSX_DEPLOYMENT_TARGET" effectiveDarwinVersion)
+  ];
+
+  meta = llvm_meta // {
+    homepage = "https://flang.llvm.org";
+    description = "LLVM Fortran Runtime";
+  };
+})

From 1ba36147a8db08211ee1e08ef61af09aad489deb Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Mon, 30 Mar 2026 17:07:37 +0800
Subject: [PATCH 049/831] flang: package standalone flang with LLVM 20+ driver
 fixes

Wire flang into llvmPackages as a first-class Fortran compiler. flang
is built standalone on top of the LLVM/clang package set rather than
bundled into the llvm derivation, with passthru metadata
(`langFortran`, `isFlang`, `isClang`, `hardeningUnsupportedFlags`) so
cc-wrapper and downstream tooling can detect and adapt to it.

Driver compatibility patches backported from upstream are applied
selectively per LLVM version:

  * `use-xflang-in-diagnostics` is applied to LLVM 20 and newer; it
    teaches the driver to suggest `-Xflang` instead of `-Xclang` in
    error messages for options only available to `flang -fc1`.
  * `warn-on-fbuiltin-and-fno-builtin` and
    `accept-and-ignore-some-gfortran-optimization-flags` are applied
    to LLVM 20 and 21 only. LLVM 22 has equivalent behaviour merged
    upstream (`warn_drv_invalid_argument_for_flang` and
    `clang_ignored_gcc_optimization_f_Group` handling in
    clang/lib/Driver/ToolChains/Flang.cpp), so the patches are skipped
    there.

Patches live under pkgs/development/compilers/llvm/21/flang/ and are
shared across versions via patches.nix. They are applied to a private
libclang variant rather than the flang source tree because standalone
flang resolves driver/option definitions through the installed libclang
package.

Two focused passthru tests are added:

  * `compile-smoke` exercises basic compilation and `@response-file`
    handling.
  * `driver-flags` covers wrapper flag isolation
    (`NIX_CFLAGS_COMPILE` must not leak into flang;
    `NIX_FFLAGS_COMPILE` must reach it), the backported driver
    diagnostics, and regression coverage for previously hard-erroring
    flags.

Build on the earlier standalone flang work by @picostove.

Co-authored-by: stove <stove@rivosinc.com>
Co-authored-by: acture <acture@gmail.com>
Co-authored-by: Alyssa Ross <hi@alyssa.is>
---
 ...ore-some-gfortran-optimization-flags.patch |  49 ++++++++
 .../21/flang/use-xflang-in-diagnostics.patch  |  40 +++++++
 .../warn-on-fbuiltin-and-fno-builtin.patch    |  74 ++++++++++++
 .../compilers/llvm/common/default.nix         | 107 ++++++++++++++----
 .../compilers/llvm/common/flang/default.nix   |  50 +++++---
 .../llvm/common/flang/dummy_target_19+.patch  |   6 +-
 .../compilers/llvm/common/flang/tests.nix     |  92 +++++++++++++++
 .../compilers/llvm/common/patches.nix         |  20 ++++
 8 files changed, 398 insertions(+), 40 deletions(-)
 create mode 100644 pkgs/development/compilers/llvm/21/flang/accept-and-ignore-some-gfortran-optimization-flags.patch
 create mode 100644 pkgs/development/compilers/llvm/21/flang/use-xflang-in-diagnostics.patch
 create mode 100644 pkgs/development/compilers/llvm/21/flang/warn-on-fbuiltin-and-fno-builtin.patch
 create mode 100644 pkgs/development/compilers/llvm/common/flang/tests.nix

diff --git a/pkgs/development/compilers/llvm/21/flang/accept-and-ignore-some-gfortran-optimization-flags.patch b/pkgs/development/compilers/llvm/21/flang/accept-and-ignore-some-gfortran-optimization-flags.patch
new file mode 100644
index 000000000000..912be7169621
--- /dev/null
+++ b/pkgs/development/compilers/llvm/21/flang/accept-and-ignore-some-gfortran-optimization-flags.patch
@@ -0,0 +1,49 @@
+From da7174958be43d69b2ed6b581c8ac8a382b59180 Mon Sep 17 00:00:00 2001
+From: Tarun Prabhu <tarun.prabhu@gmail.com>
+Date: Tue, 28 Oct 2025 19:35:27 -0600
+Subject: [PATCH] [flang][Driver] Accept (and ignore) some gfortran-specific
+ options
+
+Enable the clang_ignored_gcc_optimization_f_group in flang. These options are
+accepted by clang, but ignored after emitting a warning message. flang's
+behavior now mirrors clang.
+
+Fixes #158436
+---
+ clang/include/clang/Driver/Options.td | 3 ++-
+ clang/lib/Driver/ToolChains/Flang.cpp | 8 ++++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/include/clang/Driver/Options.td b/include/clang/Driver/Options.td
+index ef1c8758705f4..cac122d296624 100644
+--- a/include/clang/Driver/Options.td
++++ b/include/clang/Driver/Options.td
+@@ -316,7 +316,8 @@ def mno_mpx : Flag<["-"], "mno-mpx">, Group<clang_ignored_legacy_options_Group>;
+ 
+ // Group that ignores all gcc optimizations that won't be implemented
+ def clang_ignored_gcc_optimization_f_Group : OptionGroup<
+-  "<clang_ignored_gcc_optimization_f_Group>">, Group<f_Group>, Flags<[Ignored]>;
++  "<clang_ignored_gcc_optimization_f_Group>">,
++  Group<f_Group>, Flags<[Ignored]>, Visibility<[ClangOption, FlangOption]>;
+ 
+ class DiagnosticOpts<string base>
+   : KeyPathAndMacro<"DiagnosticOpts->", base, "DIAG_"> {}
+diff --git a/lib/Driver/ToolChains/Flang.cpp b/lib/Driver/ToolChains/Flang.cpp
+index 88bce181d40d2..2f5e93d139858 100644
+--- a/lib/Driver/ToolChains/Flang.cpp
++++ b/lib/Driver/ToolChains/Flang.cpp
+@@ -858,6 +858,14 @@ void Flang::ConstructJob(Compilation &C, const JobAction &JA,
+     if (const Arg *A = Args.getLastArg(Opt))
+       D.Diag(diag::warn_drv_invalid_argument_for_flang) << A->getSpelling();
+ 
++  // Warn about options that are ignored by flang. These are options that are
++  // accepted by gfortran, but have no equivalent in flang.
++  for (const Arg *A :
++       Args.filtered(options::OPT_clang_ignored_gcc_optimization_f_Group)) {
++    D.Diag(diag::warn_ignored_gcc_optimization) << A->getAsString(Args);
++    A->claim();
++  }
++
+   const InputInfo &Input = Inputs[0];
+   types::ID InputType = Input.getType();
+ 
diff --git a/pkgs/development/compilers/llvm/21/flang/use-xflang-in-diagnostics.patch b/pkgs/development/compilers/llvm/21/flang/use-xflang-in-diagnostics.patch
new file mode 100644
index 000000000000..29af46eba798
--- /dev/null
+++ b/pkgs/development/compilers/llvm/21/flang/use-xflang-in-diagnostics.patch
@@ -0,0 +1,40 @@
+From 9ab9d33171ee35c948967a2a2d714b8059887607 Mon Sep 17 00:00:00 2001
+From: Tarun Prabhu <tarun@lanl.gov>
+Date: Wed, 29 Oct 2025 09:13:17 -0600
+Subject: [PATCH] [flang][driver] Use -Xflang in diagnostics
+
+When an option that is only available in `flang -fc1` is provided to
+`flang`, emit a diagnostic with a suggestion containing "did you mean
+-Xflang '-foo'".
+
+Partially addresses #163550.
+---
+ clang/lib/Driver/Driver.cpp | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/lib/Driver/Driver.cpp b/lib/Driver/Driver.cpp
+index 40ea513e85427..71c52807091ba 100644
+--- a/lib/Driver/Driver.cpp
++++ b/lib/Driver/Driver.cpp
+@@ -365,9 +365,18 @@
+     auto ArgString = A->getAsString(Args);
+     std::string Nearest;
+     if (getOpts().findNearest(ArgString, Nearest, VisibilityMask) > 1) {
+-      if (!IsCLMode() &&
+-          getOpts().findExact(ArgString, Nearest,
+-                              llvm::opt::Visibility(options::CC1Option))) {
++      if (IsFlangMode()) {
++        if (getOpts().findExact(ArgString, Nearest,
++                                llvm::opt::Visibility(options::FC1Option))) {
++          DiagID = diag::err_drv_unknown_argument_with_suggestion;
++          Diags.Report(DiagID) << ArgString << "-Xflang " + Nearest;
++        } else {
++          DiagID = diag::err_drv_unknown_argument;
++          Diags.Report(DiagID) << ArgString;
++        }
++      } else if (!IsCLMode() && getOpts().findExact(ArgString, Nearest,
++                                                    llvm::opt::Visibility(
++                                                        options::CC1Option))) {
+         DiagID = diag::err_drv_unknown_argument_with_suggestion;
+         Diags.Report(DiagID) << ArgString << "-Xclang " + Nearest;
+       } else {
diff --git a/pkgs/development/compilers/llvm/21/flang/warn-on-fbuiltin-and-fno-builtin.patch b/pkgs/development/compilers/llvm/21/flang/warn-on-fbuiltin-and-fno-builtin.patch
new file mode 100644
index 000000000000..ee2cb99b57a5
--- /dev/null
+++ b/pkgs/development/compilers/llvm/21/flang/warn-on-fbuiltin-and-fno-builtin.patch
@@ -0,0 +1,74 @@
+From 263377a175709c2d11f3ff63c2d2d2843afb91ea Mon Sep 17 00:00:00 2001
+From: Tarun Prabhu <tarun@lanl.gov>
+Date: Thu, 23 Oct 2025 13:24:20 -0600
+Subject: [PATCH] [flang][Driver] Warn on -fbuiltin and -fno-builtin
+
+The options -fbuiltin and -fno-builtin are not valid for Fortran. However,
+they are accepted by gfortran which emits a warning message but continues to
+compile the code. Both -fbuiltin and -fno-builtin have been enabled for flang.
+Specifying either will result in a warning message being shown but no other
+effects. Compilation will proceed normally after these warnings are shown. This
+brings flang's behavior in line with gfortran for these options.
+
+Fixes #164766
+---
+ clang/include/clang/Basic/DiagnosticDriverKinds.td |  3 +++
+ clang/include/clang/Driver/Options.td              |  4 ++--
+ clang/lib/Driver/ToolChains/Flang.cpp              |  7 +++++++
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/include/clang/Basic/DiagnosticDriverKinds.td b/include/clang/Basic/DiagnosticDriverKinds.td
+index 0581bf353d936..83980e3ac35b7 100644
+--- a/include/clang/Basic/DiagnosticDriverKinds.td
++++ b/include/clang/Basic/DiagnosticDriverKinds.td
+@@ -131,6 +131,9 @@ def warn_drv_unsupported_option_for_offload_arch_req_feature : Warning<
+ def warn_drv_unsupported_option_for_target : Warning<
+   "ignoring '%0' option as it is not currently supported for target '%1'">,
+   InGroup<OptionIgnored>;
++def warn_drv_invalid_argument_for_flang : Warning<
++  "'%0' is not valid for Fortran">,
++  InGroup<OptionIgnored>;
+ def warn_drv_unsupported_option_for_flang : Warning<
+   "the argument '%0' is not supported for option '%1'. Mapping to '%1%2'">,
+   InGroup<OptionIgnored>;
+diff --git a/include/clang/Driver/Options.td b/include/clang/Driver/Options.td
+index ef1c8758705f4..bca8b26bc3d30 100644
+--- a/include/clang/Driver/Options.td
++++ b/include/clang/Driver/Options.td
+@@ -1940,7 +1940,7 @@ defm borland_extensions : BoolFOption<"borland-extensions",
+           "Accept non-standard constructs supported by the Borland compiler">,
+   NegFlag<SetFalse>>;
+ def fbuiltin : Flag<["-"], "fbuiltin">, Group<f_Group>,
+-  Visibility<[ClangOption, CLOption, DXCOption]>;
++  Visibility<[ClangOption, CLOption, DXCOption, FlangOption, FC1Option]>;
+ def fbuiltin_module_map : Flag <["-"], "fbuiltin-module-map">, Group<f_Group>,
+   Flags<[]>, HelpText<"Load the clang builtins module map file.">;
+ defm caret_diagnostics : BoolFOption<"caret-diagnostics",
+@@ -3493,7 +3493,7 @@ def fno_assume_sane_operator_new : Flag<["-"], "fno-assume-sane-operator-new">,
+   HelpText<"Don't assume that C++'s global operator new can't alias any pointer">,
+   Visibility<[ClangOption, CC1Option]>,
+   MarshallingInfoNegativeFlag<CodeGenOpts<"AssumeSaneOperatorNew">>;
+ def fno_builtin : Flag<["-"], "fno-builtin">, Group<f_Group>,
+-  Visibility<[ClangOption, CC1Option, CLOption, DXCOption]>,
++  Visibility<[ClangOption, CC1Option, CLOption, DXCOption, FlangOption, FC1Option]>,
+   HelpText<"Disable implicit builtin knowledge of functions">;
+ def fno_builtin_ : Joined<["-"], "fno-builtin-">, Group<f_Group>,
+   Visibility<[ClangOption, CC1Option, CLOption, DXCOption]>,
+diff --git a/lib/Driver/ToolChains/Flang.cpp b/lib/Driver/ToolChains/Flang.cpp
+index a56fa41c49d34..88bce181d40d2 100644
+--- a/lib/Driver/ToolChains/Flang.cpp
++++ b/lib/Driver/ToolChains/Flang.cpp
+@@ -851,6 +851,13 @@ void Flang::ConstructJob(Compilation &C, const JobAction &JA,
+     assert(false && "Unexpected action class for Flang tool.");
+   }
+ 
++  // We support some options that are invalid for Fortran and have no effect.
++  // These are solely for compatibility with other compilers. Emit a warning if
++  // any such options are provided, then proceed normally.
++  for (options::ID Opt : {options::OPT_fbuiltin, options::OPT_fno_builtin})
++    if (const Arg *A = Args.getLastArg(Opt))
++      D.Diag(diag::warn_drv_invalid_argument_for_flang) << A->getSpelling();
++
+   const InputInfo &Input = Inputs[0];
+   types::ID InputType = Input.getType();
+ 
diff --git a/pkgs/development/compilers/llvm/common/default.nix b/pkgs/development/compilers/llvm/common/default.nix
index 2a88fecc0b6e..54f579695a12 100644
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@@ -476,28 +476,93 @@ makeScopeWithSplicing' {
     // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "19") {
       bolt = callPackage ./bolt { };
     }
-    // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "20") {
-      flang = callPackage ./flang { };
+    // lib.optionalAttrs (lib.versionAtLeast metadata.release_version "20") (
+      let
+        # Standalone flang still resolves driver/option definitions via the
+        # installed libclang package, so keep flang-specific driver backports
+        # in a private libclang variant instead of patching the flang source
+        # tree. The `-Xflang` diagnostic improvement applies to every
+        # supported standalone-flang version (20+); the other two backports
+        # are only needed up to LLVM 21 because upstream merged equivalent
+        # behaviour into LLVM 22.
+        flangDriverPatches =
+          lib.optionals (lib.versionAtLeast metadata.release_version "20") [
+            (metadata.getVersionFile "flang/use-xflang-in-diagnostics.patch")
+          ]
+          ++
+            lib.optionals
+              (lib.versionAtLeast metadata.release_version "20" && lib.versionOlder metadata.release_version "22")
+              [
+                (metadata.getVersionFile "flang/warn-on-fbuiltin-and-fno-builtin.patch")
+                (metadata.getVersionFile "flang/accept-and-ignore-some-gfortran-optimization-flags.patch")
+              ];
+        flangLibclang =
+          if flangDriverPatches == [ ] then
+            self.libclang
+          else
+            self.libclang.override {
+              extraPatches = flangDriverPatches;
+            };
+        flangUnwrapped = callPackage ./flang {
+          libclang = flangLibclang;
+        };
+        flangRt = callPackage ./flang-rt {
+          buildFlang = buildLlvmPackages.flang-unwrapped;
+        };
+      in
+      {
+        flang-unwrapped = flangUnwrapped;
+        flang-rt = flangRt;
+        flang =
+          let
+            wrapped = wrapCCWith rec {
+              cc = flangUnwrapped;
+              bintools = bintools';
+              extraPackages = [ targetLlvmPackages.flang-rt ];
+              extraBuildCommands = mkExtraBuildCommands0 cc + ''
+                # triplet however is not used in darwin
+                PLATFORM_DIR="${if stdenv.targetPlatform.isDarwin then "darwin" else stdenv.targetPlatform.config}"
+                RT_LIB_PATH="${targetLlvmPackages.flang-rt}/lib/clang/${clangVersion}/lib/$PLATFORM_DIR"
+                if [ -d "$RT_LIB_PATH" ]; then
+                  ln -s "$RT_LIB_PATH" "$rsrc"/lib
+                  echo "-L$rsrc/lib" >> $out/nix-support/cc-ldflags
+                else
+                  ln -s "${targetLlvmPackages.flang-rt}/lib" "$rsrc"/lib
+                  echo "-L$rsrc/lib" >> $out/nix-support/cc-ldflags
+                fi
+              '';
+            };
+            tests = callPackage ./flang/tests.nix {
+              flang = wrapped;
+            };
+          in
+          wrapped
+          // {
+            passthru = (wrapped.passthru or { }) // {
+              inherit tests;
+            };
+          };
 
-      libc-overlay = callPackage ./libc {
-        isFullBuild = false;
-        # Use clang due to "gnu::naked" not working on aarch64.
-        # Issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77882
-        stdenv = overrideCC stdenv buildLlvmPackages.clang;
-      };
+        libc-overlay = callPackage ./libc {
+          isFullBuild = false;
+          # Use clang due to "gnu::naked" not working on aarch64.
+          # Issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77882
+          stdenv = overrideCC stdenv buildLlvmPackages.clang;
+        };
 
-      libc-full = callPackage ./libc {
-        isFullBuild = true;
-        # Use clang due to "gnu::naked" not working on aarch64.
-        # Issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77882
-        stdenv = overrideCC stdenv buildLlvmPackages.clangNoLibcNoRt;
-        # FIXME: This should almost certainly be `stdenv.hostPlatform`.
-        cmake = if stdenv.targetPlatform.libc == "llvm" then cmakeMinimal else cmake;
-        python3 = if stdenv.targetPlatform.libc == "llvm" then python3Minimal else python3;
-      };
+        libc-full = callPackage ./libc {
+          isFullBuild = true;
+          # Use clang due to "gnu::naked" not working on aarch64.
+          # Issue: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=77882
+          stdenv = overrideCC stdenv buildLlvmPackages.clangNoLibcNoRt;
+          # FIXME: This should almost certainly be `stdenv.hostPlatform`.
+          cmake = if stdenv.targetPlatform.libc == "llvm" then cmakeMinimal else cmake;
+          python3 = if stdenv.targetPlatform.libc == "llvm" then python3Minimal else python3;
+        };
 
-      libc =
-        # FIXME: This should almost certainly be `stdenv.hostPlatform`.
-        if stdenv.targetPlatform.libc == "llvm" then self.libc-full else self.libc-overlay;
-    };
+        libc =
+          # FIXME: This should almost certainly be `stdenv.hostPlatform`.
+          if stdenv.targetPlatform.libc == "llvm" then self.libc-full else self.libc-overlay;
+      }
+    );
 }
diff --git a/pkgs/development/compilers/llvm/common/flang/default.nix b/pkgs/development/compilers/llvm/common/flang/default.nix
index 335633d7d19c..0cd94ab4b4b9 100644
--- a/pkgs/development/compilers/llvm/common/flang/default.nix
+++ b/pkgs/development/compilers/llvm/common/flang/default.nix
@@ -23,21 +23,27 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "flang";
   inherit version;
 
-  src = runCommand "flang-src-${version}" { inherit (monorepoSrc) passthru; } ''
-    mkdir -p "$out"
-    cp -r ${monorepoSrc}/${finalAttrs.pname} "$out"
-    cp -r ${monorepoSrc}/cmake "$out"
-    cp -r ${monorepoSrc}/llvm "$out"
-    cp -r ${monorepoSrc}/clang "$out"
-    cp -r ${monorepoSrc}/mlir "$out"
-    cp -r ${monorepoSrc}/third-party "$out"
-    chmod -R +w $out/llvm
-  '';
+  src =
+    runCommand "${finalAttrs.pname}-src-${finalAttrs.version}"
+      {
+        inherit (monorepoSrc) passthru;
+      }
+      ''
+        mkdir -p "$out"
+        cp -r ${monorepoSrc}/${finalAttrs.pname} "$out"
+        cp -r ${monorepoSrc}/cmake "$out"
+        cp -r ${monorepoSrc}/llvm "$out"
+        cp -r ${monorepoSrc}/clang "$out"
+        cp -r ${monorepoSrc}/mlir "$out"
+        cp -r ${monorepoSrc}/third-party "$out"
+        cp -r ${monorepoSrc}/flang-rt "$out"
+        chmod -R +w $out/llvm
+      '';
 
   patches = [
     ./dummy_target_19+.patch
   ];
-  patchFlags = [ "-p2" ];
+  patchFlags = [ "-p1" ];
 
   sourceRoot = "${finalAttrs.src.name}/flang";
 
@@ -62,24 +68,36 @@ stdenv.mkDerivation (finalAttrs: {
     ls -l ${mlir.dev}/lib/cmake/mlir/MLIRConfig.cmake
   '';
   cmakeFlags = [
-    (lib.cmakeBool "CMAKE_VERBOSE_MAKEFILE" true)
     (lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm")
-    # TODO: Needs patches and the `lit` package like other LLVM builds?
     (lib.cmakeFeature "LLVM_TOOLS_BINARY_DIR" "${buildLlvmPackages.tblgen}/bin/")
-    (lib.cmakeFeature "LLVM_EXTERNAL_LIT" "${buildLlvmPackages.tblgen}/bin/llvm-lit")
     (lib.cmakeFeature "CLANG_DIR" "${libclang.dev}/lib/cmake/clang")
     (lib.cmakeFeature "MLIR_DIR" "${mlir.dev}/lib/cmake/mlir")
     (lib.cmakeFeature "MLIR_TABLEGEN_EXE" "${buildLlvmPackages.tblgen}/bin/mlir-tblgen")
     (lib.cmakeFeature "MLIR_TABLEGEN_TARGET" "MLIR-TBLGen")
-    (lib.cmakeBool "LLVM_BUILD_EXAMPLES" false)
+    (lib.cmakeBool "MLIR_LINK_MLIR_DYLIB" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeFeature "LLVM_LIT_ARGS" "-v")
     (lib.cmakeBool "LLVM_ENABLE_PLUGINS" false)
     (lib.cmakeBool "FLANG_STANDALONE_BUILD" true)
     (lib.cmakeBool "LLVM_INCLUDE_EXAMPLES" false)
     (lib.cmakeBool "FLANG_INCLUDE_TESTS" false)
-
   ]
   ++ devExtraCmakeFlags;
 
+  passthru = {
+    # Used by cc-wrapper to determine whether or not the default setup hook is enabled.
+    langC = false;
+    langCC = false;
+    langFortran = true;
+    isClang = true;
+    isFlang = true;
+
+    hardeningUnsupportedFlags = [
+      "zerocallusedregs"
+      "stackprotector"
+      "stackclashprotection"
+    ];
+  };
+
   postUnpack = ''
     chmod -R u+w -- $sourceRoot/..
   '';
diff --git a/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch b/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
index ab09ef650416..a6f295ef50b3 100644
--- a/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
+++ b/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
@@ -1,7 +1,7 @@
-diff --git a/flang/CMakeLists.txt b/flang/CMakeLists.txt
+diff --git a/CMakeLists.txt b/CMakeLists.txt
 index 070c39eb6e9a..168c97524943 100644
---- a/flang/CMakeLists.txt
-+++ b/flang/CMakeLists.txt
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
 @@ -1,6 +1,22 @@
  cmake_minimum_required(VERSION 3.20.0)
  set(LLVM_SUBPROJECT_TITLE "Flang")
diff --git a/pkgs/development/compilers/llvm/common/flang/tests.nix b/pkgs/development/compilers/llvm/common/flang/tests.nix
new file mode 100644
index 000000000000..4c195b9b27ff
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/flang/tests.nix
@@ -0,0 +1,92 @@
+{
+  runCommand,
+  flang,
+}:
+let
+  flangExe = "${flang}/bin/flang";
+  writeHello = ''
+    cat > hello.f90 <<'EOF'
+    program hello
+    end program hello
+    EOF
+  '';
+in
+{
+  compile-smoke = runCommand "flang-compile-smoke" { } ''
+    set -euo pipefail
+
+    ${writeHello}
+
+    ${flangExe} -c hello.f90 -o compile.o
+    [ -f compile.o ]
+
+    cat > args.rsp <<'EOF'
+    -c
+    hello.f90
+    -o
+    response.o
+    EOF
+
+    ${flangExe} @args.rsp
+    [ -f response.o ]
+
+    touch $out
+  '';
+
+  driver-flags = runCommand "flang-driver-flags" { } ''
+    set -euo pipefail
+
+    ${writeHello}
+
+    ${flangExe} -### -c hello.f90 > no-seed.log 2>&1
+    if grep -F -- "-frandom-seed=" no-seed.log; then
+      echo "wrapper unexpectedly injected -frandom-seed" >&2
+      exit 1
+    fi
+
+    # Confirm that user-supplied NIX_CFLAGS_COMPILE does not leak into the
+    # Fortran wrapper invocation: the wrapper must source flags from
+    # NIX_FFLAGS_COMPILE only, so a marker placed in NIX_CFLAGS_COMPILE
+    # must not appear in the resulting flang command line.
+    NIX_CFLAGS_COMPILE="-Icflags-leak-marker-include" \
+      ${flangExe} -### -c hello.f90 > cflags-isolation.log 2>&1
+    if grep -F -- "cflags-leak-marker-include" cflags-isolation.log; then
+      echo "NIX_CFLAGS_COMPILE leaked into the flang wrapper" >&2
+      exit 1
+    fi
+
+    # Confirm that NIX_FFLAGS_COMPILE is the user-facing channel for
+    # Fortran flags and flows through to the driver.
+    NIX_FFLAGS_COMPILE="-Iffflags-marker-include" \
+      ${flangExe} -### -c hello.f90 > fflags-passthrough.log 2>&1
+    grep -F -- "ffflags-marker-include" fflags-passthrough.log
+
+    ${flangExe} -### -fbuiltin -fno-builtin hello.f90 > builtin.log 2>&1
+    grep -F -- "warning: '-fbuiltin' is not valid for Fortran" builtin.log
+    grep -F -- "warning: '-fno-builtin' is not valid for Fortran" builtin.log
+    if grep -F -- "error: unknown argument" builtin.log; then
+      echo "builtin compatibility flags unexpectedly failed" >&2
+      exit 1
+    fi
+
+    ${flangExe} -### -fexpensive-optimizations hello.f90 > ignored-flag.log 2>&1
+    grep -F -- "optimization flag '-fexpensive-optimizations' is not supported" ignored-flag.log
+    if grep -F -- "error: unknown argument" ignored-flag.log; then
+      echo "ignored gfortran-style flag unexpectedly failed" >&2
+      exit 1
+    fi
+
+    if ${flangExe} -### -complex-range=full hello.f90 > suggestion.log 2>&1; then
+      echo "expected -complex-range=full to fail at the driver layer" >&2
+      exit 1
+    fi
+    grep -F -- "error: unknown argument '-complex-range=full'" suggestion.log
+    grep -F -- "did you mean '-Xflang -complex-range=full'" suggestion.log
+    if grep -F -- "-Xclang -complex-range=full" suggestion.log; then
+      echo "driver suggested -Xclang instead of -Xflang" >&2
+      exit 1
+    fi
+
+    touch $out
+  '';
+}
diff --git a/pkgs/development/compilers/llvm/common/patches.nix b/pkgs/development/compilers/llvm/common/patches.nix
index 30fa0411956a..7a780175c8cc 100644
--- a/pkgs/development/compilers/llvm/common/patches.nix
+++ b/pkgs/development/compilers/llvm/common/patches.nix
@@ -138,4 +138,24 @@
       path = ../19;
     }
   ];
+  "flang/warn-on-fbuiltin-and-fno-builtin.patch" = [
+    {
+      after = "20";
+      before = "22";
+      path = ../21;
+    }
+  ];
+  "flang/accept-and-ignore-some-gfortran-optimization-flags.patch" = [
+    {
+      after = "20";
+      before = "22";
+      path = ../21;
+    }
+  ];
+  "flang/use-xflang-in-diagnostics.patch" = [
+    {
+      after = "20";
+      path = ../21;
+    }
+  ];
 }

From 7e8258d3af32103093ec90a6f9b4ae191f4fd5b0 Mon Sep 17 00:00:00 2001
From: Acture <acturea@gmail.com>
Date: Wed, 1 Apr 2026 16:51:38 +0800
Subject: [PATCH 050/831] llvm/mlir: fix MLIRConfig.cmake to support external
 tablegen overrides

MLIRConfig.cmake unconditionally overwrites MLIR_TABLEGEN_EXE and does
not create an imported target, breaking standalone builds that provide
their own mlir-tblgen binary (e.g. Nix sandboxed builds).

The patch adds guards to respect caller-set MLIR_TABLEGEN_EXE,
MLIR_PDLL_TABLEGEN_EXE, and MLIR_SRC_SHARDER_TABLEGEN_EXE values, and
auto-creates an imported mlir-tblgen target for downstream consumers.
This replaces the previous dummy-target workaround in flang's
CMakeLists.txt.

Upstream issue: https://github.com/llvm/llvm-project/issues/150986

Co-authored-by: Alexander Bantyev <balsoft@balsoft.ru>
---
 .../compilers/llvm/common/flang/default.nix   |  5 +-
 .../llvm/common/flang/dummy_target_19+.patch  | 27 ----------
 .../compilers/llvm/common/mlir/default.nix    |  8 +++
 .../mlir/mlir-tablegen-imported-target.patch  | 54 +++++++++++++++++++
 4 files changed, 63 insertions(+), 31 deletions(-)
 delete mode 100644 pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
 create mode 100644 pkgs/development/compilers/llvm/common/mlir/mlir-tablegen-imported-target.patch

diff --git a/pkgs/development/compilers/llvm/common/flang/default.nix b/pkgs/development/compilers/llvm/common/flang/default.nix
index 0cd94ab4b4b9..5ddb77d74b2e 100644
--- a/pkgs/development/compilers/llvm/common/flang/default.nix
+++ b/pkgs/development/compilers/llvm/common/flang/default.nix
@@ -40,9 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
         chmod -R +w $out/llvm
       '';
 
-  patches = [
-    ./dummy_target_19+.patch
-  ];
+  patches = [ ];
   patchFlags = [ "-p1" ];
 
   sourceRoot = "${finalAttrs.src.name}/flang";
@@ -73,7 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CLANG_DIR" "${libclang.dev}/lib/cmake/clang")
     (lib.cmakeFeature "MLIR_DIR" "${mlir.dev}/lib/cmake/mlir")
     (lib.cmakeFeature "MLIR_TABLEGEN_EXE" "${buildLlvmPackages.tblgen}/bin/mlir-tblgen")
-    (lib.cmakeFeature "MLIR_TABLEGEN_TARGET" "MLIR-TBLGen")
     (lib.cmakeBool "MLIR_LINK_MLIR_DYLIB" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeFeature "LLVM_LIT_ARGS" "-v")
     (lib.cmakeBool "LLVM_ENABLE_PLUGINS" false)
diff --git a/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch b/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
deleted file mode 100644
index a6f295ef50b3..000000000000
--- a/pkgs/development/compilers/llvm/common/flang/dummy_target_19+.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 070c39eb6e9a..168c97524943 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1,6 +1,22 @@
- cmake_minimum_required(VERSION 3.20.0)
- set(LLVM_SUBPROJECT_TITLE "Flang")
- 
-+# Patch: define dummy mlir-tblgen target for TableGen.cmake
-+if(DEFINED MLIR_TABLEGEN_EXE AND NOT TARGET mlir-tblgen)
-+  add_executable(mlir-tblgen IMPORTED GLOBAL)
-+  set_target_properties(mlir-tblgen PROPERTIES
-+    IMPORTED_LOCATION "${MLIR_TABLEGEN_EXE}"
-+  )
-+endif()
-+
-+if(DEFINED MLIR_TABLEGEN_EXE AND NOT TARGET MLIR-TBLGen)
-+  add_executable(MLIR-TBLGen IMPORTED GLOBAL)
-+  set_target_properties(MLIR-TBLGen PROPERTIES
-+    IMPORTED_LOCATION "${MLIR_TABLEGEN_EXE}"
-+  )
-+endif()
-+
-+
- if(NOT DEFINED LLVM_COMMON_CMAKE_UTILS)
-   set(LLVM_COMMON_CMAKE_UTILS ${CMAKE_CURRENT_SOURCE_DIR}/../cmake)
- endif()
diff --git a/pkgs/development/compilers/llvm/common/mlir/default.nix b/pkgs/development/compilers/llvm/common/mlir/default.nix
index c68f6a9b0b68..40bfddc38ee2 100644
--- a/pkgs/development/compilers/llvm/common/mlir/default.nix
+++ b/pkgs/development/compilers/llvm/common/mlir/default.nix
@@ -39,6 +39,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./gnu-install-dirs.patch
+    # MLIRConfig.cmake unconditionally overwrites MLIR_TABLEGEN_EXE, breaking standalone
+    # builds that provide their own pre-built mlir-tblgen (e.g. in Nix sandboxed builds).
+    # The patch adds guards to respect caller-set values and auto-creates an imported
+    # mlir-tblgen target for downstream consumers. This replaces the previous dummy target
+    # workaround in flang's CMakeLists.txt.
+
+    # Upstream issue: https://github.com/llvm/llvm-project/issues/150986
+    ./mlir-tablegen-imported-target.patch
   ]
   ++ lib.optional (lib.versionOlder release_version "20") [
     # Fix build with gcc15
diff --git a/pkgs/development/compilers/llvm/common/mlir/mlir-tablegen-imported-target.patch b/pkgs/development/compilers/llvm/common/mlir/mlir-tablegen-imported-target.patch
new file mode 100644
index 000000000000..a173341168d2
--- /dev/null
+++ b/pkgs/development/compilers/llvm/common/mlir/mlir-tablegen-imported-target.patch
@@ -0,0 +1,54 @@
+diff --git a/cmake/modules/MLIRConfig.cmake.in b/cmake/modules/MLIRConfig.cmake.in
+index 71f3e028b1e8..b30b6cdc0de1 100644
+--- a/cmake/modules/MLIRConfig.cmake.in
++++ b/cmake/modules/MLIRConfig.cmake.in
+@@ -9,9 +9,16 @@ find_package(LLVM ${LLVM_VERSION} EXACT REQUIRED CONFIG
+ set(MLIR_EXPORTED_TARGETS "@MLIR_EXPORTS@")
+ set(MLIR_CMAKE_DIR "@MLIR_CONFIG_CMAKE_DIR@")
+ set(MLIR_INCLUDE_DIRS "@MLIR_CONFIG_INCLUDE_DIRS@")
+-set(MLIR_TABLEGEN_EXE "@MLIR_CONFIG_TABLEGEN_EXE@")
+-set(MLIR_PDLL_TABLEGEN_EXE "@MLIR_CONFIG_PDLL_TABLEGEN_EXE@")
+-set(MLIR_SRC_SHARDER_TABLEGEN_EXE "@MLIR_CONFIG_SRC_SHARDER_TABLEGEN_EXE@")
++# Allow users to override tablegen executables (e.g. for sandboxed builds).
++if(NOT MLIR_TABLEGEN_EXE)
++  set(MLIR_TABLEGEN_EXE "@MLIR_CONFIG_TABLEGEN_EXE@")
++endif()
++if(NOT MLIR_PDLL_TABLEGEN_EXE)
++  set(MLIR_PDLL_TABLEGEN_EXE "@MLIR_CONFIG_PDLL_TABLEGEN_EXE@")
++endif()
++if(NOT MLIR_SRC_SHARDER_TABLEGEN_EXE)
++  set(MLIR_SRC_SHARDER_TABLEGEN_EXE "@MLIR_CONFIG_SRC_SHARDER_TABLEGEN_EXE@")
++endif()
+ set(MLIR_IRDL_TO_CPP_EXE "@MLIR_CONFIG_IRDL_TO_CPP_EXE@")
+ set(MLIR_INSTALL_AGGREGATE_OBJECTS "@MLIR_INSTALL_AGGREGATE_OBJECTS@")
+ set(MLIR_ENABLE_BINDINGS_PYTHON "@MLIR_ENABLE_BINDINGS_PYTHON@")
+@@ -32,6 +39,29 @@ if(NOT TARGET MLIRSupport)
+   @MLIR_CONFIG_INCLUDE_EXPORTS@
+ endif()
+
++# Ensure MLIR_TABLEGEN_EXE is a full path and has a corresponding imported
++# target. In install trees, MLIR_TABLEGEN_EXE may be a bare name
++# ("mlir-tblgen") rather than an absolute path. Resolve it so that
++# TableGen.cmake can use it as both a COMMAND and a DEPENDS entry.
++if(MLIR_TABLEGEN_EXE AND NOT IS_ABSOLUTE "${MLIR_TABLEGEN_EXE}"
++    AND NOT TARGET "${MLIR_TABLEGEN_EXE}")
++  find_program(_mlir_tblgen_exe "${MLIR_TABLEGEN_EXE}"
++    HINTS "${LLVM_TOOLS_BINARY_DIR}")
++  if(_mlir_tblgen_exe)
++    set(MLIR_TABLEGEN_EXE "${_mlir_tblgen_exe}")
++  endif()
++  unset(_mlir_tblgen_exe)
++endif()
++
++if(NOT TARGET mlir-tblgen AND MLIR_TABLEGEN_EXE)
++  add_executable(mlir-tblgen IMPORTED GLOBAL)
++  set_target_properties(mlir-tblgen PROPERTIES
++    IMPORTED_LOCATION "${MLIR_TABLEGEN_EXE}")
++endif()
++if(NOT DEFINED MLIR_TABLEGEN_TARGET)
++  set(MLIR_TABLEGEN_TARGET mlir-tblgen)
++endif()
++
+ # By creating these targets here, subprojects that depend on MLIR's
+ # tablegen-generated headers can always depend on these targets whether building
+ # in-tree with MLIR or not.

From 09bb0b6ec4d020e2e1ca78b03af7ebd67385e309 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 5 May 2026 12:31:09 +0000
Subject: [PATCH 051/831] yara: 4.5.5 -> 4.5.6

---
 pkgs/by-name/ya/yara/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ya/yara/package.nix b/pkgs/by-name/ya/yara/package.nix
index 317575a66bfc..905561b69435 100644
--- a/pkgs/by-name/ya/yara/package.nix
+++ b/pkgs/by-name/ya/yara/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yara";
-  version = "4.5.5";
+  version = "4.5.6";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a+oLxVJgdDrnOra85PPo8ZlFhinawWHuRtVE39S8yJk=";
+    hash = "sha256-G1f0o7wsds4Mz4Whz35JdSKIkPIqea5Fe5rB8vMdkZU=";
   };
 
   nativeBuildInputs = [

From 6bfe46da49c97390f2a81d3fd2bdc2281fae2af7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 5 May 2026 14:24:03 +0000
Subject: [PATCH 052/831] hwdata: 0.406 -> 0.407

---
 pkgs/by-name/hw/hwdata/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index 0678443277a9..9624dc7a05c6 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.406";
+  version = "0.407";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6GXXkDzunbtea+MmmWV2gpHgCgdGi75U+TV9H/6Emtk=";
+    hash = "sha256-JrEUmXH1/fua6EJjHHwny19QS0HvYGRPelKF0UroDhc=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)

From 99cda4d5c7e6f7b427dea344b91f3207e5e6e11d Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Thu, 24 Jul 2025 19:58:56 +0200
Subject: [PATCH 053/831] hotdoc: use callPackage, refactor clang usage

---
 pkgs/development/tools/hotdoc/clang.patch | 96 ++++++++++++++---------
 pkgs/development/tools/hotdoc/default.nix | 58 +++-----------
 pkgs/top-level/all-packages.nix           |  2 +-
 3 files changed, 74 insertions(+), 82 deletions(-)

diff --git a/pkgs/development/tools/hotdoc/clang.patch b/pkgs/development/tools/hotdoc/clang.patch
index 53334206b7d5..cf5c10fca3d4 100644
--- a/pkgs/development/tools/hotdoc/clang.patch
+++ b/pkgs/development/tools/hotdoc/clang.patch
@@ -1,8 +1,32 @@
 diff --git a/hotdoc/extensions/c/c_extension.py b/hotdoc/extensions/c/c_extension.py
-index 1cfd5b3..cff20c8 100644
+index 1cfd5b3..1e1926f 100644
 --- a/hotdoc/extensions/c/c_extension.py
 +++ b/hotdoc/extensions/c/c_extension.py
-@@ -89,7 +89,7 @@ def get_clang_headers():
+@@ -44,14 +44,6 @@ from hotdoc.utils.loggable import (info as core_info, warn, Logger,
+                                    debug as core_debug)
+ 
+ 
+-LLVM_CONFIG = os.environ.get("LLVM_CONFIG")
+-if LLVM_CONFIG is None:
+-    LLVM_CONFIG = shutil.which('llvm-config')
+-
+-if LLVM_CONFIG is None:
+-    raise ImportError()
+-
+-
+ def ast_node_is_function_pointer(ast_node):
+     if ast_node.kind == cindex.TypeKind.POINTER and \
+             ast_node.get_pointee().get_result().kind != \
+@@ -80,42 +72,26 @@ Logger.register_warning_code('clang-headers-not-found', HotdocException,
+                              'c-extension')
+ 
+ 
+-CLANG_HEADERS_WARNING = (
+-    'Did not find clang headers. Please report a bug with the output of the'
+-    '\'llvm-config --version\' and \'llvm-config --prefix\' commands')
+-
+-
+ def get_clang_headers():
      try:
          # Clang 5.0+ can tell us directly
          resource_dir = subprocess.check_output(
@@ -11,42 +35,44 @@ index 1cfd5b3..cff20c8 100644
          if len(resource_dir) > 0:
              include_dir = os.path.join(resource_dir, 'include')
              if os.path.exists(include_dir):
+                 return include_dir
+     except subprocess.CalledProcessError:
+         pass
+-    version = subprocess.check_output(
+-        [LLVM_CONFIG, '--version']).strip().decode()
+-    prefix = subprocess.check_output(
+-        [LLVM_CONFIG, '--prefix']).strip().decode()
+-    versions = (version, version.split('.').pop(0))
+-    for (ver, lib) in itertools.product(
+-            versions,
+-            ['lib', 'lib64']):
+-        p = os.path.join(prefix, lib, 'clang', ver, 'include')
+-        if os.path.exists(p):
+-            return p
+ 
+-    warn('clang-headers-not-found', CLANG_HEADERS_WARNING)
++    warn('clang-headers-not-found', 'Did not find clang headers. Make sure you\'re using Clang 5.0+')
+ 
+ 
+ CLANG_HEADERS = get_clang_headers()
+ 
+ 
+ def get_clang_libdir():
+-    return subprocess.check_output([LLVM_CONFIG, '--libdir']).strip().decode()
++    return '@libclang_lib_dir@'
+ 
+ 
+ class ClangScanner(object):
 diff --git a/hotdoc/extensions/c/clang/cindex.py b/hotdoc/extensions/c/clang/cindex.py
-index fc93fda..2eb8eaf 100644
+index fc93fda..0a16651 100644
 --- a/hotdoc/extensions/c/clang/cindex.py
 +++ b/hotdoc/extensions/c/clang/cindex.py
-@@ -3937,20 +3937,23 @@ class Config:
-         if Config.library_file:
-             return Config.library_file
+@@ -3949,6 +3949,8 @@ class Config:
  
--        import platform
--        name = platform.system()
-+        if Config.library_path:
-+            import platform
-+            name = platform.system()
+         if Config.library_path:
+             file = Config.library_path + '/' + file
++        else:
++            file = "@libclang_lib_dir@" + '/' + file
  
--        if name == 'Darwin':
--            file = 'libclang.dylib'
--        elif name == 'Windows':
--            file = 'libclang.dll'
--        else:
--            file = 'libclang.so'
-+            if name == 'Darwin':
-+                file = 'libclang.dylib'
-+            elif name == 'Windows':
-+                file = 'libclang.dll'
-+            else:
-+                file = 'libclang.so'
+         return file
  
--        if Config.library_path:
--            file = Config.library_path + '/' + file
-+            if Config.library_path:
-+                file = Config.library_path + '/' + file
-+
-+            return file
- 
--        return file
-+        return "@libclang@"
- 
-     def get_cindex_library(self):
-         try:
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/development/tools/hotdoc/default.nix
index 64f7538ca37b..47862db4d978 100644
--- a/pkgs/development/tools/hotdoc/default.nix
+++ b/pkgs/development/tools/hotdoc/default.nix
@@ -1,37 +1,21 @@
 {
   lib,
   stdenv,
-  buildPythonApplication,
+  python3Packages,
   fetchpatch,
   fetchPypi,
   replaceVars,
-  clang,
-  libclang,
-  pytestCheckHook,
   pkg-config,
   cmake,
   flex,
   glib,
   json-glib,
   libxml2,
-  appdirs,
-  backports-entry-points-selectable,
-  dbus-deviation,
-  faust-cchardet,
-  feedgen,
-  lxml,
-  networkx,
-  pkgconfig,
-  pyyaml,
-  schema,
-  setuptools,
-  toposort,
-  wheezy-template,
   llvmPackages,
   gst_all_1,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "hotdoc";
   version = "0.17.4";
   pyproject = true;
@@ -43,8 +27,8 @@ buildPythonApplication rec {
 
   patches = [
     (replaceVars ./clang.patch {
-      clang = lib.getExe clang;
-      libclang = "${lib.getLib libclang}/lib/libclang${stdenv.hostPlatform.extensions.sharedLibrary}";
+      clang = lib.getExe llvmPackages.clang;
+      libclang_lib_dir = "${lib.getLib llvmPackages.libclang}/lib";
     })
 
     # Fix build with gcc15
@@ -55,7 +39,9 @@ buildPythonApplication rec {
     })
   ];
 
-  build-system = [ setuptools ];
+  postPatch = ''
+    patch -p1 -d cmark -i ${./fix-cmake-4.patch}
+  '';
 
   nativeBuildInputs = [
     pkg-config
@@ -66,10 +52,12 @@ buildPythonApplication rec {
   buildInputs = [
     glib
     json-glib
-    libxml2.dev
+    libxml2
   ];
 
-  dependencies = [
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
     appdirs
     backports-entry-points-selectable
     dbus-deviation
@@ -85,7 +73,7 @@ buildPythonApplication rec {
     wheezy-template
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = with python3Packages; [ pytestCheckHook ];
 
   # CMake is used to build CMARK, but the build system is still python
   dontUseCmakeConfigure = true;
@@ -103,14 +91,6 @@ buildPythonApplication rec {
     "hotdoc"
   ];
 
-  disabledTestPaths = [
-    # Executing hotdoc exits with code 1
-    "tests/test_hotdoc.py::TestHotdoc::test_basic"
-    "tests/test_hotdoc.py::TestHotdoc::test_explicit_conf_file"
-    "tests/test_hotdoc.py::TestHotdoc::test_implicit_conf_file"
-    "tests/test_hotdoc.py::TestHotdoc::test_private_folder"
-  ];
-
   disabledTests = [
     # Test does not correctly handle path normalization for test comparison
     "test_cli_overrides"
@@ -120,20 +100,6 @@ buildPythonApplication rec {
     "test_index"
   ];
 
-  postPatch =
-    # Hardcode libclang paths
-    ''
-      substituteInPlace hotdoc/extensions/c/c_extension.py \
-        --replace "shutil.which('llvm-config')" 'True' \
-        --replace "subprocess.check_output(['llvm-config', '--version']).strip().decode()" '"${lib.versions.major llvmPackages.libclang.version}"' \
-        --replace "subprocess.check_output(['llvm-config', '--prefix']).strip().decode()" '"${lib.getLib llvmPackages.libclang}"' \
-        --replace "subprocess.check_output(['llvm-config', '--libdir']).strip().decode()" '"${lib.getLib llvmPackages.libclang}/lib"'
-    ''
-    # <https://github.com/MathieuDuponchelle/cmark/pull/2>
-    + ''
-      patch -p1 -d cmark -i ${./fix-cmake-4.patch}
-    '';
-
   # Make pytest run from a temp dir to have it pick up installed package for cmark
   preCheck = ''
     pushd $TMPDIR
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 001ee576682d..8420aa185a95 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2505,7 +2505,7 @@ with pkgs;
 
   host = bind.host;
 
-  hotdoc = python3Packages.callPackage ../development/tools/hotdoc { };
+  hotdoc = callPackage ../development/tools/hotdoc { };
 
   hpccm = with python3Packages; toPythonApplication hpccm;
 

From eeb1649a2fa25faf1c8cfdfe009dc7f174f12c4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 5 May 2026 08:04:28 -0700
Subject: [PATCH 054/831] python3Packages.xmltodict: 1.0.2 -> 1.0.4

Diff: https://github.com/martinblech/xmltodict/compare/v1.0.2...v1.0.4

Changelog: https://github.com/martinblech/xmltodict/blob/v1.0.4/CHANGELOG.md
---
 pkgs/development/python-modules/xmltodict/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xmltodict/default.nix b/pkgs/development/python-modules/xmltodict/default.nix
index 9d1c01842a42..bd22bc108bbe 100644
--- a/pkgs/development/python-modules/xmltodict/default.nix
+++ b/pkgs/development/python-modules/xmltodict/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "xmltodict";
-  version = "1.0.2";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "martinblech";
     repo = "xmltodict";
     tag = "v${version}";
-    hash = "sha256-gnTNkh0GLfRmjMsLhfvpNrewfinNOhem0i3wzIZvKpA=";
+    hash = "sha256-G7hVtS6toUJC0YY1AXBOJSc3wnAZyWilLnT/5vvFRRw=";
   };
 
   build-system = [ setuptools ];

From 00c938cad9fb1ad0f5e332811ea923879f2a1c7b Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Tue, 5 May 2026 17:06:35 +0200
Subject: [PATCH 055/831] hotdoc: move to pkgs/by-name

---
 pkgs/{development/tools => by-name/ho}/hotdoc/clang.patch       | 0
 pkgs/{development/tools => by-name/ho}/hotdoc/fix-cmake-4.patch | 0
 .../tools/hotdoc/default.nix => by-name/ho/hotdoc/package.nix}  | 0
 pkgs/top-level/all-packages.nix                                 | 2 --
 4 files changed, 2 deletions(-)
 rename pkgs/{development/tools => by-name/ho}/hotdoc/clang.patch (100%)
 rename pkgs/{development/tools => by-name/ho}/hotdoc/fix-cmake-4.patch (100%)
 rename pkgs/{development/tools/hotdoc/default.nix => by-name/ho/hotdoc/package.nix} (100%)

diff --git a/pkgs/development/tools/hotdoc/clang.patch b/pkgs/by-name/ho/hotdoc/clang.patch
similarity index 100%
rename from pkgs/development/tools/hotdoc/clang.patch
rename to pkgs/by-name/ho/hotdoc/clang.patch
diff --git a/pkgs/development/tools/hotdoc/fix-cmake-4.patch b/pkgs/by-name/ho/hotdoc/fix-cmake-4.patch
similarity index 100%
rename from pkgs/development/tools/hotdoc/fix-cmake-4.patch
rename to pkgs/by-name/ho/hotdoc/fix-cmake-4.patch
diff --git a/pkgs/development/tools/hotdoc/default.nix b/pkgs/by-name/ho/hotdoc/package.nix
similarity index 100%
rename from pkgs/development/tools/hotdoc/default.nix
rename to pkgs/by-name/ho/hotdoc/package.nix
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8420aa185a95..51279ac2fd72 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2505,8 +2505,6 @@ with pkgs;
 
   host = bind.host;
 
-  hotdoc = callPackage ../development/tools/hotdoc { };
-
   hpccm = with python3Packages; toPythonApplication hpccm;
 
   html-proofer = callPackage ../tools/misc/html-proofer { };

From 230567bf2bf1a6cecd3a3a2c956eeb02cf451c29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 5 May 2026 08:07:33 -0700
Subject: [PATCH 056/831] python3Packages.xmltodict: add dotlambda to
 maintainers

---
 pkgs/development/python-modules/xmltodict/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/xmltodict/default.nix b/pkgs/development/python-modules/xmltodict/default.nix
index bd22bc108bbe..0c928c0aa158 100644
--- a/pkgs/development/python-modules/xmltodict/default.nix
+++ b/pkgs/development/python-modules/xmltodict/default.nix
@@ -29,6 +29,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/martinblech/xmltodict";
     changelog = "https://github.com/martinblech/xmltodict/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.dotlambda ];
   };
 }

From 19df48b95abeaa4a18df925c21356d5d994e21c6 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 5 May 2026 20:52:17 +0100
Subject: [PATCH 057/831] hunspell: 1.7.2 -> 1.7.3

Changes: https://github.com/hunspell/hunspell/releases/tag/v1.7.3
---
 pkgs/by-name/hu/hunspell/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hu/hunspell/package.nix b/pkgs/by-name/hu/hunspell/package.nix
index ce0e7db16a7b..398c9e9e453b 100644
--- a/pkgs/by-name/hu/hunspell/package.nix
+++ b/pkgs/by-name/hu/hunspell/package.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hunspell";
-  version = "1.7.2";
+  version = "1.7.3";
 
   outputs = [
     "bin"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "hunspell";
     repo = "hunspell";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-x2FXxnVIqsf5/UEQcvchAndXBv/3mW8Z55djQAFgNA8=";
+    hash = "sha256-NoLlH+4Hb6w+HYl2fSBzroav1Pb3GojFSTJGBxlteBM=";
   };
 
   patches = [ ./0001-Make-hunspell-look-in-XDG_DATA_DIRS-for-dictionaries.patch ];

From 16ed2d73444b123572b501142e046265b8013b3a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 00:52:44 +0000
Subject: [PATCH 058/831] djvulibre: 3.5.29 -> 3.5.30

---
 pkgs/by-name/dj/djvulibre/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dj/djvulibre/package.nix b/pkgs/by-name/dj/djvulibre/package.nix
index f6eb3ccbb140..13563f3242b8 100644
--- a/pkgs/by-name/dj/djvulibre/package.nix
+++ b/pkgs/by-name/dj/djvulibre/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "djvulibre";
-  version = "3.5.29";
+  version = "3.5.30";
 
   src = fetchurl {
     url = "mirror://sourceforge/djvu/djvulibre-${finalAttrs.version}.tar.gz";
-    hash = "sha256-07SwOuK9yoUWo2726ye3d/BSjJ7aJnRdmWKCSj/f7M8=";
+    hash = "sha256-7l5FfUz+vlZvlLmeXj08x/XHndt0HCrCui5FbwAylkQ=";
   };
 
   outputs = [

From dd134e69e6f64e4a7f6f6e260dfc25776cd89b93 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 15:15:05 +0000
Subject: [PATCH 059/831] minimal-bootstrap: fix early-musl-userland flake on
 parallel builds

---
 .../linux/minimal-bootstrap/gnumake/musl.nix           |  9 +++++++++
 .../linux/minimal-bootstrap/gnused/default.nix         | 10 ++++++++++
 .../os-specific/linux/minimal-bootstrap/gnutar/mes.nix | 10 ++++++++++
 .../linux/minimal-bootstrap/gnutar/musl.nix            | 10 ++++++++++
 4 files changed, 39 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
index 1913ce85927b..7476143d3469 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
@@ -4,6 +4,7 @@
   hostPlatform,
   fetchurl,
   bash,
+  coreutils,
   tinycc,
   gnumakeBoot,
   gnupatch,
@@ -37,6 +38,7 @@ bash.runCommand "${pname}-${version}"
     inherit pname version meta;
 
     nativeBuildInputs = [
+      coreutils
       tinycc.compiler
       gnumakeBoot
       gnupatch
@@ -59,6 +61,13 @@ bash.runCommand "${pname}-${version}"
     tar xzf ${src}
     cd make-${version}
 
+    # Defeat parallel-build automake regen race, see gnused/default.nix.
+    touch Makefile.in Makefile aclocal.m4 config.h.in configure 2>/dev/null || true
+    for f in */Makefile.in; do touch "$f" 2>/dev/null || true; done
+    chmod +x configure config.guess config.sub install-sh missing compile \
+      depcomp mkinstalldirs help2man 2>/dev/null || true
+    [ -d build-aux ] && chmod +x build-aux/* 2>/dev/null || true
+
     # Patch
     ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
index 267f1f12dd20..260f9103c756 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
@@ -4,6 +4,7 @@
   hostPlatform,
   fetchurl,
   bash,
+  coreutils,
   gnumake,
   tinycc,
   gnused,
@@ -33,6 +34,7 @@ bash.runCommand "${pname}-${version}"
     inherit pname version meta;
 
     nativeBuildInputs = [
+      coreutils
       gnumake
       tinycc.compiler
       gnused
@@ -53,6 +55,14 @@ bash.runCommand "${pname}-${version}"
     tar xzf ${src}
     cd sed-${version}
 
+    # Defeat parallel-build automake regen race: refresh generated-file
+    # mtimes and restore +x on autotools helpers.
+    touch Makefile.in Makefile aclocal.m4 config.h.in configure 2>/dev/null || true
+    for f in */Makefile.in; do touch "$f" 2>/dev/null || true; done
+    chmod +x configure config.guess config.sub install-sh missing compile \
+      depcomp mkinstalldirs help2man 2>/dev/null || true
+    [ -d build-aux ] && chmod +x build-aux/* 2>/dev/null || true
+
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
     export LD=tcc
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
index 2580347d7102..f38f8e262854 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
@@ -4,6 +4,7 @@
   hostPlatform,
   fetchurl,
   bash,
+  coreutils,
   tinycc,
   gnumake,
   gnused,
@@ -25,6 +26,7 @@ bash.runCommand "${pname}-${version}"
     inherit pname version meta;
 
     nativeBuildInputs = [
+      coreutils
       tinycc.compiler
       gnumake
       gnused
@@ -45,6 +47,14 @@ bash.runCommand "${pname}-${version}"
     rm tar.tar
     cd tar-${version}
 
+    # untar drops mtimes and +x on autotools helpers, restore them so
+    # parallel builds don't trip into automake regeneration.
+    touch Makefile.in Makefile aclocal.m4 config.h.in configure 2>/dev/null || true
+    for f in */Makefile.in; do touch "$f" 2>/dev/null || true; done
+    chmod +x configure config.guess config.sub install-sh missing compile \
+      depcomp mkinstalldirs help2man 2>/dev/null || true
+    [ -d build-aux ] && chmod +x build-aux/* 2>/dev/null || true
+
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
     bash ./configure \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
index c3e967ebe53d..09d2d260b895 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
@@ -4,6 +4,7 @@
   hostPlatform,
   fetchurl,
   bash,
+  coreutils,
   tinycc,
   gnumake,
   gnugrep,
@@ -26,6 +27,7 @@ bash.runCommand "${pname}-${version}"
     inherit pname version meta;
 
     nativeBuildInputs = [
+      coreutils
       tinycc.compiler
       gnumake
       gnused
@@ -46,6 +48,14 @@ bash.runCommand "${pname}-${version}"
     rm tar.tar
     cd tar-${version}
 
+    # untar drops mtimes and +x on autotools helpers, restore them so
+    # parallel builds don't trip into automake regeneration.
+    touch Makefile.in Makefile aclocal.m4 config.h.in configure 2>/dev/null || true
+    for f in */Makefile.in; do touch "$f" 2>/dev/null || true; done
+    chmod +x configure config.guess config.sub install-sh missing compile \
+      depcomp mkinstalldirs help2man 2>/dev/null || true
+    [ -d build-aux ] && chmod +x build-aux/* 2>/dev/null || true
+
     # Configure
     export CC="tcc -B ${tinycc.libs}/lib"
     export LD=tcc

From 08521f3b58242c879b96105dc23102c8ea708d5f Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:32 +0000
Subject: [PATCH 060/831] minimal-bootstrap.binutils: --disable-{gold,plugins}

---
 pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix | 2 ++
 pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix  | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
index 4ba20f13192e..eb34c121e9da 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
@@ -54,6 +54,8 @@ let
     # libbfd and libopcodes into a default visibility. Drop default lib
     # path to force users to declare their use of these libraries.
     "--with-lib-path=:"
+    "--disable-gold"
+    "--disable-plugins"
   ];
 in
 bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index fd0681ca4d41..90e2eb8126ea 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -56,6 +56,8 @@ let
     # libbfd and libopcodes into a default visibility. Drop default lib
     # path to force users to declare their use of these libraries.
     "--with-lib-path=:"
+    "--disable-gold"
+    "--disable-plugins"
   ];
 in
 bash.runCommand "${pname}-${version}"

From 9eb073dafa87aa513a1ac5e353c3c9948903f072 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:32 +0000
Subject: [PATCH 061/831] minimal-bootstrap.glibc:
 --disable-{nscd,build-nscd,profile,timezone-tools,mathvec}

---
 pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
index b1df854db276..f156f862ecc0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
@@ -104,7 +104,12 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --with-headers=${linux-headers}/include \
-      --disable-dependency-tracking
+      --disable-dependency-tracking \
+      --disable-nscd \
+      --disable-build-nscd \
+      --disable-profile \
+      --disable-timezone-tools \
+      --disable-mathvec
 
     # Build
     make -j $NIX_BUILD_CORES

From 4791df2472f2b75a852a49306884d9b88e2e6c56 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:32 +0000
Subject: [PATCH 062/831] minimal-bootstrap.gcc46-cxx:
 --disable-{libsanitizer,shared}

---
 pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
index 9eb873ea0da5..3016e751e72f 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
@@ -155,7 +155,9 @@ bash.runCommand "${pname}-${version}"
       --disable-libstdcxx-pch \
       --disable-lto \
       --disable-multilib \
-      --disable-nls
+      --disable-nls \
+      --disable-libsanitizer \
+      --disable-shared
 
     # Build
     make -j $NIX_BUILD_CORES

From 1ea118f2b0a43aa573848517968a1ac90ff3e225 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:33 +0000
Subject: [PATCH 063/831] minimal-bootstrap.gcc10: drop ISL,
 --disable-{libstdcxx-filesystem-ts,shared}

---
 pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
index 3146c350dddb..25b06eb13f00 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/10.nix
@@ -48,12 +48,6 @@ let
     url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
     hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
   };
-
-  islVersion = "0.24";
-  isl = fetchurl {
-    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
-    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
-  };
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -112,13 +106,11 @@ bash.runCommand "${pname}-${version}"
     tar xf ${gmp}
     tar xf ${mpfr}
     tar xf ${mpc}
-    tar xf ${isl}
     cd gcc-${version}
 
     ln -s ../gmp-${gmpVersion} gmp
     ln -s ../mpfr-${mpfrVersion} mpfr
     ln -s ../mpc-${mpcVersion} mpc
-    ln -s ../isl-${islVersion} isl
 
     # Patch
     # doesn't recognise musl
@@ -157,7 +149,10 @@ bash.runCommand "${pname}-${version}"
       --disable-lto \
       --disable-multilib \
       --disable-nls \
-      --disable-plugin
+      --disable-plugin \
+      --without-isl \
+      --disable-libstdcxx-filesystem-ts \
+      --disable-shared
 
     # Build
     make -j $NIX_BUILD_CORES

From 9ced5a330a4bca970d931aa622ddab02eef359bc Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:33 +0000
Subject: [PATCH 064/831] minimal-bootstrap.gcc-latest: drop ISL,
 --disable-shared

---
 .../linux/minimal-bootstrap/gcc/latest.nix           | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
index 287f894626e0..d003f164abad 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
@@ -45,12 +45,6 @@ let
     url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
     hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
   };
-
-  islVersion = "0.24";
-  isl = fetchurl {
-    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
-    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
-  };
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -109,13 +103,11 @@ bash.runCommand "${pname}-${version}"
     tar xf ${gmp}
     tar xf ${mpfr}
     tar xf ${mpc}
-    tar xf ${isl}
     cd gcc-${version}
 
     ln -s ../gmp-${gmpVersion} gmp
     ln -s ../mpfr-${mpfrVersion} mpfr
     ln -s ../mpc-${mpcVersion} mpc
-    ln -s ../isl-${islVersion} isl
 
     # Patch
     # force musl even if host triple is gnu
@@ -151,7 +143,9 @@ bash.runCommand "${pname}-${version}"
       --disable-lto \
       --disable-multilib \
       --disable-nls \
-      --disable-plugin
+      --disable-plugin \
+      --without-isl \
+      --disable-shared
 
     # Build
     make -j $NIX_BUILD_CORES

From 0571f521a81fbd72eda2f9c8dae949ad54594f1c Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 6 May 2026 17:34:33 +0000
Subject: [PATCH 065/831] minimal-bootstrap.gcc-glibc: drop ISL,
 --disable-libstdcxx-{backtrace,filesystem-ts}

---
 .../linux/minimal-bootstrap/gcc/glibc.nix           | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
index eb8da7723f98..3188453cea74 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/glibc.nix
@@ -52,12 +52,6 @@ let
     url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
     hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
   };
-
-  islVersion = "0.24";
-  isl = fetchurl {
-    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
-    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
-  };
 in
 bash.runCommand "${pname}-${version}"
   {
@@ -115,13 +109,11 @@ bash.runCommand "${pname}-${version}"
     tar xf ${gmp}
     tar xf ${mpfr}
     tar xf ${mpc}
-    tar xf ${isl}
     cd gcc-${version}
 
     ln -s ../gmp-${gmpVersion} gmp
     ln -s ../mpfr-${mpfrVersion} mpfr
     ln -s ../mpc-${mpcVersion} mpc
-    ln -s ../isl-${islVersion} isl
 
     # Configure
     export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
@@ -152,7 +144,10 @@ bash.runCommand "${pname}-${version}"
       --disable-multilib \
       --disable-nls \
       --disable-plugin \
-      --with-specs="%x{-dynamic-linker=${glibc}/lib/${linkerName}} %x{-L${glibc}/lib/} -B${glibc}/lib"
+      --with-specs="%x{-dynamic-linker=${glibc}/lib/${linkerName}} %x{-L${glibc}/lib/} -B${glibc}/lib" \
+      --without-isl \
+      --disable-libstdcxx-backtrace \
+      --disable-libstdcxx-filesystem-ts
 
     # Build
     make -j $NIX_BUILD_CORES

From 04d4126705c928fc30af301c62d98ef2fb4e3c75 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 6 May 2026 18:17:20 +0000
Subject: [PATCH 066/831] amf-headers: 1.5.0 -> 1.5.2

---
 pkgs/by-name/am/amf-headers/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/am/amf-headers/package.nix b/pkgs/by-name/am/amf-headers/package.nix
index b1f1dcc0e174..a03ba327914d 100644
--- a/pkgs/by-name/am/amf-headers/package.nix
+++ b/pkgs/by-name/am/amf-headers/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "amf-headers";
-  version = "1.5.0";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "GPUOpen-LibrariesAndSDKs";
     repo = "AMF";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-ZVC1e4S5CNpfl3ewHR9aVfYwxDBE7/BJ6OyH2kF00fQ=";
+    sha256 = "sha256-+jVYm/Zmt+1bzKnKTiClgoMRsyhqpuKZj79DvGHpPTM=";
   };
 
   installPhase = ''

From 6517fae64e6b483e510f46db6d0f970f1fbdcf84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 26 Feb 2026 18:44:27 +0100
Subject: [PATCH 067/831] pypy3Packages.meson: fix postPatch

---
 pkgs/by-name/me/meson/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/me/meson/package.nix b/pkgs/by-name/me/meson/package.nix
index 4f48831753c4..edd39a451200 100644
--- a/pkgs/by-name/me/meson/package.nix
+++ b/pkgs/by-name/me/meson/package.nix
@@ -72,11 +72,11 @@ python3.pkgs.buildPythonApplication rec {
     if python3.isPyPy then
       ''
         substituteInPlace mesonbuild/modules/python.py \
-          --replace-fail "PythonExternalProgram('python3', mesonlib.python_command)" \
-                         "PythonExternalProgram('${python3.meta.mainProgram}', mesonlib.python_command)"
+          --replace-fail "PythonExternalProgram('python3', mesonlib.python_command" \
+                         "PythonExternalProgram('${python3.meta.mainProgram}', mesonlib.python_command"
         substituteInPlace mesonbuild/modules/python3.py \
-          --replace-fail "state.environment.lookup_binary_entry(mesonlib.MachineChoice.HOST, 'python3')" \
-                         "state.environment.lookup_binary_entry(mesonlib.MachineChoice.HOST, '${python3.meta.mainProgram}')"
+          --replace-fail "state.environment.lookup_binary_entry(mesonlib.MachineChoice.HOST, 'python3'" \
+                         "state.environment.lookup_binary_entry(mesonlib.MachineChoice.HOST, '${python3.meta.mainProgram}'"
         substituteInPlace "test cases"/*/*/*.py "test cases"/*/*/*/*.py \
           --replace-quiet '#!/usr/bin/env python3' '#!/usr/bin/env pypy3' \
           --replace-quiet '#! /usr/bin/env python3' '#!/usr/bin/env pypy3'
@@ -141,6 +141,8 @@ python3.pkgs.buildPythonApplication rec {
       ++ lib.optionals python3.isPyPy [
         # fails for unknown reason
         "test cases/python/4 custom target depends extmodule"
+        # we patch the path to the binary...
+        "test cases/common/26 find program"
       ]
     ))
     ++ [

From 8a07895dc2b3ecb7fec03b14ced0d3fe533c4884 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 26 Feb 2026 18:44:39 +0100
Subject: [PATCH 068/831] pypy3Packages.sphinx: update disabled test paths

but cannot currently be tested due to pypy not understanding the type
keyword
---
 pkgs/development/python-modules/sphinx/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index fb99c84de0bd..b0733c1289e5 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -95,11 +95,11 @@ buildPythonPackage rec {
 
   disabledTestPaths = lib.optionals isPyPy [
     # internals are asserted which are sightly different in PyPy
-    "tests/test_extensions/test_ext_autodoc.py"
-    "tests/test_extensions/test_ext_autodoc_autoclass.py"
-    "tests/test_extensions/test_ext_autodoc_autofunction.py"
-    "tests/test_extensions/test_ext_autodoc_automodule.py"
-    "tests/test_extensions/test_ext_autodoc_preserve_defaults.py"
+    "tests/test_ext_autodoc/test_ext_autodoc.py"
+    "tests/test_ext_autodoc/test_ext_autodoc_autoclass.py"
+    "tests/test_ext_autodoc/test_ext_autodoc_autofunction.py"
+    "tests/test_ext_autodoc/test_ext_autodoc_automodule.py"
+    "tests/test_ext_autodoc/test_ext_autodoc_preserve_defaults.py"
     "tests/test_util/test_util_inspect.py"
     "tests/test_util/test_util_typing.py"
   ];

From 957d7443453c3d11cb74aa35c181d1ec9f75ca20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 26 Feb 2026 18:45:00 +0100
Subject: [PATCH 069/831] pypy3Packages.zopfli: replace setuptools version pin
 for pypy

---
 pkgs/development/python-modules/zopfli/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/zopfli/default.nix b/pkgs/development/python-modules/zopfli/default.nix
index 5d6b2f1ef79f..e602cd3ce333 100644
--- a/pkgs/development/python-modules/zopfli/default.nix
+++ b/pkgs/development/python-modules/zopfli/default.nix
@@ -17,6 +17,11 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-qO6ZKyVJ4JDNPwF4v2Bt1Bop4GE6BM31BUIkZixy3OY=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools<72.2.0" "setuptools"
+  '';
+
   build-system = [ setuptools-scm ];
 
   buildInputs = [ zopfli ];

From a6a281823a9daf610ca1dd7b4247d2fde394fda2 Mon Sep 17 00:00:00 2001
From: Tyler Langlois <tjl@byu.net>
Date: Wed, 6 May 2026 15:16:18 -0600
Subject: [PATCH 070/831] libcap: 2.77 -> 2.78

Removes the manually-applied patch for Makefile workaround, included
in the 2.78 release.
---
 pkgs/by-name/li/libcap/package.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/li/libcap/package.nix b/pkgs/by-name/li/libcap/package.nix
index c9c5813a16c1..19dc58048530 100644
--- a/pkgs/by-name/li/libcap/package.nix
+++ b/pkgs/by-name/li/libcap/package.nix
@@ -3,7 +3,6 @@
   lib,
   buildPackages,
   fetchurl,
-  fetchpatch,
   runtimeShell,
   pkgsBuildHost,
   usePam ? !isStatic,
@@ -31,11 +30,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.77";
+  version = "2.78";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    hash = "sha256-iXvBi0Svwmxw54zq09uzHhVKzCS+4IWloJB5qI2/b1I=";
+    hash = "sha256-DWIeVi/ZMsz2e5Zg+wGORopoPXuCdUHfJ4EyKMmWuxE=";
   };
 
   outputs = [
@@ -76,13 +75,6 @@ stdenv.mkDerivation rec {
     "LIBCSTATIC=yes"
   ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://git.kernel.org/pub/scm/libs/libcap/libcap.git/patch/?id=d628b3bfe40338d4efff6b0ae50f250a0eb884c7";
-      hash = "sha256-Eiv/BOJZkduL+hOEJd8K1LQd9wvOeCKchE2GaLcerVc=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs ./progs/mkcapshdoc.sh
 

From 2bb9b3d1669a9bd7c6425c84da9732759c7bedb0 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 8 May 2026 15:55:03 +0200
Subject: [PATCH 071/831] gnutls: remove unused inputs

You can tell it doesn't autoreconf, because if you apply a patch that
forces it to, it refuses because 2.6.9 is too old.
---
 pkgs/by-name/gn/gnutls/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/by-name/gn/gnutls/package.nix b/pkgs/by-name/gn/gnutls/package.nix
index aba0f7388bb2..a56c842c68da 100644
--- a/pkgs/by-name/gn/gnutls/package.nix
+++ b/pkgs/by-name/gn/gnutls/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  buildPackages,
   fetchurl,
   zlib,
   libtasn1,
@@ -9,7 +8,6 @@
   pkg-config,
   perl,
   gmp,
-  automake,
   libidn2,
   libiconv,
   texinfo,
@@ -170,10 +168,6 @@ stdenv.mkDerivation rec {
     pkg-config
     texinfo
   ]
-  ++ [
-    buildPackages.autoconf269
-    automake
-  ]
   ++ lib.optionals doCheck [
     which
     net-tools

From 9fafdc761f765fd292105a2050be9c6fe279eade Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 8 May 2026 00:22:14 +0200
Subject: [PATCH 072/831] Reapply "nodejs_24: fix majorVersion check"

This reverts commit 99a42f0985699d53321dec8877b246c102381fe2.
---
 pkgs/development/web/nodejs/nodejs.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index b89c24b6cc87..36f8b1feb0d3 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -130,9 +130,9 @@ let
 
   useSharedAdaAndSimd = lib.versionAtLeast version "22.2";
   useSharedGtestAndHistogram = lib.versionAtLeast version (
-    if majorVersion == 24 then "24.14.0" else "25.4"
+    if majorVersion == "24" then "24.14.0" else "25.4"
   );
-  useSharedNBytes = lib.versionAtLeast version (if majorVersion == 24 then "24.14.0" else "25.5");
+  useSharedNBytes = lib.versionAtLeast version (if majorVersion == "24" then "24.14.0" else "25.5");
   useSharedLief = lib.versionAtLeast version "25.6";
   useSharedMerve = lib.versionAtLeast version (if majorVersion == 24 then "24.14.0" else "25.6.1");
   useSharedSQLite = lib.versionAtLeast version "22.5";

From 02d2fdd686118eed0091ea82b41310dc74e571fd Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Tue, 28 Apr 2026 21:53:45 +0200
Subject: [PATCH 073/831] openapv: 0.2.1.2 -> 0.2.1.3

changelog: https://github.com/AcademySoftwareFoundation/openapv/releases/tag/v0.2.1.3-fix

diff: https://github.com/AcademySoftwareFoundation/openapv/compare/v0.2.1.2...v0.2.1.3-fix
---
 pkgs/by-name/op/openapv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/openapv/package.nix b/pkgs/by-name/op/openapv/package.nix
index b153552d6f17..27d31127a004 100644
--- a/pkgs/by-name/op/openapv/package.nix
+++ b/pkgs/by-name/op/openapv/package.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openapv";
-  version = "0.2.1.2";
+  version = "0.2.1.3";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openapv";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-wxncN7j5p0GXpWhOx4Ix0oTgGK2sIrfJgQ45fFwmQBI=";
+    tag = "v${finalAttrs.version}-fix"; # Remove the `-fix` suffix after the next version
+    hash = "sha256-lc/x2dWh6T8c63siHB32ka+SPVYTTyaO4YrQ12EbGqw=";
   };
 
   postPatch = ''

From d37588dfa3c8eb4d90c07d8b6b429c75a90d4019 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 8 May 2026 20:00:21 +0000
Subject: [PATCH 074/831] doxygen: 1.16.1 -> 1.17.0

---
 pkgs/by-name/do/doxygen/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/doxygen/package.nix b/pkgs/by-name/do/doxygen/package.nix
index eb701a89dc89..9ab45d795aa9 100644
--- a/pkgs/by-name/do/doxygen/package.nix
+++ b/pkgs/by-name/do/doxygen/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doxygen";
-  version = "1.16.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "doxygen";
     repo = "doxygen";
     tag = "Release_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-MszJpYdXaC8BYK1lSV1LpJncKN1LrFoyJXZajpz0HIA=";
+    hash = "sha256-SSq/sFB9y2CFMeL58vgcHa2ulo+tPPUGT347ABoHoD4=";
   };
 
   # https://github.com/doxygen/doxygen/issues/10928#issuecomment-2179320509

From 4cdf41c344968cf9f49cfcf46f71dab1c4586475 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?=
 =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?=
 =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= <regime_skylark.0y@icloud.com>
Date: Thu, 7 May 2026 18:00:15 -0400
Subject: [PATCH 075/831] libfyaml: patch for C11 atomics detection and macros

---
 pkgs/by-name/li/libfyaml/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/li/libfyaml/package.nix b/pkgs/by-name/li/libfyaml/package.nix
index ebbaae3748d8..26cc0461020b 100644
--- a/pkgs/by-name/li/libfyaml/package.nix
+++ b/pkgs/by-name/li/libfyaml/package.nix
@@ -25,6 +25,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/pantoniou/libfyaml/commit/0982fcefc6a16d4c8cb5b06747d3fc8e630de3ae.diff";
       hash = "sha256-aDubIn+et+1fWE7XU7a5AGZVacVFbAbC1PoSDrA6hXw=";
     })
+    # backport "Fix C11 atomics detection and buggy macros for C++ compatibility"
+    (fetchpatch {
+      url = "https://github.com/pantoniou/libfyaml/commit/1026d76850909dc9b1c5f95b8cd94e865a313fd5.diff";
+      hash = "sha256-0YfOqdqHdELFMqr52TDAC3BNFLkcuxvuJY5b9yZ7NFk=";
+    })
     (fetchpatch {
       url = "https://github.com/pantoniou/libfyaml/commit/9192deaac095f9881cc1e5756dede683f36b09d6.diff";
       hash = "sha256-cNL9wQtxIRg/ShZLJP4qHYNFRrYo9kRG+/U+3FiUeaI=";

From 6cf5d0644f4b3dc950fe87c9d61682f049bade27 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 9 May 2026 00:40:55 +0000
Subject: [PATCH 076/831] libedit: 20251016-3.1 -> 20260508-3.1

---
 pkgs/by-name/li/libedit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libedit/package.nix b/pkgs/by-name/li/libedit/package.nix
index 30a316d0074d..11712e641d99 100644
--- a/pkgs/by-name/li/libedit/package.nix
+++ b/pkgs/by-name/li/libedit/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libedit";
-  version = "20251016-3.1";
+  version = "20260508-3.1";
 
   src = fetchurl {
     url = "https://thrysoee.dk/editline/libedit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ITYrAGU7v8HHH3GnV42ma1tSA1WdQxNNLddxnjE84EE=";
+    hash = "sha256-kfQtZXHdjZL67dE0ETTOWrygxdC0s1KBQYbTPysRJy4=";
   };
 
   outputs = [

From 00b0ebee830ecfdb7d54efef0d57b07bd78ab2d6 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 9 May 2026 22:46:35 +0100
Subject: [PATCH 077/831] dash: 0.5.13.3 -> 0.5.13.4

Changes: https://git.kernel.org/pub/scm/utils/dash/dash.git/log/?h=v0.5.13.4
---
 pkgs/by-name/da/dash/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/da/dash/package.nix b/pkgs/by-name/da/dash/package.nix
index eb5da071f472..ada4d8812cb9 100644
--- a/pkgs/by-name/da/dash/package.nix
+++ b/pkgs/by-name/da/dash/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.13.3";
+  version = "0.5.13.4";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qDcnwSmaxMPZ1Dl5OTs6TrACddVjauAlJueXnVHW+9E=";
+    hash = "sha256-0Q39Qc2lkWVWDbOcqRXCxKdjb/8EKB2NLfd62Sx1Pis=";
   };
 
   strictDeps = true;

From 5e1b98759ee1c37fd8e516cae6779581f758dd47 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 10 May 2026 10:34:45 +0100
Subject: [PATCH 078/831] yara: fix the hash

Without the change `staging` fails as:

```
$ nix build github:NixOS/nixpkgs/staging#yara.src
error: hash mismatch in fixed-output derivation '/nix/store/b4i6zf2vr4qvjkjy5sgbayia2iqxz491-source.drv':
         specified: sha256-G1f0o7wsds4Mz4Whz35JdSKIkPIqea5Fe5rB8vMdkZU=
            got:    sha256-vzYH56BC0Stb2I4U5VzxA0xG46xZkWmbTIC6BtzeNQ8=
error: build of resolved derivation '/nix/store/b4i6zf2vr4qvjkjy5sgbayia2iqxz491-source.drv' failed
```
---
 pkgs/by-name/ya/yara/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ya/yara/package.nix b/pkgs/by-name/ya/yara/package.nix
index 905561b69435..1200538d3211 100644
--- a/pkgs/by-name/ya/yara/package.nix
+++ b/pkgs/by-name/ya/yara/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "VirusTotal";
     repo = "yara";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G1f0o7wsds4Mz4Whz35JdSKIkPIqea5Fe5rB8vMdkZU=";
+    hash = "sha256-vzYH56BC0Stb2I4U5VzxA0xG46xZkWmbTIC6BtzeNQ8=";
   };
 
   nativeBuildInputs = [

From 32f67f000b22d422e36befbbabd36279e2a660a2 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sun, 10 May 2026 15:19:19 +0200
Subject: [PATCH 079/831] openexr: 3.4.10 -> 3.4.11

changelog: https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.11

diff: https://github.com/AcademySoftwareFoundation/openexr/compare/v3.4.10...v3.4.11
---
 pkgs/development/libraries/openexr/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index 11d5c376c025..f81d46c321ef 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.4.10";
+  version = "3.4.11";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-jXio+PvagKTR8NjcYIQ/j8LOMNc/0sQBuaixKk/0V3k=";
+    hash = "sha256-5dx2tag6XyuJfNfJgc68X+VWKXaHOL3M7ZJEQbQwFDA=";
   };
 
   outputs = [

From 04928a618027c1780f162aab5880d304d2c356bc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 10 May 2026 17:02:06 +0200
Subject: [PATCH 080/831] python314: 3.14.4 -> 3.14.5

https://docs.python.org/release/3.14.5/whatsnew/changelog.html

Fixes: CVE 2026-3219
---
 ...hacl-static-ldeps-for-static-modules.patch | 50 -------------------
 .../interpreters/python/cpython/default.nix   |  5 --
 .../interpreters/python/default.nix           |  4 +-
 3 files changed, 2 insertions(+), 57 deletions(-)
 delete mode 100644 pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch

diff --git a/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch b/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch
deleted file mode 100644
index 8501ab38a940..000000000000
--- a/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From ee1b8479cff97ca7e5ed4d51d6aa24ccb47deb8b Mon Sep 17 00:00:00 2001
-From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-Date: Sat, 21 Mar 2026 18:34:50 -0400
-Subject: [PATCH] gh-146264: Use static HACL deps for static module builds
-
----
- .../next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst  | 3 +++
- configure                                                      | 2 +-
- configure.ac                                                   | 2 +-
- 3 files changed, 5 insertions(+), 2 deletions(-)
- create mode 100644 Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
-
-diff --git a/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst b/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
-new file mode 100644
-index 00000000000..1fdafe56043
---- /dev/null
-+++ b/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
-@@ -0,0 +1,3 @@
-+Fix static module builds on non-WASI targets by linking HACL dependencies as
-+static libraries when ``MODULE_BUILDTYPE=static``, preventing duplicate
-+``_Py_LibHacl_*`` symbol errors at link time.
-diff --git a/configure b/configure
-index 23f24d51c79..db5c861f601 100755
---- a/configure
-+++ b/configure
-@@ -33009,7 +33009,7 @@ fi
- 
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for HACL* library linking type" >&5
- printf %s "checking for HACL* library linking type... " >&6; }
--if test "$ac_sys_system" = "WASI"; then
-+if test "$ac_sys_system" = "WASI" || test "$MODULE_BUILDTYPE" = "static"; then
-   LIBHACL_LDEPS_LIBTYPE=STATIC
-   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: static" >&5
- printf "%s\n" "static" >&6; }
-diff --git a/configure.ac b/configure.ac
-index 635fce3f2e6..59166d63e63 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -8171,7 +8171,7 @@ AC_SUBST([LIBHACL_BLAKE2_SIMD256_OBJS])
- # HACL*-based cryptographic primitives
- 
- AC_MSG_CHECKING([for HACL* library linking type])
--if test "$ac_sys_system" = "WASI"; then
-+if test "$ac_sys_system" = "WASI" || test "$MODULE_BUILDTYPE" = "static"; then
-   LIBHACL_LDEPS_LIBTYPE=STATIC
-   AC_MSG_RESULT([static])
- else
--- 
-2.53.0
-
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index a4149eeeb8af..e674de90810f 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -427,11 +427,6 @@ stdenv.mkDerivation (finalAttrs: {
     # backport fix for https://github.com/python/cpython/issues/95855
     ./platform-triplet-detection.patch
   ]
-  ++ optionals (pythonAtLeast "3.14" && pythonOlder "3.15") [
-    # https://github.com/python/cpython/issues/146264
-    # https://github.com/python/cpython/pull/146265
-    ./3.14/hacl-static-ldeps-for-static-modules.patch
-  ]
   ++ optionals (version == "3.13.10" || version == "3.14.1") [
     # https://github.com/python/cpython/issues/142218
     ./${lib.versions.majorMinor version}/gh-142218.patch
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 11a150d78506..1e70883b03a2 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -79,10 +79,10 @@
       sourceVersion = {
         major = "3";
         minor = "14";
-        patch = "4";
+        patch = "5";
         suffix = "";
       };
-      hash = "sha256-2SPFEwPjjiSRNvwb3zVo1W7LAyFO/e9IUWF209f6rvg=";
+      hash = "sha256-fjJZe5nl2aOavtNd5Gk/oWnfPlhQ1MM0M3/9ahmjbbY=";
       inherit passthruFun;
     };
 

From 194e729c3a36c371590d4f3f6f8d610253f75da2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 10 May 2026 17:05:43 +0200
Subject: [PATCH 081/831] cpython: kill dead code

---
 pkgs/development/interpreters/python/cpython/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index e674de90810f..ab24113d07ab 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -133,7 +133,6 @@ let
     getLib
     optionals
     optionalString
-    replaceStrings
     ;
 
   withLibxcrypt =
@@ -427,10 +426,6 @@ stdenv.mkDerivation (finalAttrs: {
     # backport fix for https://github.com/python/cpython/issues/95855
     ./platform-triplet-detection.patch
   ]
-  ++ optionals (version == "3.13.10" || version == "3.14.1") [
-    # https://github.com/python/cpython/issues/142218
-    ./${lib.versions.majorMinor version}/gh-142218.patch
-  ]
   ++ optionals (stdenv.hostPlatform.isMinGW) (
     let
       # https://src.fedoraproject.org/rpms/mingw-python3

From 778a572c94d6f2d89b83f4aa2b6fa902633eb9dd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 10 May 2026 22:55:29 +0000
Subject: [PATCH 082/831] prek: 0.3.11 -> 0.3.13

---
 pkgs/by-name/pr/prek/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 32b40a198cfd..4f4920e06410 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.3.11";
+  version = "0.3.13";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Vd4XmO+Z0Zs5kE/PMesnr6q+JUz+DGXWKVoHsPZPKwM=";
+    hash = "sha256-OPH1H571jw0b8EsyzRcVdG54sQ7KeOclmnHCeVGteRI=";
   };
 
-  cargoHash = "sha256-AggCANaSMeKftOlan8TpgLgpYgaLCpYBBbBOeLKCCVo=";
+  cargoHash = "sha256-lvB09qOvVXmSdhR1TRJQ3rvYyn6cFSOGpogJZDajPuQ=";
 
   nativeBuildInputs = [
     installShellFiles

From 4ed3b8cbf6e463ee73eecfe45e5adea72985492e Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 11 May 2026 09:00:04 +0200
Subject: [PATCH 083/831] spandsp3: fix test failure on musl

(Due to a buffer overrun affecting all platforms.)
---
 pkgs/development/libraries/spandsp/3.nix      |  5 ++++
 .../Fix-buffer-overrun-in-t85-tests.patch     | 29 +++++++++++++++++++
 2 files changed, 34 insertions(+)
 create mode 100644 pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch

diff --git a/pkgs/development/libraries/spandsp/3.nix b/pkgs/development/libraries/spandsp/3.nix
index 5a7f0005a407..3d10c91e4b4e 100644
--- a/pkgs/development/libraries/spandsp/3.nix
+++ b/pkgs/development/libraries/spandsp/3.nix
@@ -12,6 +12,11 @@
     rev = "6ec23e5a7e411a22d59e5678d12c4d2942c4a4b6"; # upstream does not seem to believe in tags
     sha256 = "03w0s99y3zibi5fnvn8lk92dggfgrr0mz5255745jfbz28b2d5y7";
   };
+
+  patches = [
+    # https://github.com/freeswitch/spandsp/pull/120
+    ./Fix-buffer-overrun-in-t85-tests.patch
+  ];
 }).overrideAttrs
   (
     finalAttrs: previousAttrs: {
diff --git a/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch b/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch
new file mode 100644
index 000000000000..de78212f7379
--- /dev/null
+++ b/pkgs/development/libraries/spandsp/Fix-buffer-overrun-in-t85-tests.patch
@@ -0,0 +1,29 @@
+From bc1c899fa1b6746d430f7b3d7ee288506d50441a Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Mon, 11 May 2026 08:51:29 +0200
+Subject: [PATCH] Fix buffer overrun in t85 tests
+
+The variable length tests involve reading an extra row from
+test_image, which would previously read past the end of test_image.
+
+Identified with fortify-headers.
+---
+ tests/t85_tests.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/t85_tests.c b/tests/t85_tests.c
+index 436dfca..671ee6c 100644
+--- a/tests/t85_tests.c
++++ b/tests/t85_tests.c
+@@ -55,7 +55,7 @@ in ITU specifications T.85.
+ #include "spandsp.h"
+ 
+ #define TESTBUF_SIZE        400000
+-#define TEST_IMAGE_SIZE     (1951*1960/8)
++#define TEST_IMAGE_SIZE     (1952*1960/8)
+ 
+ uint8_t testbuf[TESTBUF_SIZE];
+ uint8_t test_image[TEST_IMAGE_SIZE];
+-- 
+2.53.0
+

From f97af3c9f75fea16d1a022937633cc75deda12d6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 11 May 2026 11:17:01 +0000
Subject: [PATCH 084/831] libgpg-error: 1.59 -> 1.61

---
 pkgs/by-name/li/libgpg-error/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libgpg-error/package.nix b/pkgs/by-name/li/libgpg-error/package.nix
index 0b933048fc0e..c086abb3c806 100644
--- a/pkgs/by-name/li/libgpg-error/package.nix
+++ b/pkgs/by-name/li/libgpg-error/package.nix
@@ -25,11 +25,11 @@ in
 stdenv.mkDerivation (
   rec {
     pname = "libgpg-error";
-    version = "1.59";
+    version = "1.61";
 
     src = fetchurl {
       url = "mirror://gnupg/libgpg-error/libgpg-error-${version}.tar.bz2";
-      hash = "sha256-oZvFCH/ZcCbZPLS0XVFjjRolICpeH7w5BXmfQkz6YTQ=";
+      hash = "sha256-eoVBPyvDVPT4qoMrcYrxIuSJZeng65AS7mWcE8Y4XJM=";
     };
 
     postPatch = ''

From b78dd5d217924d72cb1e058422e01a0f43714c1a Mon Sep 17 00:00:00 2001
From: Birdee <85372418+BirdeeHub@users.noreply.github.com>
Date: Sun, 10 May 2026 16:47:11 -0700
Subject: [PATCH 085/831] luaPackages.luarocks_bootstrap: properly configure
 luarocks to set LUA_LIBDIR

---
 pkgs/development/tools/misc/luarocks/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 9ad31b6e78cd..10a1ff3b4699 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -58,6 +58,10 @@ stdenv.mkDerivation (finalAttrs: {
     if test -n "$lua_inc"; then
         appendToVar configureFlags "--with-lua-include=$lua_inc"
     fi
+    lua_lib="${lua}/lib"
+    if test -d "$lua_lib"; then
+        appendToVar configureFlags "--with-lua-lib=$lua_lib"
+    fi
   '';
 
   nativeBuildInputs = [

From 3803be5263c98b9e52d0e6f791272137f5e1e193 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 11 Apr 2026 21:47:48 +0100
Subject: [PATCH 086/831] simdjson: 4.6.0 -> 4.6.4

Changes:
- https://github.com/simdjson/simdjson/releases/tag/v4.6.1
- https://github.com/simdjson/simdjson/releases/tag/v4.6.2
- https://github.com/simdjson/simdjson/releases/tag/v4.6.3
- https://github.com/simdjson/simdjson/releases/tag/v4.6.4
---
 pkgs/by-name/si/simdjson/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/si/simdjson/package.nix b/pkgs/by-name/si/simdjson/package.nix
index e1cc6c566ebb..44942f163cab 100644
--- a/pkgs/by-name/si/simdjson/package.nix
+++ b/pkgs/by-name/si/simdjson/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simdjson";
-  version = "4.6.0";
+  version = "4.6.4";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VGErBWAHk63XMv8yC+Na+gXHByhYhtIEMSBySwIDlXk=";
+    hash = "sha256-8oQzsR7DSaNTN9su1uI9tRQ9HvOwXShPwSrnQj8+lGM=";
   };
 
   nativeBuildInputs = [ cmake ];

From fe1ca2c575fa37169ccb114ffc9a5581aa44860d Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 11 May 2026 17:42:53 -0400
Subject: [PATCH 087/831] expat: 2.8.0 -> 2.8.1

Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes
Diff: https://github.com/libexpat/libexpat/compare/R_2_8_0...R_2_8_1

Fixes: CVE-2026-45186
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index cf55e71a2037..78ff9e9253b0 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.8.0";
+  version = "2.8.1";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-o3v64KqXdb2FIevYXcRW1Ibw/zETj2yR/ZAupzJiRUI=";
+    hash = "sha256-ELGV7ngWCpCDiBgKj+NgPU6aEvR1X79fOBayOp11DaA=";
   };
 
   strictDeps = true;

From 18366e70a82125a938b33f5eceaafd762c768768 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 11 May 2026 23:01:12 +0100
Subject: [PATCH 088/831] gdb: 17.1 -> 17.2

Changes: https://www.sourceware.org/gdb/download/ANNOUNCEMENT
---
 pkgs/by-name/gd/gdb/package.nix | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/gd/gdb/package.nix b/pkgs/by-name/gd/gdb/package.nix
index 361ad20350b4..0199d4ad285c 100644
--- a/pkgs/by-name/gd/gdb/package.nix
+++ b/pkgs/by-name/gd/gdb/package.nix
@@ -5,7 +5,6 @@
 
   # Build time
   fetchurl,
-  fetchpatch,
   pkg-config,
   perl,
   texinfo,
@@ -66,11 +65,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "17.1";
+  version = "17.2";
 
   src = fetchurl {
     url = "mirror://gnu/gdb/gdb-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FJlvX3TJ9o9aVD/cRbyngAIH+R+SrupsLnkYIsfG2HY=";
+    hash = "sha256-HANsDXLks9H7XJTIhjKt1vnXb018TS6nk8EqnxmjIow=";
   };
 
   postPatch =
@@ -88,17 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./debug-info-from-env.patch
-
-    (fetchurl {
-      name = "musl.patch";
-      url = "https://inbox.sourceware.org/gdb-patches/20260324164527.1446549-2-sunilkumar.dora@windriver.com/raw";
-      hash = "sha256-FC4DDVS4wtE/HXtbUqvkxu9+e7nE3DYi1zIuQP9yQO8=";
-    })
-    (fetchpatch {
-      name = "musl-aarch64.patch";
-      url = "https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=1ccc3f6a2e28fa1f3357826374cba165b3ba3ff7";
-      hash = "sha256-Q2oTo2b+9yNN3PSsxqgxV4/9/05uFE/JMLe1CPs9Y7I=";
-    })
   ]
   ++ optionals stdenv.hostPlatform.isDarwin [
     ./darwin-target-match.patch

From 00cd8e646c7da669125ae26acf4b47079826e1f0 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas.gerbet@3ds.com>
Date: Tue, 12 May 2026 13:58:14 +0200
Subject: [PATCH 089/831] libcaca: apply patch for CVE-2026-42046

Fixes https://github.com/NixOS/nixpkgs/issues/519387
---
 pkgs/by-name/li/libcaca/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/li/libcaca/package.nix b/pkgs/by-name/li/libcaca/package.nix
index 689257d7ff8e..d233cdabfe87 100644
--- a/pkgs/by-name/li/libcaca/package.nix
+++ b/pkgs/by-name/li/libcaca/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   imlib2,
   libxext,
@@ -23,6 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-N0Lfi0d4kjxirEbIjdeearYWvStkKMyV6lgeyNKXcVw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-42046.patch";
+      url = "https://github.com/cacalabs/libcaca/commit/fb77acff9ba6bb01d53940da34fb10f20b156a23.patch";
+      hash = "sha256-AdpiE5Gw/CVET//7TTYZCb0glW5HY+T8xZkYs1XCBvY=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

From 1860b778a5a8abe503b0f6098d292514bc8560ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?=
 =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?=
 =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= <regime_skylark.0y@icloud.com>
Date: Tue, 12 May 2026 07:24:24 -0400
Subject: [PATCH 090/831] libfyaml: fixing pflag mismatched intention

the assumption of the code is that if there are no lib flags set, then
just use the fallback of lpthread.

BUT! The way libSystem passes to it nothing because it's trying to
communicate that it's taking care of it using PTHREAD_CFLAGS. It leads
to this weird situation where both are passed!
---
 pkgs/by-name/li/libfyaml/package.nix          |  4 ++++
 pkgs/by-name/li/libfyaml/pthread-darwin.patch | 12 ++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/by-name/li/libfyaml/pthread-darwin.patch

diff --git a/pkgs/by-name/li/libfyaml/package.nix b/pkgs/by-name/li/libfyaml/package.nix
index 26cc0461020b..7a7e5dc089c6 100644
--- a/pkgs/by-name/li/libfyaml/package.nix
+++ b/pkgs/by-name/li/libfyaml/package.nix
@@ -34,6 +34,10 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/pantoniou/libfyaml/commit/9192deaac095f9881cc1e5756dede683f36b09d6.diff";
       hash = "sha256-cNL9wQtxIRg/ShZLJP4qHYNFRrYo9kRG+/U+3FiUeaI=";
     })
+    # On Darwin, AX_PTHREAD returns empty PTHREAD_LIBS with -pthread in PTHREAD_CFLAGS;
+    # don't force -lpthread when PTHREAD_CFLAGS already provides pthread support.
+    # Pending PR: https://github.com/pantoniou/libfyaml/pull/294
+    ./pthread-darwin.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libfyaml/pthread-darwin.patch b/pkgs/by-name/li/libfyaml/pthread-darwin.patch
new file mode 100644
index 000000000000..bada0d80d142
--- /dev/null
+++ b/pkgs/by-name/li/libfyaml/pthread-darwin.patch
@@ -0,0 +1,12 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -99,6 +99,7 @@
+ AX_PTHREAD([], [AC_MSG_ERROR("Missing required pthread support")])
+ 
+-# in some cases PTHREAD_LIBS is empty - force -lpthread */
+-if test "x$PTHREAD_LIBS" = "x"; then
++# In some cases PTHREAD_LIBS is empty; force -lpthread only when PTHREAD_CFLAGS
++# also provides no pthread support (e.g. on Darwin, -pthread in CFLAGS suffices).
++if test "x$PTHREAD_LIBS" = "x" && test "x$PTHREAD_CFLAGS" = "x"; then
+ 	PTHREAD_LIBS="-lpthread"
+ fi

From 59edd93aa956ce3b5ec85c492bbc70c3fc932fa7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?=
 =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?=
 =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= <regime_skylark.0y@icloud.com>
Date: Tue, 12 May 2026 10:03:46 -0400
Subject: [PATCH 091/831] libfyaml: patch for libm "none required" issues

---
 pkgs/by-name/li/libfyaml/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/li/libfyaml/package.nix b/pkgs/by-name/li/libfyaml/package.nix
index 7a7e5dc089c6..4804f7bb9645 100644
--- a/pkgs/by-name/li/libfyaml/package.nix
+++ b/pkgs/by-name/li/libfyaml/package.nix
@@ -38,6 +38,16 @@ stdenv.mkDerivation (finalAttrs: {
     # don't force -lpthread when PTHREAD_CFLAGS already provides pthread support.
     # Pending PR: https://github.com/pantoniou/libfyaml/pull/294
     ./pthread-darwin.patch
+
+    # backport "build: don't output 'none required' to LIBM if no linker flags needed for it"
+    (fetchpatch {
+      url = "https://github.com/pantoniou/libfyaml/commit/24b18e7363b336962fe160c1dc05ca57ba95783c.diff";
+      hash = "sha256-g5QKI4HuS8MEQ9ddIQNC0j+28Dh9zLAp5RaZX5SWBHk=";
+    })
+    (fetchpatch {
+      url = "https://github.com/pantoniou/libfyaml/commit/9f2492ca27bb1fda64f2b12edc2da17406208b93.diff";
+      hash = "sha256-E4wS+P7R3VGrBpD7swWMMi/QPTF+9rzAeEyxhbmdiwk=";
+    })
   ];
 
   nativeBuildInputs = [

From 37cad8f4e382617c3a98aa5af8b1efb4acac5e81 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 12 May 2026 15:40:54 +0000
Subject: [PATCH 092/831] catch2_3: 3.14.0 -> 3.15.0

---
 pkgs/by-name/ca/catch2_3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/catch2_3/package.nix b/pkgs/by-name/ca/catch2_3/package.nix
index 525a410dbcba..4c931652b666 100644
--- a/pkgs/by-name/ca/catch2_3/package.nix
+++ b/pkgs/by-name/ca/catch2_3/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     tag = "v${version}";
-    hash = "sha256-tegAa+cNF7pJcW33B+VZ86ZlDG7dwS3o6QnN/XvTI2A=";
+    hash = "sha256-1GBzS8jgJXb82BMMRuHWqszB1Xwg6wohmCuINWE7QoU=";
   };
 
   patches = lib.optionals stdenv.cc.isClang [

From b2e8b0c6028f84faa0cf2b959732f30591c7f18f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 12 May 2026 18:27:09 +0200
Subject: [PATCH 093/831] Revert "groff: only apply the latest patch on linux
 for now"

This reverts commit 37a9427fd325fd4f815f4717a6280a7b076a173f.
---
 pkgs/by-name/gr/groff/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/groff/package.nix b/pkgs/by-name/gr/groff/package.nix
index a824d9a82f02..083b1493dcf6 100644
--- a/pkgs/by-name/gr/groff/package.nix
+++ b/pkgs/by-name/gr/groff/package.nix
@@ -48,8 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-dOKBl5W2r/QxrqyYPWOpyJaO6roqLrp9+LpMe0Hnz9g=";
   };
 
-  patches = lib.optionals stdenv.isLinux [
-    # TODO: apply everywhere on rebuild
+  patches = [
     # This revert a upstream refactor in continuous rendering mode, but this
     # causes a big performance regression for big manpages like
     # `man 5 configuration.nix`.

From 5198c49a5a58932c1a782aee9ad2fd6509f935e1 Mon Sep 17 00:00:00 2001
From: Ruud van Asseldonk <dev@ruuda.nl>
Date: Tue, 12 May 2026 19:03:20 +0200
Subject: [PATCH 094/831] libressl_4_3: backport executable stack fix

And also add an additional check to preCheck that will enable us to
catch executable stack issues earlier next time.
---
 pkgs/by-name/li/libressl/default.nix | 29 ++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index a4ac4000d452..4ccc79407ba7 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -61,6 +61,22 @@ let
 
       doCheck = !(stdenv.hostPlatform.isPower64 || stdenv.hostPlatform.isRiscV);
       preCheck = ''
+        # Bail if any shared object has executable stack enabled. This can
+        # happen when an object produced from an assmbly file in libcrypto is
+        # missing a .note.GNU-stack section. An executable stack is dangerous
+        # and unintentional, but without this check the derivation will build
+        # and even run if W^X is not enforced; it would fail dangerously.
+        objdump -p **/*.so | awk '
+          BEGIN { res = 0 }
+          /file format/ { file = $1 }
+          /STACK/ { stack = 1; next }
+          stack {
+            if ($0 ~ /flags.*x/) { print file " has executable stack"; res = 1 }
+            stack = 0
+          }
+          END { exit res }
+        '
+
         export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
         export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
       '';
@@ -139,5 +155,18 @@ in
   libressl_4_3 = generic {
     version = "4.3.1";
     hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
+    patches = [
+      # Fix for https://github.com/libressl/portable/issues/1278, where LibreSSL
+      # 4.3 started requiring executable stack because some objects were missing
+      # a .note.GNU-stack section; will probably be included in the next release.
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/libressl/portable/4dae91d056c6c75ba5cf2bc5e6148b8e02239119/patches/gnu-stack.patch";
+        hash = "sha256-Q1oWL4N8w5Zmjfq5QkTJR53NgZ4GqChSDaBicli5G2I=";
+        # This patch is written to be applied with -p0, with no leading path
+        # component, but Nix applies with -p1 by default, so we add it to not
+        # break compatibility with how other patches must be applied.
+        decode = "sed 's|^--- |--- a/|; s|^+++ |+++ b/|'";
+      })
+    ];
   };
 }

From 2b8ed1fe219eb6783afc4081e3ab62e8ee99ee39 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 12 May 2026 22:44:31 +0200
Subject: [PATCH 095/831] audit: 4.1.2-unstable-2025-09-06 -> 4.1.4

Upstream diff: https://github.com/linux-audit/audit-userspace/compare/cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4...v4.1.4

Adds support for io_uring and syscalls of Linux 7.0 kernels.
---
 pkgs/by-name/au/audit/package.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index 197df3501597..3b2389e7843c 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -30,13 +30,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "4.1.2-unstable-2025-09-06"; # fixes to non-static builds right after 4.1.2 release
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "linux-audit";
     repo = "audit-userspace";
-    rev = "cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4";
-    hash = "sha256-NX0TWA+LtcZgbM9aQfokWv2rGNAAb3ksGqAH8URAkYM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GdJ9nzlDAdOazOHH/YWuEoELrJh+G5ZJUKwIqAKAzpo=";
   };
 
   postPatch = ''
@@ -132,10 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Instead, we load audit rules in a dedicated module.
   postFixup = ''
     moveToOutput bin/augenrules $scripts
-    substituteInPlace $scripts/bin/augenrules \
-      --replace-fail "/sbin/auditctl -R" "$bin/bin/auditctl -R" \
-      --replace-fail "auditctl -s" "$bin/bin/auditctl -s" \
-      --replace-fail "/bin/ls" "ls"
     wrapProgram $scripts/bin/augenrules \
       --prefix PATH : ${
         lib.makeBinPath [

From 6c0ee887326898b4baae9a977347ca05b0fde76c Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:37:53 +0300
Subject: [PATCH 096/831] glslang: 16.2.0 -> 16.3.0

Diff: https://github.com/KhronosGroup/glslang/compare/16.2.0...16.3.0
---
 pkgs/by-name/gl/glslang/external-gtest.patch | 69 --------------------
 pkgs/by-name/gl/glslang/package.nix          | 10 +--
 2 files changed, 2 insertions(+), 77 deletions(-)
 delete mode 100644 pkgs/by-name/gl/glslang/external-gtest.patch

diff --git a/pkgs/by-name/gl/glslang/external-gtest.patch b/pkgs/by-name/gl/glslang/external-gtest.patch
deleted file mode 100644
index 3477b7584bfc..000000000000
--- a/pkgs/by-name/gl/glslang/external-gtest.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From ab20ba112e6fa5117bfeadde199fdc6c18cbdfb5 Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Mon, 12 Jan 2026 16:41:53 +0100
-Subject: [PATCH] Look for external gtest build, if not building in-tree
-
----
- CMakeLists.txt        | 12 ++++++++++++
- gtests/CMakeLists.txt |  8 +++-----
- 2 files changed, 15 insertions(+), 5 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 1e7d3ec9..ecda9c53 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -321,6 +321,18 @@ if(ENABLE_GLSLANG_BINARIES)
-     add_subdirectory(StandAlone)
- endif()
- 
-+option(ALLOW_EXTERNAL_GTEST "Allows to build against installed googletest. This is unsupported if the commit isn't the one in known_good.json")
-+set(GMOCK_TARGET gmock)
-+if(NOT TARGET ${GMOCK_TARGET})
-+    if(ALLOW_EXTERNAL_GTEST)
-+        message(STATUS "Trying to find local googletest")
-+        find_package(GTest)
-+        if(TARGET GTest::gmock)
-+            set(GMOCK_TARGET GTest::gmock)
-+        endif()
-+    endif()
-+endif()
-+
- if(GLSLANG_TESTS)
-     enable_testing()
-     add_subdirectory(gtests)
-diff --git a/gtests/CMakeLists.txt b/gtests/CMakeLists.txt
-index 27a5500c..21125775 100644
---- a/gtests/CMakeLists.txt
-+++ b/gtests/CMakeLists.txt
-@@ -32,7 +32,7 @@
- # POSSIBILITY OF SUCH DAMAGE.
- 
- if(GLSLANG_TESTS)
--    if(TARGET gmock)
-+    if(TARGET ${GMOCK_TARGET})
-         message(STATUS "Google Mock found - building tests")
- 
-         set(TEST_SOURCES
-@@ -76,9 +76,7 @@ if(GLSLANG_TESTS)
-                                    PRIVATE GLSLANG_TEST_BUILD=1)
-         target_include_directories(glslangtests PRIVATE
-                                    ${CMAKE_CURRENT_SOURCE_DIR}
--                                   ${PROJECT_SOURCE_DIR}
--                                   ${gmock_SOURCE_DIR}/include
--                                   ${gtest_SOURCE_DIR}/include)
-+                                   ${PROJECT_SOURCE_DIR})
- 
-         if(ENABLE_OPT)
-             target_link_libraries(glslangtests
-@@ -90,7 +88,7 @@ if(GLSLANG_TESTS)
-             glslang glslang-default-resource-limits
-             $<$<AND:$<CXX_COMPILER_ID:GNU>,$<VERSION_LESS:$<CXX_COMPILER_VERSION>,9.0>>:stdc++fs>)
- 
--        target_link_libraries(glslangtests PRIVATE ${LIBRARIES} gmock)
-+        target_link_libraries(glslangtests PRIVATE ${LIBRARIES} ${GMOCK_TARGET})
- 
-         # The TARGET_RUNTIME_DLL_DIRS feature requires CMake 3.27 or greater.
-         if(WIN32 AND BUILD_SHARED_LIBS AND CMAKE_VERSION VERSION_LESS "3.27")
--- 
-2.51.2
-
diff --git a/pkgs/by-name/gl/glslang/package.nix b/pkgs/by-name/gl/glslang/package.nix
index 3af77636355d..0d7fe92908c8 100644
--- a/pkgs/by-name/gl/glslang/package.nix
+++ b/pkgs/by-name/gl/glslang/package.nix
@@ -12,21 +12,15 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "glslang";
-  version = "16.2.0";
+  version = "16.3.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     tag = finalAttrs.version;
-    hash = "sha256-2uWnZZNGdZorHaiLzMb/rpM6bL9oBClKqiFkUH3krJQ=";
+    hash = "sha256-wclcJ0NfqFXSUHGVsxjn2I8XxWbrkzOB4WXqsN1XtmE=";
   };
 
-  patches = [
-    # Allow building against our already-built gtest, without eating a rebuild
-    # https://github.com/KhronosGroup/glslang/pull/4140
-    ./external-gtest.patch
-  ];
-
   outputs = [
     "bin"
     "out"

From b3147b179a9b64b835c6cc6ad88c3dc5021b3739 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:37:57 +0300
Subject: [PATCH 097/831] vulkan-headers: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-Headers/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-headers/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-headers/package.nix b/pkgs/by-name/vu/vulkan-headers/package.nix
index 65d0a32fdfd9..956a3725941a 100644
--- a/pkgs/by-name/vu/vulkan-headers/package.nix
+++ b/pkgs/by-name/vu/vulkan-headers/package.nix
@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-headers";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   # Adding `ninja` here to enable Ninja backend. Otherwise on gcc-14 or
   # later the build fails as:
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-R/t0mAhNX+jREDVIFnv0agB9qtcnRb06K4OHtLRxWow=";
+    hash = "sha256-RcUVurC+Rc0MyWpQLaLVmdn7FZO1GWWzTZZAOwvKwb4=";
   };
 
   passthru.updateScript = ./update.sh;

From c2b36e9c51e7c167e296b0fc9c95968731efefff Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:00 +0300
Subject: [PATCH 098/831] vulkan-loader: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-Loader/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-loader/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-loader/package.nix b/pkgs/by-name/vu/vulkan-loader/package.nix
index a0f31bfc1014..3987debfef12 100644
--- a/pkgs/by-name/vu/vulkan-loader/package.nix
+++ b/pkgs/by-name/vu/vulkan-loader/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-loader";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-OcguNyi1yZ2OMnI2HSrx+pYvk4RHbn6IGZqnYwWGmB0=";
+    hash = "sha256-jgibBetbMpqRJ+OJpJgNxgC6phECewNqtla9CCJj56U=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];

From 353dd30c46cf461890e9903976178e16f6cfff4e Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:05 +0300
Subject: [PATCH 099/831] vulkan-validation-layers: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-ValidationLayers/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-validation-layers/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-validation-layers/package.nix b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
index 5e4834e111a2..432825de08fc 100644
--- a/pkgs/by-name/vu/vulkan-validation-layers/package.nix
+++ b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-validation-layers";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-xUeMqtQ7bR3P50yQN5TXVzCO9Ugp9tUyFMtYnvc3g8s=";
+    hash = "sha256-3qUZP/R29eqTR4IAWH6jBGgmRqE0d1ahcdKbxUOAmTY=";
   };
 
   strictDeps = true;

From f86d7dfdee90d252f21603919561f662a39f3588 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:08 +0300
Subject: [PATCH 100/831] vulkan-tools: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-Tools/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-tools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-tools/package.nix b/pkgs/by-name/vu/vulkan-tools/package.nix
index 826602ba462e..f6bbd8c69f5b 100644
--- a/pkgs/by-name/vu/vulkan-tools/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-+5BL28h7+r+mLr1Tr7UT4UEB8jRrIc2JwoasJ7HzxI0=";
+    hash = "sha256-qtEq1ZQT5JXE4bXzy8W053CRF/dOFVV7d7NE9uNYssI=";
   };
 
   patches = [ ./wayland-scanner.patch ];

From de214862bb241fe227fb8f3993afcadcc1a41c14 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:12 +0300
Subject: [PATCH 101/831] vulkan-tools-lunarg: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/LunarG/VulkanTools/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-tools-lunarg/package.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
index 89c59d98e8e2..7ccc9cfa11cc 100644
--- a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-tools-lunarg";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "VulkanTools";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-y/xTeEBjhDBlB0qcWUe159SvsRa5tBLUy6FZSmupQsU=";
+    hash = "sha256-tKt/OrGIVfg2/aK9dYPuOB4+05ayUheP9T7Ny5MfWTk=";
   };
 
   nativeBuildInputs = [
@@ -61,7 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxcb-keysyms
     libxcb-wm
     qt6.qtbase
-    qt6.qtwayland
   ];
 
   cmakeFlags = [

From 8924c245e7e8c9ae432e405038eb778022e2eb20 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:16 +0300
Subject: [PATCH 102/831] vulkan-extension-layer: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-ExtensionLayer/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-extension-layer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-extension-layer/package.nix b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
index 1be76857c00f..eb36c08cf7ce 100644
--- a/pkgs/by-name/vu/vulkan-extension-layer/package.nix
+++ b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-extension-layer";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-Qj2sZ9O3WNDb7thv5PzWmONIKBO6hXwz0wQ0PobFgvg=";
+    hash = "sha256-6ZtPp6OqzzppmijIU1/77qcUvwCck/eMZOUh5pSwVc8=";
   };
 
   nativeBuildInputs = [

From e494c9581f738b7ec34c1e972308a5226ab557d8 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:19 +0300
Subject: [PATCH 103/831] vulkan-utility-libraries: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/Vulkan-Utility-Libraries/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-utility-libraries/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
index b6f8c7ff3e5b..2ea2fc62a0be 100644
--- a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
+++ b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-QB9U7Nj2jRTYlHql/qUuwpWoEQ+/T/cVYvs+zKXUUfw=";
+    hash = "sha256-E0T5eSI30eDB7//6srjwlkX9HfUp1UiyCPWDyK+ZEi8=";
   };
 
   nativeBuildInputs = [

From b0cff5e20f3598e0bf581ab2942614bb49a69d00 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:39:35 +0300
Subject: [PATCH 104/831] spirv-cross: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/SPIRV-Cross/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0

Changelog: https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/vulkan-sdk-1.4.350.0
---
 pkgs/by-name/sp/spirv-cross/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-cross/package.nix b/pkgs/by-name/sp/spirv-cross/package.nix
index 81ba6c313fa8..ed353a8f884a 100644
--- a/pkgs/by-name/sp/spirv-cross/package.nix
+++ b/pkgs/by-name/sp/spirv-cross/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-F3/j2+B/qv3sDiOiOy1OhR9G+DnM7I4LJqljZXL4S7Q=";
+    hash = "sha256-JdVAS5uVSfe0mOGtyodkgmvgD4of9Amq8PbDSAtgaXc=";
   };
 
   nativeBuildInputs = [

From c832986da6f651660d271194dad9f951c1719fa9 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:22 +0300
Subject: [PATCH 105/831] vulkan-volk: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/zeux/volk/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/vu/vulkan-volk/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vu/vulkan-volk/package.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
index 52ae5b0de349..613867ceee19 100644
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "volk";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-jAXUwejUJGc8H+2lDGLHIlrI0sdzQbnJ+ZNbZHYdFX8=";
+    hash = "sha256-7JsOWhMTnxeJfsTVgnnHQt5gYJ8tqELT+s3VDHTPof8=";
   };
 
   nativeBuildInputs = [ cmake ];

From ea3998dd4348525ca588cb7ffa797b57f8457ba6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:39:40 +0300
Subject: [PATCH 106/831] spirv-tools: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/SPIRV-Tools/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/sp/spirv-tools/package.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-tools/package.nix b/pkgs/by-name/sp/spirv-tools/package.nix
index e08ae33d33e6..16a2bdef93e7 100644
--- a/pkgs/by-name/sp/spirv-tools/package.nix
+++ b/pkgs/by-name/sp/spirv-tools/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   python3,
   spirv-headers,
@@ -9,18 +10,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-tools";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-8haVqfmTBvNuv5jEc/LaAO34pWjTZAJ04FIxuxfJNUc=";
+    hash = "sha256-tR3POZH/LXaAljMUS9aHBBvIvlr6o7d6+YUtJCRMS1w=";
   };
 
   patches = [
     # https://github.com/KhronosGroup/SPIRV-Tools/pull/6483
     ./0001-Fix-generated-pkg-config-modules-with-absolute-insta.patch
+
+    # backport to fix glslang tests
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/2ec8457ab33d539b6f1fecc998360c0b8b05ed4f.diff";
+      hash = "sha256-YHbYBwXMm4rTKpmMW6I3LUafhA4RuNUdXqUBUAXwXpE=";
+    })
   ]
   # The cmake options are sufficient for turning on static building, but not
   # for disabling shared building, just trim the shared lib from the CMake

From bbfc13f3fe4253beda6d14bc9dcaa84cdd4e08da Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 13 May 2026 10:38:25 +0300
Subject: [PATCH 107/831] spirv-headers: 1.4.341.0 -> 1.4.350.0

Diff: https://github.com/KhronosGroup/SPIRV-Headers/compare/vulkan-sdk-1.4.341.0...vulkan-sdk-1.4.350.0
---
 pkgs/by-name/sp/spirv-headers/package.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sp/spirv-headers/package.nix b/pkgs/by-name/sp/spirv-headers/package.nix
index 95a5f55b4cf2..3f4c75ed5962 100644
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -2,20 +2,30 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-headers";
-  version = "1.4.341.0";
+  version = "1.4.350.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-aYKFJxRDoY/Cor8gYVoR/YSyXWSNtcRG0HK8BZH0Ztk=";
+    hash = "sha256-nwzhJlkdN8DaExHvnuVc5rZmlrkPYb7Qmj1fx3O5Zpw=";
   };
 
+  patches = [
+    # backport to fix glslang tests
+    # FIXME: remove in next update
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/1a22b167081842915a1c78a0b5b5a353a23284aa.diff";
+      hash = "sha256-XUHfPHnk7bWK4vnozfW/84vaZN+rbFJUZSa6Og8GUAU=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   meta = {

From 3b9aea2467ea586ad703b1e390fd7f0a47f4a206 Mon Sep 17 00:00:00 2001
From: Vilem Liepelt <17603372+buggymcbugfix@users.noreply.github.com>
Date: Wed, 13 May 2026 10:36:23 +0200
Subject: [PATCH 108/831] sqlite: 3.51.2 -> 3.53.1

---
 pkgs/development/libraries/sqlite/default.nix | 6 +++---
 pkgs/development/libraries/sqlite/tools.nix   | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 54b4ef4557f2..bc27578cda3d 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -28,17 +28,17 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sqlite${lib.optionalString interactive "-interactive"}";
-  version = "3.51.2";
+  version = "3.53.1";
 
   # nixpkgs-update: no auto update
   # NB! Make sure to update ./tools.nix src (in the same directory).
   src = fetchurl {
     url = "https://sqlite.org/2026/sqlite-src-${archiveVersion version}.zip";
-    hash = "sha256-hREPdi1QeUFNmd1deRe8P/fgWHbmzL0T2ElqOBfyCCk=";
+    hash = "sha256-GytXVdkGTE1dGwv1MHtIsImWPikcQMxzUTGKobYcRg4=";
   };
   docsrc = fetchurl {
     url = "https://sqlite.org/2026/sqlite-doc-${archiveVersion version}.zip";
-    hash = "sha256-xuMNB8XpwSaQHFTY18kKnBo3B4JFUX8GCzxpxN5Dv10=";
+    hash = "sha256-n9Bgv33YwseOdBHQb7gdyKqgWeth7sgMZeBlioVFtDM=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/sqlite/tools.nix b/pkgs/development/libraries/sqlite/tools.nix
index 932366a1b595..9755b3733273 100644
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@@ -19,14 +19,14 @@ let
     }:
     stdenv.mkDerivation rec {
       inherit pname;
-      version = "3.51.2";
+      version = "3.53.1";
 
       # nixpkgs-update: no auto update
       src =
         assert version == sqlite.version;
         fetchurl {
           url = "https://sqlite.org/2026/sqlite-src-${archiveVersion version}.zip";
-          hash = "sha256-hREPdi1QeUFNmd1deRe8P/fgWHbmzL0T2ElqOBfyCCk=";
+          hash = "sha256-GytXVdkGTE1dGwv1MHtIsImWPikcQMxzUTGKobYcRg4=";
         };
 
       nativeBuildInputs = [ unzip ];

From fad1bd870d529e9739978d06206156d64034da8e Mon Sep 17 00:00:00 2001
From: n0099 <git@n0099.com>
Date: Wed, 13 May 2026 12:48:32 +0000
Subject: [PATCH 109/831] guile: set `meta.mainProgram`

---
 pkgs/development/interpreters/guile/3.0.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index d400a4059cec..beddf97c4dde 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -193,5 +193,6 @@ builder rec {
     license = lib.licenses.lgpl3Plus;
     maintainers = [ ];
     platforms = lib.platforms.all;
+    mainProgram = "guile";
   };
 }

From 61b63e8b5a57f9d3a75b03f698e1f31cc5ce55c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 13 May 2026 20:09:18 +0200
Subject: [PATCH 110/831] python314Packages.gast: remove astunparse

Not required since https://github.com/serge-sans-paille/gast/commit/c9d91d26a21d9951f43f4ea5beeafa682757644f
---
 pkgs/development/python-modules/gast/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/gast/default.nix b/pkgs/development/python-modules/gast/default.nix
index 35f3906c1576..8151bbace629 100644
--- a/pkgs/development/python-modules/gast/default.nix
+++ b/pkgs/development/python-modules/gast/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  astunparse,
   buildPythonPackage,
   fetchFromGitHub,
   pytestCheckHook,
@@ -22,7 +21,6 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   nativeCheckInputs = [
-    astunparse
     pytestCheckHook
   ];
 

From fbe89543131df4abbc8fb9b368bdbe0a42566e1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 13 May 2026 02:41:42 +0200
Subject: [PATCH 111/831] python314Packages.astunparse: drop not required wheel
 dependency

---
 pkgs/development/python-modules/astunparse/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/astunparse/default.nix b/pkgs/development/python-modules/astunparse/default.nix
index fdff2e83ebf9..558d7bd2dea8 100644
--- a/pkgs/development/python-modules/astunparse/default.nix
+++ b/pkgs/development/python-modules/astunparse/default.nix
@@ -3,7 +3,6 @@
   fetchPypi,
   buildPythonPackage,
   six,
-  wheel,
 }:
 
 buildPythonPackage rec {
@@ -18,7 +17,6 @@ buildPythonPackage rec {
 
   propagatedBuildInputs = [
     six
-    wheel
   ];
 
   # tests not included with pypi release

From a14b8f95cc4d7f8b2e75f701501c0544c417a041 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 13 May 2026 02:41:52 +0200
Subject: [PATCH 112/831] python314Packages.astunparse: set pyproject = true

---
 pkgs/development/python-modules/astunparse/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/astunparse/default.nix b/pkgs/development/python-modules/astunparse/default.nix
index 558d7bd2dea8..8f367a1a15ee 100644
--- a/pkgs/development/python-modules/astunparse/default.nix
+++ b/pkgs/development/python-modules/astunparse/default.nix
@@ -2,20 +2,23 @@
   lib,
   fetchPypi,
   buildPythonPackage,
+  setuptools,
   six,
 }:
 
 buildPythonPackage rec {
   pname = "astunparse";
   version = "1.6.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     sha256 = "5ad93a8456f0d084c3456d059fd9a92cce667963232cbf763eac3bc5b7940872";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     six
   ];
 

From b7da8e825ddf25cf8d6df1eb9ef2165a2804f944 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sun, 3 May 2026 18:14:12 -0500
Subject: [PATCH 113/831] luaPackages.dkjson: 2.8-2 -> 2.9-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index d2a2d743fb19..fd51a4161f37 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -720,15 +720,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "dkjson";
-      version = "2.8-2";
+      version = "2.9-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/dkjson-2.8-2.rockspec";
-          sha256 = "0hr4vfmf64kvmqbnr1vx4p6gl3mmiq1hg5jd60rqwplsiaib2r67";
+          url = "mirror://luarocks/dkjson-2.9-1.rockspec";
+          sha256 = "1nxm2ncjdx1yh4lb4v5jab826069idimqbxikapf6hdv0n9m1h90";
         }).outPath;
       src = fetchurl {
-        url = "https://dkolf.de/dkjson-lua/dkjson-2.8.tar.gz";
-        sha256 = "0chmlcv8498n313x19aampwvz2s1pp4zpcvvxdhwihcixcxwvs14";
+        url = "https://dkolf.de/dkjson-lua/dkjson-2.9.tar.gz";
+        sha256 = "0qwszsny4g58pb8hzm1wlsp6gvmjiywgcydim6w1bgdnq66x5dvs";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.6";

From 8e730cb76072abfa046465399edad890ca75328e Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Wed, 13 May 2026 19:37:45 -0500
Subject: [PATCH 114/831] luaPackages.dkjson: 2.9-1 -> 2.10-1

---
 pkgs/development/lua-modules/generated-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index fd51a4161f37..75393ee5533b 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -720,15 +720,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "dkjson";
-      version = "2.9-1";
+      version = "2.10-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/dkjson-2.9-1.rockspec";
-          sha256 = "1nxm2ncjdx1yh4lb4v5jab826069idimqbxikapf6hdv0n9m1h90";
+          url = "mirror://luarocks/dkjson-2.10-1.rockspec";
+          sha256 = "0h49fv93h6n32xwwgwvrhb6w5rzvgjzyls6m9xhmcd94pbkih8v2";
         }).outPath;
       src = fetchurl {
-        url = "https://dkolf.de/dkjson-lua/dkjson-2.9.tar.gz";
-        sha256 = "0qwszsny4g58pb8hzm1wlsp6gvmjiywgcydim6w1bgdnq66x5dvs";
+        url = "https://dkolf.de/dkjson-lua/dkjson-2.10.tar.gz";
+        sha256 = "092v9m13h7zl89qfgywbs22wdvniwr2lr3shjqrn91f4nl39xiz8";
       };
 
       disabled = luaOlder "5.1" || luaAtLeast "5.6";

From 2351a8df54be7484c7da7f6fbe1f24ac1db7a0e4 Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 12 May 2026 18:15:13 -0400
Subject: [PATCH 115/831] minimal-bootstrap: only create one derivation for mes
 sources

Co-authored-by: Aleksi Hannula <ahannula4+nixgit@gmail.com>
---
 .../linux/minimal-bootstrap/mes/default.nix   |   61 +-
 .../minimal-bootstrap/mes/gen-sources.sh      |   32 +-
 .../linux/minimal-bootstrap/mes/libc.nix      |   28 +-
 .../linux/minimal-bootstrap/mes/sources.json  | 2348 +----------------
 4 files changed, 110 insertions(+), 2359 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
index 36849236ee6c..7c3335ed1f21 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
@@ -1,3 +1,8 @@
+let
+  sourcesJson = (builtins.fromJSON (builtins.readFile ./sources.json));
+  inherit (builtins) split filter isString;
+in
+
 {
   lib,
   fetchurl,
@@ -57,7 +62,7 @@ let
     }
     .${buildPlatform.system};
 
-  sources = (lib.importJSON ./sources.json).${arch}.linux.mescc;
+  sources = sourcesJson."${arch}.linux.mescc";
 
   inherit (sources)
     libc_mini_SOURCES
@@ -67,7 +72,7 @@ let
     ;
 
   # add symlink() to libc+tcc so we can use it in ln-boot
-  libc_tcc_SOURCES = sources.libc_tcc_SOURCES ++ [ "lib/linux/symlink.c" ];
+  libc_tcc_SOURCES = "${sources.libc_tcc_SOURCES} lib/linux/symlink.c";
   setjmp_x86_64 = ./setjmp_x86_64.c;
 
   meta = {
@@ -254,39 +259,31 @@ let
 
   CC = toString ([ cc ] ++ ccArgs);
 
-  stripExt = source: lib.replaceStrings [ ".c" ] [ "" ] (baseNameOf source);
-
-  compile =
-    source:
-    kaem.runCommand (stripExt source) { } ''
-      mkdir ''${out}
-      cd ''${out}
-      ${CC} -c ${srcPrefix}/${source}
-    '';
-
-  crt1 = compile "/lib/linux/${arch}-mes-mescc/crt1.c";
-
-  getRes = suffix: res: "${res}/${res.name}${suffix}";
-
-  archive = out: sources: "catm ${out} ${lib.concatMapStringsSep " " (getRes ".o") sources}";
-  sourceArchive = out: sources: "catm ${out} ${lib.concatMapStringsSep " " (getRes ".s") sources}";
+  crt1 =
+    kaem.runCommand "${pname}-crt1-${version}"
+      {
+        inherit meta;
+      }
+      ''
+        mkdir ''${out}
+        cd ''${out}
+        ${CC} -c ${srcPrefix}/lib/linux/${arch}-mes-mescc/crt1.c
+      '';
 
   mkLib =
     libname: sources:
-    let
-      os = map compile sources;
-    in
     kaem.runCommand "${pname}-${libname}-${version}"
       {
         inherit meta;
       }
       ''
+        cd ${srcPost}/mes-${version}
         LIBDIR=''${out}/lib
         mkdir -p ''${LIBDIR}
-        cd ''${LIBDIR}
+        catm ''${LIBDIR}/${libname}.c ${sources}
 
-        ${archive "${libname}.a" os}
-        ${sourceArchive "${libname}.s" os}
+        ${CC} -S -o ''${LIBDIR}/${libname}.s ''${out}/lib/${libname}.c
+        ${CC} -c -o ''${LIBDIR}/${libname}.a ''${LIBDIR}/${libname}.s
       '';
 
   libc-mini = mkLib "libc-mini" libc_mini_SOURCES;
@@ -338,6 +335,9 @@ let
 
   # Build mes itself
   compiler =
+    let
+      objs = filter isString (split " " mes_SOURCES);
+    in
     kaem.runCommand "${pname}-${version}"
       {
         inherit pname version;
@@ -353,8 +353,19 @@ let
       }
       ''
         mkdir -p ''${out}/bin
+        ${lib.concatMapStringsSep "\n" (obj: ''
+          ${srcPost.bin}/bin/mes-m2 -e main ${srcPost.bin}/bin/mescc.scm -- \
+            -D HAVE_CONFIG_H=1 \
+            -I ${srcPrefix}/include \
+            -I ${srcPrefix}/include/linux/${arch} \
+            -I ${srcPost}/mes-${version}/src \
+            -c \
+            -o ${lib.removePrefix "src/" obj}.o \
+            ${srcPost}/mes-${version}/${obj}
+        '') objs}
 
         ${srcPost.bin}/bin/mes-m2 -e main ${srcPost.bin}/bin/mescc.scm -- \
+          -I ${srcPost}/mes-${version}/src \
           -L ''${srcPrefix}/lib \
           -L ${libs}/lib \
           -lc \
@@ -362,7 +373,7 @@ let
           -nostdlib \
           -o ''${out}/bin/mes \
           ${libs}/lib/${arch}-mes/crt1.o \
-          ${lib.concatMapStringsSep " " (getRes ".o") (map compile mes_SOURCES)}
+          ${lib.concatMapStringsSep " " (obj: "${lib.removePrefix "src/" obj}.o") objs}
       '';
 in
 {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh b/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
index fcee9605e42c..a3a0b5c2e05c 100755
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
@@ -17,13 +17,15 @@ ARCHS="x86 x86_64"
 KERNELS="linux"
 COMPILERS="mescc gcc"
 
+to_json_joined_string() {
+  printf '%s\n' "$@" | jq --raw-input --null-input '[inputs]|join(" ")'
+}
 
-to_json_array() {
-  if [ $# -eq 0 ]; then
-    echo '[]'
-  else
-    printf '%s\n' "$@" | jq --raw-input --null-input '[inputs]'
-  fi
+to_json_joined_string_1() {
+  printf '%s\n' "$@" | jq --raw-input --null-input '[inputs]|.[0:100]|join(" ")'
+}
+to_json_joined_string_2() {
+  printf '%s\n' "$@" | jq --raw-input --null-input '[inputs]|.[100:]|join(" ")'
 }
 
 gen_sources() {
@@ -38,20 +40,22 @@ gen_sources() {
 
   jq --null-input \
     --arg key "$mes_cpu.$mes_kernel.$compiler" \
-    --argjson libc_mini_SOURCES "$(to_json_array $libc_mini_SOURCES)" \
-    --argjson libmescc_SOURCES "$(to_json_array $libmescc_SOURCES)" \
-    --argjson libtcc1_SOURCES "$(to_json_array $libtcc1_SOURCES)" \
-    --argjson libc_SOURCES "$(to_json_array $libc_SOURCES)" \
-    --argjson libc_tcc_SOURCES "$(to_json_array $libc_tcc_SOURCES)" \
-    --argjson libc_gnu_SOURCES "$(to_json_array $libc_gnu_SOURCES)" \
-    --argjson mes_SOURCES "$(to_json_array $mes_SOURCES)" \
+    --argjson libc_mini_SOURCES "$(to_json_joined_string $libc_mini_SOURCES)" \
+    --argjson libmescc_SOURCES "$(to_json_joined_string $libmescc_SOURCES)" \
+    --argjson libtcc1_SOURCES "$(to_json_joined_string $libtcc1_SOURCES)" \
+    --argjson libc_SOURCES "$(to_json_joined_string $libc_SOURCES)" \
+    --argjson libc_tcc_SOURCES "$(to_json_joined_string $libc_tcc_SOURCES)" \
+    --argjson libc_gnu1_SOURCES "$(to_json_joined_string_1 $libc_gnu_SOURCES)" \
+    --argjson libc_gnu2_SOURCES "$(to_json_joined_string_2 $libc_gnu_SOURCES)" \
+    --argjson mes_SOURCES "$(to_json_joined_string $mes_SOURCES)" \
     '{($key): {
       libc_mini_SOURCES: $libc_mini_SOURCES,
       libmescc_SOURCES: $libmescc_SOURCES,
       libtcc1_SOURCES: $libtcc1_SOURCES,
       libc_SOURCES: $libc_SOURCES,
       libc_tcc_SOURCES: $libc_tcc_SOURCES,
-      libc_gnu_SOURCES: $libc_gnu_SOURCES,
+      libc_gnu1_SOURCES: $libc_gnu1_SOURCES,
+      libc_gnu2_SOURCES: $libc_gnu2_SOURCES,
       mes_SOURCES: $mes_SOURCES
     }}'
 }
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
index d6dc9fa97787..edf1a2f15640 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
@@ -1,9 +1,12 @@
+let
+  sourcesJson = (builtins.fromJSON (builtins.readFile ./sources.json));
+in
+
 {
   lib,
   kaem,
   ln-boot,
   mes,
-  mes-libc,
   buildPlatform,
   fetchurl,
 }:
@@ -18,8 +21,13 @@ let
     }
     .${buildPlatform.system};
 
-  sources = (lib.importJSON ./sources.json).${arch}.linux.gcc;
-  inherit (sources) libtcc1_SOURCES libc_gnu_SOURCES;
+  sources = sourcesJson."${arch}.linux.gcc";
+  inherit (sources) libtcc1_SOURCES libc_gnu1_SOURCES libc_gnu2_SOURCES;
+
+  ldexpl = fetchurl {
+    url = "https://gitlab.com/janneke/mes/-/raw/c837abed8edb341d4e56913729fbe9803b4de47c/lib/math/ldexpl.c";
+    hash = "sha256-3QoFZZIqVmlMUosEqOdYIMEHzYgQ7GJ7Hz0Bf/1iIig=";
+  };
 
   # Concatenate all source files into a convenient bundle
   # "gcc" variants of source files (eg. "lib/linux/x86-mes-gcc") can also be
@@ -27,14 +35,14 @@ let
   #
   # Passing this many arguments is too much for kaem so we need to split
   # the operation in two
-  firstLibc = (lib.take 100 libc_gnu_SOURCES) ++ [ ./ldexpl.c ];
-  lastLibc = lib.drop 100 libc_gnu_SOURCES;
+  firstLibc = libc_gnu1_SOURCES + " ${ldexpl}";
+  lastLibc = libc_gnu2_SOURCES;
 in
 kaem.runCommand "${pname}-${version}"
   {
     inherit pname version;
 
-    nativeBuildInputs = [ ln-boot ];
+    extraPath = "${ln-boot}/bin";
 
     passthru.CFLAGS = "-std=c11";
 
@@ -56,8 +64,8 @@ kaem.runCommand "${pname}-${version}"
     mkdir -p ''${out}/lib/${arch}-mes
 
     # libc.c
-    catm ''${TMPDIR}/first.c ${lib.concatStringsSep " " firstLibc}
-    catm ''${out}/lib/libc.c ''${TMPDIR}/first.c ${lib.concatStringsSep " " lastLibc}
+    catm ''${TMPDIR}/first.c ${firstLibc}
+    catm ''${out}/lib/libc.c ''${TMPDIR}/first.c ${lastLibc}
 
     # crt{1,n,i}.c
     cp lib/linux/${arch}-mes-gcc/crt1.c ''${out}/lib
@@ -65,11 +73,11 @@ kaem.runCommand "${pname}-${version}"
     cp lib/linux/${arch}-mes-gcc/crti.c ''${out}/lib
 
     # libtcc1.c
-    catm ''${out}/lib/libtcc1.c ${lib.concatStringsSep " " libtcc1_SOURCES}
+    catm ''${out}/lib/libtcc1.c ${libtcc1_SOURCES}
 
     # getopt.c
     cp lib/posix/getopt.c ''${out}/lib/libgetopt.c
 
     # Install headers
-    ln -s ${mes.srcPrefix}/include ''${out}/include
+    ${ln-boot}/bin/ln -s ${mes.srcPrefix}/include ''${out}/include
   ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.json b/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.json
index cca800e197c5..8ca28a1366f5 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.json
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.json
@@ -1,2314 +1,42 @@
 {
-  "x86": {
-    "linux": {
-      "gcc": {
-        "libc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-gcc/_exit.c",
-          "lib/linux/x86-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c"
-        ],
-        "libc_gnu_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-gcc/_exit.c",
-          "lib/linux/x86-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86-mes-gcc/setjmp.c",
-          "lib/ctype/isalnum.c",
-          "lib/ctype/isalpha.c",
-          "lib/ctype/isascii.c",
-          "lib/ctype/iscntrl.c",
-          "lib/ctype/isgraph.c",
-          "lib/ctype/isprint.c",
-          "lib/ctype/ispunct.c",
-          "lib/math/ceil.c",
-          "lib/math/fabs.c",
-          "lib/math/floor.c",
-          "lib/mes/fdgets.c",
-          "lib/posix/alarm.c",
-          "lib/posix/execl.c",
-          "lib/posix/execlp.c",
-          "lib/posix/mktemp.c",
-          "lib/posix/pathconf.c",
-          "lib/posix/sbrk.c",
-          "lib/posix/sleep.c",
-          "lib/posix/unsetenv.c",
-          "lib/stdio/clearerr.c",
-          "lib/stdio/feof.c",
-          "lib/stdio/fgets.c",
-          "lib/stdio/fileno.c",
-          "lib/stdio/freopen.c",
-          "lib/stdio/fscanf.c",
-          "lib/stdio/perror.c",
-          "lib/stdio/vfscanf.c",
-          "lib/stdlib/__exit.c",
-          "lib/stdlib/abort.c",
-          "lib/stdlib/abs.c",
-          "lib/stdlib/alloca.c",
-          "lib/stdlib/atexit.c",
-          "lib/stdlib/atof.c",
-          "lib/stdlib/atol.c",
-          "lib/stdlib/mbstowcs.c",
-          "lib/string/bcmp.c",
-          "lib/string/bcopy.c",
-          "lib/string/bzero.c",
-          "lib/string/index.c",
-          "lib/string/rindex.c",
-          "lib/string/strcspn.c",
-          "lib/string/strdup.c",
-          "lib/string/strerror.c",
-          "lib/string/strncat.c",
-          "lib/string/strpbrk.c",
-          "lib/string/strspn.c",
-          "lib/stub/__cleanup.c",
-          "lib/stub/atan2.c",
-          "lib/stub/bsearch.c",
-          "lib/stub/chown.c",
-          "lib/stub/cos.c",
-          "lib/stub/ctime.c",
-          "lib/stub/exp.c",
-          "lib/stub/fpurge.c",
-          "lib/stub/freadahead.c",
-          "lib/stub/frexp.c",
-          "lib/stub/getgrgid.c",
-          "lib/stub/getgrnam.c",
-          "lib/stub/getlogin.c",
-          "lib/stub/getpgid.c",
-          "lib/stub/getpgrp.c",
-          "lib/stub/getpwnam.c",
-          "lib/stub/getpwuid.c",
-          "lib/stub/gmtime.c",
-          "lib/stub/log.c",
-          "lib/stub/mktime.c",
-          "lib/stub/modf.c",
-          "lib/stub/pclose.c",
-          "lib/stub/popen.c",
-          "lib/stub/pow.c",
-          "lib/stub/rand.c",
-          "lib/stub/rewind.c",
-          "lib/stub/setbuf.c",
-          "lib/stub/setgrent.c",
-          "lib/stub/setlocale.c",
-          "lib/stub/setvbuf.c",
-          "lib/stub/sigaddset.c",
-          "lib/stub/sigblock.c",
-          "lib/stub/sigdelset.c",
-          "lib/stub/sigsetmask.c",
-          "lib/stub/sin.c",
-          "lib/stub/sqrt.c",
-          "lib/stub/strftime.c",
-          "lib/stub/sys_siglist.c",
-          "lib/stub/system.c",
-          "lib/stub/times.c",
-          "lib/stub/ttyname.c",
-          "lib/stub/utime.c",
-          "lib/linux/getegid.c",
-          "lib/linux/geteuid.c",
-          "lib/linux/getgid.c",
-          "lib/linux/getppid.c",
-          "lib/linux/getrusage.c",
-          "lib/linux/getuid.c",
-          "lib/linux/ioctl.c",
-          "lib/linux/mknod.c",
-          "lib/linux/readlink.c",
-          "lib/linux/setgid.c",
-          "lib/linux/settimer.c",
-          "lib/linux/setuid.c",
-          "lib/linux/signal.c",
-          "lib/linux/sigprogmask.c"
-        ],
-        "libc_mini_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-gcc/_exit.c",
-          "lib/linux/x86-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/mes/write.c"
-        ],
-        "libc_tcc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-gcc/_exit.c",
-          "lib/linux/x86-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86-mes-gcc/setjmp.c"
-        ],
-        "libmescc_SOURCES": [
-          "lib/mes/globals.c",
-          "lib/linux/x86-mes-gcc/syscall-internal.c"
-        ],
-        "libtcc1_SOURCES": [
-          "lib/libtcc1.c"
-        ],
-        "mes_SOURCES": [
-          "src/builtins.c",
-          "src/cc.c",
-          "src/core.c",
-          "src/display.c",
-          "src/eval-apply.c",
-          "src/gc.c",
-          "src/globals.c",
-          "src/hash.c",
-          "src/lib.c",
-          "src/math.c",
-          "src/mes.c",
-          "src/module.c",
-          "src/posix.c",
-          "src/reader.c",
-          "src/stack.c",
-          "src/string.c",
-          "src/struct.c",
-          "src/symbol.c",
-          "src/variable.c",
-          "src/vector.c"
-        ]
-      },
-      "mescc": {
-        "libc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-mescc/_exit.c",
-          "lib/linux/x86-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c"
-        ],
-        "libc_gnu_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-mescc/_exit.c",
-          "lib/linux/x86-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86-mes-mescc/setjmp.c",
-          "lib/ctype/isalnum.c",
-          "lib/ctype/isalpha.c",
-          "lib/ctype/isascii.c",
-          "lib/ctype/iscntrl.c",
-          "lib/ctype/isgraph.c",
-          "lib/ctype/isprint.c",
-          "lib/ctype/ispunct.c",
-          "lib/math/ceil.c",
-          "lib/math/fabs.c",
-          "lib/math/floor.c",
-          "lib/mes/fdgets.c",
-          "lib/posix/alarm.c",
-          "lib/posix/execl.c",
-          "lib/posix/execlp.c",
-          "lib/posix/mktemp.c",
-          "lib/posix/pathconf.c",
-          "lib/posix/sbrk.c",
-          "lib/posix/sleep.c",
-          "lib/posix/unsetenv.c",
-          "lib/stdio/clearerr.c",
-          "lib/stdio/feof.c",
-          "lib/stdio/fgets.c",
-          "lib/stdio/fileno.c",
-          "lib/stdio/freopen.c",
-          "lib/stdio/fscanf.c",
-          "lib/stdio/perror.c",
-          "lib/stdio/vfscanf.c",
-          "lib/stdlib/__exit.c",
-          "lib/stdlib/abort.c",
-          "lib/stdlib/abs.c",
-          "lib/stdlib/alloca.c",
-          "lib/stdlib/atexit.c",
-          "lib/stdlib/atof.c",
-          "lib/stdlib/atol.c",
-          "lib/stdlib/mbstowcs.c",
-          "lib/string/bcmp.c",
-          "lib/string/bcopy.c",
-          "lib/string/bzero.c",
-          "lib/string/index.c",
-          "lib/string/rindex.c",
-          "lib/string/strcspn.c",
-          "lib/string/strdup.c",
-          "lib/string/strerror.c",
-          "lib/string/strncat.c",
-          "lib/string/strpbrk.c",
-          "lib/string/strspn.c",
-          "lib/stub/__cleanup.c",
-          "lib/stub/atan2.c",
-          "lib/stub/bsearch.c",
-          "lib/stub/chown.c",
-          "lib/stub/cos.c",
-          "lib/stub/ctime.c",
-          "lib/stub/exp.c",
-          "lib/stub/fpurge.c",
-          "lib/stub/freadahead.c",
-          "lib/stub/frexp.c",
-          "lib/stub/getgrgid.c",
-          "lib/stub/getgrnam.c",
-          "lib/stub/getlogin.c",
-          "lib/stub/getpgid.c",
-          "lib/stub/getpgrp.c",
-          "lib/stub/getpwnam.c",
-          "lib/stub/getpwuid.c",
-          "lib/stub/gmtime.c",
-          "lib/stub/log.c",
-          "lib/stub/mktime.c",
-          "lib/stub/modf.c",
-          "lib/stub/pclose.c",
-          "lib/stub/popen.c",
-          "lib/stub/pow.c",
-          "lib/stub/rand.c",
-          "lib/stub/rewind.c",
-          "lib/stub/setbuf.c",
-          "lib/stub/setgrent.c",
-          "lib/stub/setlocale.c",
-          "lib/stub/setvbuf.c",
-          "lib/stub/sigaddset.c",
-          "lib/stub/sigblock.c",
-          "lib/stub/sigdelset.c",
-          "lib/stub/sigsetmask.c",
-          "lib/stub/sin.c",
-          "lib/stub/sqrt.c",
-          "lib/stub/strftime.c",
-          "lib/stub/sys_siglist.c",
-          "lib/stub/system.c",
-          "lib/stub/times.c",
-          "lib/stub/ttyname.c",
-          "lib/stub/utime.c",
-          "lib/linux/getegid.c",
-          "lib/linux/geteuid.c",
-          "lib/linux/getgid.c",
-          "lib/linux/getppid.c",
-          "lib/linux/getrusage.c",
-          "lib/linux/getuid.c",
-          "lib/linux/ioctl.c",
-          "lib/linux/mknod.c",
-          "lib/linux/readlink.c",
-          "lib/linux/setgid.c",
-          "lib/linux/settimer.c",
-          "lib/linux/setuid.c",
-          "lib/linux/signal.c",
-          "lib/linux/sigprogmask.c"
-        ],
-        "libc_mini_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-mescc/_exit.c",
-          "lib/linux/x86-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/mes/write.c"
-        ],
-        "libc_tcc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86-mes-mescc/_exit.c",
-          "lib/linux/x86-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86-mes-mescc/setjmp.c"
-        ],
-        "libmescc_SOURCES": [
-          "lib/mes/globals.c",
-          "lib/linux/x86-mes-mescc/syscall-internal.c"
-        ],
-        "libtcc1_SOURCES": [
-          "lib/libtcc1.c"
-        ],
-        "mes_SOURCES": [
-          "src/builtins.c",
-          "src/cc.c",
-          "src/core.c",
-          "src/display.c",
-          "src/eval-apply.c",
-          "src/gc.c",
-          "src/globals.c",
-          "src/hash.c",
-          "src/lib.c",
-          "src/math.c",
-          "src/mes.c",
-          "src/module.c",
-          "src/posix.c",
-          "src/reader.c",
-          "src/stack.c",
-          "src/string.c",
-          "src/struct.c",
-          "src/symbol.c",
-          "src/variable.c",
-          "src/vector.c"
-        ]
-      }
-    }
+  "x86.linux.gcc": {
+    "libc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-gcc/_exit.c lib/linux/x86-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c",
+    "libc_gnu1_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-gcc/_exit.c lib/linux/x86-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c",
+    "libc_gnu2_SOURCES": "lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86-mes-gcc/setjmp.c lib/ctype/isalnum.c lib/ctype/isalpha.c lib/ctype/isascii.c lib/ctype/iscntrl.c lib/ctype/isgraph.c lib/ctype/isprint.c lib/ctype/ispunct.c lib/math/ceil.c lib/math/fabs.c lib/math/floor.c lib/mes/fdgets.c lib/posix/alarm.c lib/posix/execl.c lib/posix/execlp.c lib/posix/mktemp.c lib/posix/pathconf.c lib/posix/sbrk.c lib/posix/sleep.c lib/posix/unsetenv.c lib/stdio/clearerr.c lib/stdio/feof.c lib/stdio/fgets.c lib/stdio/fileno.c lib/stdio/freopen.c lib/stdio/fscanf.c lib/stdio/perror.c lib/stdio/vfscanf.c lib/stdlib/__exit.c lib/stdlib/abort.c lib/stdlib/abs.c lib/stdlib/alloca.c lib/stdlib/atexit.c lib/stdlib/atof.c lib/stdlib/atol.c lib/stdlib/mbstowcs.c lib/string/bcmp.c lib/string/bcopy.c lib/string/bzero.c lib/string/index.c lib/string/rindex.c lib/string/strcspn.c lib/string/strdup.c lib/string/strerror.c lib/string/strncat.c lib/string/strpbrk.c lib/string/strspn.c lib/stub/__cleanup.c lib/stub/atan2.c lib/stub/bsearch.c lib/stub/chown.c lib/stub/cos.c lib/stub/ctime.c lib/stub/exp.c lib/stub/fpurge.c lib/stub/freadahead.c lib/stub/frexp.c lib/stub/getgrgid.c lib/stub/getgrnam.c lib/stub/getlogin.c lib/stub/getpgid.c lib/stub/getpgrp.c lib/stub/getpwnam.c lib/stub/getpwuid.c lib/stub/gmtime.c lib/stub/log.c lib/stub/mktime.c lib/stub/modf.c lib/stub/pclose.c lib/stub/popen.c lib/stub/pow.c lib/stub/rand.c lib/stub/rewind.c lib/stub/setbuf.c lib/stub/setgrent.c lib/stub/setlocale.c lib/stub/setvbuf.c lib/stub/sigaddset.c lib/stub/sigblock.c lib/stub/sigdelset.c lib/stub/sigsetmask.c lib/stub/sin.c lib/stub/sqrt.c lib/stub/strftime.c lib/stub/sys_siglist.c lib/stub/system.c lib/stub/times.c lib/stub/ttyname.c lib/stub/utime.c lib/linux/getegid.c lib/linux/geteuid.c lib/linux/getgid.c lib/linux/getppid.c lib/linux/getrusage.c lib/linux/getuid.c lib/linux/ioctl.c lib/linux/mknod.c lib/linux/readlink.c lib/linux/setgid.c lib/linux/settimer.c lib/linux/setuid.c lib/linux/signal.c lib/linux/sigprogmask.c",
+    "libc_mini_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-gcc/_exit.c lib/linux/x86-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/mes/write.c",
+    "libc_tcc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-gcc/_exit.c lib/linux/x86-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86-mes-gcc/setjmp.c",
+    "libmescc_SOURCES": "lib/mes/globals.c lib/linux/x86-mes-gcc/syscall-internal.c",
+    "libtcc1_SOURCES": "lib/libtcc1.c",
+    "mes_SOURCES": "src/builtins.c src/cc.c src/core.c src/display.c src/eval-apply.c src/gc.c src/globals.c src/hash.c src/lib.c src/math.c src/mes.c src/module.c src/posix.c src/reader.c src/stack.c src/string.c src/struct.c src/symbol.c src/variable.c src/vector.c"
   },
-  "x86_64": {
-    "linux": {
-      "gcc": {
-        "libc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-gcc/_exit.c",
-          "lib/linux/x86_64-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c"
-        ],
-        "libc_gnu_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-gcc/_exit.c",
-          "lib/linux/x86_64-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86_64-mes-gcc/setjmp.c",
-          "lib/ctype/isalnum.c",
-          "lib/ctype/isalpha.c",
-          "lib/ctype/isascii.c",
-          "lib/ctype/iscntrl.c",
-          "lib/ctype/isgraph.c",
-          "lib/ctype/isprint.c",
-          "lib/ctype/ispunct.c",
-          "lib/math/ceil.c",
-          "lib/math/fabs.c",
-          "lib/math/floor.c",
-          "lib/mes/fdgets.c",
-          "lib/posix/alarm.c",
-          "lib/posix/execl.c",
-          "lib/posix/execlp.c",
-          "lib/posix/mktemp.c",
-          "lib/posix/pathconf.c",
-          "lib/posix/sbrk.c",
-          "lib/posix/sleep.c",
-          "lib/posix/unsetenv.c",
-          "lib/stdio/clearerr.c",
-          "lib/stdio/feof.c",
-          "lib/stdio/fgets.c",
-          "lib/stdio/fileno.c",
-          "lib/stdio/freopen.c",
-          "lib/stdio/fscanf.c",
-          "lib/stdio/perror.c",
-          "lib/stdio/vfscanf.c",
-          "lib/stdlib/__exit.c",
-          "lib/stdlib/abort.c",
-          "lib/stdlib/abs.c",
-          "lib/stdlib/alloca.c",
-          "lib/stdlib/atexit.c",
-          "lib/stdlib/atof.c",
-          "lib/stdlib/atol.c",
-          "lib/stdlib/mbstowcs.c",
-          "lib/string/bcmp.c",
-          "lib/string/bcopy.c",
-          "lib/string/bzero.c",
-          "lib/string/index.c",
-          "lib/string/rindex.c",
-          "lib/string/strcspn.c",
-          "lib/string/strdup.c",
-          "lib/string/strerror.c",
-          "lib/string/strncat.c",
-          "lib/string/strpbrk.c",
-          "lib/string/strspn.c",
-          "lib/stub/__cleanup.c",
-          "lib/stub/atan2.c",
-          "lib/stub/bsearch.c",
-          "lib/stub/chown.c",
-          "lib/stub/cos.c",
-          "lib/stub/ctime.c",
-          "lib/stub/exp.c",
-          "lib/stub/fpurge.c",
-          "lib/stub/freadahead.c",
-          "lib/stub/frexp.c",
-          "lib/stub/getgrgid.c",
-          "lib/stub/getgrnam.c",
-          "lib/stub/getlogin.c",
-          "lib/stub/getpgid.c",
-          "lib/stub/getpgrp.c",
-          "lib/stub/getpwnam.c",
-          "lib/stub/getpwuid.c",
-          "lib/stub/gmtime.c",
-          "lib/stub/log.c",
-          "lib/stub/mktime.c",
-          "lib/stub/modf.c",
-          "lib/stub/pclose.c",
-          "lib/stub/popen.c",
-          "lib/stub/pow.c",
-          "lib/stub/rand.c",
-          "lib/stub/rewind.c",
-          "lib/stub/setbuf.c",
-          "lib/stub/setgrent.c",
-          "lib/stub/setlocale.c",
-          "lib/stub/setvbuf.c",
-          "lib/stub/sigaddset.c",
-          "lib/stub/sigblock.c",
-          "lib/stub/sigdelset.c",
-          "lib/stub/sigsetmask.c",
-          "lib/stub/sin.c",
-          "lib/stub/sqrt.c",
-          "lib/stub/strftime.c",
-          "lib/stub/sys_siglist.c",
-          "lib/stub/system.c",
-          "lib/stub/times.c",
-          "lib/stub/ttyname.c",
-          "lib/stub/utime.c",
-          "lib/linux/getegid.c",
-          "lib/linux/geteuid.c",
-          "lib/linux/getgid.c",
-          "lib/linux/getppid.c",
-          "lib/linux/getrusage.c",
-          "lib/linux/getuid.c",
-          "lib/linux/ioctl.c",
-          "lib/linux/mknod.c",
-          "lib/linux/readlink.c",
-          "lib/linux/setgid.c",
-          "lib/linux/settimer.c",
-          "lib/linux/setuid.c",
-          "lib/linux/signal.c",
-          "lib/linux/sigprogmask.c"
-        ],
-        "libc_mini_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-gcc/_exit.c",
-          "lib/linux/x86_64-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/mes/write.c"
-        ],
-        "libc_tcc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-gcc/_exit.c",
-          "lib/linux/x86_64-mes-gcc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-gcc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86_64-mes-gcc/setjmp.c"
-        ],
-        "libmescc_SOURCES": [
-          "lib/mes/globals.c",
-          "lib/linux/x86_64-mes-gcc/syscall-internal.c"
-        ],
-        "libtcc1_SOURCES": [
-          "lib/libtcc1.c"
-        ],
-        "mes_SOURCES": [
-          "src/builtins.c",
-          "src/cc.c",
-          "src/core.c",
-          "src/display.c",
-          "src/eval-apply.c",
-          "src/gc.c",
-          "src/globals.c",
-          "src/hash.c",
-          "src/lib.c",
-          "src/math.c",
-          "src/mes.c",
-          "src/module.c",
-          "src/posix.c",
-          "src/reader.c",
-          "src/stack.c",
-          "src/string.c",
-          "src/struct.c",
-          "src/symbol.c",
-          "src/variable.c",
-          "src/vector.c"
-        ]
-      },
-      "mescc": {
-        "libc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-mescc/_exit.c",
-          "lib/linux/x86_64-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c"
-        ],
-        "libc_gnu_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-mescc/_exit.c",
-          "lib/linux/x86_64-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86_64-mes-mescc/setjmp.c",
-          "lib/ctype/isalnum.c",
-          "lib/ctype/isalpha.c",
-          "lib/ctype/isascii.c",
-          "lib/ctype/iscntrl.c",
-          "lib/ctype/isgraph.c",
-          "lib/ctype/isprint.c",
-          "lib/ctype/ispunct.c",
-          "lib/math/ceil.c",
-          "lib/math/fabs.c",
-          "lib/math/floor.c",
-          "lib/mes/fdgets.c",
-          "lib/posix/alarm.c",
-          "lib/posix/execl.c",
-          "lib/posix/execlp.c",
-          "lib/posix/mktemp.c",
-          "lib/posix/pathconf.c",
-          "lib/posix/sbrk.c",
-          "lib/posix/sleep.c",
-          "lib/posix/unsetenv.c",
-          "lib/stdio/clearerr.c",
-          "lib/stdio/feof.c",
-          "lib/stdio/fgets.c",
-          "lib/stdio/fileno.c",
-          "lib/stdio/freopen.c",
-          "lib/stdio/fscanf.c",
-          "lib/stdio/perror.c",
-          "lib/stdio/vfscanf.c",
-          "lib/stdlib/__exit.c",
-          "lib/stdlib/abort.c",
-          "lib/stdlib/abs.c",
-          "lib/stdlib/alloca.c",
-          "lib/stdlib/atexit.c",
-          "lib/stdlib/atof.c",
-          "lib/stdlib/atol.c",
-          "lib/stdlib/mbstowcs.c",
-          "lib/string/bcmp.c",
-          "lib/string/bcopy.c",
-          "lib/string/bzero.c",
-          "lib/string/index.c",
-          "lib/string/rindex.c",
-          "lib/string/strcspn.c",
-          "lib/string/strdup.c",
-          "lib/string/strerror.c",
-          "lib/string/strncat.c",
-          "lib/string/strpbrk.c",
-          "lib/string/strspn.c",
-          "lib/stub/__cleanup.c",
-          "lib/stub/atan2.c",
-          "lib/stub/bsearch.c",
-          "lib/stub/chown.c",
-          "lib/stub/cos.c",
-          "lib/stub/ctime.c",
-          "lib/stub/exp.c",
-          "lib/stub/fpurge.c",
-          "lib/stub/freadahead.c",
-          "lib/stub/frexp.c",
-          "lib/stub/getgrgid.c",
-          "lib/stub/getgrnam.c",
-          "lib/stub/getlogin.c",
-          "lib/stub/getpgid.c",
-          "lib/stub/getpgrp.c",
-          "lib/stub/getpwnam.c",
-          "lib/stub/getpwuid.c",
-          "lib/stub/gmtime.c",
-          "lib/stub/log.c",
-          "lib/stub/mktime.c",
-          "lib/stub/modf.c",
-          "lib/stub/pclose.c",
-          "lib/stub/popen.c",
-          "lib/stub/pow.c",
-          "lib/stub/rand.c",
-          "lib/stub/rewind.c",
-          "lib/stub/setbuf.c",
-          "lib/stub/setgrent.c",
-          "lib/stub/setlocale.c",
-          "lib/stub/setvbuf.c",
-          "lib/stub/sigaddset.c",
-          "lib/stub/sigblock.c",
-          "lib/stub/sigdelset.c",
-          "lib/stub/sigsetmask.c",
-          "lib/stub/sin.c",
-          "lib/stub/sqrt.c",
-          "lib/stub/strftime.c",
-          "lib/stub/sys_siglist.c",
-          "lib/stub/system.c",
-          "lib/stub/times.c",
-          "lib/stub/ttyname.c",
-          "lib/stub/utime.c",
-          "lib/linux/getegid.c",
-          "lib/linux/geteuid.c",
-          "lib/linux/getgid.c",
-          "lib/linux/getppid.c",
-          "lib/linux/getrusage.c",
-          "lib/linux/getuid.c",
-          "lib/linux/ioctl.c",
-          "lib/linux/mknod.c",
-          "lib/linux/readlink.c",
-          "lib/linux/setgid.c",
-          "lib/linux/settimer.c",
-          "lib/linux/setuid.c",
-          "lib/linux/signal.c",
-          "lib/linux/sigprogmask.c"
-        ],
-        "libc_mini_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-mescc/_exit.c",
-          "lib/linux/x86_64-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/mes/write.c"
-        ],
-        "libc_tcc_SOURCES": [
-          "lib/mes/__init_io.c",
-          "lib/mes/eputs.c",
-          "lib/mes/oputs.c",
-          "lib/mes/globals.c",
-          "lib/stdlib/exit.c",
-          "lib/linux/x86_64-mes-mescc/_exit.c",
-          "lib/linux/x86_64-mes-mescc/_write.c",
-          "lib/stdlib/puts.c",
-          "lib/string/strlen.c",
-          "lib/ctype/isnumber.c",
-          "lib/mes/abtol.c",
-          "lib/mes/cast.c",
-          "lib/mes/eputc.c",
-          "lib/mes/fdgetc.c",
-          "lib/mes/fdputc.c",
-          "lib/mes/fdputs.c",
-          "lib/mes/fdungetc.c",
-          "lib/mes/itoa.c",
-          "lib/mes/ltoa.c",
-          "lib/mes/ltoab.c",
-          "lib/mes/mes_open.c",
-          "lib/mes/ntoab.c",
-          "lib/mes/oputc.c",
-          "lib/mes/ultoa.c",
-          "lib/mes/utoa.c",
-          "lib/stub/__raise.c",
-          "lib/ctype/isdigit.c",
-          "lib/ctype/isspace.c",
-          "lib/ctype/isxdigit.c",
-          "lib/mes/assert_msg.c",
-          "lib/posix/write.c",
-          "lib/stdlib/atoi.c",
-          "lib/linux/lseek.c",
-          "lib/dirent/__getdirentries.c",
-          "lib/dirent/closedir.c",
-          "lib/dirent/opendir.c",
-          "lib/mes/__assert_fail.c",
-          "lib/mes/__buffered_read.c",
-          "lib/mes/__mes_debug.c",
-          "lib/posix/execv.c",
-          "lib/posix/getcwd.c",
-          "lib/posix/getenv.c",
-          "lib/posix/isatty.c",
-          "lib/posix/open.c",
-          "lib/posix/buffered-read.c",
-          "lib/posix/setenv.c",
-          "lib/posix/wait.c",
-          "lib/stdio/fgetc.c",
-          "lib/stdio/fputc.c",
-          "lib/stdio/fputs.c",
-          "lib/stdio/getc.c",
-          "lib/stdio/getchar.c",
-          "lib/stdio/putc.c",
-          "lib/stdio/putchar.c",
-          "lib/stdio/ungetc.c",
-          "lib/stdlib/calloc.c",
-          "lib/stdlib/free.c",
-          "lib/stdlib/realloc.c",
-          "lib/string/memchr.c",
-          "lib/string/memcmp.c",
-          "lib/string/memcpy.c",
-          "lib/string/memmove.c",
-          "lib/string/memset.c",
-          "lib/string/strcmp.c",
-          "lib/string/strcpy.c",
-          "lib/string/strncmp.c",
-          "lib/posix/raise.c",
-          "lib/linux/access.c",
-          "lib/linux/brk.c",
-          "lib/linux/chdir.c",
-          "lib/linux/chmod.c",
-          "lib/linux/clock_gettime.c",
-          "lib/linux/close.c",
-          "lib/linux/dup.c",
-          "lib/linux/dup2.c",
-          "lib/linux/execve.c",
-          "lib/linux/fcntl.c",
-          "lib/linux/fork.c",
-          "lib/linux/fstat.c",
-          "lib/linux/fsync.c",
-          "lib/linux/_getcwd.c",
-          "lib/linux/getdents.c",
-          "lib/linux/gettimeofday.c",
-          "lib/linux/ioctl3.c",
-          "lib/linux/link.c",
-          "lib/linux/lstat.c",
-          "lib/linux/_open3.c",
-          "lib/linux/malloc.c",
-          "lib/linux/mkdir.c",
-          "lib/linux/nanosleep.c",
-          "lib/linux/pipe.c",
-          "lib/linux/_read.c",
-          "lib/linux/readdir.c",
-          "lib/linux/rename.c",
-          "lib/linux/rmdir.c",
-          "lib/linux/stat.c",
-          "lib/linux/symlink.c",
-          "lib/linux/time.c",
-          "lib/linux/umask.c",
-          "lib/linux/uname.c",
-          "lib/linux/unlink.c",
-          "lib/linux/utimensat.c",
-          "lib/linux/wait4.c",
-          "lib/linux/waitpid.c",
-          "lib/linux/x86_64-mes-mescc/syscall.c",
-          "lib/linux/getpid.c",
-          "lib/linux/kill.c",
-          "lib/ctype/islower.c",
-          "lib/ctype/isupper.c",
-          "lib/ctype/tolower.c",
-          "lib/ctype/toupper.c",
-          "lib/mes/abtod.c",
-          "lib/mes/dtoab.c",
-          "lib/mes/search-path.c",
-          "lib/posix/execvp.c",
-          "lib/stdio/fclose.c",
-          "lib/stdio/fdopen.c",
-          "lib/stdio/ferror.c",
-          "lib/stdio/fflush.c",
-          "lib/stdio/fopen.c",
-          "lib/stdio/fprintf.c",
-          "lib/stdio/fread.c",
-          "lib/stdio/fseek.c",
-          "lib/stdio/ftell.c",
-          "lib/stdio/fwrite.c",
-          "lib/stdio/printf.c",
-          "lib/stdio/remove.c",
-          "lib/stdio/snprintf.c",
-          "lib/stdio/sprintf.c",
-          "lib/stdio/sscanf.c",
-          "lib/stdio/vfprintf.c",
-          "lib/stdio/vprintf.c",
-          "lib/stdio/vsnprintf.c",
-          "lib/stdio/vsprintf.c",
-          "lib/stdio/vsscanf.c",
-          "lib/stdlib/qsort.c",
-          "lib/stdlib/strtod.c",
-          "lib/stdlib/strtof.c",
-          "lib/stdlib/strtol.c",
-          "lib/stdlib/strtold.c",
-          "lib/stdlib/strtoll.c",
-          "lib/stdlib/strtoul.c",
-          "lib/stdlib/strtoull.c",
-          "lib/string/memmem.c",
-          "lib/string/strcat.c",
-          "lib/string/strchr.c",
-          "lib/string/strlwr.c",
-          "lib/string/strncpy.c",
-          "lib/string/strrchr.c",
-          "lib/string/strstr.c",
-          "lib/string/strupr.c",
-          "lib/stub/sigaction.c",
-          "lib/stub/ldexp.c",
-          "lib/stub/mprotect.c",
-          "lib/stub/localtime.c",
-          "lib/stub/putenv.c",
-          "lib/stub/realpath.c",
-          "lib/stub/sigemptyset.c",
-          "lib/x86_64-mes-mescc/setjmp.c"
-        ],
-        "libmescc_SOURCES": [
-          "lib/mes/globals.c",
-          "lib/linux/x86_64-mes-mescc/syscall-internal.c"
-        ],
-        "libtcc1_SOURCES": [
-          "lib/libtcc1.c"
-        ],
-        "mes_SOURCES": [
-          "src/builtins.c",
-          "src/cc.c",
-          "src/core.c",
-          "src/display.c",
-          "src/eval-apply.c",
-          "src/gc.c",
-          "src/globals.c",
-          "src/hash.c",
-          "src/lib.c",
-          "src/math.c",
-          "src/mes.c",
-          "src/module.c",
-          "src/posix.c",
-          "src/reader.c",
-          "src/stack.c",
-          "src/string.c",
-          "src/struct.c",
-          "src/symbol.c",
-          "src/variable.c",
-          "src/vector.c"
-        ]
-      }
-    }
+  "x86.linux.mescc": {
+    "libc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-mescc/_exit.c lib/linux/x86-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c",
+    "libc_gnu1_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-mescc/_exit.c lib/linux/x86-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c",
+    "libc_gnu2_SOURCES": "lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86-mes-mescc/setjmp.c lib/ctype/isalnum.c lib/ctype/isalpha.c lib/ctype/isascii.c lib/ctype/iscntrl.c lib/ctype/isgraph.c lib/ctype/isprint.c lib/ctype/ispunct.c lib/math/ceil.c lib/math/fabs.c lib/math/floor.c lib/mes/fdgets.c lib/posix/alarm.c lib/posix/execl.c lib/posix/execlp.c lib/posix/mktemp.c lib/posix/pathconf.c lib/posix/sbrk.c lib/posix/sleep.c lib/posix/unsetenv.c lib/stdio/clearerr.c lib/stdio/feof.c lib/stdio/fgets.c lib/stdio/fileno.c lib/stdio/freopen.c lib/stdio/fscanf.c lib/stdio/perror.c lib/stdio/vfscanf.c lib/stdlib/__exit.c lib/stdlib/abort.c lib/stdlib/abs.c lib/stdlib/alloca.c lib/stdlib/atexit.c lib/stdlib/atof.c lib/stdlib/atol.c lib/stdlib/mbstowcs.c lib/string/bcmp.c lib/string/bcopy.c lib/string/bzero.c lib/string/index.c lib/string/rindex.c lib/string/strcspn.c lib/string/strdup.c lib/string/strerror.c lib/string/strncat.c lib/string/strpbrk.c lib/string/strspn.c lib/stub/__cleanup.c lib/stub/atan2.c lib/stub/bsearch.c lib/stub/chown.c lib/stub/cos.c lib/stub/ctime.c lib/stub/exp.c lib/stub/fpurge.c lib/stub/freadahead.c lib/stub/frexp.c lib/stub/getgrgid.c lib/stub/getgrnam.c lib/stub/getlogin.c lib/stub/getpgid.c lib/stub/getpgrp.c lib/stub/getpwnam.c lib/stub/getpwuid.c lib/stub/gmtime.c lib/stub/log.c lib/stub/mktime.c lib/stub/modf.c lib/stub/pclose.c lib/stub/popen.c lib/stub/pow.c lib/stub/rand.c lib/stub/rewind.c lib/stub/setbuf.c lib/stub/setgrent.c lib/stub/setlocale.c lib/stub/setvbuf.c lib/stub/sigaddset.c lib/stub/sigblock.c lib/stub/sigdelset.c lib/stub/sigsetmask.c lib/stub/sin.c lib/stub/sqrt.c lib/stub/strftime.c lib/stub/sys_siglist.c lib/stub/system.c lib/stub/times.c lib/stub/ttyname.c lib/stub/utime.c lib/linux/getegid.c lib/linux/geteuid.c lib/linux/getgid.c lib/linux/getppid.c lib/linux/getrusage.c lib/linux/getuid.c lib/linux/ioctl.c lib/linux/mknod.c lib/linux/readlink.c lib/linux/setgid.c lib/linux/settimer.c lib/linux/setuid.c lib/linux/signal.c lib/linux/sigprogmask.c",
+    "libc_mini_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-mescc/_exit.c lib/linux/x86-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/mes/write.c",
+    "libc_tcc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86-mes-mescc/_exit.c lib/linux/x86-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86-mes-mescc/setjmp.c",
+    "libmescc_SOURCES": "lib/mes/globals.c lib/linux/x86-mes-mescc/syscall-internal.c",
+    "libtcc1_SOURCES": "lib/libtcc1.c",
+    "mes_SOURCES": "src/builtins.c src/cc.c src/core.c src/display.c src/eval-apply.c src/gc.c src/globals.c src/hash.c src/lib.c src/math.c src/mes.c src/module.c src/posix.c src/reader.c src/stack.c src/string.c src/struct.c src/symbol.c src/variable.c src/vector.c"
+  },
+  "x86_64.linux.gcc": {
+    "libc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-gcc/_exit.c lib/linux/x86_64-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c",
+    "libc_gnu1_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-gcc/_exit.c lib/linux/x86_64-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c",
+    "libc_gnu2_SOURCES": "lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86_64-mes-gcc/setjmp.c lib/ctype/isalnum.c lib/ctype/isalpha.c lib/ctype/isascii.c lib/ctype/iscntrl.c lib/ctype/isgraph.c lib/ctype/isprint.c lib/ctype/ispunct.c lib/math/ceil.c lib/math/fabs.c lib/math/floor.c lib/mes/fdgets.c lib/posix/alarm.c lib/posix/execl.c lib/posix/execlp.c lib/posix/mktemp.c lib/posix/pathconf.c lib/posix/sbrk.c lib/posix/sleep.c lib/posix/unsetenv.c lib/stdio/clearerr.c lib/stdio/feof.c lib/stdio/fgets.c lib/stdio/fileno.c lib/stdio/freopen.c lib/stdio/fscanf.c lib/stdio/perror.c lib/stdio/vfscanf.c lib/stdlib/__exit.c lib/stdlib/abort.c lib/stdlib/abs.c lib/stdlib/alloca.c lib/stdlib/atexit.c lib/stdlib/atof.c lib/stdlib/atol.c lib/stdlib/mbstowcs.c lib/string/bcmp.c lib/string/bcopy.c lib/string/bzero.c lib/string/index.c lib/string/rindex.c lib/string/strcspn.c lib/string/strdup.c lib/string/strerror.c lib/string/strncat.c lib/string/strpbrk.c lib/string/strspn.c lib/stub/__cleanup.c lib/stub/atan2.c lib/stub/bsearch.c lib/stub/chown.c lib/stub/cos.c lib/stub/ctime.c lib/stub/exp.c lib/stub/fpurge.c lib/stub/freadahead.c lib/stub/frexp.c lib/stub/getgrgid.c lib/stub/getgrnam.c lib/stub/getlogin.c lib/stub/getpgid.c lib/stub/getpgrp.c lib/stub/getpwnam.c lib/stub/getpwuid.c lib/stub/gmtime.c lib/stub/log.c lib/stub/mktime.c lib/stub/modf.c lib/stub/pclose.c lib/stub/popen.c lib/stub/pow.c lib/stub/rand.c lib/stub/rewind.c lib/stub/setbuf.c lib/stub/setgrent.c lib/stub/setlocale.c lib/stub/setvbuf.c lib/stub/sigaddset.c lib/stub/sigblock.c lib/stub/sigdelset.c lib/stub/sigsetmask.c lib/stub/sin.c lib/stub/sqrt.c lib/stub/strftime.c lib/stub/sys_siglist.c lib/stub/system.c lib/stub/times.c lib/stub/ttyname.c lib/stub/utime.c lib/linux/getegid.c lib/linux/geteuid.c lib/linux/getgid.c lib/linux/getppid.c lib/linux/getrusage.c lib/linux/getuid.c lib/linux/ioctl.c lib/linux/mknod.c lib/linux/readlink.c lib/linux/setgid.c lib/linux/settimer.c lib/linux/setuid.c lib/linux/signal.c lib/linux/sigprogmask.c",
+    "libc_mini_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-gcc/_exit.c lib/linux/x86_64-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/mes/write.c",
+    "libc_tcc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-gcc/_exit.c lib/linux/x86_64-mes-gcc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-gcc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86_64-mes-gcc/setjmp.c",
+    "libmescc_SOURCES": "lib/mes/globals.c lib/linux/x86_64-mes-gcc/syscall-internal.c",
+    "libtcc1_SOURCES": "lib/libtcc1.c",
+    "mes_SOURCES": "src/builtins.c src/cc.c src/core.c src/display.c src/eval-apply.c src/gc.c src/globals.c src/hash.c src/lib.c src/math.c src/mes.c src/module.c src/posix.c src/reader.c src/stack.c src/string.c src/struct.c src/symbol.c src/variable.c src/vector.c"
+  },
+  "x86_64.linux.mescc": {
+    "libc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-mescc/_exit.c lib/linux/x86_64-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c",
+    "libc_gnu1_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-mescc/_exit.c lib/linux/x86_64-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c",
+    "libc_gnu2_SOURCES": "lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86_64-mes-mescc/setjmp.c lib/ctype/isalnum.c lib/ctype/isalpha.c lib/ctype/isascii.c lib/ctype/iscntrl.c lib/ctype/isgraph.c lib/ctype/isprint.c lib/ctype/ispunct.c lib/math/ceil.c lib/math/fabs.c lib/math/floor.c lib/mes/fdgets.c lib/posix/alarm.c lib/posix/execl.c lib/posix/execlp.c lib/posix/mktemp.c lib/posix/pathconf.c lib/posix/sbrk.c lib/posix/sleep.c lib/posix/unsetenv.c lib/stdio/clearerr.c lib/stdio/feof.c lib/stdio/fgets.c lib/stdio/fileno.c lib/stdio/freopen.c lib/stdio/fscanf.c lib/stdio/perror.c lib/stdio/vfscanf.c lib/stdlib/__exit.c lib/stdlib/abort.c lib/stdlib/abs.c lib/stdlib/alloca.c lib/stdlib/atexit.c lib/stdlib/atof.c lib/stdlib/atol.c lib/stdlib/mbstowcs.c lib/string/bcmp.c lib/string/bcopy.c lib/string/bzero.c lib/string/index.c lib/string/rindex.c lib/string/strcspn.c lib/string/strdup.c lib/string/strerror.c lib/string/strncat.c lib/string/strpbrk.c lib/string/strspn.c lib/stub/__cleanup.c lib/stub/atan2.c lib/stub/bsearch.c lib/stub/chown.c lib/stub/cos.c lib/stub/ctime.c lib/stub/exp.c lib/stub/fpurge.c lib/stub/freadahead.c lib/stub/frexp.c lib/stub/getgrgid.c lib/stub/getgrnam.c lib/stub/getlogin.c lib/stub/getpgid.c lib/stub/getpgrp.c lib/stub/getpwnam.c lib/stub/getpwuid.c lib/stub/gmtime.c lib/stub/log.c lib/stub/mktime.c lib/stub/modf.c lib/stub/pclose.c lib/stub/popen.c lib/stub/pow.c lib/stub/rand.c lib/stub/rewind.c lib/stub/setbuf.c lib/stub/setgrent.c lib/stub/setlocale.c lib/stub/setvbuf.c lib/stub/sigaddset.c lib/stub/sigblock.c lib/stub/sigdelset.c lib/stub/sigsetmask.c lib/stub/sin.c lib/stub/sqrt.c lib/stub/strftime.c lib/stub/sys_siglist.c lib/stub/system.c lib/stub/times.c lib/stub/ttyname.c lib/stub/utime.c lib/linux/getegid.c lib/linux/geteuid.c lib/linux/getgid.c lib/linux/getppid.c lib/linux/getrusage.c lib/linux/getuid.c lib/linux/ioctl.c lib/linux/mknod.c lib/linux/readlink.c lib/linux/setgid.c lib/linux/settimer.c lib/linux/setuid.c lib/linux/signal.c lib/linux/sigprogmask.c",
+    "libc_mini_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-mescc/_exit.c lib/linux/x86_64-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/mes/write.c",
+    "libc_tcc_SOURCES": "lib/mes/__init_io.c lib/mes/eputs.c lib/mes/oputs.c lib/mes/globals.c lib/stdlib/exit.c lib/linux/x86_64-mes-mescc/_exit.c lib/linux/x86_64-mes-mescc/_write.c lib/stdlib/puts.c lib/string/strlen.c lib/ctype/isnumber.c lib/mes/abtol.c lib/mes/cast.c lib/mes/eputc.c lib/mes/fdgetc.c lib/mes/fdputc.c lib/mes/fdputs.c lib/mes/fdungetc.c lib/mes/itoa.c lib/mes/ltoa.c lib/mes/ltoab.c lib/mes/mes_open.c lib/mes/ntoab.c lib/mes/oputc.c lib/mes/ultoa.c lib/mes/utoa.c lib/stub/__raise.c lib/ctype/isdigit.c lib/ctype/isspace.c lib/ctype/isxdigit.c lib/mes/assert_msg.c lib/posix/write.c lib/stdlib/atoi.c lib/linux/lseek.c lib/dirent/__getdirentries.c lib/dirent/closedir.c lib/dirent/opendir.c lib/mes/__assert_fail.c lib/mes/__buffered_read.c lib/mes/__mes_debug.c lib/posix/execv.c lib/posix/getcwd.c lib/posix/getenv.c lib/posix/isatty.c lib/posix/open.c lib/posix/buffered-read.c lib/posix/setenv.c lib/posix/wait.c lib/stdio/fgetc.c lib/stdio/fputc.c lib/stdio/fputs.c lib/stdio/getc.c lib/stdio/getchar.c lib/stdio/putc.c lib/stdio/putchar.c lib/stdio/ungetc.c lib/stdlib/calloc.c lib/stdlib/free.c lib/stdlib/realloc.c lib/string/memchr.c lib/string/memcmp.c lib/string/memcpy.c lib/string/memmove.c lib/string/memset.c lib/string/strcmp.c lib/string/strcpy.c lib/string/strncmp.c lib/posix/raise.c lib/linux/access.c lib/linux/brk.c lib/linux/chdir.c lib/linux/chmod.c lib/linux/clock_gettime.c lib/linux/close.c lib/linux/dup.c lib/linux/dup2.c lib/linux/execve.c lib/linux/fcntl.c lib/linux/fork.c lib/linux/fstat.c lib/linux/fsync.c lib/linux/_getcwd.c lib/linux/getdents.c lib/linux/gettimeofday.c lib/linux/ioctl3.c lib/linux/link.c lib/linux/lstat.c lib/linux/_open3.c lib/linux/malloc.c lib/linux/mkdir.c lib/linux/nanosleep.c lib/linux/pipe.c lib/linux/_read.c lib/linux/readdir.c lib/linux/rename.c lib/linux/rmdir.c lib/linux/stat.c lib/linux/symlink.c lib/linux/time.c lib/linux/umask.c lib/linux/uname.c lib/linux/unlink.c lib/linux/utimensat.c lib/linux/wait4.c lib/linux/waitpid.c lib/linux/x86_64-mes-mescc/syscall.c lib/linux/getpid.c lib/linux/kill.c lib/ctype/islower.c lib/ctype/isupper.c lib/ctype/tolower.c lib/ctype/toupper.c lib/mes/abtod.c lib/mes/dtoab.c lib/mes/search-path.c lib/posix/execvp.c lib/stdio/fclose.c lib/stdio/fdopen.c lib/stdio/ferror.c lib/stdio/fflush.c lib/stdio/fopen.c lib/stdio/fprintf.c lib/stdio/fread.c lib/stdio/fseek.c lib/stdio/ftell.c lib/stdio/fwrite.c lib/stdio/printf.c lib/stdio/remove.c lib/stdio/snprintf.c lib/stdio/sprintf.c lib/stdio/sscanf.c lib/stdio/vfprintf.c lib/stdio/vprintf.c lib/stdio/vsnprintf.c lib/stdio/vsprintf.c lib/stdio/vsscanf.c lib/stdlib/qsort.c lib/stdlib/strtod.c lib/stdlib/strtof.c lib/stdlib/strtol.c lib/stdlib/strtold.c lib/stdlib/strtoll.c lib/stdlib/strtoul.c lib/stdlib/strtoull.c lib/string/memmem.c lib/string/strcat.c lib/string/strchr.c lib/string/strlwr.c lib/string/strncpy.c lib/string/strrchr.c lib/string/strstr.c lib/string/strupr.c lib/stub/sigaction.c lib/stub/ldexp.c lib/stub/mprotect.c lib/stub/localtime.c lib/stub/putenv.c lib/stub/realpath.c lib/stub/sigemptyset.c lib/x86_64-mes-mescc/setjmp.c",
+    "libmescc_SOURCES": "lib/mes/globals.c lib/linux/x86_64-mes-mescc/syscall-internal.c",
+    "libtcc1_SOURCES": "lib/libtcc1.c",
+    "mes_SOURCES": "src/builtins.c src/cc.c src/core.c src/display.c src/eval-apply.c src/gc.c src/globals.c src/hash.c src/lib.c src/math.c src/mes.c src/module.c src/posix.c src/reader.c src/stack.c src/string.c src/struct.c src/symbol.c src/variable.c src/vector.c"
   }
 }

From a7338726f54dca2fbb8d0f5eb1297af20febd57e Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Tue, 12 May 2026 18:52:45 -0400
Subject: [PATCH 116/831] minimal-bootstrap: avoid forcing meta definition

The result of commonMeta is never actually needed if assertValidity goes
away, and `.meta` is never accessed from the derivation. We perform a
similar optimization in stdenv.mkDerivation.
---
 pkgs/os-specific/linux/minimal-bootstrap/utils.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
index 180d55a91494..1339b4ca13c7 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
@@ -23,7 +23,8 @@ rec {
       baseDrv = derivation (
         {
           inherit (buildPlatform) system;
-          inherit (meta) name;
+          # redefining from meta to avoid forcing the thunk until it's used
+          name = attrs.name or "${attrs.pname}-${attrs.version}";
         }
         // maybeContentAddressed
         // (removeAttrs attrs [

From d240d8ae80d9cf1b76c59375f1c90cdee2eb190b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 14 May 2026 23:04:02 +0100
Subject: [PATCH 117/831] libmd: 1.1.0 -> 1.2.0

Changes: https://git.hadrons.org/cgit/libmd.git/log/?h=1.2.0
---
 pkgs/by-name/li/libmd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libmd/package.nix b/pkgs/by-name/li/libmd/package.nix
index 3ecb7834f29b..14abb0cfab4f 100644
--- a/pkgs/by-name/li/libmd/package.nix
+++ b/pkgs/by-name/li/libmd/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmd";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchurl {
     urls = [
       "https://archive.hadrons.org/software/libmd/libmd-${finalAttrs.version}.tar.xz"
       "https://libbsd.freedesktop.org/releases/libmd-${finalAttrs.version}.tar.xz"
     ];
-    sha256 = "sha256-G9aqQidTE68xQcfPLluWTosf1IgCXK8vlx9DsAd2szI=";
+    hash = "sha256-rBX/uEMFAvuszexmxagu4OqwsPNiIN9WcQ/q3+sT0KA=";
   };
 
   enableParallelBuilding = true;

From 757acf21b82a3ca9a070e0267acc10faced77bb3 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 13 May 2026 15:08:53 -0700
Subject: [PATCH 118/831] x265: 4.1 -> 4.2

Changelog: https://x265.readthedocs.io/en/master/releasenotes.html#version-4-2
---
 pkgs/by-name/x2/x265/package.nix | 24 ++----------------------
 1 file changed, 2 insertions(+), 22 deletions(-)

diff --git a/pkgs/by-name/x2/x265/package.nix b/pkgs/by-name/x2/x265/package.nix
index 80ef96001f7c..c51679eca4e7 100644
--- a/pkgs/by-name/x2/x265/package.nix
+++ b/pkgs/by-name/x2/x265/package.nix
@@ -36,7 +36,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "x265";
-  version = "4.1";
+  version = "4.2";
 
   outputs = [
     "out"
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   # whether we fetch a source tarball or a tag from the git repo
   src = fetchurl {
     url = "https://bitbucket.org/multicoreware/x265_git/downloads/x265_${finalAttrs.version}.tar.gz";
-    hash = "sha256-oxaZxqiYBrdLAVHl5qffZd5LSQUEgv5ev4pDedevjyk=";
+    hash = "sha256-QLHqBFPgMJ8OupNODd9TP49ilZZmeeiJTo8cHI1eEhA=";
   };
 
   patches = [
@@ -55,26 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     # fix compilation with gcc15
     # https://bitbucket.org/multicoreware/x265_git/pull-requests/36
     ./gcc15-fixes.patch
-
-    # Fix the build with CMake 4.
-    (fetchpatch {
-      name = "x265-fix-cmake-4-1.patch";
-      url = "https://bitbucket.org/multicoreware/x265_git/commits/b354c009a60bcd6d7fc04014e200a1ee9c45c167/raw";
-      stripLen = 1;
-      hash = "sha256-kS+hYZb5dnIlNoZ8ABmNkLkPx+NqCPy+DonXktBzJAE=";
-    })
-    (fetchpatch {
-      name = "x265-fix-cmake-4-2.patch";
-      url = "https://bitbucket.org/multicoreware/x265_git/commits/51ae8e922bcc4586ad4710812072289af91492a8/raw";
-      stripLen = 1;
-      hash = "sha256-ZrpyfSnijUgdyVscW73K48iEXa9k85ftNaQdr0HWSYg=";
-    })
-    (fetchpatch {
-      name = "x265-fix-cmake-4-3.patch";
-      url = "https://bitbucket.org/multicoreware/x265_git/commits/78e5ac35c13c5cbccc5933083edceb0d3eaeaa21/raw";
-      stripLen = 1;
-      hash = "sha256-qEihgUKGEdthbKz67s+/hS/qdpzl+3tEB3gx2tarax4=";
-    })
   ]
   # TODO: remove after update to version 4.2
   ++ lib.optionals (stdenv.hostPlatform.isAarch32 && stdenv.hostPlatform.isLinux) [

From a7daddef5b46fd55f43e3aad943882516d5609c7 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 13 May 2026 18:14:53 -0700
Subject: [PATCH 119/831] handbrake: 1.10.2 -> 1.11.1

---
 pkgs/by-name/ha/handbrake/package.nix | 149 +++++++++++++++-----------
 1 file changed, 85 insertions(+), 64 deletions(-)

diff --git a/pkgs/by-name/ha/handbrake/package.nix b/pkgs/by-name/ha/handbrake/package.nix
index ce91685cf0b2..edc886281aca 100644
--- a/pkgs/by-name/ha/handbrake/package.nix
+++ b/pkgs/by-name/ha/handbrake/package.nix
@@ -10,7 +10,10 @@
 {
   stdenv,
   lib,
+  applyPatches,
   fetchFromGitHub,
+  fetchFromGitLab,
+  fetchpatch2,
   # For tests
   testers,
   runCommand,
@@ -26,7 +29,7 @@
   numactl,
   writeText,
   # Processing, video codecs, containers
-  ffmpeg_7-full,
+  ffmpeg_8-full,
   nv-codec-headers,
   libogg,
   x264,
@@ -85,14 +88,35 @@
 }:
 
 let
-  version = "1.10.2";
+  version = "1.11.1";
 
-  src = fetchFromGitHub {
-    owner = "HandBrake";
-    repo = "HandBrake";
-    # uses version commit for logic in version.txt
-    rev = "dddf75f756e56d2b8dbb0609175bc12047a4841d";
-    hash = "sha256-CIMpJDJ0IIz95f3/zxeQqpCFpHWEmdgA+VaaUDY516A=";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "HandBrake";
+      repo = "HandBrake";
+      # uses version commit for logic in version.txt
+      rev = "4ce99a885cde39b3511016efdb5124726819defb";
+      hash = "sha256-oWXNiRK0wbmINnjM3GrOIawcSULTuy3yANfgW8li9F0=";
+    };
+
+    patches = [
+      # Only needed so the subsequent patch applies
+      (fetchpatch2 {
+        url = "https://github.com/HandBrake/HandBrake/commit/c8e16778a330881af36fa32004f887bd73874d15.patch";
+        hash = "sha256-i3/X9opDzsZIO7bjLHHZltuQH93uENRF0t7FP7DDdBM=";
+      })
+      # Update x265 submodule to v4.2, drop in next release
+      (fetchpatch2 {
+        url = "https://github.com/HandBrake/HandBrake/commit/432514bf839e7280511e4a7afc35fb4868ef4d0b.patch";
+        excludes = [
+          "contrib/x265/module.defs"
+          "contrib/x265_8bit/module.defs"
+          "contrib/x265_10bit/module.defs"
+          "contrib/x265_12bit/module.defs"
+        ];
+        hash = "sha256-xwIY1pO9mKbrQFjQCENuvntIoiZTHeUVg8axrl3zxxo=";
+      })
+    ];
   };
 
   # Handbrake maintains a set of ffmpeg patches. In particular, these
@@ -100,70 +124,67 @@ let
   # https://github.com/HandBrake/HandBrake/issues/4029
   # base ffmpeg version is specified in:
   # https://github.com/HandBrake/HandBrake/blob/master/contrib/ffmpeg/module.defs
-  ffmpeg-version = "7.1.1";
-  ffmpeg-hb =
-    (ffmpeg_7-full.override {
-      version = ffmpeg-version;
-      hash = "sha256-GyS8imOqfOUPxXrzCiQtzCQIIH6bvWmQAB0fKUcRsW4=";
-    }).overrideAttrs
-      (old: {
-        patches = (old.patches or [ ]) ++ [
-          "${src}/contrib/ffmpeg/A01-mov-read-name-track-tag-written-by-movenc.patch"
-          "${src}/contrib/ffmpeg/A02-movenc-write-3gpp-track-titl-tag.patch"
-          "${src}/contrib/ffmpeg/A03-mov-read-3gpp-udta-tags.patch"
-          "${src}/contrib/ffmpeg/A04-movenc-write-3gpp-track-names-tags-for-all-available.patch"
-          "${src}/contrib/ffmpeg/A05-avformat-mov-add-support-audio-fallback-track-ref.patch"
-          "${src}/contrib/ffmpeg/A06-dvdsubdec-fix-processing-of-partial-packets.patch"
-          "${src}/contrib/ffmpeg/A07-dvdsubdec-return-number-of-bytes-used.patch"
-          "${src}/contrib/ffmpeg/A08-dvdsubdec-use-pts-of-initial-packet.patch"
-          "${src}/contrib/ffmpeg/A09-dvdsubdec-add-an-option-to-output-subtitles-with-emp.patch"
-          "${src}/contrib/ffmpeg/A10-ccaption_dec-fix-pts-in-real_time-mode.patch"
-          "${src}/contrib/ffmpeg/A11-avformat-matroskaenc-return-error-if-aac-extradata-c.patch"
-          "${src}/contrib/ffmpeg/A12-videotoolbox-disable-H.264-10-bit-on-Intel-macOS-it-.patch"
-
-          # patch to fix <https://github.com/HandBrake/HandBrake/issues/5011>
-          # commented out because it causes ffmpeg's filter-pixdesc-p010le test to fail.
-          # "${src}/contrib/ffmpeg/A13-libswscale-fix-yuv420p-to-p01xle-color-conversion-bu.patch"
-
-          "${src}/contrib/ffmpeg/A14-hevc_mp4toannexb.c-fix-qsv-decode-of-10bit-hdr.patch"
-          "${src}/contrib/ffmpeg/A15-Expose-the-unmodified-Dolby-Vision-RPU-T35-buffers.patch"
-          "${src}/contrib/ffmpeg/A16-avcodec-amfenc-Add-support-for-on-demand-key-frames.patch"
-          "${src}/contrib/ffmpeg/A17-avcodec-amfenc-properly-set-primaries-transfer-and-m.patch"
-          "${src}/contrib/ffmpeg/A18-libavcodec-qsvenc-update-has_b_frames-value.patch"
-          "${src}/contrib/ffmpeg/A19-libavcodec-qsv-enable-av1-scc.patch"
-          "${src}/contrib/ffmpeg/A20-Revert-avcodec-amfenc-GPU-driver-version-check.patch"
-          "${src}/contrib/ffmpeg/A21-lavc-pgssubdec-Add-graphic-plane-and-cropping.patch"
-          "${src}/contrib/ffmpeg/A22-avformat-mov-read-and-write-additional-iTunes-style-.patch"
-          "${src}/contrib/ffmpeg/A23-avformat-movenc-write-iTunEXTC-and-iTunMOVI-metadata.patch"
-          "${src}/contrib/ffmpeg/A24-AV1-videotoolbox.patch"
-          "${src}/contrib/ffmpeg/A25-videotoolbox-speedup-decoding.patch"
-          "${src}/contrib/ffmpeg/A28-enable-av1_mf-encoder.patch"
-          "${src}/contrib/ffmpeg/A30-qsv-fixed-BT2020-BT709-conversion.patch"
-          "${src}/contrib/ffmpeg/A31-Parse-EAC3-Atmos-ComplexityIndex-for-MP4-remuxing.patch"
-        ];
-      });
+  ffmpeg-hb = ffmpeg_8-full.overrideAttrs (old: {
+    patches = (old.patches or [ ]) ++ [
+      "${src}/contrib/ffmpeg/A01-mov-read-name-track-tag-written-by-movenc.patch"
+      "${src}/contrib/ffmpeg/A02-movenc-write-3gpp-track-titl-tag.patch"
+      "${src}/contrib/ffmpeg/A03-mov-read-3gpp-udta-tags.patch"
+      "${src}/contrib/ffmpeg/A04-movenc-write-3gpp-track-names-tags-for-all-available.patch"
+      "${src}/contrib/ffmpeg/A05-avformat-mov-add-support-audio-fallback-track-ref.patch"
+      "${src}/contrib/ffmpeg/A06-avformat-mov-read-and-write-additional-iTunes-style-.patch"
+      "${src}/contrib/ffmpeg/A07-avformat-movenc-write-iTunEXTC-and-iTunMOVI-metadata.patch"
+      "${src}/contrib/ffmpeg/A08-dvdsubdec-fix-processing-of-partial-packets.patch"
+      "${src}/contrib/ffmpeg/A09-dvdsubdec-return-number-of-bytes-used.patch"
+      "${src}/contrib/ffmpeg/A10-dvdsubdec-use-pts-of-initial-packet.patch"
+      "${src}/contrib/ffmpeg/A11-dvdsubdec-add-an-option-to-output-subtitles-with-emp.patch"
+      "${src}/contrib/ffmpeg/A12-ccaption_dec-fix-pts-in-real_time-mode.patch"
+      "${src}/contrib/ffmpeg/A13-avformat-matroskaenc-return-error-if-aac-extradata-c.patch"
+      "${src}/contrib/ffmpeg/A14-Expose-the-unmodified-Dolby-Vision-RPU-T35-buffers.patch"
+      "${src}/contrib/ffmpeg/A15-lavc-pgssubdec-Add-graphic-plane-and-cropping.patch"
+      "${src}/contrib/ffmpeg/A16-libavcodec-qsvenc.c-update-has_b_frames-value-after-.patch"
+      "${src}/contrib/ffmpeg/A17-qsv-enable-av1-scc.patch"
+      "${src}/contrib/ffmpeg/A18-fixed-BT2020-BT709-conversion-via-VPP.patch"
+      "${src}/contrib/ffmpeg/A19-videotoolbox-disable-H.264-10-bit-on-Intel-macOS-it-.patch"
+      "${src}/contrib/ffmpeg/A20-videotoolbox-speedup-decoding.patch"
+      "${src}/contrib/ffmpeg/A21-Revert-avcodec-amfenc-GPU-driver-version-check.patch"
+      "${src}/contrib/ffmpeg/A22-fix-d3d11-static-pool-size-error.patch"
+      "${src}/contrib/ffmpeg/A23-movenc-set-the-chapters-track-language-to-the-same-a.patch"
+      "${src}/contrib/ffmpeg/A24-movenc-use-version-2-audio-descriptor-for-2-channels.patch"
+    ];
+  });
 
   x265-hb = x265.overrideAttrs (old: {
-    version = "4.1";
-    sourceRoot = "x265_4.1/source";
+    version = "4.2";
+    sourceRoot = "x265_4.2/source";
     src = fetchurl {
-      url = "https://bitbucket.org/multicoreware/x265_git/downloads/x265_4.1.tar.gz";
-      hash = "sha256-oxaZxqiYBrdLAVHl5qffZd5LSQUEgv5ev4pDedevjyk=";
+      url = "https://bitbucket.org/multicoreware/x265_git/downloads/x265_4.2.tar.gz";
+      hash = "sha256-QLHqBFPgMJ8OupNODd9TP49ilZZmeeiJTo8cHI1eEhA=";
     };
     # nixpkgs' x265 sourceRoot is x265-.../source whereas handbrake's x265 patches
     # are written with respect to the parent directory instead of that source directory.
     # patches which don't cleanly apply are commented out.
     postPatch = (old.postPatch or "") + ''
       pushd ..
-      patch -p1 < ${src}/contrib/x265/A01-Do-not-set-thread-priority-on-Windows.patch
-      patch -p1 < ${src}/contrib/x265/A02-Apple-Silicon-tuning.patch
-      patch -p1 < ${src}/contrib/x265/A03-Implement-ambient-viewing-environment-sei.patch
-      patch -p1 < ${src}/contrib/x265/A04-add-new-matrix-coefficients-from-H.273-v3.patch
-      patch -p1 < ${src}/contrib/x265/A05-Fix-Dolby-Vision-RPU-memory-management.patch
-      # patch -p1 < ${src}/contrib/x265/A06-Update-version-strings.patch
-      patch -p1 < ${src}/contrib/x265/A07-Fix-macOS-cross-compilation.patch
-      # patch -p1 < ${src}/contrib/x265/A08-Fix-inconsistent-bitrate-in-second-pass.patch
-      patch -p1 < ${src}/contrib/x265/A09-Ensuring-the-mvdLX-is-compliant.patch
+        for p in ${src}/contrib/x265/*.patch; do
+          patch -p1 < "$p"
+        done
+      popd
+    '';
+  });
+
+  svt-av1-hb = svt-av1.overrideAttrs (old: rec {
+    version = "4.0.1";
+    src = fetchFromGitLab {
+      owner = "AOMediaCodec";
+      repo = "SVT-AV1";
+      rev = "v${version}";
+      hash = "sha256-7krVkLZxgolqPTkuyKAx07BekAPacftcGZ44lQTQFZQ=";
+    };
+    postPatch = (old.postPatch or "") + ''
+      pushd ..
+        for p in ${src}/contrib/svt-av1/*.patch; do
+          patch -p1 < "$p"
+        done
       popd
     '';
   });
@@ -268,7 +289,7 @@ let
       libvpx
       libxml2
       speex
-      svt-av1
+      svt-av1-hb
       x264
       x265-hb
       xz

From ecc16d328b05308abd7b80af1fdb33def80ffd6b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 15 May 2026 19:04:04 +0000
Subject: [PATCH 120/831] tinyxxd: 1.3.15 -> 1.3.16

---
 pkgs/by-name/ti/tinyxxd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ti/tinyxxd/package.nix b/pkgs/by-name/ti/tinyxxd/package.nix
index c149c0f7c3b6..2c0cc51b5520 100644
--- a/pkgs/by-name/ti/tinyxxd/package.nix
+++ b/pkgs/by-name/ti/tinyxxd/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tinyxxd";
-  version = "1.3.15";
+  version = "1.3.16";
 
   src = fetchFromGitHub {
     repo = "tinyxxd";
     owner = "xyproto";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JLu3x54/kpKhvfTeWovxmV+/bEB4MqaNlFPrHnM/+ko=";
+    hash = "sha256-SaxjQFQ//xxRCIx4FMx1exGGOGEKN/evgABTquL92WM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

From c8a15a9b709bd7bb191ad7587a9ea55e54116f7b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 15 May 2026 21:16:22 +0100
Subject: [PATCH 121/831] libei: 1.5.0 -> 1.6.0

Changes: https://gitlab.freedesktop.org/libinput/libei/-/releases/1.6.0
---
 pkgs/by-name/li/libei/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libei/package.nix b/pkgs/by-name/li/libei/package.nix
index 93e90b41467c..4724fb81451f 100644
--- a/pkgs/by-name/li/libei/package.nix
+++ b/pkgs/by-name/li/libei/package.nix
@@ -27,14 +27,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libei";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "libinput";
     repo = "libei";
     rev = finalAttrs.version;
-    hash = "sha256-PqQpJz88tDzjwsBuwxpWcGAWz6Gp6A/oAOS87uxGOGs=";
+    hash = "sha256-fUeMdRK7uoRvgvY3INMorwnTleLrLA5xOeYBFp1qXeI=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isBSD [

From 3c52efb060ec585d4b6adbf09822ab75f3476ecb Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sat, 16 May 2026 05:11:20 -0400
Subject: [PATCH 122/831] libunistring: enable __structuredAttrs

This is early in the bootstrap process.

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/development/libraries/libunistring/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 9a0bb2387e80..c0c8c61e64d7 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libunistring";
   version = "1.4.2";
 
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "mirror://gnu/libunistring/libunistring-${finalAttrs.version}.tar.gz";
     hash = "sha256-6CZksXAGTmIzGWISayWdRS1Tsie7SpOrIAQNhG/sAdg=";

From 65c17bdbe095b5ab84f03b2d8214d596573b1ca0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 16 May 2026 18:41:32 +0000
Subject: [PATCH 123/831] utf8cpp: 4.0.9 -> 4.1.0

---
 pkgs/by-name/ut/utf8cpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/utf8cpp/package.nix b/pkgs/by-name/ut/utf8cpp/package.nix
index a97a1043b555..c801aca45475 100644
--- a/pkgs/by-name/ut/utf8cpp/package.nix
+++ b/pkgs/by-name/ut/utf8cpp/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "utf8cpp";
-  version = "4.0.9";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0FgMKHymFOA3BM7VS8US2is8TmQlL/wWj4nSRihqcDo=";
+    hash = "sha256-Jh/sdWx+FWR70iqmPqDI/ZcyHBoSQFcGrQSICipdXbA=";
   };
 
   nativeBuildInputs = [ cmake ];

From 35441d748159534185e67177d683e3c58a41321e Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sat, 16 May 2026 15:53:16 -0400
Subject: [PATCH 124/831] c-ares: enable strictDeps, structuredAttrs

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/c-/c-ares/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/c-/c-ares/package.nix b/pkgs/by-name/c-/c-ares/package.nix
index 4e7a3b2e97ba..35d956d9d5b1 100644
--- a/pkgs/by-name/c-/c-ares/package.nix
+++ b/pkgs/by-name/c-/c-ares/package.nix
@@ -20,6 +20,9 @@ stdenv.mkDerivation rec {
   pname = "c-ares";
   version = "1.34.6";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
     # Note: tag name varies in some versions, e.g. v1.30.0, c-ares-1_17_0.
     url = "https://github.com/c-ares/c-ares/releases/download/v${version}/c-ares-${version}.tar.gz";

From 01e4dac6b3c1ca14ebebe2b59b06f48c692a9be6 Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Wed, 13 May 2026 14:48:35 +0200
Subject: [PATCH 125/831] boost: strictDeps

---
 pkgs/development/libraries/boost/generic.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 09e6aa28c567..5f219a93418a 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -423,5 +423,7 @@ stdenv.mkDerivation {
   ];
   setOutputFlags = false;
 
+  strictDeps = true;
+
   __structuredAttrs = true;
 }

From 097b8a0ef0503be85b9845d483a5445b567e4160 Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Sat, 16 May 2026 23:49:04 +0200
Subject: [PATCH 126/831] python3Packages.boost: fix use of user-config.jam

---
 pkgs/development/libraries/boost/generic.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index 5f219a93418a..2c5bcf0c7c0e 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -74,6 +74,7 @@ let
 
   needUserConfig =
     stdenv.hostPlatform != stdenv.buildPlatform
+    || enablePython
     || useMpi
     || (stdenv.hostPlatform.isDarwin && enableShared);
 

From 52a17d79945fd79d6ef161d708b3a277336a9b7a Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Tue, 5 May 2026 11:25:50 +0200
Subject: [PATCH 127/831] boost191: init at 1.91.0

---
 pkgs/by-name/bo/boost-build/package.nix      |  4 ++-
 pkgs/development/libraries/boost/1.91.nix    | 26 ++++++++++++++++++++
 pkgs/development/libraries/boost/default.nix |  1 +
 pkgs/top-level/all-packages.nix              |  1 +
 4 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/libraries/boost/1.91.nix

diff --git a/pkgs/by-name/bo/boost-build/package.nix b/pkgs/by-name/bo/boost-build/package.nix
index f789f8c0cb82..b3f17995518a 100644
--- a/pkgs/by-name/bo/boost-build/package.nix
+++ b/pkgs/by-name/bo/boost-build/package.nix
@@ -35,7 +35,9 @@ stdenv.mkDerivation {
   patches =
     useBoost.boostBuildPatches or [ ]
     ++ lib.optional (
-      useBoost ? version && lib.versionAtLeast useBoost.version "1.81"
+      useBoost ? version
+      && lib.versionAtLeast useBoost.version "1.81"
+      && lib.versionOlder useBoost.version "1.88"
     ) ./fix-clang-target.patch;
 
   postPatch =
diff --git a/pkgs/development/libraries/boost/1.91.nix b/pkgs/development/libraries/boost/1.91.nix
new file mode 100644
index 000000000000..6a0587e5cc38
--- /dev/null
+++ b/pkgs/development/libraries/boost/1.91.nix
@@ -0,0 +1,26 @@
+{
+  lib,
+  callPackage,
+  fetchurl,
+  ...
+}@args:
+
+callPackage ./generic.nix (
+  args
+  // rec {
+    version = "1.91.0";
+
+    src =
+      let
+        underVersion = lib.replaceString "." "_" version;
+      in
+      fetchurl {
+        urls = [
+          "https://archives.boost.io/release/${version}/source/boost_${underVersion}.tar.bz2"
+          # "mirror://sourceforge/boost/boost_${underVersion}.tar.bz2" 1.91.0.beta1 is available, but not 1.91.0
+        ];
+        # SHA256 from https://www.boost.org/releases/1.91.0/
+        sha256 = "de5e6b0e4913395c6bdfa90537febd9028ea4c0735d2cdb0cd9b45d5f51264f5";
+      };
+  }
+)
diff --git a/pkgs/development/libraries/boost/default.nix b/pkgs/development/libraries/boost/default.nix
index 930cfab4e8bf..c9eb8ec98b63 100644
--- a/pkgs/development/libraries/boost/default.nix
+++ b/pkgs/development/libraries/boost/default.nix
@@ -31,4 +31,5 @@ in
   boost188 = makeBoost ./1.88.nix;
   boost189 = makeBoost ./1.89.nix;
   boost190 = makeBoost ./1.90.nix;
+  boost191 = makeBoost ./1.91.nix;
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dad4830b1531..5f2e711b1dca 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6023,6 +6023,7 @@ with pkgs;
     boost188
     boost189
     boost190
+    boost191
     ;
 
   boost = boost189;

From e7c432489f86d2650d6dd9bc95ea01cf46c86257 Mon Sep 17 00:00:00 2001
From: Jack Rosenberg <mail@jackr.eu>
Date: Tue, 5 May 2026 10:35:37 +0200
Subject: [PATCH 128/831] fuse3: 3.17.4 -> 3.18.2
 https://github.com/libfuse/libfuse/blob/fuse-3.18.2/ChangeLog.rst
 https://github.com/libfuse/libfuse/compare/fuse-3.17.2...fuse-3.18.2

---
 pkgs/os-specific/linux/fuse/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 41c8e32a27ec..983bb378d7c0 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -14,7 +14,7 @@ in
   };
 
   fuse_3 = mkFuse {
-    version = "3.17.4";
-    hash = "sha256-G3+cBp8q8S8oLIcgWp0p+TAtzqXlKYbRSY/5Y3L7QO4=";
+    version = "3.18.2";
+    hash = "sha256-QArQMSStVxwUo6CgU2JlXBdFWjzlGXfZk1AVGLGeE70=";
   };
 }

From c7c2309c84a1729387b3a315b373c97de8f8833a Mon Sep 17 00:00:00 2001
From: Jack Rosenberg <mail@jackr.eu>
Date: Tue, 5 May 2026 10:48:39 +0200
Subject: [PATCH 129/831] fuse3: modernize

---
 pkgs/os-specific/linux/fuse/common.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index 726032f36d26..130d3e8c846c 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -20,22 +20,25 @@
 let
   isFuse3 = lib.hasPrefix "3" version;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fuse";
   inherit version;
 
   src = fetchFromGitHub {
     owner = "libfuse";
     repo = "libfuse";
-    rev = "${pname}-${version}";
+    tag = "fuse-${version}";
     inherit hash;
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   patches =
     lib.optional (!isFuse3 && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isLoongArch64))
       (fetchpatch {
         url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
-        sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa";
+        hash = "sha256-UsLE14P50Ell0xo3PESk5tIHH2HLalsaWiEubO9KdPE=";
       })
     ++ (
       if isFuse3 then
@@ -48,7 +51,7 @@ stdenv.mkDerivation rec {
           ./fuse2-Do-not-set-FUSERMOUNT_DIR.patch
           (fetchpatch {
             url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-fs/fuse/files/fuse-2.9.9-closefrom-glibc-2-34.patch?id=8a970396fca7aca2d5a761b8e7a8242f1eef14c9";
-            sha256 = "sha256-ELYBW/wxRcSMssv7ejCObrpsJHtOPJcGq33B9yHQII4=";
+            hash = "sha256-ELYBW/wxRcSMssv7ejCObrpsJHtOPJcGq33B9yHQII4=";
           })
           ./fuse2-gettext-0.25.patch
         ]
@@ -145,4 +148,4 @@ stdenv.mkDerivation rec {
     ];
     outputsToInstall = [ "bin" ];
   };
-}
+})

From 329b59d07d7f527a9dcb25481b3504804b8cd70b Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 19 Jan 2026 19:38:26 -0500
Subject: [PATCH 130/831] dbus: fix install name on installed binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some binaries have incorrect install names. They should be the absolute
path, but they have `@rpath` instead. This something that Meson should
handle automatically, but it’s not happening for these binaries.
---
 pkgs/by-name/db/dbus/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/db/dbus/package.nix b/pkgs/by-name/db/dbus/package.nix
index b754f292c7c3..7084c73c5085 100644
--- a/pkgs/by-name/db/dbus/package.nix
+++ b/pkgs/by-name/db/dbus/package.nix
@@ -156,6 +156,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'DBUS_DAEMONDIR"/dbus-daemon"' '"/run/current-system/sw/bin/dbus-daemon"'
   '';
 
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # For some reason, only these binaries reference the dylib by rpath instead of by an absolute install name.
+    for exe in bin/dbus-daemon bin/dbus-run-session libexec/dbus-daemon-launch-helper; do
+      install_name_tool "$out/$exe" \
+        -change "@rpath/libdbus-1.3.dylib" "$lib/lib/libdbus-1.3.dylib"
+    done
+  '';
+
   postFixup = ''
     # It's executed from $lib by absolute path
     moveToOutput bin/dbus-launch "$lib"

From 171926f883a3ea50add3939d569a75417982f72c Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 19 Jan 2026 19:38:26 -0500
Subject: [PATCH 131/831] dbus: default to using tmpdir instead of launchd
 activation

This matches the default behavior on Linux. If D-Bus defaults to launchd
activation, all packages or tests using `dbus-run-session` will fail due
the launch agent not being installed and available.
---
 pkgs/by-name/db/dbus/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/db/dbus/package.nix b/pkgs/by-name/db/dbus/package.nix
index 7084c73c5085..264f6d944497 100644
--- a/pkgs/by-name/db/dbus/package.nix
+++ b/pkgs/by-name/db/dbus/package.nix
@@ -129,6 +129,9 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dselinux=disabled"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # D-Bus defaults to launchd-activation on Darwin, but that requires the launch agent be installed. It also breaks
+    # anything that uses `dbus-run-session` in tests. Changing the default aligns Darwin with other UNIX platforms.
+    "-Ddbus_session_bus_listen_address=unix:tmpdir=/tmp"
     # `launchctl` is only needed at runtime. Lie to `find_program` because it will always be present on a Darwin host.
     "--cross-file=${writeText "darwin.ini" ''
       [binaries]

From 033d41e2e542a1449f933113a601e77220755897 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 132/831] darwin.sourceRelease: 26.3 -> 26.4

IOAudioFamily: 700.2 -> 740.1
IOHIDFamily: 2222.80.22 -> 2238.100.59
IOKitUser: 100222.80.4 -> 100231.100.18.0.1
IONetworkingFamily: 186 -> 188
IOStorageFamily: 333.40.1 -> 337.100.1
Libc: 1725.40.4 -> 1752.100.10
Libnotify: 344.0.1 -> 48.100.7
Security: 61901.80.25 -> 61901.101.4
configd: 1385.80.4 -> 1405.100.8
eap8021x: 368.60.2 -> 368.101.1
hfs: 704.60.4 -> 715.100.10
libdispatch: 1542.0.4 -> 1542.100.32
libmalloc: 792.80.2 -> 812.100.31
libplatform: 359.80.2 -> 375.100.10
libpthread: 539.80.3 -> 539.100.4
mDNSResponder: 2881.80.4.0.1 -> 2881.100.56.0.1
objc4: 951.1 -> 951.7
ppp: 1023 -> 1025
xnu: 12377.81.4 -> 12377.101.15
---
 .../darwin/sourceRelease/versions.json        | 76 +++++++++----------
 1 file changed, 38 insertions(+), 38 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 352df185452c..d51fffa33a75 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -21,7 +21,7 @@
   },
   "IOAudioFamily": {
     "hash": "sha256-A3iiAjjP29VdjMj40tLS5Q/ni4qeh9bBpnmNzeG2pIY=",
-    "version": "700.2"
+    "version": "740.1"
   },
   "IOBDStorageFamily": {
     "hash": "sha256-OcQUJ3nEfrpvWX/npnedJ4PECIGWFSLiM0PKoiH911w=",
@@ -56,40 +56,40 @@
     "version": "262"
   },
   "IOGraphics": {
-    "hash": "sha256-iysZE42mOKZbFxSZBNspaBTCRKEKK38DFGBxZWQxZxI=",
-    "version": "599"
+    "hash": "sha256-+9DtN1aRQQXLl+OaMZNXdD7ae+NZw3eSWpVhRY5qvhw=",
+    "version": "600"
   },
   "IOHIDFamily": {
-    "hash": "sha256-EJg5lL5uuFCzeOjKDeNZCRYlinwt4WDci0Lr8rJ4Q9k=",
-    "version": "2222.80.22"
+    "hash": "sha256-BORZA8jiVFq/HHY6AnSotKyERkWAN1jK555ZNPW4G1M=",
+    "version": "2238.100.59"
   },
   "IOKitTools": {
     "hash": "sha256-Oknsvzn4nv77WU7f0WPS446iwR2BM2q4iw46r/qctAE=",
     "version": "125"
   },
   "IOKitUser": {
-    "hash": "sha256-bT6CIKd4/Ea17jWd74FWvz5dsmdyDRGU+D5/VydAjrA=",
-    "version": "100222.80.4"
+    "hash": "sha256-PPsD3JGEJlwe9qJdlduQP4q13DtUT3Eak7W1WhlUdn4=",
+    "version": "100231.100.18.0.1"
   },
   "IONetworkingFamily": {
-    "hash": "sha256-ZF5ML41Y1l1liQn32qTkcl4mMvx9Xdizb9VgvTzVTL4=",
-    "version": "186"
+    "hash": "sha256-zSmOsiCh+W1k9d6G2+/FD0KPrrtjQTkZscyKgKIa3UU=",
+    "version": "188"
   },
   "IOSerialFamily": {
     "hash": "sha256-wVS4QTx6MBOS0VrwyCZ3s5Usezwaf8rWzmNnfdDTXTU=",
     "version": "93"
   },
   "IOStorageFamily": {
-    "hash": "sha256-5oUSyzMxniNHG7rPkuxb31v4QcOmXNCriI3Jku2VOTY=",
-    "version": "333.40.1"
+    "hash": "sha256-whybjI8XIaihvo16oLq6xP5pNRPZeG7Jdy5jbyWqG1k=",
+    "version": "337.100.1"
   },
   "IOUSBFamily": {
     "hash": "sha256-Z0E3TfKP49toYo1Fo9kElRap8CZ+mVDHy5RIexgJTpA=",
     "version": "630.4.5"
   },
   "Libc": {
-    "hash": "sha256-3r3IFwONIg+4Oe99IRJ4jvyevZRmIuFmjVL+JMrfw/M=",
-    "version": "1725.40.4"
+    "hash": "sha256-+40LeOU1ViMKBXCSvJXQi1N8NSAhL/rlucR32KZ+Chw=",
+    "version": "1752.100.10"
   },
   "Libinfo": {
     "hash": "sha256-4InBEPi0n2EMo/8mIBib1Im4iTKRcRJ4IlAcLCigVGk=",
@@ -100,8 +100,8 @@
     "version": "2026"
   },
   "Libnotify": {
-    "hash": "sha256-p8cJZlBYOFmI1NDHXGYjgcv8z9Ldc1amZuYlxxJfeVY=",
-    "version": "344.0.1"
+    "hash": "sha256-5ZpFParMjqf3nwsjx3Y1SCTXmTUtHX9eDkVJTW59Ppg=",
+    "version": "348.100.7"
   },
   "Librpcsvc": {
     "hash": "sha256-UWYdCQ9QsBqwM01bWr+igINAHSdSluB/FrOclC5AjTI=",
@@ -120,8 +120,8 @@
     "version": "1846.81.1"
   },
   "Security": {
-    "hash": "sha256-+Rt3+bwj7++u8Pm5V6QgIQUpugwcY2gjqkCWZ2xqGqw=",
-    "version": "61901.80.25"
+    "hash": "sha256-1ka7ws6POwm+WKwB/VYZX/uQTQccJe5r9tYDHgoqHp0=",
+    "version": "61901.101.4"
   },
   "adv_cmds": {
     "hash": "sha256-QSqEchXCBSUo6kpGb1FyCcrZx1RFfUP/9hoNbQK2lF8=",
@@ -140,8 +140,8 @@
     "version": "138"
   },
   "configd": {
-    "hash": "sha256-OJhJocVQvIaulSK65z2URATB+NTnFdOXyunjcBGr08k=",
-    "version": "1385.80.4"
+    "hash": "sha256-3GiQlhfYhemK37ue0KY8Q3CDQK2TMFRDFnoxFeJzO+k=",
+    "version": "1405.100.8"
   },
   "copyfile": {
     "hash": "sha256-I9uDi5BDQKa7mO3XpHxv0d6PiROW2ueZ3vGfrsG0OJo=",
@@ -168,16 +168,16 @@
     "version": "1340"
   },
   "eap8021x": {
-    "hash": "sha256-To9CIsN0oXRmtUjPojXYfUmaoOOdrNbq3AYwghxzoQs=",
-    "version": "368.60.2"
+    "hash": "sha256-nwCp5QgtXC2X3y5eR3DnXkdpECNkLmejM2iGQ6nuPaQ=",
+    "version": "368.101.1"
   },
   "file_cmds": {
     "hash": "sha256-1hdTjg1Nf31gAhwjQEhRZQhaqayC8x7PGHAwZ1aEIm8=",
     "version": "475"
   },
   "hfs": {
-    "hash": "sha256-WqXzEVvveaOvTbVN/HzKdDxeHYmxEfLhV3WjO/S+u1E=",
-    "version": "704.60.4"
+    "hash": "sha256-GOI7U2J4vy5GQRubSWqx0xZFtE4e/hq7SsUuqptrYR0=",
+    "version": "715.100.10"
   },
   "launchd": {
     "hash": "sha256-8mW9bnuHmRXCx9py8Wy28C5b2QPICW0rlAps5njYa00=",
@@ -188,8 +188,8 @@
     "version": "96"
   },
   "libdispatch": {
-    "hash": "sha256-L0+Ho9dAlMXVpqFEGIcIMsJc0gULckRulUImNEZe5MU=",
-    "version": "1542.0.4"
+    "hash": "sha256-1PHHUzPipwUdzk9uMHweG64J4EU4lixPApV7qwPBpWY=",
+    "version": "1542.100.32"
   },
   "libffi": {
     "hash": "sha256-xHefZVsZg9kUXV0t/HLdjPkkD/hn/4bvdRVJ4PsQLeM=",
@@ -200,20 +200,20 @@
     "version": "113"
   },
   "libmalloc": {
-    "hash": "sha256-FYWPf6UwDfmWtde2xW1EuBfygv43bvzGncKEMUHY3Qc=",
-    "version": "792.80.2"
+    "hash": "sha256-kwJ6vfk1PzDdE0n3Ba+3hXLSf63YmMgPluxrEuvOpF0=",
+    "version": "812.100.31"
   },
   "libpcap": {
     "hash": "sha256-G7CL3pCCmxOoZ+ouA+xfOeDgvLcT9AN9zyrx+cL2Ge4=",
     "version": "144"
   },
   "libplatform": {
-    "hash": "sha256-m1g1suIbEA4g7vWEKYR9x+g0aaXSjvR0IRy4jCU+y0w=",
-    "version": "359.80.2"
+    "hash": "sha256-bghS+sClE2nygZMahh1udoMZmGvRSCKn+W4ywTi51Zw=",
+    "version": "375.100.10"
   },
   "libpthread": {
     "hash": "sha256-3Xoe0gYZ6RbMZqzsAG8ynnFb3cqypFYImPNYA5H6P9s=",
-    "version": "539.80.3"
+    "version": "539.100.4"
   },
   "libresolv": {
     "hash": "sha256-SDdF7foz8DFUXmXEznwusNMkXFHrPkdLWQM8xfxb0gc=",
@@ -224,8 +224,8 @@
     "version": "73"
   },
   "mDNSResponder": {
-    "hash": "sha256-Wa6IM6qz/gjO1GwER7KkPEiknEJbkntA2Q92Bc/YMoY=",
-    "version": "2881.80.4.0.1"
+    "hash": "sha256-0u2c3b0rmOFock4wIWg6n16XZWEr+bsj2r5JwgUOr7o=",
+    "version": "2881.100.56.0.1"
   },
   "mail_cmds": {
     "hash": "sha256-peoaHopJaYDqyE4TGfLx7W1K2KsFZmHLWr8Er/HpA90=",
@@ -240,16 +240,16 @@
     "version": "730.80.3"
   },
   "objc4": {
-    "hash": "sha256-imgOe9mr5HnvTAupIEj1UwS7tbmk3coqNf5BQgI32lE=",
-    "version": "951.1"
+    "hash": "sha256-vonl+pqJurD7ozdZ8AQokvtlgKXCk+BP/vFfoyGJiUQ=",
+    "version": "951.7"
   },
   "patch_cmds": {
     "hash": "sha256-fDY2NOT3DnU5pm06cHSs+JJcA/EFP8Lxjg7sErUerJ0=",
     "version": "72"
   },
   "ppp": {
-    "hash": "sha256-N8e3BvyxTvb+mAhNHuCWVGqEyEE89G2zNQDL/mro+X0=",
-    "version": "1023"
+    "hash": "sha256-syc0tbDPACswBNNrTaOsC6Lyix6d7O9634PBCjnuqOs=",
+    "version": "1025"
   },
   "remote_cmds": {
     "hash": "sha256-8c/NgQZ+K6jJ3aoYK78/BsEkM1gmRS+9z0437+SvcCw=",
@@ -276,7 +276,7 @@
     "version": "144"
   },
   "xnu": {
-    "hash": "sha256-ci4Rsa1nRpS9qYBUxnaQokrtBzApGF/kQXugGusb9ok=",
-    "version": "12377.81.4"
+    "hash": "sha256-TpT7j7jgcibaHd7cqGbyfDRO0XkjKJNf/tPrdnVVpUw=",
+    "version": "12377.101.15"
   }
 }

From 5663b16973445e8f1c58057f55599b3c9882cbc7 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 133/831] darwin.adv_cmds: fix build after 26.4 source release
 update

---
 pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
index 3ded625c156b..3f0e13b38f2a 100644
--- a/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
@@ -14,7 +14,7 @@
 let
   Libc = sourceRelease "Libc";
   libplatform = sourceRelease "libplatform";
-  xnu = sourceRelease "xnu";
+  xnu = sourceRelease "xnu"; # Can’t use xnuHeaders because adv_cmds is a transitive dependency of xnuHeaders.
 
   privateHeaders = stdenvNoCC.mkDerivation {
     name = "adv_cmds-deps-private-headers";
@@ -27,6 +27,9 @@ let
       install -D -m644 -t "$out/include/System/sys" \
         '${xnu}/bsd/sys/persona.h' \
         '${xnu}/bsd/sys/proc.h'
+
+      install -D -m644 -t "$out/include/sys" \
+        '${xnu}/bsd/sys/proc_private.h'
     '';
   };
 in

From 63d7cdac01939aa8fd7dd5561a63b152dc2d63aa Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 134/831] darwin.AvailabilityVersions: 155 -> 157.2

https://github.com/apple-oss-distributions/AvailabilityVersions/compare/AvailabilityVersions-155...AvailabilityVersions-157.2
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index d51fffa33a75..0f3e475e2d53 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -1,7 +1,7 @@
 {
   "AvailabilityVersions": {
-    "hash": "sha256-WcRJx/dt4DdEZ+lQBGgLwRYv1zlSwyNeKUTtuKH1fzE=",
-    "version": "155"
+    "hash": "sha256-v+ikUET6ByNEBRbPbl7ivqTJKJkZQDGG7Q20tIMt8pU=",
+    "version": "157.2"
   },
   "CarbonHeaders": {
     "hash": "sha256-nIPXnLr21yVnpBhx9K5q3l/nPARA6JL/dED08MeyhP8=",

From 10bb94fb92560bd6a169b4b106098ddc0f17bfed Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 135/831] darwin.copyfile: 230.0.1.0.1 -> 240

https://github.com/apple-oss-distributions/copyfile/compare/copyfile-230.0.1.0.1...copyfile-240
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 0f3e475e2d53..786fc6a5c49e 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -144,8 +144,8 @@
     "version": "1405.100.8"
   },
   "copyfile": {
-    "hash": "sha256-I9uDi5BDQKa7mO3XpHxv0d6PiROW2ueZ3vGfrsG0OJo=",
-    "version": "230.0.1.0.1"
+    "hash": "sha256-IPwDBOtzdUiS1M4ZlhJ44z8Rv7Ot21QnKGxwUW8UZ8c=",
+    "version": "240"
   },
   "developer_cmds": {
     "hash": "sha256-4DDyWuRbxpwDLkbfJIwYp6DKcEDByDiGUmsdOmwq5fI=",

From 89251e8199cd1bf5740e8088e85d6afe24aa093e Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 136/831] darwin.developer_cmds: 87 -> 89

https://github.com/apple-oss-distributions/developer_cmds/compare/developer_cmds-87...developer_cmds-89
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 786fc6a5c49e..0ee3deb8ca03 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -148,8 +148,8 @@
     "version": "240"
   },
   "developer_cmds": {
-    "hash": "sha256-4DDyWuRbxpwDLkbfJIwYp6DKcEDByDiGUmsdOmwq5fI=",
-    "version": "87"
+    "hash": "sha256-MX7PIvmWvu/QTUqgzjMu0NntcZuFTL35faec3IkWHBE=",
+    "version": "89"
   },
   "diskdev_cmds": {
     "hash": "sha256-WDedl0pv/AReA96Gh+v2MwoX+QGrekK7YXEGw3aWB5Q=",

From 3ea2eff071bad9cb03b3582c2e02309125be3011 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 137/831] darwin.diskdev_cmds: 751.80.2 -> 757

https://github.com/apple-oss-distributions/diskdev_cmds/compare/diskdev_cmds-751.80.2...diskdev_cmds-757
---
 pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix b/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix
index a9e5571a8954..7a16dbe68484 100644
--- a/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/package.nix
@@ -48,7 +48,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-qyQM+48PKKWUmdoBprpDf4DXIVAtd3EKCU+ZD/EhNXQ=";
+  xcodeHash = "sha256-mlTUd9eTBQhJa1hzAKzBpw6+702C4dwUjwZvJs/EKyw=";
 
   postPatch =
     # Fix incompatible pointer to integer conversion. The last parameter is size_t not a pointer.
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 0ee3deb8ca03..a60760db5da6 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -152,8 +152,8 @@
     "version": "89"
   },
   "diskdev_cmds": {
-    "hash": "sha256-WDedl0pv/AReA96Gh+v2MwoX+QGrekK7YXEGw3aWB5Q=",
-    "version": "751.80.2"
+    "hash": "sha256-SciJme+LNmkKkxEO77P0kRGMhtw2ZXSKKMSp55YbdIo=",
+    "version": "757"
   },
   "doc_cmds": {
     "hash": "sha256-nnwKXKKjgJXcLCArD38Dme2L1WyR1U0rwn7zI+NCftw=",

From ad15de5dbd17c591bc755ead6f2981d0d8d28f61 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 138/831] darwin.dyld: 1340 -> 1376.6

https://github.com/apple-oss-distributions/dyld/compare/dyld-1340...dyld-1376.6
---
 .../darwin/by-name/dy/dyld/meson.build.in     | 178 ++++++++++++++++--
 .../darwin/by-name/dy/dyld/package.nix        |  22 ++-
 .../darwin/sourceRelease/versions.json        |   4 +-
 3 files changed, 175 insertions(+), 29 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/dy/dyld/meson.build.in b/pkgs/os-specific/darwin/by-name/dy/dyld/meson.build.in
index 5bbef54de647..467f425e1cc0 100644
--- a/pkgs/os-specific/darwin/by-name/dy/dyld/meson.build.in
+++ b/pkgs/os-specific/darwin/by-name/dy/dyld/meson.build.in
@@ -9,6 +9,7 @@ project(
     version : '@version@'
 )
 add_project_arguments(
+    '-DLD_VERSION=@version@',
     # Prevent build failures due to these targets not being defined
     '-DTARGET_OS_BRIDGE=0',
     '-DTARGET_OS_EXCLAVEKIT=0',
@@ -63,6 +64,32 @@ corecrypto_dep = declare_dependency(
     link_with : corecrypto,
 )
 
+common = static_library(
+    'common',
+    dependencies : [ corecrypto_dep ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'lsl',
+        'other-tools',
+    ],
+    sources : [
+        'common/CRC32c.cpp',
+        'common/CachePatching.cpp',
+        'common/Diagnostics.cpp',
+        'common/DyldSharedCache.cpp',
+        'common/MachOFile.cpp',
+        'common/MachOLayout.cpp',
+        'common/MachOLoaded.cpp',
+        'common/TargetPolicy.cpp',
+        'common/Utilities.cpp',
+    ],
+)
+common_dep = declare_dependency(
+    include_directories : [ 'common' ],
+    link_with : common,
+)
+
 lsl = static_library(
     'lsl',
     cpp_args : [
@@ -77,7 +104,6 @@ lsl = static_library(
     ],
     sources : [
         'lsl/Allocator.cpp',
-        'lsl/CRC32c.cpp',
         'lsl/PVLEInt64.cpp',
     ],
 )
@@ -107,7 +133,7 @@ libmach_o = static_library(
         'mach_o/FunctionStarts.cpp',
         'mach_o/FunctionVariants.cpp',
         'mach_o/GradedArchitectures.cpp',
-        'mach_o/Header.cpp',
+        'mach_o/LazyLoadDylib.cpp',
         'mach_o/Image.cpp',
         'mach_o/Instructions.cpp',
         # 'mach_o/LinkerOptimizationHints.cpp',
@@ -121,6 +147,7 @@ libmach_o = static_library(
         'mach_o/SplitSeg.cpp',
         'mach_o/Symbol.cpp',
         'mach_o/Universal.cpp',
+        'mach_o/UnsafeHeader.cpp',
         'mach_o/Version32.cpp',
         'mach_o/Version64.cpp',
     ],
@@ -147,12 +174,12 @@ libmach_o_writer = static_library(
         'mach_o_writer/ExportsTrieWriter.cpp',
         'mach_o_writer/FunctionStartsWriter.cpp',
         'mach_o_writer/FunctionVariantsWriter.cpp',
-        'mach_o_writer/HeaderWriter.cpp',
         'mach_o_writer/LinkerOptimizationHintsWriter.cpp',
         'mach_o_writer/NListSymbolTableWriter.cpp',
         'mach_o_writer/RebaseOpcodesWriter.cpp',
         'mach_o_writer/SplitSegWriter.cpp',
         'mach_o_writer/UniversalWriter.cpp',
+        'mach_o_writer/UnsafeHeaderWriter.cpp',
     ],
 )
 libmach_o_writer_dep = declare_dependency(
@@ -170,7 +197,11 @@ libminidyld = static_library(
         '-DPRIVATE',
         '-DBUILDING_LIBDYLD=1',
     ],
-    dependencies : [ corecrypto_dep, lsl_dep ],
+    dependencies : [
+        common_dep,
+        corecrypto_dep,
+        lsl_dep
+    ],
     include_directories : [
         common_inc,
         'cache_builder',
@@ -178,9 +209,6 @@ libminidyld = static_library(
         'libdyld_introspection',
     ],
     sources : [
-        'common/CachePatching.cpp',
-        'common/MachOLayout.cpp',
-        'common/MachOLoaded.cpp',
         'libdyld/CrashReporterAnnotations.c',
     ],
 )
@@ -189,6 +217,7 @@ libdsc_extractor = shared_library(
     'dsc_extractor',
     cpp_args : [ '-DBUILDING_SHARED_CACHE_EXTRACTOR=1' ],
     dependencies : [
+        common_dep,
         corecrypto_dep,
         libmach_o_dep,
         lsl_dep
@@ -204,13 +233,8 @@ libdsc_extractor = shared_library(
     name_prefix : '',
     name_suffix : 'bundle',
     sources : [
-        'common/DyldSharedCache.cpp',
-        'common/MachOFile.cpp',
-        'common/TargetPolicy.cpp',
         'other-tools/dsc_extractor.cpp',
         'other-tools/dsc_iterator.cpp',
-        'common/MachOLayout.cpp',
-        'common/Diagnostics.cpp',
     ],
 )
 
@@ -223,6 +247,30 @@ executable(
     sources : [ 'other-tools/dsc_extractor_bin.cpp' ],
 )
 
+
+executable(
+    'dyld_analyzer',
+    cpp_args : [ '-DBUILDING_LEGACY_TOOL' ],
+    dependencies : [
+        common_dep,
+        libmach_o_dep,
+        lsl_dep,
+    ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'other-tools',
+    ],
+    install : true,
+    link_with : [ libminidyld ],
+    sources : [
+        'other-tools/dyld_analyzer.cpp',
+        'other-tools/FileUtils.cpp',
+        'other-tools/MiscFileUtils.cpp',
+        'other-tools/Tool.cpp',
+    ],
+)
+
 executable(
     'dyld_info',
     cpp_args : [
@@ -230,6 +278,7 @@ executable(
         '-DBUILDING_FOR_TOOLCHAIN=1',
     ],
     dependencies : [
+        common_dep,
         corecrypto_dep,
         libmach_o_dep,
         llvm_dep,
@@ -244,13 +293,6 @@ executable(
     link_args : [ '-Wl,-weak-lLTO' ],
     link_with : [ libminidyld ],
     sources : [
-        'common/Diagnostics.cpp',
-        'common/DyldSharedCache.cpp',
-        'common/MachOAnalyzer.cpp',
-        'common/MachOFile.cpp',
-        'common/MetadataVisitor.cpp',
-        'common/SwiftVisitor.cpp',
-        'common/TargetPolicy.cpp',
         'other-tools/dyld_info.cpp',
         'other-tools/FileUtils.cpp',
         'other-tools/MiscFileUtils.cpp',
@@ -258,3 +300,101 @@ executable(
     ],
 )
 install_man('doc/man/man1/dyld_info.1')
+
+# Requires headers from unpublished ld-prime sources
+# executable(
+#     'libtool',
+#     dependencies : [ lsl_dep ],
+#     include_directories : [
+#         common_inc,
+#         'cache_builder',
+#         'mach_o_writer',
+#     ],
+#     install : true,
+#     sources : [
+#         'other-tools/libtool.cpp',
+#         'other-tools/Tool.cpp',
+#     ],
+# )
+# install_man('doc/man/man1/libtool.1')
+#
+# # ranlib is a symlink to libtool
+# install_man('doc/man/man1/ranlib.1')
+
+# Requires headers from unpublished ld-prime sources
+# executable(
+#     'lipo',
+#     dependencies : [ lsl_dep ],
+#     include_directories : [ common_inc ],
+#     install : true,
+#     sources : [
+#         'other-tools/lipo.cpp',
+#         'other-tools/Tool.cpp',
+#     ],
+# )
+
+executable(
+    'nm',
+    cpp_args : [ '-DBUILDING_LEGACY_TOOL' ],
+    dependencies : [
+        common_dep,
+        libmach_o_dep,
+        lsl_dep,
+    ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'other-tools',
+    ],
+    install : true,
+    link_with : [ libminidyld ],
+    sources : [
+        'other-tools/MiscFileUtils.cpp',
+        'other-tools/nm.cpp',
+        'other-tools/Tool.cpp',
+    ],
+)
+
+executable(
+    'strings',
+    cpp_args : [ '-DBUILDING_LEGACY_TOOL' ],
+    dependencies : [
+        common_dep,
+        libmach_o_dep,
+        lsl_dep,
+    ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'other-tools',
+    ],
+    install : true,
+    link_with : [ libminidyld ],
+    sources : [
+        'other-tools/MiscFileUtils.cpp',
+        'other-tools/strings.cpp',
+        'other-tools/Tool.cpp',
+    ],
+)
+
+executable(
+    'size',
+    cpp_args : [ '-DBUILDING_LEGACY_TOOL' ],
+    dependencies : [
+        common_dep,
+        libmach_o_dep,
+        lsl_dep,
+    ],
+    include_directories : [
+        common_inc,
+        'cache_builder',
+        'other-tools',
+    ],
+    install : true,
+    link_with : [ libminidyld ],
+    sources : [
+        'other-tools/MiscFileUtils.cpp',
+        'other-tools/size.cpp',
+        'other-tools/Tool.cpp',
+    ],
+)
diff --git a/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix b/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
index a92bdb13e3ad..27ae0af42ab1 100644
--- a/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
+++ b/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
@@ -10,6 +10,7 @@
   pkgsBuildHost,
   sourceRelease,
   stdenvNoCC,
+  xnuHeaders,
 }:
 
 let
@@ -70,18 +71,19 @@ let
 
       install -D -m644 -t "$out/include/os" \
         '${xnu}/libsyscall/os/tsd.h' \
-        '${xnu}/libkern/os/atomic_private.h' \
-        '${xnu}/libkern/os/atomic_private_arch.h' \
-        '${xnu}/libkern/os/atomic_private_impl.h' \
-        '${xnu}/libkern/os/base_private.h' \
+        '${xnuHeaders}/Library/Frameworks/Kernel.framework/Versions/A/PrivateHeaders/os/atomic_private.h' \
+        '${xnuHeaders}/Library/Frameworks/Kernel.framework/Versions/A/PrivateHeaders/os/atomic_private_arch.h' \
+        '${xnuHeaders}/Library/Frameworks/Kernel.framework/Versions/A/PrivateHeaders/os/atomic_private_impl.h' \
+        '${xnuHeaders}/Library/Frameworks/Kernel.framework/Versions/A/PrivateHeaders/os/base_private.h' \
         '${libplatform}/private/os/lock_private.h'
 
       substituteInPlace "$out/include/os/lock_private.h" \
         --replace-fail ', bridgeos(4.0)' ""
 
       install -D -m644 -t "$out/include/sys" \
-        '${xnu}/bsd/sys/kern_memorystatus.h' \
-        '${xnu}/bsd/sys/reason.h'
+        '${xnuHeaders}/include/sys/commpage_private.h' \
+        '${xnuHeaders}/include/sys/kern_memorystatus.h' \
+        '${xnuHeaders}/include/sys/reason.h'
 
       # This file is part of ld-prime, which is unhelpfully not included in the dyld source release.
       # Fortunately, nothing in it is actually needed to build `dyld_info` and `dsc_extractor`.
@@ -100,7 +102,7 @@ mkAppleDerivation {
 
   propagatedBuildOutputs = [ ];
 
-  xcodeHash = "sha256-F/V1XzBP1qEDpUDTz+jyp5dbcfqdQp8s9NW2OBoU5x0=";
+  xcodeHash = "sha256-eECKavCwz8NDqPOgW1YZ4ldQQHSUdBvAGRtYcVgEX/w=";
 
   patches = [
     # Disable use of private kdebug API
@@ -134,7 +136,8 @@ mkAppleDerivation {
       --replace-fail '__API_UNAVAILABLE(ios, tvos, watchos) __API_UNAVAILABLE(bridgeos)' ""
 
     substituteInPlace include/mach-o/utils_priv.h \
-      --replace-fail 'SPI_AVAILABLE(macos(15.0), ios(18.0), tvos(18.0), watchos(11.0))' ""
+      --replace-fail 'SPI_AVAILABLE' "__SPI_AVAILABLE" \
+      --replace-fail '____SPI_AVAILABLE' "__SPI_AVAILABLE"
 
     substituteInPlace libdyld/utils.cpp \
       --replace-fail 'DYLD_EXCLAVEKIT_UNAVAILABLE' ""
@@ -146,6 +149,9 @@ mkAppleDerivation {
         = { CRASHREPORTER_ANNOTATIONS_VERSION, 0, 0, 0, 0, 0, 0 };
     EOF
 
+    substituteInPlace other-tools/Tool.cpp \
+      --replace-fail 'bridgeOS 6,' ""
+
     # Fix header includes
     substituteInPlace libdyld_introspection/dyld_introspection.cpp \
       --replace-fail 'dyld_introspection.h' 'mach-o/dyld_introspection.h'
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index a60760db5da6..7a8bc75624eb 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -164,8 +164,8 @@
     "version": "413"
   },
   "dyld": {
-    "hash": "sha256-rvWFiQVLJKqL0hOL2nRqwRkyPc/OvGnL0GEBymq7Fio=",
-    "version": "1340"
+    "hash": "sha256-uXFAHIgSrAR2duFhSvOXdaa0x8GTj4Qjq9TNGOZRGhU=",
+    "version": "1376.6"
   },
   "eap8021x": {
     "hash": "sha256-nwCp5QgtXC2X3y5eR3DnXkdpECNkLmejM2iGQ6nuPaQ=",

From ca6d6d5817edb91338ff221a63f30fb38bd33589 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 139/831] darwin.file_cmds: 475 -> 479

https://github.com/apple-oss-distributions/file_cmds/compare/file_cmds-475...file_cmds-479
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 7a8bc75624eb..933aa066417e 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -172,8 +172,8 @@
     "version": "368.101.1"
   },
   "file_cmds": {
-    "hash": "sha256-1hdTjg1Nf31gAhwjQEhRZQhaqayC8x7PGHAwZ1aEIm8=",
-    "version": "475"
+    "hash": "sha256-4Ii7dbijMCYq0IyAYXt1wm+9igSqUCtS60hsAm8+dM8=",
+    "version": "479"
   },
   "hfs": {
     "hash": "sha256-GOI7U2J4vy5GQRubSWqx0xZFtE4e/hq7SsUuqptrYR0=",

From 4c124e96a89c72f71026522204a1c6b8bb13600a Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 140/831] darwin.ICU: 76142.3.1.1 -> 76142.4.7

https://github.com/apple-oss-distributions/ICU/compare/ICU-76142.3.1.1...ICU-76142.4.7

Contrary to the version convention, this ICU is based on ICU 78. One can
confirm by checking `$dev/include/unicode/uvernum.h`, which shows 78.
---
 .../darwin/by-name/ic/ICU/package.nix         |  8 +++---
 .../0001-suppress-icu-check-crash.patch       | 25 +++++++++++++++++++
 .../patches/suppress-icu-check-crash.patch    | 13 ----------
 .../darwin/sourceRelease/versions.json        |  4 +--
 4 files changed, 32 insertions(+), 18 deletions(-)
 create mode 100644 pkgs/os-specific/darwin/by-name/ic/ICU/patches/0001-suppress-icu-check-crash.patch
 delete mode 100644 pkgs/os-specific/darwin/by-name/ic/ICU/patches/suppress-icu-check-crash.patch

diff --git a/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix b/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
index f742f4743807..d2678d47b0bc 100644
--- a/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
@@ -3,7 +3,7 @@
   bootstrapStdenv,
   buildPackages,
   fetchpatch2,
-  icu76, # The ICU version should correspond to the same one used by Apple’s ICU package
+  icu78, # The ICU version should correspond to the same one used by Apple’s ICU package
   mkAppleDerivation,
   python3,
   stdenvNoCC,
@@ -40,9 +40,11 @@ let
 
     patches = [
       # Skip MessageFormatTest test, which is known to crash sometimes and should be suppressed if it does.
-      ./patches/suppress-icu-check-crash.patch
+      ./patches/0001-suppress-icu-check-crash.patch
     ];
 
+    patchFlags = [ "-p4" ];
+
     preConfigure = ''
       sed -i -e "s|/bin/sh|${stdenv.shell}|" configure
       patchShebangs --build .
@@ -118,7 +120,7 @@ let
 
           # Add missing test data. It’s not included in the source release.
           chmod u+w "$NIX_BUILD_TOP/source/icu"
-          tar -C "$NIX_BUILD_TOP/source" -axf ${lib.escapeShellArg icu76.src} icu/testdata
+          tar -C "$NIX_BUILD_TOP/source" -axf ${lib.escapeShellArg icu78.src} icu/testdata
         ''
         + lib.optionalString stdenv.hostPlatform.isx86_64 ''
           # These tests fail under Rosetta 2 with a floating-point exception.
diff --git a/pkgs/os-specific/darwin/by-name/ic/ICU/patches/0001-suppress-icu-check-crash.patch b/pkgs/os-specific/darwin/by-name/ic/ICU/patches/0001-suppress-icu-check-crash.patch
new file mode 100644
index 000000000000..b9018766b838
--- /dev/null
+++ b/pkgs/os-specific/darwin/by-name/ic/ICU/patches/0001-suppress-icu-check-crash.patch
@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Fri, 8 May 2026 21:00:49 -0400
+Subject: [PATCH] suppress-icu-check-crash
+
+---
+ icu/icu4c/source/test/cintltst/cmsgtst.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/icu/icu4c/source/test/cintltst/cmsgtst.c b/icu/icu4c/source/test/cintltst/cmsgtst.c
+index 16263b5c7..fccc2753d 100644
+--- a/icu/icu4c/source/test/cintltst/cmsgtst.c
++++ b/icu/icu4c/source/test/cintltst/cmsgtst.c
+@@ -231,7 +231,7 @@ static void MessageFormatTest( void )
+                         austrdup(result), austrdup(testResultStrings[i]) );
+                 }
+ 
+-#if (U_PLATFORM == U_PF_LINUX || U_PLATFORM == U_PF_QNX) /* add platforms here .. */
++#if (U_PLATFORM == U_PF_LINUX || U_PLATFORM == U_PF_DARWIN || U_PLATFORM == U_PF_QNX) /* add platforms here .. */
+                 log_verbose("Skipping potentially crashing test for mismatched varargs.\n");
+ #else
+                 log_verbose("Note: the next is a platform dependent test. If it crashes, add an exclusion for your platform near %s:%d\n", __FILE__, __LINE__); 
+-- 
+2.51.2
+
diff --git a/pkgs/os-specific/darwin/by-name/ic/ICU/patches/suppress-icu-check-crash.patch b/pkgs/os-specific/darwin/by-name/ic/ICU/patches/suppress-icu-check-crash.patch
deleted file mode 100644
index 23a5ac307c80..000000000000
--- a/pkgs/os-specific/darwin/by-name/ic/ICU/patches/suppress-icu-check-crash.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/test/cintltst/cmsgtst.c b/test/cintltst/cmsgtst.c
-index cb328707..1073e6c1 100644
---- a/test/cintltst/cmsgtst.c
-+++ b/test/cintltst/cmsgtst.c
-@@ -231,7 +231,7 @@ static void MessageFormatTest( void )
-                         austrdup(result), austrdup(testResultStrings[i]) );
-                 }
- 
--#if (U_PLATFORM == U_PF_LINUX) /* add platforms here .. */
-+#if (U_PLATFORM == U_PF_LINUX || U_PLATFORM == U_PF_DARWIN) /* add platforms here .. */
-                 log_verbose("Skipping potentially crashing test for mismatched varargs.\n");
- #else
-                 log_verbose("Note: the next is a platform dependent test. If it crashes, add an exclusion for your platform near %s:%d\n", __FILE__, __LINE__); 
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 933aa066417e..de9dff82d2cb 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -16,8 +16,8 @@
     "version": "88"
   },
   "ICU": {
-    "hash": "sha256-qtv+IUEjdY5I87wDEIO9cWFAh1WmnIDVIzIyyL9NTd8=",
-    "version": "76142.3.1.1"
+    "hash": "sha256-NnTaNtYDDSNe7wLr9U/raaCXGBDWHMt91HJcumY0qTQ=",
+    "version": "76142.4.7"
   },
   "IOAudioFamily": {
     "hash": "sha256-A3iiAjjP29VdjMj40tLS5Q/ni4qeh9bBpnmNzeG2pIY=",

From 6575bc0242017976bd3924c72d6d498f79f014bf Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 141/831] darwin.libiconv: 113 -> 115.100.1

https://github.com/apple-oss-distributions/libiconv/compare/libiconv-113...libiconv-115.100.1
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index de9dff82d2cb..b2cc513862a5 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -196,8 +196,8 @@
     "version": "40"
   },
   "libiconv": {
-    "hash": "sha256-MboAwJvpO0ix7XsAuKUUxipv8ecxD2OjDgD5bQbygr8=",
-    "version": "113"
+    "hash": "sha256-iPPdwts6kALf2lGnYnXfMTuBa2lYrDt7rySiUmraJqs=",
+    "version": "115.100.1"
   },
   "libmalloc": {
     "hash": "sha256-kwJ6vfk1PzDdE0n3Ba+3hXLSf63YmMgPluxrEuvOpF0=",

From 0d5d9a512954686344ed5e5346bab660983c5cfc Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 142/831] darwin.libpcap: 144 -> 146

https://github.com/apple-oss-distributions/libpcap/compare/libpcap-144...libpcap-146
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index b2cc513862a5..63ca1def35c4 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -204,8 +204,8 @@
     "version": "812.100.31"
   },
   "libpcap": {
-    "hash": "sha256-G7CL3pCCmxOoZ+ouA+xfOeDgvLcT9AN9zyrx+cL2Ge4=",
-    "version": "144"
+    "hash": "sha256-imKN9h6AfSyjjOjp9AX68LNXybh/pitXDM35N/3/Tls=",
+    "version": "146"
   },
   "libplatform": {
     "hash": "sha256-bghS+sClE2nygZMahh1udoMZmGvRSCKn+W4ywTi51Zw=",

From 11e16349972656869ac34c91b73ea50fecb82f17 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 143/831] darwin.libresolv: 93 -> 96

https://github.com/apple-oss-distributions/libresolv/compare/libresolv-93...libresolv-96
---
 pkgs/os-specific/darwin/by-name/li/libresolv/package.nix | 9 ++++++---
 pkgs/os-specific/darwin/sourceRelease/versions.json      | 4 ++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix b/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
index 6e8cf1f8e394..f38797fd2ce9 100644
--- a/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
+++ b/pkgs/os-specific/darwin/by-name/li/libresolv/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  fetchFromGitHub,
   mkAppleDerivation,
   sourceRelease,
   stdenvNoCC,
@@ -23,8 +22,12 @@ let
         '${dyld}/include/mach-o/dyld_priv.h'
 
       substituteInPlace "$out/include/mach-o/dyld_priv.h" \
-        --replace-fail ', bridgeos(3.0)' "" \
-        --replace-fail '//@VERSION_DEFS@' 'const dyld_build_version_t dyld_2024_SU_E_os_versions = { 1 /* macOS */, 150400 };'
+        --replace-fail ', bridgeos(3.0)' ""
+
+      cat <<EOF > "$out/include/mach-o/dyld_version_defines.h"
+      #pragma once
+      const dyld_build_version_t dyld_2024_SU_E_os_versions = { 1 /* macOS */, 150400 };
+      EOF
     '';
   };
 in
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 63ca1def35c4..e77862dd91a3 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -216,8 +216,8 @@
     "version": "539.100.4"
   },
   "libresolv": {
-    "hash": "sha256-SDdF7foz8DFUXmXEznwusNMkXFHrPkdLWQM8xfxb0gc=",
-    "version": "93"
+    "hash": "sha256-MAfzoyww1UK0o5TJ7XI4A9vi1T09Nz6Yb9iMrS/wX78=",
+    "version": "96"
   },
   "libutil": {
     "hash": "sha256-64+1CIRpYBon7skJRKdaXcxucPh9GrhAbUERhL2PLXA=",

From a90fc6279376633863e9f9bd52d1a9719630a9fe Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 144/831] darwin.mail_cmds: 41 -> 43

https://github.com/apple-oss-distributions/mail_cmds/compare/mail_cmds-41...mail_cmds-43
---
 pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix
index b29e711251d6..01eb728f2eb6 100644
--- a/pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ma/mail_cmds/package.nix
@@ -14,7 +14,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-6rBflDgQkqWDc8XPLgKIO703bMamg2QlhUnP71hBX3I=";
+  xcodeHash = "sha256-X9WKaCXm7gJI04iOJ3upmqTwZ6Lw+JjH0xSs+ng/9J0=";
 
   meta.description = "Traditional mail command for Darwin";
 }
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index e77862dd91a3..6e4f2b81be0d 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -228,8 +228,8 @@
     "version": "2881.100.56.0.1"
   },
   "mail_cmds": {
-    "hash": "sha256-peoaHopJaYDqyE4TGfLx7W1K2KsFZmHLWr8Er/HpA90=",
-    "version": "41"
+    "hash": "sha256-xAU0HNDC2jmzYqnWWIzUjV0Kldl3SHMvM66Pl6kK8/0=",
+    "version": "43"
   },
   "misc_cmds": {
     "hash": "sha256-04uBS16nNrg73Fqh4Obev7nQDjTTlY4f5+pEv3i0FIU=",

From 362d374daf44df736ebbbd86288f66669476cd4f Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 145/831] darwin.network_cmds: 730.80.3 -> 741.100.2

https://github.com/apple-oss-distributions/network_cmds/compare/network_cmds-730.80.3...network_cmds-741.100.2
---
 pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix | 3 +++
 pkgs/os-specific/darwin/sourceRelease/versions.json         | 4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
index 1504ebf59590..51455f86897f 100644
--- a/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
@@ -119,6 +119,9 @@ let
       #include <${xnuHeaders}/include/netinet6/nd6.h>
       EOF
 
+      install -D -t "$out/include/netkey" \
+        '${xnuHeaders}/include/netkey/keysock_private.h'
+
       install -D -t "$out/include/os" \
         '${xnuHeaders}/Library/Frameworks/Kernel.framework/PrivateHeaders/os/atomic_private.h' \
         '${xnuHeaders}/Library/Frameworks/Kernel.framework/PrivateHeaders/os/atomic_private_arch.h' \
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 6e4f2b81be0d..39acfc776ad4 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -236,8 +236,8 @@
     "version": "45"
   },
   "network_cmds": {
-    "hash": "sha256-WlO668xfWOJk9QkTDJBqBVfXK52yg2Ofdjcdk6pQvIo=",
-    "version": "730.80.3"
+    "hash": "sha256-GXtGhkmTrpYHZj5ufpx2aOMRTMjCe8/H425OWBluKeU=",
+    "version": "741.100.2"
   },
   "objc4": {
     "hash": "sha256-vonl+pqJurD7ozdZ8AQokvtlgKXCk+BP/vFfoyGJiUQ=",

From 857fccfb375188654f8947495860739c4e898dd9 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 146/831] darwin.patch_cmds: 72 -> 75

https://github.com/apple-oss-distributions/patch_cmds/compare/patch_cmds-72...patch_cmds-75
---
 .../darwin/by-name/pa/patch_cmds/package.nix  | 12 +++++--
 .../patches/0001-Fall-back-to-scandir.patch   | 32 +++++++++++++++++++
 .../darwin/sourceRelease/versions.json        |  4 +--
 3 files changed, 44 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/os-specific/darwin/by-name/pa/patch_cmds/patches/0001-Fall-back-to-scandir.patch

diff --git a/pkgs/os-specific/darwin/by-name/pa/patch_cmds/package.nix b/pkgs/os-specific/darwin/by-name/pa/patch_cmds/package.nix
index 30f1eef87c27..5be1753d589a 100644
--- a/pkgs/os-specific/darwin/by-name/pa/patch_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/pa/patch_cmds/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  apple-sdk,
+  apple-sdk_26,
   libutil,
   mkAppleDerivation,
   pkg-config,
@@ -14,11 +14,19 @@ mkAppleDerivation {
     "man"
   ];
 
+  patches = [
+    # Use `scandir` on versions of macOS older than 26.4.
+    ./patches/0001-Fall-back-to-scandir.patch
+  ];
+
   xcodeHash = "sha256-Ox8Ii2sUuledUttZ64DaHC0iFlUybs3lNZ23IDeziPM=";
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ libutil ];
+  buildInputs = [
+    apple-sdk_26
+    libutil
+  ];
 
   meta = {
     description = "BSD patch commands for Darwin";
diff --git a/pkgs/os-specific/darwin/by-name/pa/patch_cmds/patches/0001-Fall-back-to-scandir.patch b/pkgs/os-specific/darwin/by-name/pa/patch_cmds/patches/0001-Fall-back-to-scandir.patch
new file mode 100644
index 000000000000..bcc6279d081e
--- /dev/null
+++ b/pkgs/os-specific/darwin/by-name/pa/patch_cmds/patches/0001-Fall-back-to-scandir.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Fri, 8 May 2026 19:34:31 -0400
+Subject: [PATCH] Fall-back-to-scandir
+
+---
+ diff/diffdir.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/diff/diffdir.c b/diff/diffdir.c
+index 7583f98..cc476bc 100644
+--- a/diff/diffdir.c
++++ b/diff/diffdir.c
+@@ -92,8 +92,13 @@ vscandir(struct inodetree *tree, const char *path, struct dirent ***dirp,
+ 		*dirp = NULL;
+ 		return (0);
+ 	}
+-	if ((ret = fdscandir(fd, dirp, select, compar)) < 0)
+-		goto fail;
++	if (__builtin_available(macOS 26.4, *)) {
++		if ((ret = fdscandir(fd, dirp, select, compar)) < 0)
++			goto fail;
++	} else {
++		if ((ret = scandir(path, dirp, select, compar)) < 0)
++			goto fail;
++	}
+ 	RB_INSERT(inodetree, tree, ino);
+ 	close(fd);
+ 	return (ret);
+-- 
+2.51.2
+
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 39acfc776ad4..e475e820ec8f 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -244,8 +244,8 @@
     "version": "951.7"
   },
   "patch_cmds": {
-    "hash": "sha256-fDY2NOT3DnU5pm06cHSs+JJcA/EFP8Lxjg7sErUerJ0=",
-    "version": "72"
+    "hash": "sha256-XoLEVrvu9pfHPalkBQDH0IfzcX8FLkcEBmW03cq2jQY=",
+    "version": "75"
   },
   "ppp": {
     "hash": "sha256-syc0tbDPACswBNNrTaOsC6Lyix6d7O9634PBCjnuqOs=",

From 68030807a152264bfedb00dafacdc71a3ded0874 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 147/831] darwin.PowerManagement: 1846.81.1 -> 1846.101.2

https://github.com/apple-oss-distributions/PowerManagement/compare/PowerManagement-1846.81.1...PowerManagement-1846.101.2
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index e475e820ec8f..088a6f64dc15 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -116,8 +116,8 @@
     "version": "146"
   },
   "PowerManagement": {
-    "hash": "sha256-KqpAUjwqENbx3qPxhkK6OFARjBGSMEpaGz5ozo9vtSY=",
-    "version": "1846.81.1"
+    "hash": "sha256-2vtld72nBFzgqh3vAh8L0PR3RORaXRojQZDc4OH4MVQ=",
+    "version": "1846.101.2"
   },
   "Security": {
     "hash": "sha256-1ka7ws6POwm+WKwB/VYZX/uQTQccJe5r9tYDHgoqHp0=",

From b850d4728a31bb7922d3e912a95712dbe18bef2a Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 148/831] darwin.remote_cmds: 306 -> 308

https://github.com/apple-oss-distributions/remote_cmds/compare/remote_cmds-306...remote_cmds-308
---
 pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in | 1 +
 pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix    | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json           | 4 ++--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in b/pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in
index 137397b3abbc..646143084e2c 100644
--- a/pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in
+++ b/pkgs/os-specific/darwin/by-name/re/remote_cmds/meson.build.in
@@ -53,6 +53,7 @@ executable(
         '-DCOLLATE_DEBUG',
         '-DYY_NO_UNPUT',
     ],
+    include_directories: [ 'wall' ],
     install : true,
     sources : [
         'talkd/announce.c',
diff --git a/pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix b/pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix
index 8029d2982acd..523c67f88645 100644
--- a/pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/re/remote_cmds/package.nix
@@ -14,7 +14,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-+hC3yJwwwXr01Aa47K5dv4gL0+IlTQZU9YYgygXkTSI=";
+  xcodeHash = "sha256-SdeF6Jp+KuVTUawJdvpw53qr3gIPEhVzqgQxAau19C0=";
 
   postPatch = ''
     # Avoid a conflict with the definition in SDK’s headers.
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 088a6f64dc15..ad26933183ea 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -252,8 +252,8 @@
     "version": "1025"
   },
   "remote_cmds": {
-    "hash": "sha256-8c/NgQZ+K6jJ3aoYK78/BsEkM1gmRS+9z0437+SvcCw=",
-    "version": "306"
+    "hash": "sha256-aTcoaFbKhVrhGQyVRvqb/Iwm0sqUn5HMO19sBpdt428=",
+    "version": "308"
   },
   "removefile": {
     "hash": "sha256-Z5UD0mk/s80CQB0PZWDzSl2JWXmnVmwUvlNb28+hR3k=",

From 03761fb93a51622cc14c1f20aa17dfaf8a121341 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 149/831] darwin.removefile: 84 -> 85.100.6

https://github.com/apple-oss-distributions/removefile/compare/removefile-84...removefile-85.100.6
---
 pkgs/os-specific/darwin/sourceRelease/versions.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index ad26933183ea..0739d0bf2b9f 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -256,8 +256,8 @@
     "version": "308"
   },
   "removefile": {
-    "hash": "sha256-Z5UD0mk/s80CQB0PZWDzSl2JWXmnVmwUvlNb28+hR3k=",
-    "version": "84"
+    "hash": "sha256-4E0LsE6b83AqP90tpIhnRdtSekToY7JUWa7lQ3+y3WI=",
+    "version": "85.100.6"
   },
   "shell_cmds": {
     "hash": "sha256-hoMssbZCrmzyJTgEAzOS4L7DhY9z/yXIcvHRhL6W5qc=",

From 4c232cc2669e1e272771a095719af84748c15f57 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 150/831] darwin.shell_cmds: 326 -> 329

https://github.com/apple-oss-distributions/shell_cmds/compare/shell_cmds-326...shell_cmds-329
---
 pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix b/pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix
index 88f7885ce814..955a2bc84542 100644
--- a/pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/sh/shell_cmds/package.nix
@@ -24,7 +24,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-fY8k7qzqqiv/KvGIB4a82qbNsm23QPnGOadrZmNoi54=";
+  xcodeHash = "sha256-sbgPFMMXgUp+F1IRLiaFto+PsfMHBd23KQ1sQK7tP7A=";
 
   postPatch = ''
     # Fix `mktemp` templates
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index 0739d0bf2b9f..bc50c75fe4e1 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -260,8 +260,8 @@
     "version": "85.100.6"
   },
   "shell_cmds": {
-    "hash": "sha256-hoMssbZCrmzyJTgEAzOS4L7DhY9z/yXIcvHRhL6W5qc=",
-    "version": "326"
+    "hash": "sha256-mZ8DuxAMrv96gDnIG3nNXY906wNVDmjymOv/t3wDr2Q=",
+    "version": "329"
   },
   "system_cmds": {
     "hash": "sha256-OYLCu2pPe10apZEK5kgINcEvxRFFPYquPzcRNkvtJKI=",

From 7a1aca160150d04be12b8b00ba56aa1b21914888 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 151/831] darwin.system_cmds: 1039 -> 1042.100.6.0.1

https://github.com/apple-oss-distributions/system_cmds/compare/system_cmds-1039...system_cmds-1042.100.6.0.1
---
 pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix | 5 +++--
 pkgs/os-specific/darwin/sourceRelease/versions.json        | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix b/pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix
index 1fdb00d9a735..8a780069d52d 100644
--- a/pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/sy/system_cmds/package.nix
@@ -18,7 +18,7 @@ let
 
   libplatform = sourceRelease "libplatform";
 
-  xnu = sourceRelease "xnu";
+  xnu = sourceRelease "xnu"; # Can’t use xnuHeaders because adv_cmds is a transitive dependency of xnuHeaders.
 
   privateHeaders = stdenvNoCC.mkDerivation {
     name = "system_cmds-deps-private-headers";
@@ -71,10 +71,11 @@ let
       install -D -t "$out/include/sys" \
         '${xnu}/bsd/sys/csr.h' \
         '${xnu}/bsd/sys/event_private.h' \
-        '${xnu}/bsd/sys/pgo.h' \
         '${xnu}/bsd/sys/kdebug_private.h' \
         '${xnu}/bsd/sys/kern_memorystatus.h' \
+        '${xnu}/bsd/sys/pgo.h' \
         '${xnu}/bsd/sys/proc_info_private.h' \
+        '${xnu}/bsd/sys/proc_private.h' \
         '${xnu}/bsd/sys/reason.h' \
         '${xnu}/bsd/sys/resource.h' \
         '${xnu}/bsd/sys/resource_private.h' \
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index bc50c75fe4e1..dca0e584e990 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -264,8 +264,8 @@
     "version": "329"
   },
   "system_cmds": {
-    "hash": "sha256-OYLCu2pPe10apZEK5kgINcEvxRFFPYquPzcRNkvtJKI=",
-    "version": "1039"
+    "hash": "sha256-zG5N06b1/X6bCPWFME10w8XoLqwGKvrAmNihLy0cxl4=",
+    "version": "1042.100.6.0.1"
   },
   "text_cmds": {
     "hash": "sha256-SDH74Pwy/kPiApisuUFBrDVQ7swCsinMK7zkpm82rnw=",

From 976af9cac6bf77cea6594526473cdf68df3fc5bf Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 152/831] darwin.text_cmds: 197 -> 199

https://github.com/apple-oss-distributions/text_cmds/compare/text_cmds-197...text_cmds-199
---
 pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix | 2 +-
 pkgs/os-specific/darwin/sourceRelease/versions.json      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix b/pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix
index 8a757030dd9b..d91a37359c32 100644
--- a/pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/te/text_cmds/package.nix
@@ -45,7 +45,7 @@ mkAppleDerivation {
     "man"
   ];
 
-  xcodeHash = "sha256-4nwDGUBSx5jjeLQ3EGQFdPZE2MfNGcBvlTU/Sye6OIk=";
+  xcodeHash = "sha256-8Z6Goz94xP3HqAaSnFUurhZE8l3G1mK5KviXtxSPQhI=";
 
   postPatch = ''
     # Improve compatiblity with libmd in nixpkgs.
diff --git a/pkgs/os-specific/darwin/sourceRelease/versions.json b/pkgs/os-specific/darwin/sourceRelease/versions.json
index dca0e584e990..78e9ad87a6bf 100644
--- a/pkgs/os-specific/darwin/sourceRelease/versions.json
+++ b/pkgs/os-specific/darwin/sourceRelease/versions.json
@@ -268,8 +268,8 @@
     "version": "1042.100.6.0.1"
   },
   "text_cmds": {
-    "hash": "sha256-SDH74Pwy/kPiApisuUFBrDVQ7swCsinMK7zkpm82rnw=",
-    "version": "197"
+    "hash": "sha256-Z2SKmsmCRX/CnRC9kkgCb8ozK+nit4GYsv1rrEWL3qs=",
+    "version": "199"
   },
   "top": {
     "hash": "sha256-F+P7yRQw4qa73JmQrMVgy3lVQRDBrFDy9kkOUJ135ys=",

From 127450a4fc9134531b214aa72d467232fc7e4e0f Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 153/831] ld64: 956.6 -> 957.1

https://github.com/apple-oss-distributions/ld64/compare/ld64-956.6...ld64-957.1
---
 pkgs/by-name/ld/ld64/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ld/ld64/package.nix b/pkgs/by-name/ld/ld64/package.nix
index 8699a4132d4a..f21f90a37929 100644
--- a/pkgs/by-name/ld/ld64/package.nix
+++ b/pkgs/by-name/ld/ld64/package.nix
@@ -47,7 +47,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ld64";
-  version = "956.6";
+  version = "957.1";
 
   outputs = [
     "out"
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "apple-oss-distributions";
     repo = "ld64";
     tag = "ld64-${finalAttrs.version}";
-    hash = "sha256-2VlBjlCZ+ZPKGZ0f5UuG3jJTLZIBXf8IZOiD6snheh4=";
+    hash = "sha256-KUkEKz2jQq815ls25u0JMYmad4cN9PS/nC3E5eV19co=";
   };
 
   patches = [

From a81408d15c1368116b81656f2074d4f405e333e1 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Mon, 11 May 2026 19:31:44 -0400
Subject: [PATCH 154/831] apple-sdk_26: 26.4 -> 26.5

---
 pkgs/by-name/ap/apple-sdk/metadata/versions.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/metadata/versions.json b/pkgs/by-name/ap/apple-sdk/metadata/versions.json
index 3002a9226cc5..d655c7ebada9 100644
--- a/pkgs/by-name/ap/apple-sdk/metadata/versions.json
+++ b/pkgs/by-name/ap/apple-sdk/metadata/versions.json
@@ -17,10 +17,10 @@
   },
   "26": {
     "urls": [
-      "https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20260406133131/https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg"
+      "https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg",
+      "https://web.archive.org/web/20260512015547/https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg"
     ],
-    "version": "26.4",
-    "hash": "sha256-7nrbCv1pNlpzEqwZWVfUPCvDfXEJJNOl7ApkeFpIOC0="
+    "version": "26.5",
+    "hash": "sha256-IkDNtiO7PP4GI6OszCNWE1Xb4iepCUKwQHYUyc9NgNA="
   }
 }

From 516deee1c136242d983d0f510ecb7ca42d885aff Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Thu, 7 May 2026 18:16:31 -0400
Subject: [PATCH 155/831] xar: 501 -> 503

https://github.com/apple-oss-distributions/xar/compare/xar-501...xar-503
---
 pkgs/by-name/xa/xar/package.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/xa/xar/package.nix b/pkgs/by-name/xa/xar/package.nix
index 53583b24caf3..b9e477ca6194 100644
--- a/pkgs/by-name/xa/xar/package.nix
+++ b/pkgs/by-name/xa/xar/package.nix
@@ -31,13 +31,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xar${lib.optionalString (e2fsprogs == null) "-minimal"}";
-  version = "501";
+  version = "503";
 
   src = fetchFromGitHub {
     owner = "apple-oss-distributions";
     repo = "xar";
     rev = "xar-${finalAttrs.version}";
-    hash = "sha256-Fq+Re0LCBIGhW2FR+pgV8SWtaDOEFgTh+rQ8JFWK/k0=";
+    hash = "sha256-QdK7NTN3A/EWr+vdfT5ZLTdX+wOmfnqvL5yJeiiPwtM=";
   };
 
   # Update patch set with
@@ -48,11 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   #   # …
   #   rm -r ../pkgs/by-name/xa/xar/patches
   #   git format-patch --zero-commit --output-directory ../pkgs/by-name/xa/xar/patches main
-  patches =
-    # Avoid Darwin rebuilds on staging-next
-    lib.filter (
-      p: stdenv.hostPlatform.isDarwin -> baseNameOf p != "0020-Fall-back-to-readlink-on-Linux.patch"
-    ) (lib.filesystem.listFilesRecursive ./patches);
+  patches = lib.filesystem.listFilesRecursive ./patches;
 
   # We do not use or modify files outside of the xar subdirectory.
   patchFlags = [ "-p2" ];

From 6d8c12b2b36e3d5993c522516e533a4c740c27fd Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 17 May 2026 19:48:32 +0100
Subject: [PATCH 156/831] lttng-ust: 2.14.0 -> 2.15.0

Changes: https://lore.kernel.org/lkml/9592e7ac-2ff5-4fc4-94cc-ee3de89fa541@efficios.com/
---
 pkgs/by-name/lt/lttng-ust/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lt/lttng-ust/package.nix b/pkgs/by-name/lt/lttng-ust/package.nix
index 0455146aaed8..164510c209ce 100644
--- a/pkgs/by-name/lt/lttng-ust/package.nix
+++ b/pkgs/by-name/lt/lttng-ust/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lttng-ust";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "lttng";
     repo = "lttng-ust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9WZDjOGfflEc6BUUO3W70KeLcZnTaePkF8eg8Ns/lQc=";
+    hash = "sha256-LOZo/sVb9eG39Gg1PBs2FoLHTeOD5us9wW4kUwNo8o0=";
   };
 
   outputs = [

From facfd506e2abbe3375c7ad8a13a36d6b1f2d4f35 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Thu, 15 Jan 2026 09:04:21 +0000
Subject: [PATCH 157/831] avahi: fix static build

fixes `nix-build -A pkgsStatic.avahi`
---
 pkgs/by-name/av/avahi/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/av/avahi/package.nix b/pkgs/by-name/av/avahi/package.nix
index 09b9a602af55..c96fa61ee92e 100644
--- a/pkgs/by-name/av/avahi/package.nix
+++ b/pkgs/by-name/av/avahi/package.nix
@@ -11,6 +11,7 @@
   expat,
   gettext,
   glib,
+  autoconf-archive,
   autoreconfHook,
   libiconv,
   libevent,
@@ -142,6 +143,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    # Remove the vendored ACX_PTHREAD macro in favor of the more up-to-date
+    # implementation from autoconf-archive, especially to support static builds.
+    rm common/acx_pthread.m4
+  '';
+
   depsBuildBuild = [
     pkg-config
   ];
@@ -150,6 +157,7 @@ stdenv.mkDerivation rec {
     pkg-config
     gettext
     glib
+    autoconf-archive
     autoreconfHook
   ];
 

From 8a93a5d60f68c890877555cdfe449017da27cf1b Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Mon, 17 Nov 2025 01:40:07 -0500
Subject: [PATCH 158/831] bmake: fix cross

---
 pkgs/by-name/bm/bmake/package.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index 8c7c6841cf3e..48b329c659b4 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -91,7 +91,11 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    ./boot-strap --prefix=$out -o . op=install
+    # `boot-strap op=install` runs the built bmake, which breaks cross builds.
+    install -Dm755 bmake $out/bin/bmake
+    install -Dm644 bmake.1 $man/share/man/man1/bmake.1
+    mkdir -p $out/share
+    cp -r mk $out/share
 
     runHook postInstall
   '';

From d6937f6ae7b9e1f2e5f50e6020e5b4db864d7691 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Sun, 17 May 2026 15:26:51 -0700
Subject: [PATCH 159/831] x265: fix i686 build

---
 pkgs/by-name/x2/x265/fix-plt-rel.patch | 11 +++++++++++
 pkgs/by-name/x2/x265/package.nix       |  3 +++
 2 files changed, 14 insertions(+)
 create mode 100644 pkgs/by-name/x2/x265/fix-plt-rel.patch

diff --git a/pkgs/by-name/x2/x265/fix-plt-rel.patch b/pkgs/by-name/x2/x265/fix-plt-rel.patch
new file mode 100644
index 000000000000..23b5472bea4f
--- /dev/null
+++ b/pkgs/by-name/x2/x265/fix-plt-rel.patch
@@ -0,0 +1,11 @@
+--- a/common/x86/cpu-a.asm
++++ b/common/x86/cpu-a.asm
+@@ -177,7 +177,7 @@ cglobal safe_intel_cpu_indicator_init
+ %if WIN64
+     lea rax, [intel_cpu_indicator_init]
+     call rax
+-%elif FORMAT_ELF
++%elif UNIX64 && FORMAT_ELF
+     call [rel intel_cpu_indicator_init wrt ..plt]
+ %else
+     call intel_cpu_indicator_init
diff --git a/pkgs/by-name/x2/x265/package.nix b/pkgs/by-name/x2/x265/package.nix
index c51679eca4e7..e55d07e6ae4d 100644
--- a/pkgs/by-name/x2/x265/package.nix
+++ b/pkgs/by-name/x2/x265/package.nix
@@ -55,6 +55,9 @@ stdenv.mkDerivation (finalAttrs: {
     # fix compilation with gcc15
     # https://bitbucket.org/multicoreware/x265_git/pull-requests/36
     ./gcc15-fixes.patch
+    # fix i686-linux build
+    # https://bitbucket.org/multicoreware/x265_git/issues/1030
+    ./fix-plt-rel.patch
   ]
   # TODO: remove after update to version 4.2
   ++ lib.optionals (stdenv.hostPlatform.isAarch32 && stdenv.hostPlatform.isLinux) [

From f6172a101fe458c28e6d70de9e530b2699693d0d Mon Sep 17 00:00:00 2001
From: Eman Resu <78693624+quatquatt@users.noreply.github.com>
Date: Sun, 17 May 2026 21:16:45 -0400
Subject: [PATCH 160/831] libass: remove libiconv dependency on darwin

This is already in stdenv.
---
 pkgs/by-name/li/libass/package.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libass/package.nix b/pkgs/by-name/li/libass/package.nix
index 61b8611327f0..045b0d926bdb 100644
--- a/pkgs/by-name/li/libass/package.nix
+++ b/pkgs/by-name/li/libass/package.nix
@@ -44,9 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     fribidi
     harfbuzz
   ]
-  ++ lib.optional fontconfigSupport fontconfig
-  # TODO: remove dep after branchoff (in darwin stdenv)
-  ++ lib.optional stdenv.hostPlatform.isDarwin libiconv.out;
+  ++ lib.optional fontconfigSupport fontconfig;
 
   meta = {
     description = "Portable ASS/SSA subtitle renderer";

From bbad6942e5605f0aa12a8de3e8a290181f23f58a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 02:27:35 +0000
Subject: [PATCH 161/831] libusb1: 1.0.29 -> 1.0.30

---
 pkgs/by-name/li/libusb1/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libusb1/package.nix b/pkgs/by-name/li/libusb1/package.nix
index 4676098bff3e..06f18ee6e5ca 100644
--- a/pkgs/by-name/li/libusb1/package.nix
+++ b/pkgs/by-name/li/libusb1/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libusb";
-  version = "1.0.29";
+  version = "1.0.30";
 
   src = fetchFromGitHub {
     owner = "libusb";
     repo = "libusb";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-m1w+uF8+2WCn72LvoaGUYa+R0PyXHtFFONQjdRfImYY=";
+    sha256 = "sha256-qgs8h1vSqJg2muBDWN5nJlvaMjGYZnwMg1m07rqzHco=";
   };
 
   outputs = [

From 963f597bc3ffcf2c03004e6df66537a0741b5036 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 09:19:18 +0000
Subject: [PATCH 162/831] publicsuffix-list: 0-unstable-2026-03-26 ->
 0-unstable-2026-05-13

---
 pkgs/by-name/pu/publicsuffix-list/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index 72c500777df2..ea3f3d9fa1e4 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-05-13";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "d333b72b39575da1ce6932b01d7c421a4107c620";
-    hash = "sha256-LWnvQrIyj+iq96T1u9WEq+HGOZ5sJYN5nCintEr6sBk=";
+    rev = "e452c7058d6946bd76952b128c12f5ce87a5acb8";
+    hash = "sha256-5D4RZAyJOL4hMU32Rmp3SYmjgqEtF36mZJr4YBG0k7E=";
   };
 
   dontBuild = true;

From 030523c9b86d56c75841ac0381cf6478f7493041 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 11:49:31 +0000
Subject: [PATCH 163/831] maturin: 1.12.6 -> 1.13.3

---
 pkgs/by-name/ma/maturin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 8c08f6a0643f..2fe364f2bfa3 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "maturin";
-  version = "1.12.6";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NQ94RdQTQlRR5+2dC95cFNhwYliHmkD11JWyGt6BV6g=";
+    hash = "sha256-xVR/R/aQ6Kvx7w/X9gedjJLzlxz+5nhnwjxsiyKcg0A=";
   };
 
-  cargoHash = "sha256-9VqS9wvQAsSYNhH7B9WlD6SZjXR4S2sYzYoNy6vbYBM=";
+  cargoHash = "sha256-awdc2SLEfMP4cLG+RvQbeYPn1o9Ft7sqOnRy8iQqjB0=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

From fea908fde99e4dc812e973459875a082c72523f4 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 18 May 2026 13:43:58 +0200
Subject: [PATCH 164/831] stdenv: do not leak outputName out of loop

This is an implementation detail leaking out into the bash environment
and it did manange to confuse me as potentially being a way to get the "default"
output name when structuredAttrs is enabled, because of the "outputName" derivation attribute.
---
 pkgs/stdenv/generic/setup.sh | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/stdenv/generic/setup.sh b/pkgs/stdenv/generic/setup.sh
index 1c5c82be25b7..98eeded49b8c 100644
--- a/pkgs/stdenv/generic/setup.sh
+++ b/pkgs/stdenv/generic/setup.sh
@@ -29,10 +29,15 @@ if [[ -n "${NIX_ATTRS_JSON_FILE:-}" ]]; then
     __structuredAttrs=1
     echo "structuredAttrs is enabled"
 
-    for outputName in "${!outputs[@]}"; do
-        # ex: out=/nix/store/...
-        export "$outputName=${outputs[$outputName]}"
-    done
+    _exportOutputsByName() {
+        local outputName
+        for outputName in "${!outputs[@]}"; do
+            # ex: out=/nix/store/...
+            export "$outputName=${outputs[$outputName]}"
+        done
+    }
+
+    _exportOutputsByName
 else
     __structuredAttrs=
     : "${outputs:=out}"

From a0ee89704420278abb4c28c7b974500b0d19d39c Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 19 Apr 2026 11:24:01 +0200
Subject: [PATCH 165/831] wrapGAppsHook: prepare for structuredAttrs

This hook is called in the fixupPhase via

```
local output
for output in $(getAllOutputNames); do
  prefix="${!output}" runHook fixupOutput
done
```

Without `__structuredAttrs`, `getAllOutputNames` returns the `output` array, in order.
However, with `__structuredAttrs`, it returns the keys of the `output` associative array,
which are no longer necessarily ordered in the same way.

In the case of some packages (e.g. `mate-panel-with-applets`) this means that instead of
`[ "out" "man" ]`, we process `[ "man" "out" ]`. Running the hook for `"man"` then sets
`wrapGAppsHookHasRun` and no wrapping is done for `"out"`, which is what was really needed.

Instead, keep track of whether the hook has run on a per-output basis. That way, the order
does not matter and any executables that are spread around multiple outputs are wrapped.
---
 .../setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh        | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index 7487dabd5aad..ea3e81bfdf27 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -42,11 +42,13 @@ wrapGApp() {
     wrapProgram "$program" "${gappsWrapperArgs[@]}" "$@"
 }
 
+declare -gA wrapGAppsHookHasRunForOutput
+
 # Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
 wrapGAppsHook() {
-    # guard against running multiple times (e.g. due to propagation)
-    [ -z "$wrapGAppsHookHasRun" ] || return 0
-    wrapGAppsHookHasRun=1
+    # guard against running multiple times for the same output (e.g. due to propagation)
+    [ "${wrapGAppsHookHasRunForOutput["$output"]:-}" = 1 ] && return 0
+    wrapGAppsHookHasRunForOutput["$output"]=1
 
     if [[ -z "${dontWrapGApps:-}" ]]; then
         targetDirsThatExist=()

From 0ddb2c508c423ce9df7a073fbe1db2deb84b41ba Mon Sep 17 00:00:00 2001
From: FlashOnFire_ <flashonfire.dev@gmail.com>
Date: Sun, 12 Apr 2026 19:12:27 +0200
Subject: [PATCH 166/831] python3Packages.librt: fix cross compilation

Signed-off-by: FlashOnFire_ <flashonfire.dev@gmail.com>
---
 pkgs/development/python-modules/librt/default.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/python-modules/librt/default.nix b/pkgs/development/python-modules/librt/default.nix
index 044a9c742517..c1531eed6054 100644
--- a/pkgs/development/python-modules/librt/default.nix
+++ b/pkgs/development/python-modules/librt/default.nix
@@ -6,6 +6,7 @@
   mypy-extensions,
   python,
   pytest,
+  stdenv,
 }:
 
 buildPythonPackage rec {
@@ -23,6 +24,18 @@ buildPythonPackage rec {
   # https://github.com/mypyc/librt/blob/v0.7.8/.github/workflows/buildwheels.yml#L90-L93
   postPatch = ''
     cp -rv lib-rt/* .
+
+    # build_setup.py patches CCompiler.spawn to inject architecture-specific
+    # SIMD flags based on platform.machine() (which returns the build arch instead
+    # of the target arch). When cross-compiling, this causes the compiler to abort
+    # with "unrecognized command-line option" errors.
+    #
+    # The patch below forces the use of the target architecture, in order
+    # to keep SIMD flags for x86_64 targets while avoiding them elsewhere.
+    substituteInPlace build_setup.py \
+      --replace-fail \
+        'X86_64 = platform.machine() in ("x86_64", "AMD64", "amd64")' \
+        'X86_64 = ${if stdenv.hostPlatform.isx86_64 then "True" else "False"}'
   '';
 
   build-system = [

From 789f939dcb76779dca085fe9594c22bb2fd26648 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 05:16:06 -0700
Subject: [PATCH 167/831] gpgme: 2.0.1 -> 2.1.0

Changelog: https://dev.gnupg.org/source/gpgme/browse/master/NEWS;gpgme-2.1.0?as=remarkup
---
 pkgs/by-name/gp/gpgme/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gp/gpgme/package.nix b/pkgs/by-name/gp/gpgme/package.nix
index cd68dd81ec3b..33edca30f448 100644
--- a/pkgs/by-name/gp/gpgme/package.nix
+++ b/pkgs/by-name/gp/gpgme/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpgme";
-  version = "2.0.1";
+  version = "2.1.0";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/gpgme-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ghqwaVyELqtRdSqBmAySsEEMfq3QQQP3kdXSpSZ4SWY=";
+    hash = "sha256-hBxepT/CYln0+/DovemC3qG4ocoMt35oHIKwUFZr+Ss=";
   };
 
   postPatch = ''
@@ -110,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://gnupg.org/software/gpgme/index.html";
-    changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;f=NEWS;hb=gpgme-${finalAttrs.version}";
+    changelog = "https://dev.gnupg.org/source/gpgme/browse/master/NEWS;gpgme-${finalAttrs.version}?as=remarkup";
     description = "Library for making GnuPG easier to use";
     longDescription = ''
       GnuPG Made Easy (GPGME) is a library designed to make access to GnuPG

From fb0f146a68b5c7fe6f776a6f7a3aa7195ad54739 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 09:12:18 -0700
Subject: [PATCH 168/831] gpgmepp: 2.0.0 -> 2.1.0

Changelog: https://dev.gnupg.org/source/gpgmepp/browse/master/NEWS;gpgmepp-2.1.0?as=remarkup
---
 pkgs/by-name/gp/gpgmepp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gp/gpgmepp/package.nix b/pkgs/by-name/gp/gpgmepp/package.nix
index d0f6ce2ae37d..d82e0d1617ba 100644
--- a/pkgs/by-name/gp/gpgmepp/package.nix
+++ b/pkgs/by-name/gp/gpgmepp/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpgmepp";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "mirror://gnupg/gpgmepp/gpgmepp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-1HlgScBnCKJvMJb3SO8JU0fho8HlcFYXAf6VLD9WU4I=";
+    hash = "sha256-V/gERo8CBFBLFyxrE5ywUSS0JjvnrVFJMsfExQYqFuI=";
   };
 
   postPatch = ''

From ce52fbf05707870a85c04c6f428d1b6558a5b124 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 09:12:53 -0700
Subject: [PATCH 169/831] qt6Packages.qgpgme: 2.0.0 -> 2.1.0

Changelog: https://dev.gnupg.org/source/gpgmeqt/browse/master/NEWS;gpgmeqt-2.1.0?as=remarkup
---
 pkgs/development/libraries/qgpgme/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/qgpgme/default.nix b/pkgs/development/libraries/qgpgme/default.nix
index c3dbe6800552..d1f7e6ca669e 100644
--- a/pkgs/development/libraries/qgpgme/default.nix
+++ b/pkgs/development/libraries/qgpgme/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qgpgme";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchurl {
     url = "mirror://gnupg/qgpgme/qgpgme-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FWRbJHXMphGOsu0zGzqNlELJ1AGcOEa6P20lMhtKYa0=";
+    hash = "sha256-WzL+s+7kp/lALSK3IGSAkI3EO7TfOCkXwHXFEhFvjwg=";
   };
 
   patches = [
@@ -30,6 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
   ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_WITH_QT5" (lib.versions.major qtbase.version == "5"))
+    (lib.cmakeBool "BUILD_WITH_QT6" (lib.versions.major qtbase.version == "6"))
+  ];
+
   buildInputs = [
     qtbase
   ];

From a74e4f1c48e260b21410ca0143797b944f5eb9cf Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Mon, 18 May 2026 07:31:40 -0700
Subject: [PATCH 170/831] nix: remove util-linux test special-casing

Fixed-by: https://lore.kernel.org/util-linux/dryjs4vfzzysrhuxa4khf7frezdmouv6ys5nqsx7u46nvk4mg6@z4o37akcrh6y/T/#u
---
 .../nix/modular/tests/functional/package.nix              | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/pkgs/tools/package-management/nix/modular/tests/functional/package.nix b/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
index b8bf89d99f7f..597c89f08c4d 100644
--- a/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
+++ b/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
@@ -73,14 +73,6 @@ mkMesonDerivation (finalAttrs: {
       echo $PWD | grep tests/functional
     '';
 
-  # Test contains invocation of `script` broken by util-linux regression:
-  # https://github.com/util-linux/util-linux/commit/70507ab9eaed10b8dd77b77d4ea25c11ee726bed
-  preCheck =
-    assert util-linux.version == "2.42";
-    ''
-      echo "exit 77" > ../json.sh
-    '';
-
   mesonCheckFlags = [
     "--print-errorlogs"
   ];

From 28dd6b9df1650e52f3564ee98ec3ebea744b0ca8 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Mon, 18 May 2026 06:26:59 -0700
Subject: [PATCH 171/831] util-linux: 2.42 -> 2.42.1

---
 pkgs/by-name/ut/util-linux/package.nix | 36 ++------------------------
 1 file changed, 2 insertions(+), 34 deletions(-)

diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index 0c9c7542a23c..3c26f7b0d780 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -43,11 +43,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "util-linux" + lib.optionalString isMinimal "-minimal";
-  version = "2.42";
+  version = "2.42.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor finalAttrs.version}/util-linux-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NFKyYLuqd11udJrDuyIRF4UAP8H0RJcAJcjaJt+nWOk=";
+    hash = "sha256-gukVjrEqmwtWnYThaH/tndGP6JzNjvWsNCchinwNf38=";
   };
 
   # Note: fetchpatch/fetchpatch2 cause infinite recursion with util-linuxMinimal.
@@ -57,38 +57,6 @@ stdenv.mkDerivation (finalAttrs: {
     # which isn't valid on NixOS (and a compatibility link on most other modern
     # distros anyway).
     ./rtcwake-search-PATH-for-shutdown.patch
-
-    # Fix compile of 2.42+ on Darwin.
-    # https://lore.kernel.org/util-linux/CAEUYr6ZjVX1bd-xcBGtFN_ZYwQnXDYsw7d1-7sTpF2BbgfrR+g@mail.gmail.com/T/#u
-    # Different fix than originally proposed; we just don't compile that file on Darwin now and the previous patch was able to be reverted.
-    # See: https://github.com/util-linux/util-linux/commit/6ccf20d2fd8e45eed70bd1b915c0d16f646bf133
-    (fetchurl {
-      name = "pidfd-utils-linux-only.patch";
-      url = "https://github.com/util-linux/util-linux/commit/afdade4a3d8e4e6070343c5576470c575719b81f.patch";
-      hash = "sha256-EnHsIhU6jaS4Qm+kQMP2an7Ay08nKbIO0MbU7Y2pwkU=";
-    })
-
-    # Musl does not define AT_HANDLE_FID, hard-code it if left undefined.
-    # https://github.com/util-linux/util-linux/pull/4203
-    (fetchurl {
-      name = "fix-musl-nsenter.patch";
-      url = "https://github.com/util-linux/util-linux/commit/000aff333e5c3a23967280cb0d6451fbbfc9c91b.patch";
-      hash = "sha256-6K3jRr2RsAfHnweBOlMn2F0h8hD3xjZobJ1pSlCQHw8=";
-    })
-
-    # `script` is broken with options after non-option args and has new memory leaks
-    # https://lore.kernel.org/util-linux/adi3573O-5gr9m2q@per.namespace.at/T/#t
-    # https://github.com/util-linux/util-linux/pull/4201
-    (fetchurl {
-      name = "script-fix-backwards-compat.patch";
-      url = "https://github.com/util-linux/util-linux/commit/70507ab9eaed10b8dd77b77d4ea25c11ee726bed.patch";
-      hash = "sha256-PpFtv8XOK36npCVSvdgKcxGQmkJtgdyMmlN+4yQuWS8=";
-    })
-    (fetchurl {
-      name = "script-fix-memory-leaks.patch";
-      url = "https://github.com/util-linux/util-linux/commit/2f1c12a49500ca7ed9c3d5e80664c1622925456b.patch";
-      hash = "sha256-9ZwA6sZwM1rQDoxV5x1KHLWxsFpI5CGWJqubtdEHj/I=";
-    })
   ];
 
   # We separate some of the utilities into their own outputs. This

From e07e1835f583ad3af59b8a0c5d93fc529bfec2ff Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 18 May 2026 21:31:08 +0100
Subject: [PATCH 172/831] libxi: 1.8.2 -> 1.8.3

Changes: https://lists.x.org/archives/xorg-announce/2026-May/003698.html
---
 pkgs/by-name/li/libxi/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libxi/package.nix b/pkgs/by-name/li/libxi/package.nix
index 3cbac22c36f3..0475ba395175 100644
--- a/pkgs/by-name/li/libxi/package.nix
+++ b/pkgs/by-name/li/libxi/package.nix
@@ -12,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxi";
-  version = "1.8.2";
+  version = "1.8.3";
 
   outputs = [
     "out"
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libXi-${finalAttrs.version}.tar.xz";
-    hash = "sha256-0OBVXlPW4hFOq/pEImuhYtJwhQGiXhjZnPs1wJTGwQQ=";
+    hash = "sha256-etYAVvAa9PeGz+k7OncHRHcRYm/I2iY3vscakECbq+U=";
   };
 
   strictDeps = true;

From b3e12e96da2fdb5c4bca369136dcb9e219002e20 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 May 2026 23:27:00 +0000
Subject: [PATCH 173/831] libksba: 1.6.7 -> 1.8.0

---
 pkgs/by-name/li/libksba/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libksba/package.nix b/pkgs/by-name/li/libksba/package.nix
index 97736060a1ac..8ea24155784d 100644
--- a/pkgs/by-name/li/libksba/package.nix
+++ b/pkgs/by-name/li/libksba/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libksba";
-  version = "1.6.7";
+  version = "1.8.0";
 
   src = fetchurl {
     url = "mirror://gnupg/libksba/libksba-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-z3JRC467TrZpPu92V0nYNnegPHkpGjEQQKW/15uqt2M=";
+    hash = "sha256-KWuduQlXSfKqEEIC16t/0JrRBxDgB4CnCcl1SxodkpI=";
   };
 
   outputs = [

From b54e4a6c055fcc26b8e22d76adf41e344b3aec06 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Tue, 19 May 2026 02:38:41 +0200
Subject: [PATCH 174/831] valgrind: remove pname substitution

---
 pkgs/by-name/va/valgrind/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index caf76027d8ee..62e1d381fd79 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "3.27.0";
 
   src = fetchurl {
-    url = "https://sourceware.org/pub/${pname}/${pname}-${version}.tar.bz2";
+    url = "https://sourceware.org/pub/valgrind/valgrind-${version}.tar.bz2";
     hash = "sha256-W1k33oJX7o9RaY6nG5cRrc6YBhqgfapKaF78OvkhW+8=";
   };
 

From 4a8e8392a42c9668f1ba0af081b4f6195f2341cb Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 9 May 2026 12:06:55 +1000
Subject: [PATCH 175/831] glibc: 2.42-61 -> 2.42-67

---
 .../libraries/glibc/2.42-master.patch         | 759 ++++++++++++++++++
 pkgs/development/libraries/glibc/common.nix   |   6 +-
 2 files changed, 762 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/glibc/2.42-master.patch b/pkgs/development/libraries/glibc/2.42-master.patch
index 47ed7dd1183b..a7bdf93961db 100644
--- a/pkgs/development/libraries/glibc/2.42-master.patch
+++ b/pkgs/development/libraries/glibc/2.42-master.patch
@@ -7154,3 +7154,762 @@ index 00181cfefb..e83ea2b939 100644
    TEST_VERIFY (ret != 0);
    TEST_COMPARE (errno, EBUSY);
  }
+
+commit f13c1bb0f97fbc12a6ba1ab5669ce561ea32b80a
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Thu Apr 16 19:13:43 2026 +0200
+
+    Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
+    
+    Follow the example in iso-2022-jp-3.c and use the __count state
+    variable to store the pending character.  This avoids restarting
+    the conversion if the output buffer ends between two 4-byte UCS-4
+    code points, so that the assert reported in the bug can no longer
+    happen.
+    
+    Even though the fix is applied to ibm1364.c, the change is only
+    effective for the two HAS_COMBINED codecs for IBM1390, IBM1399.
+    
+    The test case was mostly auto-generated using
+    claude-4.6-opus-high-thinking, and composer-2-fast shows up in the
+    log as well.  During review, gpt-5.4-xhigh flagged that the original
+    version of the test case was not exercising the new character
+    flush logic.
+    
+    This fixes bug 33980.
+    
+    Assisted-by: LLM
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    (cherry picked from commit d6f08d1cf027f4eb2ba289a6cc66853722d4badc)
+
+diff --git a/iconvdata/Makefile b/iconvdata/Makefile
+index 5a2abeea24..cc689f63e9 100644
+--- a/iconvdata/Makefile
++++ b/iconvdata/Makefile
+@@ -76,7 +76,7 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
+ 	tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
+ 	bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \
+ 	bug-iconv13 bug-iconv14 bug-iconv15 \
+-	tst-iconv-iso-2022-cn-ext
++	tst-iconv-iso-2022-cn-ext tst-bug33980
+ ifeq ($(have-thread-library),yes)
+ tests += bug-iconv3
+ endif
+@@ -333,6 +333,8 @@ $(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ 			  $(addprefix $(objpfx),$(modules.so))
+ $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ 					$(addprefix $(objpfx),$(modules.so))
++$(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \
++			   $(addprefix $(objpfx),$(modules.so))
+ 
+ $(objpfx)iconv-test.out: run-iconv-test.sh \
+ 			 $(addprefix $(objpfx), $(gconv-modules)) \
+diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
+index 45c62acee5..244c61ad7a 100644
+--- a/iconvdata/ibm1364.c
++++ b/iconvdata/ibm1364.c
+@@ -67,12 +67,29 @@
+ 
+ /* Since this is a stateful encoding we have to provide code which resets
+    the output state to the initial state.  This has to be done during the
+-   flushing.  */
++   flushing.  For the to-internal direction (FROM_DIRECTION is true),
++   there may be a pending character that needs flushing.  */
+ #define EMIT_SHIFT_TO_INIT \
+   if ((data->__statep->__count & ~7) != sb)				      \
+     {									      \
+       if (FROM_DIRECTION)						      \
+-	data->__statep->__count &= 7;					      \
++	{								      \
++	  uint32_t ch = data->__statep->__count >> 7;			      \
++	  if (__glibc_unlikely (ch != 0))				      \
++	    {								      \
++	      if (__glibc_unlikely (outend - outbuf < 4))		      \
++		status = __GCONV_FULL_OUTPUT;				      \
++	      else							      \
++		{							      \
++		  put32 (outbuf, ch);					      \
++		  outbuf += 4;						      \
++		  /* Clear character and db bit.  */			      \
++		  data->__statep->__count &= 7;				      \
++		}							      \
++	    }								      \
++	  else								      \
++	    data->__statep->__count &= 7;				      \
++	}								      \
+       else								      \
+ 	{								      \
+ 	  /* We are not in the initial state.  To switch back we have	      \
+@@ -99,11 +116,13 @@
+     *curcsp = save_curcs
+ 
+ 
+-/* Current codeset type.  */
++/* Current codeset type.  The bit is stored in the __count variable of
++   the conversion state.  If the db bit is set, bit 7 and above store
++   a pending UCS-4 code point if non-zero.  */
+ enum
+ {
+-  sb = 0,
+-  db = 64
++  sb = 0,			/* Single byte mode.  */
++  db = 64			/* Double byte mode.  */
+ };
+ 
+ 
+@@ -119,21 +138,29 @@ enum
+       }									      \
+     else								      \
+       {									      \
+-	/* This is a combined character.  Make sure we have room.  */	      \
+-	if (__glibc_unlikely (outptr + 8 > outend))			      \
+-	  {								      \
+-	    result = __GCONV_FULL_OUTPUT;				      \
+-	    break;							      \
+-	  }								      \
+-									      \
+ 	const struct divide *cmbp					      \
+ 	  = &DB_TO_UCS4_COMB[ch - __TO_UCS4_COMBINED_MIN];		      \
+ 	assert (cmbp->res1 != 0 && cmbp->res2 != 0);			      \
+ 									      \
+ 	put32 (outptr, cmbp->res1);					      \
+ 	outptr += 4;							      \
+-	put32 (outptr, cmbp->res2);					      \
+-	outptr += 4;							      \
++									      \
++	/* See whether we have room for the second character.  */	      \
++	if (outend - outptr >= 4)					      \
++	  {								      \
++	    put32 (outptr, cmbp->res2);					      \
++	    outptr += 4;						      \
++	  }								      \
++	else								      \
++	  {								      \
++	    /* Otherwise store only the first character now, and	      \
++	       put the second one into the queue.  */			      \
++	    curcs |= cmbp->res2 << 7;					      \
++	    inptr += 2;							      \
++	    /* Tell the caller why we terminate the loop.  */		      \
++	    result = __GCONV_FULL_OUTPUT;				      \
++	    break;							      \
++	  }								      \
+       }									      \
+   }
+ #else
+@@ -153,7 +180,20 @@ enum
+ #define LOOPFCT 		FROM_LOOP
+ #define BODY \
+   {									      \
+-    uint32_t ch = *inptr;						      \
++    uint32_t ch;							      \
++									      \
++    ch = curcs >> 7;							      \
++    if (__glibc_unlikely (ch != 0))					      \
++      {									      \
++	put32 (outptr, ch);						      \
++	outptr += 4;							      \
++	/* Remove the pending character, but preserve state bits.  */	      \
++	curcs &= (1 << 7) - 1;						      \
++	continue;							      \
++      }									      \
++									      \
++    /* Otherwise read the next input byte.  */				      \
++    ch = *inptr;							      \
+ 									      \
+     if (__builtin_expect (ch, 0) == SO)					      \
+       {									      \
+diff --git a/iconvdata/tst-bug33980.c b/iconvdata/tst-bug33980.c
+new file mode 100644
+index 0000000000..c9693e0efe
+--- /dev/null
++++ b/iconvdata/tst-bug33980.c
+@@ -0,0 +1,153 @@
++/* Test for bug 33980: combining characters in IBM1390/IBM1399.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <alloc_buffer.h>
++#include <errno.h>
++#include <iconv.h>
++#include <stdbool.h>
++#include <string.h>
++
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/support.h>
++
++/* Run iconv in a loop with a small output buffer of OUTBUFSIZE bytes
++   starting at OUTBUF.  OUTBUF should be right before an unmapped page
++   so that writing past the end will fault.  Skip SHIFT bytes at the
++   start of the input and output, to exercise different buffer
++   alignment.  TRUNCATE indicates skipped bytes at the end of
++   input (0 and 1 a valid).  */
++static void
++test_one (const char *encoding, unsigned int shift, unsigned int truncate,
++          char *outbuf, size_t outbufsize)
++{
++  /* In IBM1390 and IBM1399, the DBCS code 0xECB5 expands to two
++     Unicode code points when translated.  */
++  static char input[] =
++    {
++      /* 8 letters X.  */
++      0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7,
++      /* SO, 0xECB5, SI: shift to DBCS, special character, shift back.  */
++      0x0e, 0xec, 0xb5, 0x0f
++    };
++
++  /* Expected output after UTF-8 conversion.  */
++  static char expected[] =
++    {
++      'X', 'X', 'X', 'X', 'X', 'X', 'X', 'X',
++      /* U+304B (HIRAGANA LETTER KA).  */
++      0xe3, 0x81, 0x8b,
++      /* U+309A (COMBINING KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK).  */
++      0xe3, 0x82, 0x9a
++    };
++
++  iconv_t cd = iconv_open ("UTF-8", encoding);
++  TEST_VERIFY_EXIT (cd != (iconv_t) -1);
++
++  char result_storage[64];
++  struct alloc_buffer result_buf
++    = alloc_buffer_create (result_storage, sizeof (result_storage));
++
++  char *inptr = &input[shift];
++  size_t inleft = sizeof (input) - shift - truncate;
++
++  while (inleft > 0)
++    {
++      char *outptr = outbuf;
++      size_t outleft = outbufsize;
++      size_t inleft_before = inleft;
++
++      size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft);
++      size_t produced = outptr - outbuf;
++      alloc_buffer_copy_bytes (&result_buf, outbuf, produced);
++
++      if (ret == (size_t) -1 && errno == E2BIG)
++        {
++          if (produced == 0 && inleft == inleft_before)
++            {
++              /* Output buffer too small to make progress.  This is
++                 expected for very small output buffer sizes.  */
++              TEST_VERIFY_EXIT (outbufsize < 3);
++              break;
++            }
++          continue;
++        }
++      if (ret == (size_t) -1)
++        FAIL_EXIT1 ("%s (outbufsize %zu): iconv: %m", encoding, outbufsize);
++      break;
++    }
++
++  /* Flush any pending state (e.g. a buffered combined character).
++     With outbufsize < 3, we could not store the first character, so
++     the second character did not become pending, and there is nothing
++     to flush.  */
++  {
++    char *outptr = outbuf;
++    size_t outleft = outbufsize;
++
++    size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft);
++    TEST_VERIFY_EXIT (ret == 0);
++    size_t produced = outptr - outbuf;
++    alloc_buffer_copy_bytes (&result_buf, outbuf, produced);
++
++    /* Second flush does not provide more data.  */
++    outptr = outbuf;
++    outleft = outbufsize;
++    ret = iconv (cd, NULL, NULL, &outptr, &outleft);
++    TEST_VERIFY_EXIT (ret == 0);
++    TEST_VERIFY (outptr == outbuf);
++  }
++
++  TEST_VERIFY_EXIT (!alloc_buffer_has_failed (&result_buf));
++  size_t result_used
++    = sizeof (result_storage) - alloc_buffer_size (&result_buf);
++
++  if (outbufsize >= 3)
++    {
++      TEST_COMPARE (inleft, 0);
++      TEST_COMPARE (result_used, sizeof (expected) - shift);
++      TEST_COMPARE_BLOB (result_storage, result_used,
++                         &expected[shift], sizeof (expected) - shift);
++    }
++  else
++    /* If the buffer is too small, only the leading X could be converted.  */
++    TEST_COMPARE (result_used, 8 - shift);
++
++  TEST_VERIFY_EXIT (iconv_close (cd) == 0);
++}
++
++static int
++do_test (void)
++{
++  struct support_next_to_fault ntf
++    = support_next_to_fault_allocate (8);
++
++  for (int shift = 0; shift <= 8; ++shift)
++    for (int truncate = 0; truncate < 2; ++truncate)
++      for (size_t outbufsize = 1; outbufsize <= 8; outbufsize++)
++        {
++          char *outbuf = ntf.buffer + ntf.length - outbufsize;
++          test_one ("IBM1390", shift, truncate, outbuf, outbufsize);
++          test_one ("IBM1399", shift, truncate, outbuf, outbufsize);
++        }
++
++  support_next_to_fault_free (&ntf);
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 12feedaf67e11c4618dc50c6aab4dbfd1e6d9531
+Author: DJ Delorie <dj@redhat.com>
+Date:   Mon Jan 26 22:24:42 2026 -0500
+
+    include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
+    
+    Including sys/mount.h should not implicitly include fcntl.h
+    as that causes namespace pollution and conflicts with kernel
+    headers.  It only needs O_CLOEXEC for OPEN_TREE_CLOEXEC
+    (although it shouldn't need that, but it's defined that way)
+    so we provide that define (via a private version) separately.
+    
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+    Tested-by: Florian Weimer <fweimer@redhat.com>
+    (cherry picked from commit 419245719ccbc7dad6a97f24465e7f09c090327a)
+
+diff --git a/io/fcntl.c b/io/fcntl.c
+index e88e28664c..b7dab1bb39 100644
+--- a/io/fcntl.c
++++ b/io/fcntl.c
+@@ -18,6 +18,10 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ 
++#ifndef __O_CLOEXEC
++# error __O_CLOEXEC not defined by fcntl.h/cloexec.h
++#endif
++
+ /* Perform file control operations on FD.  */
+ int
+ __fcntl (int fd, int cmd, ...)
+diff --git a/sysdeps/unix/sysv/linux/Makefile b/sysdeps/unix/sysv/linux/Makefile
+index c47cbdf428..053041f256 100644
+--- a/sysdeps/unix/sysv/linux/Makefile
++++ b/sysdeps/unix/sysv/linux/Makefile
+@@ -129,6 +129,7 @@ CFLAGS-test-errno-linux.c += $(no-fortify-source)
+ 
+ sysdep_headers += \
+   bits/a.out.h \
++  bits/cloexec.h \
+   bits/epoll.h \
+   bits/eventfd.h \
+   bits/inotify.h \
+diff --git a/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h b/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h
+new file mode 100644
+index 0000000000..f381f28a53
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 010000000
+diff --git a/sysdeps/unix/sysv/linux/bits/cloexec.h b/sysdeps/unix/sysv/linux/bits/cloexec.h
+new file mode 100644
+index 0000000000..3059fb6473
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 02000000
+diff --git a/sysdeps/unix/sysv/linux/bits/fcntl-linux.h b/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
+index f425a4bf22..98954feaca 100644
+--- a/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
++++ b/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
+@@ -81,9 +81,7 @@
+ #ifndef __O_NOFOLLOW
+ # define __O_NOFOLLOW	0400000
+ #endif
+-#ifndef __O_CLOEXEC
+-# define __O_CLOEXEC   02000000
+-#endif
++#include <bits/cloexec.h>
+ #ifndef __O_DIRECT
+ # define __O_DIRECT	 040000
+ #endif
+diff --git a/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h b/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h
+new file mode 100644
+index 0000000000..f381f28a53
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 010000000
+diff --git a/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h b/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h
+new file mode 100644
+index 0000000000..6706eaa7d5
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 0x400000
+diff --git a/sysdeps/unix/sysv/linux/sys/mount.h b/sysdeps/unix/sysv/linux/sys/mount.h
+index b549e75148..365da1c296 100644
+--- a/sysdeps/unix/sysv/linux/sys/mount.h
++++ b/sysdeps/unix/sysv/linux/sys/mount.h
+@@ -21,7 +21,6 @@
+ #ifndef _SYS_MOUNT_H
+ #define _SYS_MOUNT_H	1
+ 
+-#include <fcntl.h>
+ #include <features.h>
+ #include <stdint.h>
+ #include <stddef.h>
+@@ -266,6 +265,11 @@ enum fsconfig_command
+ 
+ /* open_tree flags.  */
+ #define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
++#ifndef O_CLOEXEC
++# include <bits/cloexec.h>
++# define O_CLOEXEC __O_CLOEXEC
++#endif
++#undef  OPEN_TREE_CLOEXEC
+ #define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
+ 
+ 
+diff --git a/sysdeps/unix/sysv/linux/tst-mount.c b/sysdeps/unix/sysv/linux/tst-mount.c
+index 40913c7082..78a2772b2f 100644
+--- a/sysdeps/unix/sysv/linux/tst-mount.c
++++ b/sysdeps/unix/sysv/linux/tst-mount.c
+@@ -20,6 +20,7 @@
+ #include <support/check.h>
+ #include <support/xunistd.h>
+ #include <support/namespace.h>
++#include <fcntl.h> /* For AT_ constants.  */
+ #include <sys/mount.h>
+ 
+ _Static_assert (sizeof (struct mount_attr) == MOUNT_ATTR_SIZE_VER0,
+
+commit 3ecfa68561d723564a1fb565366182eb4acb3e8f
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Wed Mar 4 18:32:36 2026 +0100
+
+    Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
+    
+    There is a conditional inclusion of <linux/mount.h> earlier in the file.
+    If that defines the macros, do not redefine them.  This addresses build
+    problems as the token sequence used by the UAPI macro definitions
+    changes between Linux versions.
+    
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+    (cherry picked from commit d12b017cddfeb9fe9920ba054ae3dfcb8e9238b8)
+
+diff --git a/sysdeps/unix/sysv/linux/sys/mount.h b/sysdeps/unix/sysv/linux/sys/mount.h
+index 365da1c296..30ba56c1e8 100644
+--- a/sysdeps/unix/sysv/linux/sys/mount.h
++++ b/sysdeps/unix/sysv/linux/sys/mount.h
+@@ -264,14 +264,16 @@ enum fsconfig_command
+ #define FSOPEN_CLOEXEC          0x00000001
+ 
+ /* open_tree flags.  */
+-#define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
++#ifndef OPEN_TREE_CLONE
++# define OPEN_TREE_CLONE    1 /* Clone the target tree and attach the clone */
++#endif
+ #ifndef O_CLOEXEC
+ # include <bits/cloexec.h>
+ # define O_CLOEXEC __O_CLOEXEC
+ #endif
+-#undef  OPEN_TREE_CLOEXEC
+-#define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
+-
++#ifndef OPEN_TREE_CLOEXEC
++# define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
++#endif
+ 
+ __BEGIN_DECLS
+ 
+
+commit 3e87cf9be93acf19d685e8003fc649cdb052a891
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Mon Apr 13 10:46:42 2026 +0800
+
+    abilist.awk: Handle weak unversioned defined symbols
+    
+    After
+    
+    commit f685e3953f9a38a41bbd0a597f9882870cee13d5
+    Author: H.J. Lu <hjl.tools@gmail.com>
+    Date:   Wed Oct 29 09:49:57 2025 +0800
+    
+        elf: Don't set its DT_VERSYM entry for unversioned symbol
+    
+    ld no longer assigns version index 1 to unversioned defined symbol.
+    For libmachuser.so, "objdump --dynamic-syms" reports:
+    
+    0000dd30  w   DF .text  000000f8              processor_start
+    
+    instead of
+    
+    0000dd30  w   DF .text  000000f8 (Base)       processor_start
+    
+    Also allow NF == 6 for weak unversioned dynamic symbols.  This fixes BZ
+    33650.
+    
+    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+    Reviewed-by: Sam James <sam@gentoo.org>
+    (cherry picked from commit ee5d1db2a81468413fbf7c82779ffa782f429d1a)
+
+diff --git a/scripts/abilist.awk b/scripts/abilist.awk
+index 6cc7af6ac8..7ea1edf8c0 100644
+--- a/scripts/abilist.awk
++++ b/scripts/abilist.awk
+@@ -38,7 +38,7 @@ $4 == "*UND*" { next }
+ $2 == "l" { next }
+ 
+ # If the target uses ST_OTHER, it will be output before the symbol name.
+-$2 == "g" || $2 == "w" && (NF == 7 || NF == 8) {
++$2 == "g" || $2 == "w" && (NF == 6 || NF == 7 || NF == 8) {
+   type = $3;
+   size = $5;
+   sub(/^0*/, "", size);
+
+commit b4bca35ab9e76890504c4dbdd5eaf15a93514580
+Author: Rocket Ma <marocketbd@gmail.com>
+Date:   Fri May 1 20:39:07 2026 -0700
+
+    libio: Fix ungetwc operating on byte stream [BZ #33998]
+    
+    * libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one
+    character, it accidently compare the wchar to push back with the last
+    char from byte stream, instead of wide stream. Under specific coding,
+    attacker may exploit this to leak information. This commit fix bug
+    33998, or CVE-2026-5928.
+    
+    Signed-off-by: Rocket Ma <marocketbd@gmail.com>
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    (cherry picked from commit ef3bfb5f910011f3780cb06aa47e730035f53285)
+
+diff --git a/libio/Makefile b/libio/Makefile
+index f020f8ec4d..fa2b8ae791 100644
+--- a/libio/Makefile
++++ b/libio/Makefile
+@@ -83,6 +83,7 @@ tests = \
+   bug-ungetwc1 \
+   bug-ungetwc2 \
+   bug-wfflush \
++  bug-wgenops-bz33998 \
+   bug-wmemstream1 \
+   bug-wsetpos \
+   test-fmemopen \
+diff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c
+new file mode 100644
+index 0000000000..cc4067da99
+--- /dev/null
++++ b/libio/bug-wgenops-bz33998.c
+@@ -0,0 +1,54 @@
++/* Regression test for ungetwc operating on byte stream (BZ #33998)
++   Copyright (C) 2026 The GNU Toolchain Authors.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "support/temp_file.h"
++#include "support/xstdio.h"
++#include "support/xunistd.h"
++#include <stdlib.h>
++#include <unistd.h>
++#include <sys/mman.h>
++#include <stdio.h>
++#include <wchar.h>
++#include <support/check.h>
++
++static int
++do_test (void)
++{
++  char *filename;
++  int fd = create_temp_file ("tst-bz33998-", &filename);
++  TEST_VERIFY (fd != -1);
++  xwrite (fd, "A", sizeof ("A")); // write "A\0" by design
++  xclose (fd);
++
++  FILE *fp = xfopen (filename, "r+");
++  TEST_COMPARE (getwc (fp), L'A');
++  /* If the bug is fixed, then ungetwc should not touch byte stream.
++     If the bug is not fixed, ungetwc firstly match last read char, L'A',
++     failed, then the pbackfail branch, matching last read char in byte
++     stream, that is, '\0' (initialized when setup wide stream). */
++  char *old_read_ptr = fp->_IO_read_ptr;
++  TEST_COMPARE (ungetwc (L'\0', fp), L'\0');
++  TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr);
++
++  xfclose (fp);
++  free (filename);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/libio/wgenops.c b/libio/wgenops.c
+index 0a11d1b1de..9e0b2c00ea 100644
+--- a/libio/wgenops.c
++++ b/libio/wgenops.c
+@@ -108,8 +108,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c)
+ {
+   if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base
+       && !_IO_in_backup (fp)
+-      && (wint_t) fp->_IO_read_ptr[-1] == c)
+-    --fp->_IO_read_ptr;
++      && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c)
++    --fp->_wide_data->_IO_read_ptr;
+   else
+     {
+       /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/
+
+commit 4ebd33dd77eabe8d4c45232bed4b42a31d2f9edc
+Author: Rocket Ma <marocketbd@gmail.com>
+Date:   Fri Apr 17 23:48:41 2026 -0700
+
+    stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
+    
+    * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
+    format %mc or %mC, glibc allocates one byte less, leading to
+    user-controlled one byte overflow. This commit fixes BZ #34008, or
+    CVE-2026-5450.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Signed-off-by: Rocket Ma <marocketbd@gmail.com>
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    (cherry picked from commit 839898777226a3ed88c0859f25ffe712519b4ead)
+
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index 64b3575acb..e52c333808 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -347,6 +347,7 @@ tests := \
+   tst-vfprintf-user-type \
+   tst-vfprintf-width-i18n \
+   tst-vfprintf-width-prec-alloc \
++  tst-vfscanf-bz34008 \
+   tst-wc-printf \
+   tstdiomisc \
+   tstgetln \
+@@ -562,6 +563,9 @@ tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \
+ tst-vfprintf-width-prec-ENV = \
+   MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \
+   LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
++tst-vfscanf-bz34008-ENV = \
++  MALLOC_CHECK_=3 \
++  LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+ tst-printf-bz25691-ENV = \
+   MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \
+   LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+diff --git a/stdio-common/tst-vfscanf-bz34008.c b/stdio-common/tst-vfscanf-bz34008.c
+new file mode 100644
+index 0000000000..48371c8a3d
+--- /dev/null
++++ b/stdio-common/tst-vfscanf-bz34008.c
+@@ -0,0 +1,48 @@
++/* Regression test for vfscanf %Nmc out-of-bound write (BZ #34008)
++   Copyright (C) 2026 The GNU Toolchain Authors.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "malloc/mcheck.h"
++#include <stddef.h>
++#include <stdio.h>
++#include <string.h>
++#include <wchar.h>
++#include <stdlib.h>
++#include <malloc.h>
++#include <support/check.h>
++
++#define WIDTH 0x410
++#define SCANFSTR "%1040mc"
++static int
++do_test (void)
++{
++  mcheck_pedantic (NULL);
++  char *input = malloc (WIDTH + 1);
++  TEST_VERIFY (input != NULL);
++  memset (input, 'A', WIDTH);
++  input[WIDTH] = '\0';
++
++  char *buf = NULL;
++  TEST_VERIFY (sscanf (input, SCANFSTR, &buf) != -1);
++  TEST_VERIFY (buf != NULL);
++
++  free (buf);
++  free (input);
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
+index 86ae5019a6..17b5565d0f 100644
+--- a/stdio-common/vfscanf-internal.c
++++ b/stdio-common/vfscanf-internal.c
+@@ -853,8 +853,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 			{
+ 			  /* Enlarge the buffer.  */
+ 			  size_t newsize
+-			    = strsize
+-			      + (strsize >= width ? width - 1 : strsize);
++			    = strsize + (strsize >= width ? width : strsize);
+ 
+ 			  str = (char *) realloc (*strptr, newsize);
+ 			  if (str == NULL)
+@@ -925,7 +924,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		      && wstr == (wchar_t *) *strptr + strsize)
+ 		    {
+ 		      size_t newsize
+-			= strsize + (strsize > width ? width - 1 : strsize);
++			= strsize + (strsize >= width ? width : strsize);
+ 		      /* Enlarge the buffer.  */
+ 		      wstr = (wchar_t *) realloc (*strptr,
+ 						  newsize * sizeof (wchar_t));
+@@ -980,7 +979,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		    && wstr == (wchar_t *) *strptr + strsize)
+ 		  {
+ 		    size_t newsize
+-		      = strsize + (strsize > width ? width - 1 : strsize);
++		      = strsize + (strsize >= width ? width : strsize);
+ 		    /* Enlarge the buffer.  */
+ 		    wstr = (wchar_t *) realloc (*strptr,
+ 						newsize * sizeof (wchar_t));
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index a013a2db2f0c..b6c6a6c86445 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -51,7 +51,7 @@
 
 let
   version = "2.42";
-  patchSuffix = "-61";
+  patchSuffix = "-67";
   sha256 = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
 in
 
@@ -68,8 +68,8 @@ stdenv.mkDerivation (
     patches = [
       /*
         No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
-         $ git fetch --all -p && git checkout origin/release/2.40/master && git describe
-         glibc-2.42-61-ga56a2943d2
+         $ git fetch --all -p && git checkout origin/release/2.42/master && git describe
+         glibc-2.42-67-g4ebd33dd77
          $ git show --minimal --reverse glibc-2.42.. ':!ADVISORIES' > 2.42-master.patch
 
         To compare the archive contents zdiff can be used.

From 0d82881a6ad2273e718af745cabbcdfe4f7121a0 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Fri, 8 May 2026 14:58:23 +1000
Subject: [PATCH 176/831] linuxHeaders: 6.18.7 -> 7.0

---
 pkgs/os-specific/linux/kernel-headers/default.nix     | 4 ++--
 pkgs/os-specific/linux/kernel-headers/no-relocs.patch | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 7a7531738fae..e2ea04864000 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -152,13 +152,13 @@ in
 
   linuxHeaders =
     let
-      version = "6.18.7";
+      version = "7.0";
     in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-        hash = "sha256-tyak0Vz5rgYhm1bYeCB3bjTYn7wTflX7VKm5wwFbjx4=";
+        hash = "sha256-u39tgLOHx1e30Uu5MCj8uQ95PFwNNnc27oFaEAs4kfA=";
       };
       patches = [
         ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/pkgs/os-specific/linux/kernel-headers/no-relocs.patch b/pkgs/os-specific/linux/kernel-headers/no-relocs.patch
index 32c88224b867..a4e794cf3b26 100644
--- a/pkgs/os-specific/linux/kernel-headers/no-relocs.patch
+++ b/pkgs/os-specific/linux/kernel-headers/no-relocs.patch
@@ -2,6 +2,6 @@
 +++ b/arch/x86/Makefile
 @@ -231,3 +231,3 @@ endif
  archscripts: scripts_basic
--	$(Q)$(MAKE) $(build)=arch/x86/tools relocs
-+	$(Q)$(MAKE) $(build)=arch/x86/tools
+-	$(Q)$(MAKE) $(build)=arch/x86/tools relocs vdso2c
++	$(Q)$(MAKE) $(build)=arch/x86/tools vdso2c
  

From f39c427320106c7f59d11c7c03122972491bb37b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 17 May 2026 01:31:49 +0300
Subject: [PATCH 177/831] python3Packages.numpy: 2.4.4 -> 2.4.6

Diff: https://github.com/numpy/numpy/compare/v2.4.4...v2.4.6

Changelogs:
- https://github.com/numpy/numpy/releases/tag/v2.4.5
- https://github.com/numpy/numpy/releases/tag/v2.4.6
---
 pkgs/development/python-modules/numpy/2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index f336a573ca13..feaeaf93f9c1 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -34,7 +34,7 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 buildPythonPackage (finalAttrs: {
   pname = "numpy";
-  version = "2.4.4";
+  version = "2.4.6";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -42,7 +42,7 @@ buildPythonPackage (finalAttrs: {
     repo = "numpy";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-LAGXw4vFpjZjZ2s/dXdzXHDm6Ah3pronjScqK02wivY=";
+    hash = "sha256-jHi3cYiSwFRm3G0Dl4dL6yACSP4lAUECotVI+4KXMg8=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [

From a700f706078ba51f1c7a7113cc47e3c5843954a1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 19 May 2026 11:20:13 +0000
Subject: [PATCH 178/831] libopenmpt: 0.8.6 -> 0.8.7

---
 pkgs/by-name/li/libopenmpt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libopenmpt/package.nix b/pkgs/by-name/li/libopenmpt/package.nix
index 0e7f01d0fe84..2cccd04d27e6 100644
--- a/pkgs/by-name/li/libopenmpt/package.nix
+++ b/pkgs/by-name/li/libopenmpt/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libopenmpt";
-  version = "0.8.6";
+  version = "0.8.7";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${finalAttrs.version}+release.autotools.tar.gz";
-    hash = "sha256-yqL6lZ44n0N02eLfOvXGM0UsEt2ARCy6LonLf/K5PFs=";
+    hash = "sha256-J1wp70e+mZL2KjX8yW98oFwG0v0FySmLje6fdD91sIk=";
   };
 
   enableParallelBuilding = true;

From 78f51bc5bcc5037966c06d952debc2e3c05f65ba Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 16:13:05 +0200
Subject: [PATCH 179/831] python3Packages.aiodns: 4.0.0 -> 4.0.3

https://github.com/saghul/aiodns/releases/tag/v4.0.1
https://github.com/saghul/aiodns/releases/tag/v4.0.2
https://github.com/saghul/aiodns/releases/tag/v4.0.3
---
 pkgs/development/python-modules/aiodns/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 54b67a88be19..1a147d54fa04 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiodns";
-  version = "4.0.0";
+  version = "4.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "saghul";
     repo = "aiodns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/iYkhzN01+NaUfMXaM39IvlEKfoKc29+f0S4y0y3GG8=";
+    hash = "sha256-a26n8n/nxq/LxgPCQJNFjU4yVSCL7YK1lBkiDdVDo2w=";
   };
 
   build-system = [ setuptools ];

From 70d339f357ec9f39f6afb6cdeab341b48f21aac7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 16:13:19 +0200
Subject: [PATCH 180/831] python3Packages.xmltodict: 1.0.2 -> 1.0.4

https://github.com/martinblech/xmltodict/blob/v1.0.4/CHANGELOG.md
---
 pkgs/development/python-modules/xmltodict/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/xmltodict/default.nix b/pkgs/development/python-modules/xmltodict/default.nix
index 9d1c01842a42..bd22bc108bbe 100644
--- a/pkgs/development/python-modules/xmltodict/default.nix
+++ b/pkgs/development/python-modules/xmltodict/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "xmltodict";
-  version = "1.0.2";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "martinblech";
     repo = "xmltodict";
     tag = "v${version}";
-    hash = "sha256-gnTNkh0GLfRmjMsLhfvpNrewfinNOhem0i3wzIZvKpA=";
+    hash = "sha256-G7hVtS6toUJC0YY1AXBOJSc3wnAZyWilLnT/5vvFRRw=";
   };
 
   build-system = [ setuptools ];

From 7096ab788ff94e63a572f77862bcbfd5a8251a77 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Wed, 20 May 2026 08:44:08 +0800
Subject: [PATCH 181/831] spidermonkey_140: 140.9.0 -> 140.11.0

https://www.firefox.com/en-US/firefox/140.11.0/releasenotes/
---
 pkgs/development/interpreters/spidermonkey/140.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/spidermonkey/140.nix b/pkgs/development/interpreters/spidermonkey/140.nix
index f66957465bf9..49908ebc35ef 100644
--- a/pkgs/development/interpreters/spidermonkey/140.nix
+++ b/pkgs/development/interpreters/spidermonkey/140.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "140.9.0";
-  hash = "sha512-vAP9KnPQCoi9Cjye6u/mGP+zQib7e8L6xKAiRv8p/gOEI793U4Jz7m+sJfsePk+pi7UiAmrjQnoK1fQdLsa6mA==";
+  version = "140.11.0";
+  hash = "sha512-0GrbPvTeEyTj1hhy1w3jGrCKwBPzOQNUm+0oxuvMW03ulLs2OIKCwZNdd9GlZAefOtvwjWu4AoSomcuz2GEwDA==";
 }

From 8aa7c75b47254ac38ee2470c3ad42a7d6af5bb99 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 02:10:28 +0000
Subject: [PATCH 182/831] libde265: 1.0.18 -> 1.0.19

---
 pkgs/by-name/li/libde265/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libde265/package.nix b/pkgs/by-name/li/libde265/package.nix
index 51e24c6ed5ac..65121864428c 100644
--- a/pkgs/by-name/li/libde265/package.nix
+++ b/pkgs/by-name/li/libde265/package.nix
@@ -15,14 +15,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.0.18";
+  version = "1.0.19";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N6K82ElrzrMSNKfPTDsc5onrxucIJ8niwFgbaEPPd2I=";
+    hash = "sha256-77OIclR2TwOigo/k5ps9S0TrDNvEjf290PqZyqBcydo=";
   };
 
   nativeBuildInputs = [

From 83594b903142a5f02015987a98b706416e4161ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 19 May 2026 20:09:22 -0700
Subject: [PATCH 183/831] python3Packages.python-multipart: 0.0.22 -> 0.0.29

Diff: https://github.com/Kludex/python-multipart/compare/0.0.22...0.0.29

Changelog: https://github.com/Kludex/python-multipart/blob/0.0.29/CHANGELOG.md
---
 .../python-modules/python-multipart/default.nix  | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/python-multipart/default.nix b/pkgs/development/python-modules/python-multipart/default.nix
index 4781d391f0a2..ed476d568dd8 100644
--- a/pkgs/development/python-modules/python-multipart/default.nix
+++ b/pkgs/development/python-modules/python-multipart/default.nix
@@ -2,10 +2,8 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   hatchling,
   pytestCheckHook,
-  mock,
   pyyaml,
 
   # for passthru.tests
@@ -18,32 +16,22 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-multipart";
-  version = "0.0.22";
+  version = "0.0.29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kludex";
     repo = "python-multipart";
     tag = finalAttrs.version;
-    hash = "sha256-UegnwGxiXQalbp18t1dl2JOQH6BY975cpBa9uo3SOuk=";
+    hash = "sha256-1aV7gWLuulINesm3L8Wm3+prmeD9+OY/ihm36rtQPRs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2026-40347-part-1.patch";
-      url = "https://github.com/Kludex/python-multipart/commit/6a7b76dd2653d99d8e5981d7ff09a4a047750b37.patch";
-      hash = "sha256-W1nyYMMoaf+lsNze3ppPeAXN+swG1dScDibazePSt+k=";
-    })
-    ./CVE-2026-40347-part-2.patch
-  ];
-
   build-system = [ hatchling ];
 
   pythonImportsCheck = [ "python_multipart" ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    mock
     pyyaml
   ];
 

From 1355d225b662faa1bb9bdbbfce935c416e2a17a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 19 May 2026 20:11:39 -0700
Subject: [PATCH 184/831] python3Packages.asgi-csrf: mark broken

---
 pkgs/development/python-modules/asgi-csrf/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/asgi-csrf/default.nix b/pkgs/development/python-modules/asgi-csrf/default.nix
index f3ec2670d6f8..9c36730fd74c 100644
--- a/pkgs/development/python-modules/asgi-csrf/default.nix
+++ b/pkgs/development/python-modules/asgi-csrf/default.nix
@@ -49,6 +49,8 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "asgi_csrf" ];
 
   meta = {
+    # https://github.com/simonw/asgi-csrf/issues/38
+    broken = lib.versionAtLeast python-multipart.version "0.0.26";
     description = "ASGI middleware for protecting against CSRF attacks";
     license = lib.licenses.asl20;
     homepage = "https://github.com/simonw/asgi-csrf";

From 2ca587c6020fd949a963f8d30e0bcde6b0a72c60 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 11:09:03 +0000
Subject: [PATCH 185/831] lcms: 2.18 -> 2.19.1

---
 pkgs/by-name/lc/lcms2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lc/lcms2/package.nix b/pkgs/by-name/lc/lcms2/package.nix
index ecb0c3280adb..d07d8ca7ffa4 100644
--- a/pkgs/by-name/lc/lcms2/package.nix
+++ b/pkgs/by-name/lc/lcms2/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "lcms2";
-  version = "2.18";
+  version = "2.19.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/lcms/lcms2-${version}.tar.gz";
-    hash = "sha256-7me+NWb0WTYsHuCU/eLBWdM/oDkKpO1fWvZ2+eUAQ0c=";
+    hash = "sha256-v8VPe6tZ+8khASAUqAMuTLpKvUbbR9RrdkFqjAsoFcg=";
   };
 
   outputs = [

From 2318abaa0baf8fb9db893bee05ba627773b4545b Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 20 May 2026 14:35:16 +0200
Subject: [PATCH 186/831] Revert "nodejs: re-introduce `nodejs.src`"

This reverts commit 9e26436f7e5e7a328dd169f8898f2747dee79031.
---
 pkgs/development/web/nodejs/symlink.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/development/web/nodejs/symlink.nix b/pkgs/development/web/nodejs/symlink.nix
index 538ac2311946..d2b0e6e19151 100644
--- a/pkgs/development/web/nodejs/symlink.nix
+++ b/pkgs/development/web/nodejs/symlink.nix
@@ -5,10 +5,7 @@
 }:
 (symlinkJoin {
   pname = "nodejs";
-  inherit (nodejs-slim) version meta;
-  passthru = nodejs-slim.passthru // {
-    inherit (nodejs-slim) src;
-  };
+  inherit (nodejs-slim) version passthru meta;
   paths = [
     nodejs-slim
     nodejs-slim.npm

From ba2df560b675f7f17843675cfce3422fb758745f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 09:17:04 -0700
Subject: [PATCH 187/831] python3Packages.frictionless: exclude datasette from
 nativeCheckInputs

Datasette depends on asgi-csrf which was broken by updating
python-multipart past version 0.0.26.
---
 pkgs/development/python-modules/frictionless/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/frictionless/default.nix b/pkgs/development/python-modules/frictionless/default.nix
index 80013e731fd4..68edce923de3 100644
--- a/pkgs/development/python-modules/frictionless/default.nix
+++ b/pkgs/development/python-modules/frictionless/default.nix
@@ -195,7 +195,8 @@ buildPythonPackage rec {
     openpyxl
     xlrd
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  # datasette is transitively broken by asgi-csrf
+  ++ lib.concatAttrValues (lib.removeAttrs optional-dependencies [ "datasette" ]);
 
   disabledTestPaths = [
     # Requires optional dependencies that have not been packaged (commented out above)

From 4d80938179e0f3f158caa76d43a019a9b203b46c Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 20 May 2026 13:05:03 +0000
Subject: [PATCH 188/831] python3Packages.sympy: build from GitHub sources,
 cleanup

---
 .../python-modules/sympy/default.nix          | 40 ++++++++++++++-----
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/sympy/default.nix b/pkgs/development/python-modules/sympy/default.nix
index ef1e4183e307..0ec139e9514c 100644
--- a/pkgs/development/python-modules/sympy/default.nix
+++ b/pkgs/development/python-modules/sympy/default.nix
@@ -1,30 +1,48 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  glibcLocales,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   mpmath,
 
+  # tests
+  glibcLocales,
+
   # Reverse dependency
   sage,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "sympy";
   version = "1.14.0";
-  format = "setuptools";
+  pyproject = true;
+  __structuredAttrs = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-09P+jfHloLQvDnvfUFQWl9vn0jdG6JSZDAMOKwXnJRc=";
+  src = fetchFromGitHub {
+    owner = "sympy";
+    repo = "sympy";
+    tag = "sympy-${finalAttrs.version}";
+    hash = "sha256-aSMQ/H5agjsa+Lp7o15/irLSTLtmF/VEqMCBGbXbvmM=";
   };
 
-  nativeCheckInputs = [ glibcLocales ];
+  build-system = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [ mpmath ];
+  pythonRelaxDeps = [
+    "mpmath"
+  ];
+  dependencies = [
+    mpmath
+  ];
 
   # tests take ~1h
   doCheck = false;
+  nativeCheckInputs = [ glibcLocales ];
   pythonImportsCheck = [ "sympy" ];
 
   passthru.tests = {
@@ -35,8 +53,10 @@ buildPythonPackage rec {
     description = "Python library for symbolic mathematics";
     mainProgram = "isympy";
     homepage = "https://www.sympy.org/";
+    downloadPage = "https://github.com/sympy/sympy";
+    changelog = "https://github.com/sympy/sympy/wiki/Release-Notes-for-${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = [ ];
     teams = [ lib.teams.sage ];
   };
-}
+})

From db738de1ef7bacf19d46f56b7a8a448a0a87291a Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 20 May 2026 13:05:41 +0000
Subject: [PATCH 189/831] python3Packages.sympy: add GaetanLepage to
 maintainers

---
 pkgs/development/python-modules/sympy/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/sympy/default.nix b/pkgs/development/python-modules/sympy/default.nix
index 0ec139e9514c..575698e7a81c 100644
--- a/pkgs/development/python-modules/sympy/default.nix
+++ b/pkgs/development/python-modules/sympy/default.nix
@@ -56,7 +56,9 @@ buildPythonPackage (finalAttrs: {
     downloadPage = "https://github.com/sympy/sympy";
     changelog = "https://github.com/sympy/sympy/wiki/Release-Notes-for-${finalAttrs.version}";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+    ];
     teams = [ lib.teams.sage ];
   };
 })

From 470b4097c36f3cb48863f87fb56f86d832b2f2ac Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 20 May 2026 10:54:18 +0000
Subject: [PATCH 190/831] protobuf: enable __structuredAttrs

---
 pkgs/development/libraries/protobuf/generic.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/protobuf/generic.nix b/pkgs/development/libraries/protobuf/generic.nix
index 91e6bc878b01..b18ebd398a0b 100644
--- a/pkgs/development/libraries/protobuf/generic.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@@ -28,6 +28,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "protobuf";
   inherit version;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "protocolbuffers";

From 6481565e50709a9e66e8eaea24f4a0900aad449b Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 19 May 2026 23:12:13 +0000
Subject: [PATCH 191/831] protobuf: 34.1 -> 35.0

Diff: https://github.com/protocolbuffers/protobuf/compare/v34.1...v35.0

Changelog: https://github.com/protocolbuffers/protobuf/releases/
---
 pkgs/development/libraries/protobuf/35.nix      | 9 +++++++++
 pkgs/development/libraries/protobuf/generic.nix | 4 ++--
 pkgs/development/python-modules/protobuf/7.nix  | 4 ++--
 pkgs/top-level/all-packages.nix                 | 4 +++-
 4 files changed, 16 insertions(+), 5 deletions(-)
 create mode 100644 pkgs/development/libraries/protobuf/35.nix

diff --git a/pkgs/development/libraries/protobuf/35.nix b/pkgs/development/libraries/protobuf/35.nix
new file mode 100644
index 000000000000..0dba884f1ecf
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/35.nix
@@ -0,0 +1,9 @@
+{ callPackage, ... }@args:
+
+callPackage ./generic.nix (
+  {
+    version = "35.0";
+    hash = "sha256-J0NA19W44CzgSjKv3A+1An6vDRTDjaWMhDzQGEOtrCk=";
+  }
+  // args
+)
diff --git a/pkgs/development/libraries/protobuf/generic.nix b/pkgs/development/libraries/protobuf/generic.nix
index b18ebd398a0b..59de3e5e7f76 100644
--- a/pkgs/development/libraries/protobuf/generic.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-rIP+Ft/SWVwh9Oy8y8GSUBgP6CtLCLvGmr6nOqmyHhY=";
       })
     ]
-    ++ lib.optionals (lib.versionAtLeast version "30") [
+    ++ lib.optionals ((lib.versionAtLeast version "30") && (lib.versionOlder version "35")) [
       # workaround nvcc bug in message_lite.h
       # https://github.com/protocolbuffers/protobuf/issues/21542
       # Caused by: https://github.com/protocolbuffers/protobuf/commit/8f7aab29b21afb89ea0d6e2efeafd17ca71486a9
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-2/vc4anc+kH7otfLHfBtW8dRowPyObiXZn0+HtQktak=";
       })
     ]
-    ++ lib.optionals (lib.versionAtLeast version "33") [
+    ++ lib.optionals ((lib.versionAtLeast version "33") && (lib.versionOlder version "35")) [
       # Fix protoc plugins crashing on big-endian platforms
       # https://github.com/protocolbuffers/protobuf/pull/25363
       (fetchpatch {
diff --git a/pkgs/development/python-modules/protobuf/7.nix b/pkgs/development/python-modules/protobuf/7.nix
index 2ca17523a3e6..3cb696c0110a 100644
--- a/pkgs/development/python-modules/protobuf/7.nix
+++ b/pkgs/development/python-modules/protobuf/7.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "protobuf";
-  version = "7.34.1";
+  version = "7.35.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-nOQiRecEzFAnvnl8HbHrkxhNRNHN1xgR+y2bJa1UEoA=";
+    hash = "sha256-ou/YRgX0HlWfGIGwkStECZ0KKsm/RrNHSCPxD7OTsOY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 20c57a760d92..90a4427cff92 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7081,10 +7081,11 @@ with pkgs;
 
   # this version should align with the static protobuf version linked into python3.pkgs.tensorflow
   # $ nix-shell -I nixpkgs=$(git rev-parse --show-toplevel) -p python3.pkgs.tensorflow --run "python3 -c 'import google.protobuf; print(google.protobuf.__version__)'"
-  protobuf = protobuf_34;
+  protobuf = protobuf_35;
 
   inherit
     ({
+      protobuf_35 = callPackage ../development/libraries/protobuf/35.nix { };
       protobuf_34 = callPackage ../development/libraries/protobuf/34.nix { };
       protobuf_33 = callPackage ../development/libraries/protobuf/33.nix { };
       protobuf_32 = callPackage ../development/libraries/protobuf/32.nix { };
@@ -7103,6 +7104,7 @@ with pkgs;
         abseil-cpp = abseil-cpp_202103;
       };
     })
+    protobuf_35
     protobuf_34
     protobuf_33
     protobuf_32

From 5dc0e319f9b90fdd54a556974c860a484ccf9d44 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 20 May 2026 23:34:40 +0000
Subject: [PATCH 192/831] protobuf_34: 34.1 -> 34.2

Diff: https://github.com/protocolbuffers/protobuf/compare/v34.1...v34.2

Changelog:
https://github.com/protocolbuffers/protobuf/releases/tag/v34.2
---
 pkgs/development/libraries/protobuf/34.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/protobuf/34.nix b/pkgs/development/libraries/protobuf/34.nix
index ec10fc8824d8..9962256b0d83 100644
--- a/pkgs/development/libraries/protobuf/34.nix
+++ b/pkgs/development/libraries/protobuf/34.nix
@@ -2,8 +2,8 @@
 
 callPackage ./generic.nix (
   {
-    version = "34.1";
-    hash = "sha256-PaIVJ8NtgnrqowbKLkX+uprsQjuxDch9AUxX4YBBNh4=";
+    version = "34.2";
+    hash = "sha256-5YZ8Q9uy7MDnLRmLkkEuqp0k6eJRvs/nPfyo33cJLgs=";
   }
   // args
 )

From 55a082e984daad073d56896b5673f865c0630ff2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 21 May 2026 05:47:41 +0100
Subject: [PATCH 193/831] valgrind: 3.27.0 -> 3.27.1

Changes: https://valgrind.org/docs/manual/dist.news.html
---
 pkgs/by-name/va/valgrind/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index 62e1d381fd79..df0e9ddf6d99 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "valgrind";
-  version = "3.27.0";
+  version = "3.27.1";
 
   src = fetchurl {
     url = "https://sourceware.org/pub/valgrind/valgrind-${version}.tar.bz2";
-    hash = "sha256-W1k33oJX7o9RaY6nG5cRrc6YBhqgfapKaF78OvkhW+8=";
+    hash = "sha256-XViRUuuAccAv6rjOarcZ5DGh+8PisXAPVDJjKouSZNw=";
   };
 
   patches = [

From 0c98395be2ba98874b055e6ed709c385446bfe06 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Thu, 21 May 2026 09:28:33 +0200
Subject: [PATCH 194/831] unbound: 1.25.0 -> 1.25.1

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/by-name/un/unbound/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index 45cdc57ff0a8..935818521103 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -57,13 +57,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.25.0";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-BAqGNi5lfYYTQd7CPH0lssLc5/AkeuKSVEFcrF/cNyc=";
+    hash = "sha256-1PXnxCPxoB5IrVBQIsrxiWAq+IoH7Ma9T1TTJsoTJc4=";
   };
 
   outputs = [

From 52afc5fa587029d9eb09757b68199aea80226062 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 21 May 2026 11:38:44 +0300
Subject: [PATCH 195/831] qt5: 5.15.18 -> 5.15.19

---
 .../libraries/qt-5/5.15/srcs-generated.json   | 160 +++++++++---------
 pkgs/development/libraries/qt-5/5.15/srcs.nix |   2 +-
 2 files changed, 81 insertions(+), 81 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index fd5fcefbff34..57473c4f5a29 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,202 +1,202 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "208f5835e6c2415c9dc5cbe92bba83aa28bab7ea",
-    "sha256": "0zqvdq5y25b1w7agx5wlr16p1wrx54086r0xcdfg9wx8dayhh1md"
+    "rev": "c3892c3ee3c0a2b8a050d0a1532f34806636eade",
+    "sha256": "0y3f4pr0vr7cpwmjxqspv79p7rljgc913fl8nqpv8y2aw8i5r4ly"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "e4c93bc7cac45bac6bccda3310947e8fe026a9ed",
-    "sha256": "1qq6jvqkl4ff7sw20pi1mawh5pypv7vxmj56d38z6p06r1azkvls"
+    "rev": "e85773764374878adc197b6a45ae8ec3ff44dafa",
+    "sha256": "1sbayayxgjj8jfi3apxw6m8qsmkba0gph2rm1wsnzjsa80zr17ia"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "4928bd58dbc1cdcf44a7e454e3d4654c3c2016f1",
-    "sha256": "02rsh60lyl6bn2jhx0ajn43safbi904nhwvdpikanrmdbg0z6dpp"
+    "rev": "14a14b137f0d794278947e980d99c47e6929e5e2",
+    "sha256": "0nvyxjm5qfq7sk22rp9hxrf8gvs6jq4i3kww1s0i8lsr69fl9biz"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "bebdfd54917e25d1c100e6bd9f5dd53c2e645fd8",
-    "sha256": "0bg36lxngkq2k11bhqdyfvbc1qyqaghwsi446zfn67vxvyxya3hx"
+    "rev": "fbed962c3195ab3952fa54d40e012ad1a4fdc42b",
+    "sha256": "1gnbgs7kh0vxjh3spv5g5zaaj1z1b0h8752pqi4lqg6jd1js2bpl"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "1093fb53ced126100d14af30a8adffd29b7ef855",
-    "sha256": "0cnlg59l743milkki8mjbrfd4cx5ycbqw73apcrnrsag9dqdbw41"
+    "rev": "16e9aff210cd4de7192adfc6cd91cdd44ba45a3d",
+    "sha256": "02virkb7h8hhkdsqpv2qg3lly4msf648f7421z10acxhin6ypw5i"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "f1be05c8efeb65b77a8bfd21763ab55bb5c04906",
-    "sha256": "1vl7wfw9sd8qfl8ixzl5wz4v5km5zdf9bii53q3pw4f2lplsralq"
+    "rev": "7e29434e06372efbb2127d0ef41538ff9aec1597",
+    "sha256": "1wv9bh13rq6mnnzsh6g88a2kj2j4nfv83vqpbdxmyavdf349pwdj"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "d9b988d3c5f9f34b97f3a9ac1347bfb55464cd60",
-    "sha256": "09jk32kw7wgcrd117a9lsm5w7jszsdhdslk10qn631wz203zbs4i"
+    "rev": "b52063032fda9af894ca0e582774364ce8caf0f8",
+    "sha256": "1zbfx7hqh1ydi2vx8pj6dxlrrc7wf8sqcwxzx8acphdyj66zcmch"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "1189557a50f11e7bc5716467a149cd09987a9f88",
-    "sha256": "0cd89d8i8chy1j1yanp1cq5s7467qr24b9c7cx9qw0nb0rf6f8qr"
+    "rev": "5bc1ac07b2d2c7839368084a4bb97e4c67eb8294",
+    "sha256": "0xpq0xjiscx72dcyg0lpr90ag5q7gypzcqnwbsnh401jrxn2pll1"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "ddb2afda6f713259fc8d95fb22a1c96bb448c36a",
-    "sha256": "0nk2vwl0ppix794xzj8nqrhsc333v8v4vr1rmwddymwlrdqlqd5d"
+    "rev": "385efd460ec13a465765fc30dd11217ae46d1846",
+    "sha256": "0djflkibfgjp8gr16hiv6nipj4q4xyclgv84f3d951dj2q7779v6"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "269fc0731f6838a1c02877a83c0ada23659c69fc",
-    "sha256": "06jhby671yzbj753yb0lnk4bv2r0nxxibq7fq1yljxdms0rc72iz"
+    "rev": "9b69ae558f0f9feffe30b0aa8993e270dfcc81ff",
+    "sha256": "056b39r4jsag5d7f5m04vmpydvnwpfs5mcynsdx717qdginlmiam"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "dfb2e7b2c98a9b7185c300d0b92b4048f5d89ba5",
-    "sha256": "1sn46lmq0y56mw0q11sgaijr2vg1wpp6lj237finp6vr3bji2816"
+    "rev": "551732fb1d963e53af437e3982a010f69eb76253",
+    "sha256": "1pyjb66nhlhin6ysm4005ng4m2ak857ai761rqx8l2h4fscgwvhf"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "c91e4c63c1eaf1e23806d9df10e3d5a9ae353c1d",
-    "sha256": "0q0vcymiqfyz8sfs9wdkhhwff55acj2rsmrb8w6yikmwcmcxp2a3"
+    "rev": "4076e38d68f05f5e1bcdedb79442d9008f18702c",
+    "sha256": "1kgvs3jgs2qysrx2kr4vn68h9gjv6ir1nd4hg0m2fbsjk644aa8w"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "ba48a8b5cedd157d972c08d371ac2581db166bf7",
-    "sha256": "00kwv405qq9q8fcwar33s2wvs1dm10fb8plxbz1q0jqcjs2ips6x"
+    "rev": "81f560be2274958011c255efa1d2d573874bed11",
+    "sha256": "1lpxngppxkhych9pkkcvw7ypw02cd324pw0z9hd9kqcd803p2017"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "27ed5a3c95a0810a96fac2a8661ea94d8ea3c44e",
-    "sha256": "04ivyxnn8d3pkjsbx0gwyj3f5if4m4cih6wyavm8bd2m2kkszx35"
+    "rev": "5f1be885cf4ee0f1eb5400bf0c5d138818fc01d0",
+    "sha256": "01880y8r2acnzfg09qm031kx99vp3zjv3zi38sh17shgcipx1fxp"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "fc7e9f41d9cec2df05c1d38d6e55d3a0d501dd25",
-    "sha256": "07q1arvdjwmbrayp2b213b8gqm4psczhx9z1m83invwmbs8iqj07"
+    "rev": "722060e4edff268feb2dda1298a7837c90f6262f",
+    "sha256": "1fqw1p6vx3gqw1sf1yk4cz1cb3d1xrbjq0p22gi0pspll314c8x0"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "ff83d119c75cd8406f73ccc08958fe36747e7390",
-    "sha256": "09jadnvphilcxxy85dlsr8a6x5w32r1c2hrbh93qbvvf9zlg60ld"
+    "rev": "8ddc44103baf166525d6650c842d7f08f651e7bb",
+    "sha256": "0akj2d8b6kdy125ggs9cd7pra3vm47frqpn6p756jafsxylkqwbh"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "510687fa4fdee84dd3d6d166e8f080c484016199",
-    "sha256": "0a8abmql94wxpfvdj5a1rnh3xsd49c5z8x93hm311sgjkd0aajx7"
+    "rev": "d1ce24a72122c315e3d190c9ebc26ed603b90057",
+    "sha256": "1wcw26x38k619xavrwav21w0vrzb24bn6ncxllcwd9bdn7vvn1wr"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "8e9a5ec9f68639162c85c198b28e072e7150883c",
-    "sha256": "04pmwqnw907dg0hpas0pdrh2fxcqn2mvqz82b1vkviksg8ny3saw"
+    "rev": "b471c6ca3edfa5ba459b8694622825b9e776bed6",
+    "sha256": "1plwpxasiw2sx76a294i4i92vk5g5gaigjfy284jpmaargxsyd7k"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "47a325358078b72016081a86be628411df2728a9",
-    "sha256": "18h309g6ni6y4bcss930g04z8ymhl2nfm3sv5s4h2fz3dl0xsqwr"
+    "rev": "4e85bd063c726f015dc8afb05834de7a71bf6a1b",
+    "sha256": "0k6wjkr2jyc1v6xrm34dnlbbdnippiph5jxzjxawlxijzzvmgcp5"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "0c3c18bf8bdac1ef1afdb8aade903edb5c2bc041",
-    "sha256": "0h8bhrbgfcf7nbfppah8lxnhvygc09983qrvp935r5sw7251km4d"
+    "rev": "af7fc486c8910b51733e1c7e758d50ca1a158b36",
+    "sha256": "1nbgpnz2qi8g24cmli25a9319vgqmk9vgngb12q2j8c8k3nlhhfs"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "e464888c53a641ee44a34ff2350cfb156c8ed59f",
-    "sha256": "08lnqz6v48j1hi6dpll7a052p6r5qfb32md16fppqzn6g5jg9ir2"
+    "rev": "5b808e0995d018c6de9f075d4a61f58d3641c11b",
+    "sha256": "1a65j06nzlxl1hmdh5li1gglcrqms0g560c2cj9vqzqm551krdj8"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "43130f2681b76a8d743a04704465b716b6b2faee",
-    "sha256": "1z1avxxq9d9nzqyxy5pq5maj73cf6dvsn5k83p3sf5kq3x0y75cj"
+    "rev": "ea9d6c4d5a0a172b4778e8f37d694d02aab83f37",
+    "sha256": "0170n0mcrf8phh3nsg2f904p8vxwmw8lks48zkpnbvyrj4gzqcr2"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "b2740a7c7f5b6ac810240404a947ca5cff9de5f7",
-    "sha256": "1jxlwc2y165fxdalcr4iqq55gsg5x4nxqd8wdq3dc1824yfnzm6i"
+    "rev": "48d10f341279e08c1bc4abb764c2d3ab9a259a51",
+    "sha256": "0523n172f96w474y804sanppfx2zkgsm342vwa6ailrcfkjw8v58"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "57491f554bc53bd020978b5744437b7ac7e56a27",
-    "sha256": "00mvwgb3xr116nl7649zq7ai2074clzw760c140sy91zqgqkjsx4"
+    "rev": "edc6f0dd5e806cced1937b2b853717f588e14fd2",
+    "sha256": "1072slgrvy910mxxqsvf7fgi237mjnbd2b8amw1srqzqj2bmnsj3"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "50a61b360877e7c1300df76b5aabf8d75554a398",
-    "sha256": "0giqwn4grg9999y31avh7ajsv9gkcfzf0xndx8bvv79si0wp59g6"
+    "rev": "8c6d11df60d4d783869c2d81568e3178f5ae75ce",
+    "sha256": "18jc5nncmpmbf758mcj9wj6dfn87hl51zp0ihqcvk6k6a8ra6l7p"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "c23069351ec31563c9ea9fcdce42ccdba95ea518",
-    "sha256": "1qgxlgnl53gabrfqihxwygdbdiqjvn2hfajmwb3h44srpq0srk33"
+    "rev": "6734222bccc5541f9527281c810c6b5f8fdd092f",
+    "sha256": "0ragq01wdwqwqp9720i3xan3a4xnkkvgc8gjy1wgwmdrs0mlb49z"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "b64a7eeda9b6a65b5ed01b1b40b07177f0aa4c0f",
-    "sha256": "134mn0njfvmzgrf325bikazkiq4xdn5wjhj56kxh1hhaz3q25hyp"
+    "rev": "ca1f2486527e7acf87d466062c035845f9774573",
+    "sha256": "0xdywglxh9sxs2s60shwf6c4m5w20h77l9d58rganqwpbrh49vkj"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "aa2376f9b1302222edcd16b4641bbd7004318c00",
-    "sha256": "0vcxgkymzhaw01f26zlny4bka9k829rwzkwk95rr3dfq7wlyxshz"
+    "rev": "a384f0d4fb8a2d0743d5dfdf12e40f6d76f8714c",
+    "sha256": "0imn7jskjvz30xnbg1z8wxkcw82hb6v92xls327385wxxj0a5i6r"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "b74f7291f343dcbcb487b020868f042d8fe83098",
-    "sha256": "1n0sjn8h5k2sh8p2a85cxdpqbnd63gz4rf9wwbshhd13w623f9s8"
+    "rev": "d2abfb9cb1f036446e5913fadb0f065dab9f0159",
+    "sha256": "048lbk25rbfbd2c8pbsifdxjcxb2003hi04lfsmgh7xr27x55gch"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "fa40a2d3373b89be0cd0a43fe0c1d047e3d34058",
-    "sha256": "06kr88gmwc7xh1whdbcg84y1naak5rv99jkscjbhzyz3z91xy7hl"
+    "rev": "3e3ab58b40734a1b9bbb7e72b2969d1f752351b1",
+    "sha256": "18dmmw1r13in7h90y3637jw3sc2pvv33bfr1bs11dyp951spw8d3"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "3cbcceb8e3e2e63a4022f1be946c7118c527a83e",
-    "sha256": "15lw5snqfkwwcsazh02lhiia39gy08nfijdpkzvll2qvg4b58zkn"
+    "rev": "388e4f32ed4b28d92bd61b917ba0e6b910e2784d",
+    "sha256": "1k76zl5c1x9q8kid3sjv4d66wy9ryl24fyiabrg32c7nbn53pbd4"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "859d2a6ee329cc08414410b2ef8c0af77a6853d3",
-    "sha256": "06sdpcanzp1a71d99rjivrbjp780mvwssc4w1sap2gskcmmgkwbs"
+    "rev": "4fc9919ee3fad1d520d0921ba3069dca3c34ff78",
+    "sha256": "12kn69l34s1r6s9w7cw9l5524kwrx8xrxwbx4hw059jns1pqac0d"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "df49b9f3badce793a0a9ea850cf1a02cc5bafef6",
-    "sha256": "01xm2r1pv7kxb4aj72ldfzmax6d799h6bj4h2xhpcii812wf5lda"
+    "rev": "605b8bc942ab263b9d1892af33a81b408f522ccc",
+    "sha256": "09vrd62ikxzjpv6awi7n34pswg4w5yvmac5ckc6ma6rqvps7mbip"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "2a157921861e651f43456cb7941b250c89feb736",
-    "sha256": "1w58b602f20mppd0zfr9yvfdn1xwfkfclnjs0p5mgymq6d946dyk"
+    "rev": "6a20afaeba182ce6e3faee592e1e85a0d3ec0fc6",
+    "sha256": "18jfxpasn47qd4glkgvps7nzm07dag6w9jbkq9l7fzbkpcbnqykb"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "b9aaac72d0853ba48f6bfd710a43df94d83d4701",
-    "sha256": "07zx55f52jgk31bm6c68iydknrih245ndnvz714l6kxw66fv4rjq"
+    "rev": "2a8ce0a61b4b9e892d948948182d935fa6792a1b",
+    "sha256": "10n50frndssj3vmmhghlw48dn0c9b26zgkgjvkza8x234j9dijv2"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "0f910acb737cefc889ce1088fc60d15bc18efe9c",
-    "sha256": "1ba9ll28hznd6qpjjiqvc2z6gaz2qgq7105dd0w810xpbaiixy0a"
+    "rev": "10eb706b24aa05f4ee69c2f2fec99b21994dfe2b",
+    "sha256": "1k01s4qkpzsjy7lygb0nhniym6g7yinih3sc16l3kljkabw44rx0"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "34342073a59f3a27ef3de02f6b21337c4f8db6cf",
-    "sha256": "1h6n7dkd6mjclxllyw2brz8wv4d68dx2ykckbwb3bkxyd6rmg1f6"
+    "rev": "043cb7c0eaf8d1bcee56a62d6a102f727a22fcbc",
+    "sha256": "0ha0ksbxm21hj37z7yk3f09ncgchw78cpcrxv56a205i2f04370d"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "5e5ae2b77078dbe51fb798743de606e6f9a5e19d",
-    "sha256": "04x8ax197z0dr01nxrb6bh4q8c077ny5n812fx5mq56l54v2m1ks"
+    "rev": "0704d01ff1218c2f32a194e38005e625c579222c",
+    "sha256": "0fsfrs770cia9i9ijvx1jyh0mjiza1cn1l7fm1a877h2qbd20l9f"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "c44c4fa86fa0794c25baef4ee1f6272aca8c511a",
-    "sha256": "0287cvs9wqlzz6gnj81gi8rp50s2rdnigcmld3fgddsg8f3v7hdj"
+    "rev": "6695a3df4460577b3fcb5546b45a0c5cb3addac4",
+    "sha256": "1xjdicq8kf6816hgnz4hc7ykcfngispm8xzv3bxacf98zicmy9rm"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "0b644263abca66503db1ce8a4e126cf358a34685",
-    "sha256": "1b1zzglvcdp7wvlpgk1gj8gmyy2r21yi6p8xiyvbccq5bbjpn0hw"
+    "rev": "ed3b333aa56ac193e969725e3c34be9070441271",
+    "sha256": "0s0z9dbivrq5pva6psfcfclw4816zb1rlr9ns03lf286iy196368"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 87a7bb97707d..ec5fdc9d5646 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "5.15.18";
+  version = "5.15.19";
 
   mk = name: args: {
     inherit version;

From e9b7cf21331391509ae684ab5530fd43373dbd0c Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 21 May 2026 15:20:19 +0200
Subject: [PATCH 196/831] nodejs_24: 24.15.0 -> 24.16.0

---
 pkgs/development/web/nodejs/v24.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 69004825bea2..914ab1479370 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "24.15.0";
-  sha256 = "a4f653d79ed140aaad921e8c22a3b585ca85cfdab80d4030f6309e4663a8a1c8";
+  version = "24.16.0";
+  sha256 = "2ff84a6de70b6165290111b0fc656ded1ad207a799816fe720cc7c31232df30f";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -56,13 +56,6 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
-      # https://github.com/NixOS/nixpkgs/pull/507974#issuecomment-4249433124
-      # OpenSSL reports different errors
-      # https://github.com/nodejs/node/pull/62629
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/dd25d8f29d3ddadcf5a5ebfdf98ece55f9df96c6.patch?full_index=1";
-        hash = "sha256-6cxRN7TyWmJgUZt3jp2YXbVIjrDb2BNep5LxBOtT3Q0=";
-      })
 
       # Patch for nghttp2 1.69 support
       (fetchpatch2 {

From aac6f377a01906dd907e0ccfb6f4d2c4fb76b467 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 21 May 2026 16:09:05 +0000
Subject: [PATCH 197/831] gn: 0-unstable-2026-03-05 -> 0-unstable-2026-04-01

---
 pkgs/by-name/gn/gn/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gn/gn/package.nix b/pkgs/by-name/gn/gn/package.nix
index 66f02fcc542a..f640662eedf4 100644
--- a/pkgs/by-name/gn/gn/package.nix
+++ b/pkgs/by-name/gn/gn/package.nix
@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2026-03-05";
+      _version = "0-unstable-2026-04-01";
     in
     _version,
-  rev ? "d8c2f07d653520568da7cace755a87dad241b72d",
-  hash ? "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y=",
+  rev ? "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
+  hash ? "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ=",
 }:
 
 stdenv.mkDerivation {

From 6a792a71bfd22611ad167767298bee9244d5c339 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 22 May 2026 01:30:05 +0000
Subject: [PATCH 198/831] libaec: 1.1.6 -> 1.1.7

---
 pkgs/by-name/li/libaec/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libaec/package.nix b/pkgs/by-name/li/libaec/package.nix
index 9c44a97c5540..7b4e5df0356a 100644
--- a/pkgs/by-name/li/libaec/package.nix
+++ b/pkgs/by-name/li/libaec/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libaec";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchFromGitLab {
     domain = "gitlab.dkrz.de";
     owner = "k202009";
     repo = "libaec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cxDP+JNwokxgzH9hO2zw+rIcz8XG7E8ujbAbWpgUEW8=";
+    hash = "sha256-aBm+CXCq7sdJb6Qq9sNuTzNj0nRwTJI20HsqUg1Qi/8=";
   };
 
   nativeBuildInputs = [

From ace84983c415e2f4c20bcb3e561f1bde840ae5e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 22 May 2026 08:00:28 +0200
Subject: [PATCH 199/831] gtk4: make patch unconditional

The condition was just to avoid rebuilds at that moment.
---
 pkgs/by-name/gt/gtk4/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gt/gtk4/package.nix b/pkgs/by-name/gt/gtk4/package.nix
index 28fd6efc8850..9b7807508a35 100644
--- a/pkgs/by-name/gt/gtk4/package.nix
+++ b/pkgs/by-name/gt/gtk4/package.nix
@@ -95,11 +95,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Ub2fYMfSOmZaVWxzZMIfsuTiglZrPn4JJFXo+RAzCJM=";
   };
 
-  patches = lib.optional stdenv.hostPlatform.is32bit (fetchpatch {
-    name = "fix-32bit-VkImage-null.patch";
-    url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/10d43de8f4f942cb591ada3103474bd7213425f1.patch";
-    hash = "sha256-DJIL6M3XcsjBoMO77OxNi84d1DxAphAfot3N7Nq1QqQ=";
-  });
+  patches = [
+    (fetchpatch {
+      name = "fix-32bit-VkImage-null.patch";
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/10d43de8f4f942cb591ada3103474bd7213425f1.patch";
+      hash = "sha256-DJIL6M3XcsjBoMO77OxNi84d1DxAphAfot3N7Nq1QqQ=";
+    })
+  ];
 
   depsBuildBuild = [
     pkg-config

From a53c6a389758b5517c67c2481d49656191a20880 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 22 May 2026 11:05:40 -0700
Subject: [PATCH 200/831] python3Packages.aiodns: 4.0.3 -> 4.0.4

Diff: https://github.com/saghul/aiodns/compare/v4.0.3...v4.0.4

Changelog: https://github.com/saghul/aiodns/releases/tag/v4.0.4
---
 pkgs/development/python-modules/aiodns/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 1a147d54fa04..21251500362e 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiodns";
-  version = "4.0.3";
+  version = "4.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "saghul";
     repo = "aiodns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a26n8n/nxq/LxgPCQJNFjU4yVSCL7YK1lBkiDdVDo2w=";
+    hash = "sha256-TLiiSRhZaEbHeyrQPk8uvj10VEttRanYEgkBy7DxH4Y=";
   };
 
   build-system = [ setuptools ];

From c18979f7b2d585ff869d16429675618584d1c1c5 Mon Sep 17 00:00:00 2001
From: roconnor <roconnor@r6.ca>
Date: Fri, 22 May 2026 15:00:55 -0400
Subject: [PATCH 201/831] rhash: disable compile-time SHA-NI for x86_64
 compatibility

Since https://github.com/rhash/RHash/commit/e5b0cb6e7092798b14d2e4d85c49e6367a5f7432 rhash,
by default, hardcodes SHA-NI instructions at compile time.
However, these instructions are not available on older x86_64 CPUs.

In particular, rhash is a dependency of cmake, meaning that no cmake builds can run on CPUs
without SHA-NI instructions with the default configuration.

This patch disables SHA-NI in rhash.

Fixes https://github.com/NixOS/nixpkgs/issues/519825.

See also the parallel Debian fix:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1113938
---
 pkgs/by-name/rh/rhash/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index adb2c682ce6d..e8ef05814fee 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     "--ar=${stdenv.cc.targetPrefix}ar"
     "--target=${stdenv.hostPlatform.config}"
+    "--disable-shani"
     (lib.enableFeature enableStatic "static")
     (lib.enableFeature enableStatic "lib-static")
   ];

From 5131deab4ec023f576cd4e6b0519c282dab8206d Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Fri, 22 May 2026 21:28:20 -0400
Subject: [PATCH 202/831] libgcrypt: 1.11.2 -> 1.12.2

1.12.0: https://dev.gnupg.org/T7643, https://lists.gnupg.org/pipermail/gnupg-announce/2026q1/000502.html
1.12.1: https://dev.gnupg.org/T8067
1.12.2: https://dev.gnupg.org/T8114, https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html
---
 pkgs/by-name/li/libgcrypt/package.nix | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix
index 9317da7494fd..08fa5886de73 100644
--- a/pkgs/by-name/li/libgcrypt/package.nix
+++ b/pkgs/by-name/li/libgcrypt/package.nix
@@ -17,11 +17,11 @@ assert enableCapabilities -> stdenv.hostPlatform.isLinux;
 
 stdenv.mkDerivation rec {
   pname = "libgcrypt";
-  version = "1.11.2";
+  version = "1.12.2";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
-    hash = "sha256-a6Wd0ZInDowdIt20GgfZXc28Hw+wLQPEtUsjWBQzCqw=";
+    hash = "sha256-fOM8JJIiGgQ2+WqFACFenz49y1/SanV81BXnqEO6vV4=";
   };
 
   outputs = [
@@ -73,17 +73,6 @@ stdenv.mkDerivation rec {
   postConfigure = ''
     sed -i configure \
         -e 's/NOEXECSTACK_FLAGS=$/NOEXECSTACK_FLAGS="-Wa,--noexecstack"/'
-  ''
-  # The cipher/simd-common-riscv.h wasn't added to the release tarball, please remove this hack on next version update
-  # https://dev.gnupg.org/T7647
-  + lib.optionalString stdenv.hostPlatform.isRiscV ''
-    cp ${
-      fetchurl {
-        url = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob_plain;f=cipher/simd-common-riscv.h;h=8381000f9ac148c60a6963a1d9ec14a3fee1c576;hb=81ce5321b1b79bde6dfdc3c164efb40c13cf656b";
-        hash = "sha256-Toe15YLAOYULnLc2fGMMv/xzs/q1t3LsyiqtL7imc+8=";
-        name = "simd-common-riscv.h";
-      }
-    } cipher/simd-common-riscv.h
   '';
 
   enableParallelBuilding = true;

From 8007e967b33514b9b71ac6a0245c53ebff775d4e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 23 May 2026 06:55:50 +0000
Subject: [PATCH 203/831] duckdb: 1.5.2 -> 1.5.3

---
 pkgs/by-name/du/duckdb/versions.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index 6b16dcfd94a2..aa83cd89b603 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.5.2",
-  "rev": "8a5851971fae891f292c2714d86046ee018e9737",
-  "hash": "sha256-FWoVF7s/n28NN1HtnO0Cr3YyoIDgJcWBtBiO7vWiSOU=",
-  "python_hash": "sha256-B14dXW5pPnToiKbSD9ACzNksIhBG+ui1P9l67Qyke8o="
+  "version": "1.5.3",
+  "rev": "14eca11bd9d4a0de2ea0f078be588a9c1c5b279c",
+  "hash": "sha256-k7mtYXHS8IcBAuOCJ/09lPYLxF3RMODIeDaz3tKmQAA=",
+  "python_hash": "sha256-r0jfYIyBHN5z4QKKxS/yjnkGjUy/yg9Kt/O6adBbH7Q="
 }

From 963d350eecafb5555700ca2a6ec857fc739409cc Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 23 May 2026 09:47:23 +0100
Subject: [PATCH 204/831] which: 2.23 -> 2.25

Changes: https://cgit.git.savannah.gnu.org/cgit/which.git/tree/NEWS?id=dbc1ccf36a920a216d290a0ccb1ee425e2cef0bc
---
 pkgs/by-name/wh/which/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wh/which/package.nix b/pkgs/by-name/wh/which/package.nix
index a8f4f1f53d02..6c28c95eb844 100644
--- a/pkgs/by-name/wh/which/package.nix
+++ b/pkgs/by-name/wh/which/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "which";
-  version = "2.23";
+  version = "2.25";
 
   src = fetchurl {
     url = "mirror://gnu/which/which-${finalAttrs.version}.tar.gz";
-    hash = "sha256-osVYIm/E2eTOMxvS/Tw/F/lVEV0sAORHYYpO+ZeKKnM=";
+    hash = "sha256-HLg+T3AuYLghGrXsTCr7qxsd7IAglFan0vr3WE7SJeo=";
   };
   patches = [
     ./gcc15.patch

From ce3f5238f07e55b399acd5d8b5939972730f20ca Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 23 May 2026 11:40:47 +0100
Subject: [PATCH 205/831] utf8cpp: 4.1.0 -> 4.1.1

Changes: https://github.com/nemtrif/utfcpp/releases/tag/v4.1.1
---
 pkgs/by-name/ut/utf8cpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/utf8cpp/package.nix b/pkgs/by-name/ut/utf8cpp/package.nix
index c801aca45475..9d383273519a 100644
--- a/pkgs/by-name/ut/utf8cpp/package.nix
+++ b/pkgs/by-name/ut/utf8cpp/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "utf8cpp";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jh/sdWx+FWR70iqmPqDI/ZcyHBoSQFcGrQSICipdXbA=";
+    hash = "sha256-0NbbQMsucrbOGEWAVZGSFp7f4dp31XrurPVVjcYsH+I=";
   };
 
   nativeBuildInputs = [ cmake ];

From 66adfb9dab823f579f9d45ee241731a10fb4e7eb Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 May 2026 14:53:37 +0300
Subject: [PATCH 206/831] kdePackages.plasma-workspace: backport patch for Qt
 6.11.1 regression

---
 pkgs/kde/plasma/plasma-workspace/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/kde/plasma/plasma-workspace/default.nix b/pkgs/kde/plasma/plasma-workspace/default.nix
index 0a02c8e424cd..195fc3c9183d 100644
--- a/pkgs/kde/plasma/plasma-workspace/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace/default.nix
@@ -24,6 +24,7 @@
   libqalculate,
   pipewire,
   gpsd,
+  fetchpatch,
 }:
 mkKdeDerivation {
   pname = "plasma-workspace";
@@ -41,6 +42,12 @@ mkKdeDerivation {
 
     # stop accidentally duplicating fontconfig configs
     ./fontconfig.patch
+
+    # backport qt 6.11.1 regression workaround
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma/plasma-workspace/-/commit/31a64dfa1a71ab1b6a495f2f44132c86858acb8f.diff";
+      hash = "sha256-j+AEdDlutDuXmYdK8BJH8bgDF9gieCkbFJK8di+9nxk=";
+    })
   ];
 
   outputs = [

From 1b3320b2d9c665aa4689ea2661221a7753afb974 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sat, 23 May 2026 14:53:51 +0300
Subject: [PATCH 207/831] qt6: 6.11.0 -> 6.11.1

---
 pkgs/development/libraries/qt-6/fetch.sh      |   2 +-
 .../libraries/qt-6/modules/qtbase/default.nix |   5 -
 .../qt-6/modules/qtdeclarative/default.nix    |   6 +
 .../libraries/qt-6/modules/qtmqtt.nix         |   4 +-
 pkgs/development/libraries/qt-6/srcs.nix      | 336 +++++++++---------
 5 files changed, 177 insertions(+), 176 deletions(-)

diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 73d170689480..bd94b3ae2c48 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.0/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.1/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index a340abb9ed00..425a17b56234 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -246,11 +246,6 @@ stdenv.mkDerivation {
     # don't pass qtbase's QML directory to qmlimportscanner if it's empty
     ./skip-missing-qml-directory.patch
 
-    # backport crash fix
-    (fetchpatch {
-      url = "https://github.com/qt/qtbase/commit/1466f88633b2c29a6159a0c2eacd0c0d6601aa5e.diff";
-      hash = "sha256-ubDAXF47SYagRAJ5SYyBxXl2PiHjAZo3xlYPDz1jRYM=";
-    })
     # another crash fix
     (fetchpatch {
       url = "https://github.com/qt/qtbase/commit/515cbbacfba9f4259c9c3b0714a31222c2b4c879.diff";
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 786229c5651b..2f19e06a67fa 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -43,6 +43,12 @@ qtModule {
       hash = "sha256-ESy35OlmsvI4yFQ/rFT8oelOUBCwCmlcbQJvwcTrCig=";
       revert = true;
     })
+
+    # backport fix recommended by KDE
+    (fetchpatch {
+      url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff";
+      hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index effea1d03ab4..c70d2cbd1f88 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.11.0";
+  version = "6.11.1";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-7X+HWAftWHn40RPFQD3/f+bp00LQk8Vsb871WfxdZSE=";
+    hash = "sha256-GWaF4iCPtATL1mJkPHVY0rom8R2FMNWGahE3KWBlfV8=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 73067dc5fd5c..93c206858d18 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,339 +4,339 @@
 
 {
   qt3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qt3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "086xpissihbil51ryl83dlcpkpv3pp3ryj0712x9k9z6756j7ks0";
-      name = "qt3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "01q11bs7vjz1s5wdrdjq904dgl2m6l7r8d3vd2kyf7lx0j78qvd6";
+      name = "qt3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qt5compat-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0gn6sj136y8yl1c00nbm81rmhws0mgx35ny7llx74j97ddj58ag6";
-      name = "qt5compat-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt5compat-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06qndy534rzabxk9yq07dsl8fj1vd72lmck11r5xbajil3d9zjyg";
+      name = "qt5compat-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtactiveqt-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1kbqa0gx41s097281g4zym9jmjs2ffc75p3rgkbs6bvnlrvl0h89";
-      name = "qtactiveqt-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtactiveqt-everywhere-src-6.11.1.tar.xz";
+      sha256 = "05hcnhxkajry4ha7ykmqr83p16qjipspwxid8l2rxgz80wy6aadv";
+      name = "qtactiveqt-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtbase = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtbase-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0pkmrd8ypw1v21cx0890gc6z4v0xr5qip2jnr56r2kc6g5cxh6i3";
-      name = "qtbase-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtbase-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1b616gr7k8byfr2ns4vczs4kj3sznhlrlw9inpb3m8la48qllnfr";
+      name = "qtbase-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtcanvaspainter = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtcanvaspainter-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1gmgzmh81wrnj81xsmilqwhc1wv7j2avg91mww8jlrv5rplzynjl";
-      name = "qtcanvaspainter-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1l08zp68q3wcr9v5hh82kw6jqvc1wmnrjn7h9959psx520dwcdly";
+      name = "qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtcharts-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1dcldlw24qd9swynxcdsxnk8haiv442wx323j7qgfwjp13a9nh5c";
-      name = "qtcharts-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcharts-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0p2icmrwb6am7x2kgk9pnpa8ypi7jiscyaawgi0x31iaihqyvqrz";
+      name = "qtcharts-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtconnectivity-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0fhrqqz58h3smkksfgnax73bmsiz7q9a1w9vhwd83vs9r0jc3w60";
-      name = "qtconnectivity-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtconnectivity-everywhere-src-6.11.1.tar.xz";
+      sha256 = "14g5h0wixqy981cnn5f8gkjbji804f18gfjkzbanxd0lljg2h191";
+      name = "qtconnectivity-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdatavis3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1jr3bkvp4wj1jdafc64ziq4raxbya6jk6s0d4mq0w2kr7zpqrggf";
-      name = "qtdatavis3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdatavis3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1b4kcqfq5q79lm70f08qiksxl36laa9dgx9ladjk2xwl1af7n6hy";
+      name = "qtdatavis3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdeclarative-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1sgxxmg49flana7mylyz4c5mf5hr00kzl8nkwwj87pqx8dlybv2f";
-      name = "qtdeclarative-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdeclarative-everywhere-src-6.11.1.tar.xz";
+      sha256 = "193ar0fcfzjjr7mi8i2622vip95qrr3qry949d9lyc5hf3v71rjj";
+      name = "qtdeclarative-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdoc-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1wwl2vr1qs2lqmz45iqpkzkxqp97g0yzfmz0kb5wpi8sys7c07bx";
-      name = "qtdoc-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdoc-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1hd5z6prx2sbr3wxzkynrn2iyjllvkids505l2xg3p272j4b5306";
+      name = "qtdoc-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtgraphs-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0nxifvs5042pzyd5syhgpmxzsq07fhpbbm57ckwzsn55q14cnvyz";
-      name = "qtgraphs-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgraphs-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0qh43qxqg4biyrrsd78nmi4dm3dnbswa95cq8db2k3lans517cc4";
+      name = "qtgraphs-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtgrpc-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0yd8jjxigaynv386f3cs1i743nm7yngciw346xqfil3chd8wpvcx";
-      name = "qtgrpc-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgrpc-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0l52w91hd2crq6zyh5a8arv07yixnwcr2pya74bxpk2hqpq08ys3";
+      name = "qtgrpc-everywhere-src-6.11.1.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qthttpserver-everywhere-src-6.11.0.tar.xz";
-      sha256 = "16wqglm8ws63qs7i769xy94bygwbhkz7hjfw27hnps7d4yirb41b";
-      name = "qthttpserver-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qthttpserver-everywhere-src-6.11.1.tar.xz";
+      sha256 = "01p7li9fvwnz2shx3d9wj9nnnnipya2q0whchyvgjqb8yzy71gq4";
+      name = "qthttpserver-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtimageformats-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1j0cjj7gxjbprszw349janl3zk38rkby1bmxil329zp2qlmb1bfk";
-      name = "qtimageformats-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtimageformats-everywhere-src-6.11.1.tar.xz";
+      sha256 = "04y4pa5krrpyiqn039d6m8bzcxj6pa1m850rz3bmw5xc8ml6rgxj";
+      name = "qtimageformats-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlanguageserver-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1gq5yjvk6iyg606pgpxkb136qlz9hpb7ngll81nhiyb1ym1y9j0v";
-      name = "qtlanguageserver-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlanguageserver-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1vwavpi8swgs88pfjfddnb9cmsb4k1sjcgywp2rsnm6ay8vqa02h";
+      name = "qtlanguageserver-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlocation-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1vxb6n8xf98zcg2bw29gsaqa74sg6jn9ilzs8c5b9q79i9m3if49";
-      name = "qtlocation-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlocation-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06z4hbiqki5chhmph131s71czyrjpnjvy3rxb4560vwy55vwx49p";
+      name = "qtlocation-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlottie-everywhere-src-6.11.0.tar.xz";
-      sha256 = "02ndplkk4bq01b0fh9l2ykw09v0k5nbsayrs9wcjwrdwg5law8rg";
-      name = "qtlottie-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlottie-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0y969gp64imwh49d5zbnw0wi2yva9fsp6qn58617rs9kvkdzml70";
+      name = "qtlottie-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtmultimedia-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0h30l8zflkla7rcshgs0jfjbjwvq9rqx0wq83f6vd0x9lz0cmi4h";
-      name = "qtmultimedia-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtmultimedia-everywhere-src-6.11.1.tar.xz";
+      sha256 = "02lvq1jk6m67m6z0w7vdzxhzmi441j8avvp79mfclfpfvm98w3rr";
+      name = "qtmultimedia-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtnetworkauth-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1mqly8had79f54dlygh42jr0c0jfiv4j4w2rbr0s7qx9nk9ig342";
-      name = "qtnetworkauth-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtnetworkauth-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0gan2qjv97d1387jqaiis2gigm6lz5jbk1k10x13w0yc5kr5n7cz";
+      name = "qtnetworkauth-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtopenapi = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtopenapi-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1h2pcq6i72yic0r7ns36vj678d1xqy291jamqd6b6jkjddmj1hlg";
-      name = "qtopenapi-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtopenapi-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0nzl95w5pbfd6mfb6rzv6arz09pcm6siz1n07pgm9rrdr6z083a4";
+      name = "qtopenapi-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtpositioning-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1scnnz65qyfg0nl9vjkqcss8xsw3yf91w71d9p1kwlfybscd07yn";
-      name = "qtpositioning-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtpositioning-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1xbq1xjjbhb41lfp9mli8a5rgqf5pniswv0161v6wa5f04cbkrnm";
+      name = "qtpositioning-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquick3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1549gdb3yxj1bpl54kgnkkhzjx0zxqi71ssp4rj6qnz56fxh085l";
-      name = "qtquick3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0vs5bcz62r32gin0g4lb6wdmqrv0ypzar1s9wsza98la7zg8asy7";
+      name = "qtquick3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquick3dphysics-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dcx9913xss435cijx5bzckvsn66qfi6c39rx0gyv9iiys76qym5";
-      name = "qtquick3dphysics-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1bvrmjb6m0ynq00ybdghvkbmwm237vff23ng8n4njysf05pns26i";
+      name = "qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquickeffectmaker-everywhere-src-6.11.0.tar.xz";
-      sha256 = "05fpv497rmx2lw7gx05sxyxjwx8gq8fbbnkzhnw73pk2xqzq20mc";
-      name = "qtquickeffectmaker-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0sqk8hkkdibv0ayxrvpcbgj3dcwfngpd6qjp2xm15pcbx1q3xrng";
+      name = "qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquicktimeline-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1micycw7m25gw0bgbfq7bnr7cg7qrjj2r69320rglc8lak6f3nq6";
-      name = "qtquicktimeline-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquicktimeline-everywhere-src-6.11.1.tar.xz";
+      sha256 = "09wcx83yxif8r4v81h2jfj3wlj60wnc9k4dsp7hlah4yzm1zclxg";
+      name = "qtquicktimeline-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtremoteobjects-everywhere-src-6.11.0.tar.xz";
-      sha256 = "15yykbaxqc6v2flgjvn92w7gwfvi820dg4cxkjxcfhpix2m21571";
-      name = "qtremoteobjects-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtremoteobjects-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06hiiyjpcgn8dp9jmgxj30nlrw73rqb869f0m63scccmqsarhqj0";
+      name = "qtremoteobjects-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtscxml-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1rylchpvzldy7hhr3icr85w8m4hf7wch17yqh368yrn3q19klf3c";
-      name = "qtscxml-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtscxml-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0gr0j09isxgii3aivfvr35x40d9n0kj0g2icc7g7bzniwm2m4jcf";
+      name = "qtscxml-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtsensors-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1iy33w7gjp06xi4342si979q9w84cvbbk90kxmk2gx69icjjja21";
-      name = "qtsensors-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsensors-everywhere-src-6.11.1.tar.xz";
+      sha256 = "13ygry3lybkgci6gkrd7k081l01icavzkiyy4g82drbvv9i70q93";
+      name = "qtsensors-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtserialbus-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1qfs9zqvz3hf16w8gg6nlwxcv6sz72546pds02dabhkcw47nqvmh";
-      name = "qtserialbus-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialbus-everywhere-src-6.11.1.tar.xz";
+      sha256 = "02pj4jnxc4afl5ymv7w8asggpg0hdj3dbnwwcqd305b8il69qv64";
+      name = "qtserialbus-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtserialport-everywhere-src-6.11.0.tar.xz";
-      sha256 = "111pmva70mcffhq09q2h1gcr03fivs9j2ywx4ib00pbyxfvr4ii6";
-      name = "qtserialport-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialport-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0x1r5l3kx7riprf0b2api0bcg0z755fq9vbgmx7px6pxiy4imwws";
+      name = "qtserialport-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtshadertools-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0jp1sb9pl7y821awln7rpk0hz7d5ipwnkqhy51caich9i2pb2g74";
-      name = "qtshadertools-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtshadertools-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1z42r414jid12jmhm1yf5kw44j886w01igav0kggkg13kcphax90";
+      name = "qtshadertools-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtspeech-everywhere-src-6.11.0.tar.xz";
-      sha256 = "08fv8v6rvcv0pa6r52kr2na2rcpjr3yk556ksinnh6aslv8qbid9";
-      name = "qtspeech-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtspeech-everywhere-src-6.11.1.tar.xz";
+      sha256 = "051z4yf22hkqhy3pkgxq8s77x06k4cd70i9jcmd8f99004cc6df0";
+      name = "qtspeech-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtsvg-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1rih59jsn0wq12gq5gbs1cz9by27x2x4wjpd0ya7s207pr9xda6z";
-      name = "qtsvg-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsvg-everywhere-src-6.11.1.tar.xz";
+      sha256 = "154adaicyy5wyz6yc95g3lm4iw9v2zdsd7l5qp107gr490pz0g3z";
+      name = "qtsvg-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttasktree = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttasktree-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0kxkm3qvzw5i5x2ads6skpz8z6shbn2msznmr614yvsdgiga4yjr";
-      name = "qttasktree-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttasktree-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1mjdwy3i24ggn2g82z5pg3grzhnaxmq7nmvdc7ba8dsdixzvjam2";
+      name = "qttasktree-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttools = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttools-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0xpwv483zrw3jkajhv9sbr7bm95qahxg770vn1jqk10hg8yrkcfg";
-      name = "qttools-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttools-everywhere-src-6.11.1.tar.xz";
+      sha256 = "03gmr9zpf0raqcvqk2cpw9lblw907hsl5cb5c2fgm4wwcxd86qcf";
+      name = "qttools-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttranslations-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0mpy3y76n1jw2prhad9rqyn48miqlmqg3581jgzr4s1iwhpqpx2l";
-      name = "qttranslations-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttranslations-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0xsnxhiqc3ybwvyn1jbhdf1sjmcf7v4mma6w9sxwg535420jrh1p";
+      name = "qttranslations-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtvirtualkeyboard-everywhere-src-6.11.0.tar.xz";
-      sha256 = "11p6m1s7r7q2y6a2ak5lyzfd2907s2skfa630snf64x32cblp2nq";
-      name = "qtvirtualkeyboard-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
+      sha256 = "073y02qmpwxxdqc4pkm6k9frghsjg1zppg2hip5b4hv269xrdim1";
+      name = "qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwayland-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dsdv1d4p1wf0sqd26cmj486bvwlprmqzmjddsw24agrc3kyc477";
-      name = "qtwayland-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwayland-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1cyr5frhglp2krxvpnqk9q426rgp6nr34ngnxpa42m7p0ajqly4m";
+      name = "qtwayland-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebchannel-everywhere-src-6.11.0.tar.xz";
-      sha256 = "097vm6pxh18bil9ld9cxg50v861nyhaha4f6bjfjqph1icx18ip9";
-      name = "qtwebchannel-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebchannel-everywhere-src-6.11.1.tar.xz";
+      sha256 = "10ld2nh6gd1v2ssbgqlf6w0lsjlqkjdfwqv85mn5krnnf45vbyv9";
+      name = "qtwebchannel-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebengine-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dk72k92zp19jkph1vl88l2dyrh105v6cycsxln1anfxnb423fb3";
-      name = "qtwebengine-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebengine-everywhere-src-6.11.1.tar.xz";
+      sha256 = "10vhcvw8j60n0mf38bi3fjcx5v1i0cbfyn4wbqhzqn61qv66d737";
+      name = "qtwebengine-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebsockets-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0cnh67ncfh0gvpqfiqhr0cpmswq9zysza130axlmh69mzg8i17sn";
-      name = "qtwebsockets-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebsockets-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1gvgci383dfm4sljqlapdiva7jhks1i2z2ayck0wbj1436hklgi4";
+      name = "qtwebsockets-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebview-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1cy4x331h0f4d5l8c18xrvdq6hwz7r16qd1xhr8gdm8j9bcsw3nb";
-      name = "qtwebview-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebview-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0g8k4xs7b0s474x00ds4i8q9b164icdgrdg8ngln10nmf3pwhqld";
+      name = "qtwebview-everywhere-src-6.11.1.tar.xz";
     };
   };
 }

From 6f40c4f10c3e1166f2e9ee552f5b8f28c967b763 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 23 May 2026 12:22:11 +0000
Subject: [PATCH 208/831] tree-sitter: 0.26.8 -> 0.26.9

---
 pkgs/by-name/tr/tree-sitter/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index 1ae410255fc0..69b45f6cc250 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -112,17 +112,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tree-sitter";
-  version = "0.26.8";
+  version = "0.26.9";
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fcFEfoALrbpBD6rWogxJ7FNVlvDQgswoX9ylRgko+8Q=";
+    hash = "sha256-ohVhW4AEKX5VspqBePtfxbJGkjmJnNkf5ntU3RUxF+0=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-9FeWnWWPUWmMF15Psmul8GxGv2JceHWc2WZPmOr81gw=";
+  cargoHash = "sha256-3egxdusYHQs8PadxGZ44+VWtlTcGBrcqlWMUyUzpWnY=";
 
   buildInputs = [
     installShellFiles

From 9d229c780ed441cda7dcf943718cc8aa3aa53492 Mon Sep 17 00:00:00 2001
From: Lisanna Dettwyler <lisanna.dettwyler@gmail.com>
Date: Fri, 6 Mar 2026 11:06:41 -0500
Subject: [PATCH 209/831] rsync: skip chgrp test

This test fails when built in a chroot store.

Signed-off-by: Lisanna Dettwyler <lisanna.dettwyler@gmail.com>
---
 pkgs/applications/networking/sync/rsync/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index ddfb056d101c..ab771e3c5057 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -80,6 +80,11 @@ stdenv.mkDerivation rec {
 
   passthru.tests = { inherit (nixosTests) rsyncd; };
 
+  # Test fails when built in a chroot store
+  preCheck = ''
+    rm testsuite/chgrp.test
+  '';
+
   doCheck = true;
 
   __darwinAllowLocalNetworking = true;

From 11aa871c2290aa6407227e255da0820a575d2109 Mon Sep 17 00:00:00 2001
From: FlashOnFire_ <flashonfire.dev@gmail.com>
Date: Sun, 12 Apr 2026 19:25:20 +0200
Subject: [PATCH 210/831] python3Packages.mypy: fix cross compilation

---
 pkgs/development/python-modules/mypy/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index bbbbb99d5e96..9040eab9ebf8 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -13,8 +13,10 @@
   types-psutil,
   types-setuptools,
 
-  # propagates
+  # nativeBuildInputs + propagates
   librt,
+
+  # propagates
   mypy-extensions,
   tomli,
   typing-extensions,
@@ -50,6 +52,10 @@ buildPythonPackage rec {
     rev-prefix = "v";
   };
 
+  nativeBuildInputs = [
+    librt
+  ];
+
   build-system = [
     mypy-extensions
     pathspec

From 39d6b815825efe757e1616fb80190a4e66c85bdd Mon Sep 17 00:00:00 2001
From: Alex James <git@alextjam.es>
Date: Sat, 23 May 2026 16:24:39 -0700
Subject: [PATCH 211/831] bmake: restore missing bsd.*.mk symlinks on Darwin

bmake's installPhase was updated in #462500 to manually install the
binaries and share Makefiles for bmake as the boot-strap script invokes
bmake (breaking cross builds). This caused the darwin.locale build to
regress as bmake could no longer find bsd.prog.mk [1]. The install-sh
script (which is invoked by the install-mk target used by the boot-strap
script) creates bsd.-prefixed symlinks to the Makefiles under share on
BSD systems, including Darwin. Update bmake's installPhase to invoke
install-mk to ensure that the symlinks are created. install-mk does not
invoke bmake so this should not break cross builds.

[1]: https://github.com/apple-oss-distributions/adv_cmds/blob/2bdd0b49a2d51a3249eecdb04277da034f54eca6/locale/BSDmakefile#L9
---
 pkgs/by-name/bm/bmake/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index 3a1185122339..148beb122af7 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -96,8 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     # `boot-strap op=install` runs the built bmake, which breaks cross builds.
     install -Dm755 bmake $out/bin/bmake
     install -Dm644 bmake.1 $man/share/man/man1/bmake.1
-    mkdir -p $out/share
-    cp -r mk $out/share
+    install -Dm755 -d $out/share/mk
+    sh mk/install-mk -v -m 444 $out/share/mk
 
     runHook postInstall
   '';

From bb9fb0a2eb6b9481c8d48597f9da1c9fc2022459 Mon Sep 17 00:00:00 2001
From: Alex James <git@alextjam.es>
Date: Sat, 23 May 2026 21:57:42 -0700
Subject: [PATCH 212/831] bmake: enable __structuredAttrs

---
 pkgs/by-name/bm/bmake/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/bm/bmake/package.nix b/pkgs/by-name/bm/bmake/package.nix
index 148beb122af7..5d8675628527 100644
--- a/pkgs/by-name/bm/bmake/package.nix
+++ b/pkgs/by-name/bm/bmake/package.nix
@@ -67,6 +67,8 @@ stdenv.mkDerivation (finalAttrs: {
     ) "export"
   );
 
+  __structuredAttrs = true;
+
   strictDeps = true;
 
   doCheck = true;

From 5f3abe53c32f4bf6aa20e4bfa582566d21d5e085 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 08:46:17 -0700
Subject: [PATCH 213/831] python3Packages.urllib3: 2.6.3 -> 2.7.0

Diff: https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0

Changelog: https://github.com/urllib3/urllib3/blob/2.7.0/CHANGES.rst
---
 .../python-modules/urllib3/default.nix          | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index 047c47c2dcbe..e9e5ce9eab21 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   isPyPy,
 
   # build-system
@@ -31,12 +31,14 @@
 let
   self = buildPythonPackage rec {
     pname = "urllib3";
-    version = "2.6.3";
+    version = "2.7.0";
     pyproject = true;
 
-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-G2K2iElEpX2+MhUJq5T9TTswcHXgwurpkaxx7hWtOO0=";
+    src = fetchFromGitHub {
+      owner = "urllib3";
+      repo = "urllib3";
+      tag = version;
+      hash = "sha256-iN59MS5gKgDxe2v4ILrZ/1y7wV4yB1tFs4ATKppYAAk=";
     };
 
     build-system = [
@@ -44,11 +46,6 @@ let
       hatch-vcs
     ];
 
-    postPatch = ''
-      substituteInPlace pyproject.toml \
-        --replace-fail ', "setuptools-scm>=8,<10"' ""
-    '';
-
     optional-dependencies = {
       brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
       h2 = [ h2 ];

From b353c0a0f82604f8d0ae661c268594011039606c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 08:52:37 -0700
Subject: [PATCH 214/831] python3Packages.urllib3: use finalAttrs

---
 .../python-modules/urllib3/default.nix        | 145 +++++++++---------
 1 file changed, 71 insertions(+), 74 deletions(-)

diff --git a/pkgs/development/python-modules/urllib3/default.nix b/pkgs/development/python-modules/urllib3/default.nix
index e9e5ce9eab21..3ff4ea706250 100644
--- a/pkgs/development/python-modules/urllib3/default.nix
+++ b/pkgs/development/python-modules/urllib3/default.nix
@@ -28,79 +28,76 @@
   trustme,
 }:
 
-let
-  self = buildPythonPackage rec {
-    pname = "urllib3";
-    version = "2.7.0";
-    pyproject = true;
+buildPythonPackage (finalAttrs: {
+  pname = "urllib3";
+  version = "2.7.0";
+  pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "urllib3";
-      repo = "urllib3";
-      tag = version;
-      hash = "sha256-iN59MS5gKgDxe2v4ILrZ/1y7wV4yB1tFs4ATKppYAAk=";
-    };
-
-    build-system = [
-      hatchling
-      hatch-vcs
-    ];
-
-    optional-dependencies = {
-      brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
-      h2 = [ h2 ];
-      socks = [ pysocks ];
-      zstd = [ backports-zstd ];
-    };
-
-    nativeCheckInputs = [
-      httpx
-      pyopenssl
-      pytest-socket
-      pytest-timeout
-      pytestCheckHook
-      quart
-      quart-trio
-      tornado
-      trio
-      trustme
-    ]
-    ++ lib.concatAttrValues optional-dependencies;
-
-    disabledTestMarks = [
-      "requires_network"
-    ];
-
-    # Tests in urllib3 are mostly timeout-based instead of event-based and
-    # are therefore inherently flaky. On your own machine, the tests will
-    # typically build fine, but on a loaded cluster such as Hydra random
-    # timeouts will occur.
-    #
-    # The urllib3 test suite has two different timeouts in their test suite
-    # (see `test/__init__.py`):
-    # - SHORT_TIMEOUT
-    # - LONG_TIMEOUT
-    # When CI is in the env, LONG_TIMEOUT will be significantly increased.
-    # Still, failures can occur and for that reason tests are disabled.
-    doCheck = false;
-
-    passthru.tests.pytest = self.overridePythonAttrs (_: {
-      doCheck = true;
-    });
-
-    preCheck = ''
-      export CI # Increases LONG_TIMEOUT
-    '';
-
-    pythonImportsCheck = [ "urllib3" ];
-
-    meta = {
-      description = "Powerful, user-friendly HTTP client for Python";
-      homepage = "https://github.com/urllib3/urllib3";
-      changelog = "https://github.com/urllib3/urllib3/blob/${version}/CHANGES.rst";
-      license = lib.licenses.mit;
-      maintainers = with lib.maintainers; [ fab ];
-    };
+  src = fetchFromGitHub {
+    owner = "urllib3";
+    repo = "urllib3";
+    tag = finalAttrs.version;
+    hash = "sha256-iN59MS5gKgDxe2v4ILrZ/1y7wV4yB1tFs4ATKppYAAk=";
   };
-in
-self
+
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
+
+  optional-dependencies = {
+    brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
+    h2 = [ h2 ];
+    socks = [ pysocks ];
+    zstd = [ backports-zstd ];
+  };
+
+  nativeCheckInputs = [
+    httpx
+    pyopenssl
+    pytest-socket
+    pytest-timeout
+    pytestCheckHook
+    quart
+    quart-trio
+    tornado
+    trio
+    trustme
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  disabledTestMarks = [
+    "requires_network"
+  ];
+
+  # Tests in urllib3 are mostly timeout-based instead of event-based and
+  # are therefore inherently flaky. On your own machine, the tests will
+  # typically build fine, but on a loaded cluster such as Hydra random
+  # timeouts will occur.
+  #
+  # The urllib3 test suite has two different timeouts in their test suite
+  # (see `test/__init__.py`):
+  # - SHORT_TIMEOUT
+  # - LONG_TIMEOUT
+  # When CI is in the env, LONG_TIMEOUT will be significantly increased.
+  # Still, failures can occur and for that reason tests are disabled.
+  doCheck = false;
+
+  passthru.tests.pytest = finalAttrs.finalPackage.overrideAttrs (_: {
+    doInstallCheck = true;
+  });
+
+  preCheck = ''
+    export CI # Increases LONG_TIMEOUT
+  '';
+
+  pythonImportsCheck = [ "urllib3" ];
+
+  meta = {
+    description = "Powerful, user-friendly HTTP client for Python";
+    homepage = "https://github.com/urllib3/urllib3";
+    changelog = "https://github.com/urllib3/urllib3/blob/${finalAttrs.src.tag}/CHANGES.rst";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})

From c146bd0855981393886d773bf056bc0039bcd64b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 09:58:22 -0700
Subject: [PATCH 215/831] tunnelgraf: mark insecure

---
 pkgs/by-name/tu/tunnelgraf/package.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/tu/tunnelgraf/package.nix b/pkgs/by-name/tu/tunnelgraf/package.nix
index 3f08a1565e1f..82b297401714 100644
--- a/pkgs/by-name/tu/tunnelgraf/package.nix
+++ b/pkgs/by-name/tu/tunnelgraf/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchPypi,
   python3,
 }:
 
@@ -12,12 +11,18 @@ let
       # Doesn't work with latest paramiko
       paramiko = super.paramiko.overridePythonAttrs (oldAttrs: rec {
         version = "3.4.0";
-        src = fetchPypi {
-          pname = "paramiko";
-          inherit version;
-          hash = "sha256-qsCPJqMdxN/9koIVJ9FoLZnVL572hRloEUqHKPPCdNM=";
+        src = fetchFromGitHub {
+          owner = "paramiko";
+          repo = "paramiko";
+          tag = version;
+          hash = "sha256-V0s9IoRmqXvzYQzzBsWmovYWwXnNC0x1phyiyjbejGA=";
         };
         doCheck = false;
+        meta = oldAttrs.meta // {
+          knownVulnerabilities = [
+            "CVE-2026-44405"
+          ];
+        };
       });
     };
   };

From 30a78f292564a1d67ba2eff1701bc268d21bbb1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 09:18:56 -0700
Subject: [PATCH 216/831] python3Packages.paramiko: 4.0.0 -> 5.0.0

Diff: https://github.com/paramiko/paramiko/compare/4.0.0...5.0.0

Changelog: https://github.com/paramiko/paramiko/blob/5.0.0/sites/www/changelog.rst
---
 .../python-modules/paramiko/default.nix       | 29 ++++++-------------
 1 file changed, 9 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 6350ba2e5a8a..cf24d7e6240f 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -3,12 +3,9 @@
   bcrypt,
   buildPythonPackage,
   cryptography,
-  fetchPypi,
-  gssapi,
+  fetchFromGitHub,
   icecream,
   invoke,
-  mock,
-  pyasn1,
   pynacl,
   pytest-relaxed,
   pytestCheckHook,
@@ -17,12 +14,14 @@
 
 buildPythonPackage rec {
   pname = "paramiko";
-  version = "4.0.0";
+  version = "5.0.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-aiXwezgMycmojSuSCtNxZ6xGZ/jZiGzOvY+Q9lS11p8=";
+  src = fetchFromGitHub {
+    owner = "paramiko";
+    repo = "paramiko";
+    tag = version;
+    hash = "sha256-zzbM2oGaZ5jkIN7LyDGuMAKSpSmUwpBbup6MBVdTaXA=";
   };
 
   build-system = [ setuptools ];
@@ -34,21 +33,11 @@ buildPythonPackage rec {
     pynacl
   ];
 
-  optional-dependencies = {
-    gssapi = [
-      pyasn1
-      gssapi
-    ];
-    ed25519 = [ ];
-  };
-
   nativeCheckInputs = [
     icecream
-    mock
     pytestCheckHook
     pytest-relaxed
-  ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ];
 
   pythonImportsCheck = [ "paramiko" ];
 
@@ -56,7 +45,7 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/paramiko/paramiko/";
-    changelog = "https://github.com/paramiko/paramiko/blob/${version}/sites/www/changelog.rst";
+    changelog = "https://github.com/paramiko/paramiko/blob/${src.tag}/sites/www/changelog.rst";
     description = "Native Python SSHv2 protocol library";
     license = lib.licenses.lgpl21Plus;
     longDescription = ''

From a8643c627799de71d9f10605370b8ed3a478a8b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 09:38:36 -0700
Subject: [PATCH 217/831] python3Packages.paramiko: use finalAttrs

---
 pkgs/development/python-modules/paramiko/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index cf24d7e6240f..5e99e2ce79d5 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -12,7 +12,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "paramiko";
   version = "5.0.0";
   pyproject = true;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "paramiko";
     repo = "paramiko";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-zzbM2oGaZ5jkIN7LyDGuMAKSpSmUwpBbup6MBVdTaXA=";
   };
 
@@ -45,7 +45,7 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/paramiko/paramiko/";
-    changelog = "https://github.com/paramiko/paramiko/blob/${src.tag}/sites/www/changelog.rst";
+    changelog = "https://github.com/paramiko/paramiko/blob/${finalAttrs.src.tag}/sites/www/changelog.rst";
     description = "Native Python SSHv2 protocol library";
     license = lib.licenses.lgpl21Plus;
     longDescription = ''
@@ -55,4 +55,4 @@ buildPythonPackage rec {
       supported. SFTP client and server mode are both supported too.
     '';
   };
-}
+})

From 9305bbec01cdd5c5b08f076b0fe136b267596786 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 11:14:01 -0700
Subject: [PATCH 218/831] python3Packages.twisted: 25.5.0 -> 26.4.0

Changelog: https://github.com/twisted/twisted/blob/twisted-26.4.0/NEWS.rst
---
 .../python-modules/twisted/default.nix        | 29 +++++--------------
 1 file changed, 7 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/python-modules/twisted/default.nix b/pkgs/development/python-modules/twisted/default.nix
index a886c3576a41..f96bed372e06 100644
--- a/pkgs/development/python-modules/twisted/default.nix
+++ b/pkgs/development/python-modules/twisted/default.nix
@@ -4,8 +4,7 @@
   buildPythonPackage,
   pythonAtLeast,
   pythonOlder,
-  fetchPypi,
-  fetchpatch,
+  fetchFromGitHub,
   python,
 
   # build-system
@@ -56,30 +55,16 @@
 
 buildPythonPackage rec {
   pname = "twisted";
-  version = "25.5.0";
+  version = "26.4.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    extension = "tar.gz";
-    hash = "sha256-HesnI1jLa+Hj6PxvnIs2946w+nwiM9Lb4R7G/uBOoxY=";
+  src = fetchFromGitHub {
+    owner = "twisted";
+    repo = "twisted";
+    tag = "twisted-${version}";
+    hash = "sha256-D6vDa+8qwjryKnElPBZgXCNokMX2l3i2bMdtk4FhEp4=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://github.com/twisted/twisted/pull/12508
-      url = "https://github.com/twisted/twisted/commit/ef6160aa2595adfba0c71da6db65b7a7252f23e9.patch";
-      hash = "sha256-zHkEWT0lvWf86RlkzU5Wx6R5ear04cfpxB7wjgdpw5c=";
-    })
-    # https://github.com/twisted/twisted/pull/12511
-    ./python314-urljoin-compat.patch
-    (fetchpatch {
-      # https://github.com/twisted/twisted/pull/12551
-      url = "https://github.com/twisted/twisted/commit/b1173fa307a9752eedd63890113eb610c3cca4a0.patch";
-      hash = "sha256-DWEygdo1b8uQOeFLy0/zcRNuuKJdSsF7cQM7RH04Puw=";
-    })
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   build-system = [

From 3c5b8bbdbaea8e109f0194917257d9cfbc75aff3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 11:44:55 -0700
Subject: [PATCH 219/831] python3Packages.scrapy: 2.14.1 -> 2.16.0

Diff: https://github.com/scrapy/scrapy/compare/2.14.1...2.16.0

Changelog: https://github.com/scrapy/scrapy/raw/2.16.0/docs/news.rst
---
 pkgs/development/python-modules/scrapy/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/scrapy/default.nix b/pkgs/development/python-modules/scrapy/default.nix
index 0cacbda728d8..cceb55ded458 100644
--- a/pkgs/development/python-modules/scrapy/default.nix
+++ b/pkgs/development/python-modules/scrapy/default.nix
@@ -9,6 +9,7 @@
   fetchFromGitHub,
   glibcLocales,
   hatchling,
+  httpx,
   installShellFiles,
   itemadapter,
   itemloaders,
@@ -40,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "scrapy";
-  version = "2.14.1";
+  version = "2.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scrapy";
     repo = "scrapy";
     tag = version;
-    hash = "sha256-KDci1Z5TZ+3svotYXkEG1s+bPWtxzIfQQwOgvI0k8w0=";
+    hash = "sha256-s72COXzDuTtRNGenZEZG8QCeq+9LBu6fuT5NOjpVYaY=";
   };
 
   pythonRelaxDeps = [
@@ -86,6 +87,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     botocore
     glibcLocales
+    httpx
     jmespath
     pexpect
     pytest-asyncio
@@ -106,7 +108,6 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    "tests/test_proxy_connect.py"
     "tests/test_utils_display.py"
     "tests/test_command_check.py"
 
@@ -133,9 +134,12 @@ buildPythonPackage rec {
     "AnonymousFTPTestCase"
     "FTPFeedStorageTest"
     "FeedExportTest"
+    "TestRealWebsite"
     "test_custom_asyncio_loop_enabled_true"
     "test_custom_loop_asyncio"
     "test_custom_loop_asyncio_deferred_signal"
+    "test_pos_string"
+    "test_key_resp_or_url"
     # "FileFeedStoragePreFeedOptionsTest" # https://github.com/scrapy/scrapy/issues/5157
     "test_persist"
     "test_timeout_download_from_spider_nodata_rcvd"

From 948ae444f28653e219f6be6a01a1f376e7dc20a8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 20 May 2026 02:59:50 +0000
Subject: [PATCH 220/831] mdbook: 0.5.2 -> 0.5.3

---
 pkgs/by-name/md/mdbook/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/md/mdbook/package.nix b/pkgs/by-name/md/mdbook/package.nix
index 66c14abfb130..fa23ac200d96 100644
--- a/pkgs/by-name/md/mdbook/package.nix
+++ b/pkgs/by-name/md/mdbook/package.nix
@@ -8,7 +8,7 @@
   installShellFiles,
 }:
 let
-  version = "0.5.2";
+  version = "0.5.3";
 in
 rustPlatform.buildRustPackage rec {
   inherit version;
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "mdBook";
     tag = "v${version}";
-    hash = "sha256-gyjD47ZR9o2lIxipzesyJ6mxb9J9W+WS77TNWhKHP6U=";
+    hash = "sha256-RMJQn58hshBGQSpu30NdUOb3Prywn6NfhauSzFZ35xQ=";
   };
 
-  cargoHash = "sha256-230KljOUSrDy8QCQki7jvJvdAsjVlUEjKDNVyTF4tWs=";
+  cargoHash = "sha256-LlImOjTQjMQURQ81Gn73v+DEHXqyyiz39K9T+MrE7S0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From a17a97fe7e53c20617fbec8112db78bf75badb2b Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Sun, 8 Mar 2026 21:43:08 +0100
Subject: [PATCH 221/831] python3Packages.opentelemetry-api: 1.34.0 -> 1.40.0

---
 pkgs/development/python-modules/opentelemetry-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-api/default.nix b/pkgs/development/python-modules/opentelemetry-api/default.nix
index eb4afad2436f..f5a482ee5155 100644
--- a/pkgs/development/python-modules/opentelemetry-api/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-api/default.nix
@@ -14,7 +14,7 @@
 let
   self = buildPythonPackage rec {
     pname = "opentelemetry-api";
-    version = "1.34.0";
+    version = "1.40.0";
     pyproject = true;
 
     # to avoid breakage, every package in opentelemetry-python must inherit this version, src, and meta
@@ -22,7 +22,7 @@ let
       owner = "open-telemetry";
       repo = "opentelemetry-python";
       tag = "v${version}";
-      hash = "sha256-fAXcS2VyDMk+UDW3ru5ZvwzXjydsY1uFcT2GvZuiGWw=";
+      hash = "sha256-1KVy9s+zjlB4w7E45PMCWRxPus24bgBmmM3k2R9d+Jg=";
     };
 
     sourceRoot = "${src.name}/opentelemetry-api";

From d40d2aaddf1821f005e4faf984400115563670fd Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Sun, 8 Mar 2026 21:43:35 +0100
Subject: [PATCH 222/831] python3Packages.opentelemetry-instrumentation: 0.55b0
 -> 0.61b0

---
 .../python-modules/opentelemetry-instrumentation/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
index 80c5e8536de1..5bceaef09814 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "opentelemetry-instrumentation";
-  version = "0.55b0";
+  version = "0.61b0";
   pyproject = true;
 
   # To avoid breakage, every package in opentelemetry-python-contrib must inherit this version, src, and meta
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "open-telemetry";
     repo = "opentelemetry-python-contrib";
     tag = "v${version}";
-    hash = "sha256-UM9ezCh3TVwyj257O0rvTCIgfrddobWcVIgJmBUj/Vo=";
+    hash = "sha256-DT13gcYPNYXBPnf622WsA16C+7sabJfOshDquHn06Ok=";
   };
 
   sourceRoot = "${src.name}/opentelemetry-instrumentation";

From a84547aa748905969c54c0b5a5a154f552d1eb09 Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Wed, 11 Mar 2026 20:57:00 +0100
Subject: [PATCH 223/831] 
 python3Packages.opentelemetry-instrumentation-requests: fix test fixtures

---
 .../default.nix                                       | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix b/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
index e64aa913d50b..5adf35cc516f 100644
--- a/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-instrumentation-requests/default.nix
@@ -1,5 +1,6 @@
 {
   buildPythonPackage,
+  fetchpatch,
   requests,
   hatchling,
   opentelemetry-api,
@@ -18,6 +19,16 @@ buildPythonPackage {
 
   sourceRoot = "${opentelemetry-instrumentation.src.name}/instrumentation/opentelemetry-instrumentation-requests";
 
+  patches = [
+    # remove hardcoded requests version from fixtures
+    (fetchpatch {
+      url = "https://github.com/open-telemetry/opentelemetry-python-contrib/commit/69a94e0c3b25edfdc4abeb18a4d26f5b7532e7ba.patch";
+      stripLen = 2;
+      includes = [ "tests/test_requests_integration.py" ];
+      hash = "sha256-JGWJVHR6lAg8bG1fpfJ4BJbqipnVFRLV7i/bKwOmtPk=";
+    })
+  ];
+
   build-system = [ hatchling ];
 
   dependencies = [

From e708eaa2be3978abc319c810b2ed10cf09da028b Mon Sep 17 00:00:00 2001
From: Yaroslav Bolyukin <iam@lach.pw>
Date: Sun, 8 Mar 2026 21:16:08 +0100
Subject: [PATCH 224/831] 
 python3Packages.opentelemetry-semantic-conventions-ai: init at 0.4.15

---
 .../default.nix                               | 38 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix

diff --git a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
new file mode 100644
index 000000000000..623e6501660a
--- /dev/null
+++ b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  hatchling,
+  opentelemetry-sdk,
+  opentelemetry-semantic-conventions,
+}:
+let
+  version = "0.4.15";
+in
+buildPythonPackage {
+  pname = "opentelemetry-semantic-conventions-ai";
+  inherit version;
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "opentelemetry_semantic_conventions_ai";
+    inherit version;
+    hash = "sha256-Et4XLR4R0hxugrv1eMfopxNYmn/adq+e14VjJWSii4E=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    opentelemetry-sdk
+    opentelemetry-semantic-conventions
+  ];
+
+  pythonImportsCheck = [ "opentelemetry.semconv_ai" ];
+
+  meta = {
+    description = "Open-source observability for your GenAI or LLM application, based on OpenTelemetry";
+    homepage = "https://github.com/traceloop/openllmetry";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ lach ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1a18f0a5c195..311153d6940b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11949,6 +11949,10 @@ self: super: with self; {
     callPackage ../development/python-modules/opentelemetry-semantic-conventions
       { };
 
+  opentelemetry-semantic-conventions-ai =
+    callPackage ../development/python-modules/opentelemetry-semantic-conventions-ai
+      { };
+
   opentelemetry-test-utils = callPackage ../development/python-modules/opentelemetry-test-utils { };
 
   opentelemetry-util-http = callPackage ../development/python-modules/opentelemetry-util-http { };

From d2a5f7f0cafe93df429883d62a6365ec7f4db78c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 19:24:27 -0700
Subject: [PATCH 225/831] libadwaita: 1.9.0 -> 1.9.1

Diff: https://gitlab.gnome.org/GNOME/libadwaita/-/compare/1.9.0...1.9.1

Changelog: https://gitlab.gnome.org/GNOME/libadwaita/-/blob/1.9.1/NEWS
---
 pkgs/by-name/li/libadwaita/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libadwaita/package.nix b/pkgs/by-name/li/libadwaita/package.nix
index 0d1ed0da7e85..8f289c6e4977 100644
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.9.0";
+  version = "1.9.1";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-JAKP8CjLCKGZvHoB26ih/J3xAru4wiVf/ObG0L8r4pY=";
+    hash = "sha256-Oy3WcsymNbbmAacm5hEOrorI1wKXjSp063mh4jCJRAE=";
   };
 
   depsBuildBuild = [

From eb99a699438577d486d66e3d860c3ba67facbb1b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 21:34:13 -0700
Subject: [PATCH 226/831] at-spi2-core: 2.60.1 -> 2.60.4

---
 pkgs/by-name/at/at-spi2-core/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix
index dd5e8f9e4ce1..c20443184374 100644
--- a/pkgs/by-name/at/at-spi2-core/package.nix
+++ b/pkgs/by-name/at/at-spi2-core/package.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.60.1";
+  version = "2.60.4";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+ZuH48FnT1+8QXzJwdniYcDymqsFUK1jaYBQMdEvaFI=";
+    hash = "sha256-Gh9bqYBZF/QfxqpoI9z4h6KR1gekJ+LVr7a136ZQcMc=";
   };
 
   nativeBuildInputs = [

From 4bb8e4bdb522b174b3ce139cc5dd8f16a4f325c2 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 25 May 2026 13:20:03 +0200
Subject: [PATCH 227/831] valgrind.meta.mainProgram: init

---
 pkgs/by-name/va/valgrind/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index 8c3a2ca3db1e..bdef19531e54 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -111,6 +111,7 @@ stdenv.mkDerivation rec {
     '';
 
     license = lib.licenses.gpl3Plus;
+    mainProgram = "valgrind";
 
     platforms =
       with lib.platforms;

From 6e3f57e4db27a98f0d9e7de6f91f3040722333b7 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 25 May 2026 16:06:28 +0200
Subject: [PATCH 228/831] pgcopydb: 0.17 -> 0.17-unstable-2026-05-21

Update to latest commit from main, where a build failure with PostgreSQL
18 was recently fixed.

The last release is from 2024, so it's time.
---
 pkgs/by-name/pg/pgcopydb/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pg/pgcopydb/package.nix b/pkgs/by-name/pg/pgcopydb/package.nix
index 906bab8156dc..d55a72b2a7d3 100644
--- a/pkgs/by-name/pg/pgcopydb/package.nix
+++ b/pkgs/by-name/pg/pgcopydb/package.nix
@@ -17,13 +17,13 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "pgcopydb";
-  version = "0.17";
+  version = "0.17-unstable-2026-05-21";
 
   src = fetchFromGitHub {
     owner = "dimitri";
     repo = "pgcopydb";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-g5MC4F0BYgTimpJZDX+PepFLXv1QuH7XGlzV66xM11M=";
+    rev = "984269274ccdaf0d297ed82db635e6746be55b75";
+    hash = "sha256-qTtziRdsge4YtQTTfWQ5KD8SQn2HYnj3rDMcrbI56SY=";
   };
 
   nativeBuildInputs = [

From 6afef1c80a05389c7e96bc78c4341fd70fe18179 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 25 May 2026 16:09:58 +0200
Subject: [PATCH 229/831] pgcopydb: propagate postgresql's buildInputs

Some of the build inputs required here are required because this links
against internals of PostgreSQL. The latter might be configured with
different dependencies on different platforms and such, so it's easier
to just depend on postgresql's build inputs.

This fixes the build with PostgreSQL 18, which added libnuma as a new
dependency.
---
 pkgs/by-name/pg/pgcopydb/package.nix | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/pkgs/by-name/pg/pgcopydb/package.nix b/pkgs/by-name/pg/pgcopydb/package.nix
index d55a72b2a7d3..f9ba308e0b30 100644
--- a/pkgs/by-name/pg/pgcopydb/package.nix
+++ b/pkgs/by-name/pg/pgcopydb/package.nix
@@ -31,18 +31,11 @@ clangStdenv.mkDerivation (finalAttrs: {
     postgresql.pg_config
   ];
 
-  buildInputs = [
+  buildInputs = postgresql.buildInputs ++ [
     boehmgc
-    libkrb5
-    openssl
     postgresql
-    readline
     sqlite
-    zlib
     python3Packages.sphinxHook
-  ]
-  ++ lib.optionals clangStdenv.hostPlatform.isLinux [
-    pam
   ];
 
   hardeningDisable = [ "format" ];

From 9c5e58d0798fb7d328e984eafc0d819e46ad68b1 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 24 May 2026 23:38:29 +0200
Subject: [PATCH 230/831] postgresql: 17 -> 18

Now that 26.05 is branched off, we should bump PostgreSQL's default
version to v18.
---
 nixos/doc/manual/release-notes/rl-2611.section.md | 2 +-
 nixos/modules/services/databases/postgresql.nix   | 8 ++++++--
 pkgs/top-level/all-packages.nix                   | 4 ++--
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 05a52258d54e..23e99e6e2a97 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -4,7 +4,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 26.11`) is v18.
 
 ## New Modules {#sec-release-26.11-new-modules}
 
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 2040d2be5bb1..982aa566f47c 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -204,7 +204,9 @@ in
         type = types.package;
         example = literalExpression "pkgs.postgresql_15";
         defaultText = literalExpression ''
-          if versionAtLeast config.system.stateVersion "25.11" then
+          if versionAtLeast config.system.stateVersion "26.11" then
+            pkgs.postgresql_18
+          else if versionAtLeast config.system.stateVersion "25.11" then
             pkgs.postgresql_17
           else if versionAtLeast config.system.stateVersion "24.11" then
             pkgs.postgresql_16
@@ -657,7 +659,9 @@ in
           '';
         base =
           # XXX Don't forget to keep `defaultText` of `services.postgresql.package` up to date!
-          if versionAtLeast config.system.stateVersion "25.11" then
+          if versionAtLeast config.system.stateVersion "26.11" then
+            pkgs.postgresql_18
+          else if versionAtLeast config.system.stateVersion "25.11" then
             pkgs.postgresql_17
           else if versionAtLeast config.system.stateVersion "24.11" then
             pkgs.postgresql_16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bcb43e25305c..d4da6b8296f4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8096,8 +8096,8 @@ with pkgs;
     postgresql_17_jit
     postgresql_18_jit
     ;
-  postgresql = postgresql_17;
-  postgresql_jit = postgresql_17_jit;
+  postgresql = postgresql_18;
+  postgresql_jit = postgresql_18_jit;
   postgresqlPackages = recurseIntoAttrs postgresql.pkgs;
   postgresql14Packages = recurseIntoAttrs postgresql_14.pkgs;
   postgresql15Packages = recurseIntoAttrs postgresql_15.pkgs;

From 59a147780b55787b12d8436ce67b8d5b8e467a42 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Mon, 25 May 2026 16:49:30 +0200
Subject: [PATCH 231/831] tree-sitter-grammars: move env variable into env for
 structuredAttrs

---
 .../tr/tree-sitter/grammars/build-grammar.nix  | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
index 4694916fbc6f..881b78756850 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
@@ -30,14 +30,16 @@ stdenv.mkDerivation (
       tree-sitter
     ];
 
-    CFLAGS = [
-      "-Isrc"
-      "-O2"
-    ];
-    CXXFLAGS = [
-      "-Isrc"
-      "-O2"
-    ];
+    env = {
+      CFLAGS = toString [
+        "-Isrc"
+        "-O2"
+      ];
+      CXXFLAGS = toString [
+        "-Isrc"
+        "-O2"
+      ];
+    };
 
     stripDebugList = [ "parser" ];
 

From 8ee15adfece7d34ce1de614e6a40bb469da01d54 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Mon, 25 May 2026 18:55:17 +0200
Subject: [PATCH 232/831] tree-sitter-grammars: set __structuredAttrs

---
 pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
index 881b78756850..478a0893b72b 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/build-grammar.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation (
 
     inherit version src;
 
+    __structuredAttrs = true;
+
     nativeBuildInputs = [
       jq
     ]

From 51f6d0a44cbf2051f267b101abd331b4fd372915 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Mon, 25 May 2026 16:48:01 +0200
Subject: [PATCH 233/831] valkey: 9.0.4 -> 9.1.0

changelog: https://github.com/valkey-io/valkey/releases/tag/9.1.0

diff: https://github.com/valkey-io/valkey/compare/9.0.4...9.1.0
---
 pkgs/by-name/va/valkey/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/va/valkey/package.nix b/pkgs/by-name/va/valkey/package.nix
index 5898430b732d..b0b0c1065f4e 100644
--- a/pkgs/by-name/va/valkey/package.nix
+++ b/pkgs/by-name/va/valkey/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   lua,
   jemalloc,
   pkg-config,
@@ -25,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "valkey";
-  version = "9.0.4";
+  version = "9.1.0";
 
   src = fetchFromGitHub {
     owner = "valkey-io";
     repo = "valkey";
     rev = finalAttrs.version;
-    hash = "sha256-FDm6i6G6h9WapMTj7ke4YtOjZ4rwIJZGONunQi0v7CE=";
+    hash = "sha256-RMZz83fycpOTPWB1dIXU0/hdh4ZGC+6JhCws8htAQ5E=";
   };
 
   patches = lib.optional useSystemJemalloc ./use_system_jemalloc.patch;
@@ -94,13 +93,14 @@ stdenv.mkDerivation (finalAttrs: {
     fi
 
     # Skip some more flaky tests.
-    # Skip test requiring custom jemalloc (unit/memefficiency).
+    # Skip test requiring custom jemalloc (unit/memefficiency, unit/type/string).
     ./runtest \
       --no-latency \
       --timeout 2000 \
       --clients "$CLIENTS" \
       --tags -leaks \
       --skipunit unit/memefficiency \
+      --skipunit unit/type/string \
       --skipunit integration/failover \
       --skipunit integration/aof-multi-part
 

From e456e5c07f724241d7a02932aec97cba63f8d011 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 25 May 2026 12:46:29 -0700
Subject: [PATCH 234/831] cargo-c: 0.10.19 -> 0.10.22

Diff: https://diff.rs/cargo-c/0.10.19/0.10.22

Changelog: https://github.com/lu-zero/cargo-c/releases/tag/v0.10.22
---
 pkgs/by-name/ca/cargo-c/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-c/package.nix b/pkgs/by-name/ca/cargo-c/package.nix
index effa2325438f..159334080752 100644
--- a/pkgs/by-name/ca/cargo-c/package.nix
+++ b/pkgs/by-name/ca/cargo-c/package.nix
@@ -12,19 +12,19 @@
 
 let
   # this version may need to be updated along with package version
-  cargoVersion = "0.93.0";
+  cargoVersion = "0.96.0";
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-c";
-  version = "0.10.19";
+  version = "0.10.22";
 
   src = fetchCrate {
     inherit (finalAttrs) pname;
     version = "${finalAttrs.version}+cargo-${cargoVersion}";
-    hash = "sha256-PrBmB+0tmU2MAUnRr+wx4g9hu0Y9i6WfR8U89bwiLVY=";
+    hash = "sha256-yqSrpBZUa0NmsPawYKKgywmbbG4zgguwfDF667s7zdo=";
   };
 
-  cargoHash = "sha256-EM/vAfW/ucOfK/XmAQn9Zk75eFb7pp8uZoByKbALCyo=";
+  cargoHash = "sha256-yeJWZtkgCRB0ipyTslsGcJi9Fi/XoWziuv74exRhAIk=";
 
   nativeBuildInputs = [
     pkg-config

From 99c958682d291c05ae2a0a044f16aa1cdb997e9e Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Mon, 25 May 2026 17:40:37 -0400
Subject: [PATCH 235/831] less: 692 -> 702

Changelog: https://www.greenwoodsoftware.com/less/news.702.html
---
 pkgs/by-name/le/less/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/le/less/package.nix b/pkgs/by-name/le/less/package.nix
index fa2f854f4d80..bc017a199195 100644
--- a/pkgs/by-name/le/less/package.nix
+++ b/pkgs/by-name/le/less/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "less";
-  version = "692";
+  version = "702";
 
   # `less` is provided by the following sources:
   # - meta.homepage
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   # homepage, and only those not marked as beta.
   src = fetchurl {
     url = "https://www.greenwoodsoftware.com/less/less-${finalAttrs.version}.tar.gz";
-    hash = "sha256-YTAPYDeY7PHXeGVweJ8P8/WhrPB1pvufdWg30WbjfRQ=";
+    hash = "sha256-JCpkwA8C2W+O4gjPY4rhcotyfH9f34Kn1PTK4y+whOI=";
   };
 
   buildInputs = [

From 3d799a0c8fb4bb552fc6d18f89c9b122a6b4185f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 25 May 2026 15:48:19 -0700
Subject: [PATCH 236/831] double-conversion: 3.3.1 -> 3.4.0

Diff: https://github.com/google/double-conversion/compare/v3.3.1...v3.4.0

Changelog: https://github.com/google/double-conversion/releases/tag/v3.4.0
---
 pkgs/by-name/do/double-conversion/package.nix | 27 +++----------------
 1 file changed, 4 insertions(+), 23 deletions(-)

diff --git a/pkgs/by-name/do/double-conversion/package.nix b/pkgs/by-name/do/double-conversion/package.nix
index 7b31908b1d37..25df8ddcb8fa 100644
--- a/pkgs/by-name/do/double-conversion/package.nix
+++ b/pkgs/by-name/do/double-conversion/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   ninja,
   ctestCheckHook,
@@ -11,34 +10,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "double-conversion";
-  version = "3.3.1";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "double-conversion";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-M80H+azCzQYa4/gBLWv5GNNhEuHsH7LbJ/ajwmACnrM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gxaPqQ51RyXZaTHkvh4RBpedPopcRiuWDoT+PPbI1uw=";
   };
 
-  patches = [
-    # Fix the build with CMake 4.
-    (fetchpatch {
-      name = "double-conversion-fix-cmake-4-1.patch";
-      url = "https://github.com/google/double-conversion/commit/101e1ba89dc41ceb75090831da97c43a76cd2906.patch";
-      hash = "sha256-VRmuNXdzt/I+gWbz5mwWkx5IGn8Vsl9WkdwRsuwZdkU=";
-    })
-    (fetchpatch {
-      name = "double-conversion-fix-cmake-4-2.patch";
-      url = "https://github.com/google/double-conversion/commit/0604b4c18815aadcf7f4b78dfa6bfcb91a634ed7.patch";
-      hash = "sha256-cJBp1ou1O/bMQ/7kvcX52dWbUdhmPfQ9aWmEhQdyhis=";
-    })
-    (fetchpatch {
-      name = "double-conversion-add-pkg-config.patch";
-      url = "https://github.com/google/double-conversion/commit/ddfd18c58ecc32fc74afc1083bb8774240b54efb.patch";
-      hash = "sha256-/pKCL19vS8fNwCm27yTNP+32ApHTH5dEGpnsMI11Lf4=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -68,6 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     pkgConfigModules = [ "double-conversion" ];
+    changelog = "https://github.com/google/double-conversion/blob/${finalAttrs.src.tag}/Changelog";
     description = "Binary-decimal and decimal-binary routines for IEEE doubles";
     homepage = "https://github.com/google/double-conversion";
     license = lib.licenses.bsd3;

From ec681ffc8f0d1277b5f5a19ad844c5a7d3fda2b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 25 May 2026 15:59:29 -0700
Subject: [PATCH 237/831] e2fsprogs: 1.47.3 -> 1.47.4

Changelog: https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.47.4
---
 pkgs/by-name/e2/e2fsprogs/package.nix | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/e2/e2fsprogs/package.nix b/pkgs/by-name/e2/e2fsprogs/package.nix
index ceb394b1c433..970ea64682c5 100644
--- a/pkgs/by-name/e2/e2fsprogs/package.nix
+++ b/pkgs/by-name/e2/e2fsprogs/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPackages,
   fetchurl,
-  fetchpatch,
   pkg-config,
   libuuid,
   gettext,
@@ -20,25 +19,15 @@
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
-  version = "1.47.3";
+  version = "1.47.4";
 
   __structuredAttrs = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/tytso/e2fsprogs/v${version}/e2fsprogs-${version}.tar.xz";
-    hash = "sha256-hX5u+AD+qiu0V4+8gQIUvl08iLBy6lPFOEczqWVzcyk=";
+    hash = "sha256-/VvziMvb4Aaj07MY2YOylIOCRArMhah/Hn0QhlPo2ws=";
   };
 
-  patches = [
-    # Upstream patch that fixes musl build (and probably others).
-    # Should be included in next release after 1.47.3.
-    (fetchpatch {
-      name = "stdio-portability.patch";
-      url = "https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/patch/?id=f79abd8554e600eacc2a7c864a8332b670c9e262";
-      hash = "sha256-zZ7zmSMTwGyS3X3b/D/mVG0bV2ul5xtY5DJx9YUvQO8=";
-    })
-  ];
-
   # fuse2fs adds 14mb of dependencies
   outputs = [
     "bin"

From b5ea1ced768bb4cfcfee96d1ca792f057bdbb2a4 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 19 May 2026 15:10:45 +0200
Subject: [PATCH 238/831] swtpm: 0.10.1 -> 0.10.1-unstable-05-06-2026

---
 pkgs/by-name/sw/swtpm/package.nix | 63 ++++++++++++-------------------
 1 file changed, 25 insertions(+), 38 deletions(-)

diff --git a/pkgs/by-name/sw/swtpm/package.nix b/pkgs/by-name/sw/swtpm/package.nix
index 8f75456b72e7..f1ec3ef1db55 100644
--- a/pkgs/by-name/sw/swtpm/package.nix
+++ b/pkgs/by-name/sw/swtpm/package.nix
@@ -7,7 +7,7 @@
   pkg-config,
   libtasn1,
   openssl,
-  fuse,
+  fuse3,
   glib,
   libseccomp,
   json-glib,
@@ -15,6 +15,7 @@
   unixtools,
   expect,
   socat,
+  gmp,
   gnutls,
   perl,
   makeWrapper,
@@ -27,20 +28,28 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "swtpm";
-  version = "0.10.1";
+  version = "0.10.1-unstable-2026-05-06"; # fuse3 support, switch to openssl, but does not yet require libtpms >= 0.11
 
   src = fetchFromGitHub {
     owner = "stefanberger";
     repo = "swtpm";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-N79vuI0FhawLyQtwVF6ABIvCmEaYefq/YkyrafUfUHE=";
+    rev = "74f272e337da2c2aa209140df85ddd43a285a2d9";
+    hash = "sha256-cviADrmSTagba9KmlfiQFS6x4W/C8vI2/HuPRqZFh2U=";
   };
 
   patches = [
     (fetchpatch {
-      name = "retry-nwwrite.patch";
-      url = "https://github.com/stefanberger/swtpm/commit/4da66c66f92438443e66b67555673c9cb898b0ae.patch";
-      hash = "sha256-TTS+ViN4g6EfNLrhvGPobcSQEbr/mEl9ZLZTWdxbifs=";
+      # some miscellaneous fixes
+      # - darwin support for socket open
+      # - fix a typoed format string
+      # - fix initializer lists to be compatible with clang
+      url = "https://github.com/stefanberger/swtpm/pull/1127.patch";
+      hash = "sha256-0DFf6LLdjv/wKcsjib1+AOJ3WWu83n5jA0Bx5/chlvc=";
+    })
+    (fetchpatch {
+      # better detection of `stat` util
+      url = "https://github.com/stefanberger/swtpm/pull/1128.patch";
+      hash = "sha256-Cgt8No15NA/eCBLuKsYLDwVWO89XohnTQ3znd4Ky6NM=";
     })
   ];
 
@@ -65,15 +74,17 @@ stdenv.mkDerivation (finalAttrs: {
     libtasn1
     glib
     json-glib
+    gmp
     gnutls
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
-    fuse
+    fuse3
     libseccomp
   ];
 
   configureFlags = [
     "--localstatedir=/var"
+    "--with-gnutls"
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     "--with-cuse"
@@ -87,39 +98,14 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Makefile tries to create the directory /var/lib/swtpm-localca, which fails
     substituteInPlace samples/Makefile.am \
-        --replace 'install-data-local:' 'do-not-execute:'
+        --replace-fail 'install-data-local:' 'do-not-execute:'
 
-    # Use the correct path to the certtool binary
+    # Use the correct path to the openssl binary
     # instead of relying on it being in the environment
     substituteInPlace src/swtpm_localca/swtpm_localca.c \
-      --replace \
-        '# define CERTTOOL_NAME "gnutls-certtool"' \
-        '# define CERTTOOL_NAME "${gnutls}/bin/certtool"' \
-      --replace \
-        '# define CERTTOOL_NAME "certtool"' \
-        '# define CERTTOOL_NAME "${gnutls}/bin/certtool"'
-
-    substituteInPlace tests/common --replace \
-        'CERTTOOL=gnutls-certtool;;' \
-        'CERTTOOL=certtool;;'
-
-    # Fix error on macOS:
-    # stat: invalid option -- '%'
-    # This is caused by the stat program not being the BSD version,
-    # as is expected by the test
-    substituteInPlace tests/common tests/sed-inplace --replace \
-        'if [[ "$(uname -s)" =~ (Linux|CYGWIN_NT-) ]]; then' \
-        'if [[ "$(uname -s)" =~ (Linux|Darwin|CYGWIN_NT-) ]]; then'
-
-    # Otherwise certtool seems to pick up the system language on macOS,
-    # which might cause a test to fail
-    substituteInPlace tests/test_swtpm_setup_create_cert --replace \
-        '$CERTTOOL' \
-        'LC_ALL=C.UTF-8 $CERTTOOL'
-
-    substituteInPlace tests/test_tpm2_swtpm_cert --replace \
-        'certtool' \
-        'LC_ALL=C.UTF-8 certtool'
+      --replace-fail \
+        '#define OPENSSL_TOOL  "openssl"' \
+        '#define OPENSSL_TOOL  "${lib.getExe openssl}"'
   '';
 
   # Workaround for https://github.com/stefanberger/swtpm/issues/795
@@ -129,6 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   doCheck = true;
+  __darwinAllowLocalNetworking = true; # tests do socket things, requires local networking to pass
   enableParallelBuilding = true;
 
   outputs = [

From 83ece5c3a1e6340a1d9b9b40db3d5c50e9e05672 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 13:01:50 +0200
Subject: [PATCH 239/831] python3Packages.starlette: 0.52.1 -> 1.1.0

https://www.starlette.io/release-notes/#110
https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr

Fixes: CVE-2026-48710
---
 pkgs/development/python-modules/starlette/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 219ce1e8b7a7..e66a5cf7a80d 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.52.1";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = "starlette";
     tag = version;
-    hash = "sha256-XPAeRnh9a0A1/5VGZzzGQBhlBsih1VR8QmFdkxG5cQE=";
+    hash = "sha256-9iQXlpA1VDGw1c7X1zJPmJ3Dub46PwqrVIX1+fWOZ7M=";
   };
 
   build-system = [ hatchling ];

From b481729faf5004e2da0fa3b932a6f2696b4cc98c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 13:06:41 +0200
Subject: [PATCH 240/831] python3Packages.fastapi: 0.135.3 -> 0.136.3

https://github.com/fastapi/fastapi/releases/tag/0.136.0
https://github.com/fastapi/fastapi/releases/tag/0.136.1
https://github.com/fastapi/fastapi/releases/tag/0.136.2
https://github.com/fastapi/fastapi/releases/tag/0.136.3
---
 pkgs/development/python-modules/fastapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 9d5aea8559e5..3e29f81a9da2 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -45,14 +45,14 @@
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.135.3";
+  version = "0.136.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tiangolo";
     repo = "fastapi";
     tag = version;
-    hash = "sha256-sE5d+MgmP9L+MUosRBsR+KSJkcC9i2EOOtKHq0sXjRM=";
+    hash = "sha256-lfmk8ZveKPukEEfwWq2mKtWmOHAtVzGuE5BsOskDzh0=";
   };
 
   build-system = [ pdm-backend ];

From 81d174f747c20e3283d967915d8e990700bbb26f Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 26 May 2026 14:16:33 +0300
Subject: [PATCH 241/831] pipewire: 1.6.5 -> 1.6.6

Diff: https://gitlab.freedesktop.org/pipewire/pipewire/-/compare/1.6.5...1.6.6

Changelog: https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/1.6.6
---
 pkgs/by-name/pi/pipewire/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 7a9de59f709d..3929f392ee6a 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -90,7 +90,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pipewire";
-  version = "1.6.5";
+  version = "1.6.6";
 
   outputs = [
     "out"
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     tag = finalAttrs.version;
-    hash = "sha256-ui5VTbSiobHmPUHW4jLguoeMWaKT4f2eTqdo3ZGgvNI=";
+    hash = "sha256-pyZozhJomFT4QkJv/NKkXpbknmVxjv8hCxZV6RcIHmE=";
   };
 
   patches = [

From 8d2dbc322b1436ad3941738b428103423f9463da Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 9 Apr 2026 12:50:27 +0700
Subject: [PATCH 242/831] python3Packages.certbot: 5.4.0 -> 5.6.0

---
 pkgs/development/python-modules/certbot/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index b7d31f76d771..17c7566b6db2 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "certbot";
-  version = "5.4.0";
+  version = "5.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "certbot";
     repo = "certbot";
     tag = "v${version}";
-    hash = "sha256-Tu46Wybod89TiwsVccNuQcweWoeQE1wbH+pDWNC9+kE=";
+    hash = "sha256-knaEk4bjC0cdnMiO4ENvaDm/i/3tn6ZOJPdyqJxLKOs=";
   };
 
   sourceRoot = "${src.name}/certbot";

From c0495d494a91369cbbca91616a74a94baaad1479 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 9 Apr 2026 12:51:07 +0700
Subject: [PATCH 243/831] python3Packages.certbot: add miniharinn as a
 maintainer

---
 pkgs/development/python-modules/certbot/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index 17c7566b6db2..e0244147707f 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -103,7 +103,7 @@ buildPythonPackage rec {
     description = "ACME client that can obtain certs and extensibly update server configurations";
     platforms = lib.platforms.unix;
     mainProgram = "certbot";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ miniharinn ];
     license = with lib.licenses; [ asl20 ];
   };
 }

From be1f6a337333de4cf993cf8f54c6736ef1244d5f Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 9 Apr 2026 12:52:36 +0700
Subject: [PATCH 244/831] python3Packages.certbot: use finalAttrs

---
 .../development/python-modules/certbot/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
index e0244147707f..797667c6d296 100644
--- a/pkgs/development/python-modules/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -22,7 +22,7 @@
   writeShellScriptBin,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "certbot";
   version = "5.6.0";
   pyproject = true;
@@ -30,11 +30,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "certbot";
     repo = "certbot";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-knaEk4bjC0cdnMiO4ENvaDm/i/3tn6ZOJPdyqJxLKOs=";
   };
 
-  sourceRoot = "${src.name}/certbot";
+  sourceRoot = "${finalAttrs.src.name}/certbot";
 
   build-system = [ setuptools ];
 
@@ -87,9 +87,9 @@ buildPythonPackage rec {
     let
       pythonEnv = python.withPackages f;
     in
-    runCommand "certbot-with-plugins-${version}"
+    runCommand "certbot-with-plugins-${finalAttrs.version}"
       {
-        inherit pname version;
+        inherit (finalAttrs) pname version;
       }
       ''
         mkdir -p $out/bin
@@ -99,11 +99,11 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/certbot/certbot";
-    changelog = "https://github.com/certbot/certbot/blob/${src.tag}/certbot/CHANGELOG.md";
+    changelog = "https://github.com/certbot/certbot/blob/${finalAttrs.src.tag}/certbot/CHANGELOG.md";
     description = "ACME client that can obtain certs and extensibly update server configurations";
     platforms = lib.platforms.unix;
     mainProgram = "certbot";
     maintainers = with lib.maintainers; [ miniharinn ];
     license = with lib.licenses; [ asl20 ];
   };
-}
+})

From 02d0ef1ce000de8f47e56363fb80bbf3ea1a6cf9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 09:06:58 -0700
Subject: [PATCH 245/831] python3Packages.hass-nabucasa: unpin acme

---
 pkgs/development/python-modules/hass-nabucasa/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/hass-nabucasa/default.nix b/pkgs/development/python-modules/hass-nabucasa/default.nix
index 07485d536e1d..b31a4b1ea581 100644
--- a/pkgs/development/python-modules/hass-nabucasa/default.nix
+++ b/pkgs/development/python-modules/hass-nabucasa/default.nix
@@ -50,6 +50,10 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "acme"
+  ];
+
   dependencies = [
     acme
     aiohttp

From 4a101f0ce85487c821f8cd07e0a9715e4a1389d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 09:46:24 -0700
Subject: [PATCH 246/831] imagemagick: 7.1.2-23 -> 7.1.2-24

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-23...7.1.2-24

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
---
 pkgs/by-name/im/imagemagick/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index bbf070eaac05..27f0acd0d16f 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -88,13 +88,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-23";
+  version = "7.1.2-24";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-zYk75q+EyWq5g/AHFU6v8a7gye0aDAEe/ZZvjqR9ZTc=";
+    hash = "sha256-oSH0dsQ3cuFNYJIIr6LHbv82FbFxxcmkjQ5csTNsYCA=";
   };
 
   outputs = [

From 160ca6558e44577004c7660a41e6cf50557d7661 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 26 May 2026 20:58:30 +0300
Subject: [PATCH 247/831] curl: set structuredAttrs

---
 pkgs/by-name/cu/curlMinimal/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 3bc05f122f6e..37ebfe7398bf 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -115,6 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   env = {
     CXX = "${stdenv.cc.targetPrefix}c++";

From d28f57cdff13598302f9cbebf024a02530893d03 Mon Sep 17 00:00:00 2001
From: Paul Grandperrin <paul.grandperrin@gmail.com>
Date: Tue, 26 May 2026 21:21:06 +0200
Subject: [PATCH 248/831] systemd: fix tmpfiles errors when mount is noatime

fixes #520485
---
 pkgs/os-specific/linux/systemd/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index e589188a6099..a6dd663aef3c 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,6 +5,7 @@
   pkgsCross,
   testers,
   fetchFromGitHub,
+  fetchpatch,
   buildPackages,
   makeBinaryWrapper,
   ninja,
@@ -237,6 +238,13 @@ stdenv.mkDerivation (finalAttrs: {
     ./0003-add-rootprefix-to-lookup-dir-paths.patch
     ./0004-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
     ./0005-core-don-t-taint-on-unmerged-usr.patch
+
+    # TODO: remove the following patch when systemd v261 is released.
+    # see upstream PR: https://github.com/systemd/systemd/pull/41232
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/df45055942330fcd2b77389e449905e7f6ca34ec.patch";
+      hash = "sha256-PDh4mP9rYGCglp25346nExU2v6P0WYPfLZgu+YwzZ9c=";
+    })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch

From 27470b5f24b8a1eb6c543d8dd9e590ddcc75d3a2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 May 2026 20:01:11 +0000
Subject: [PATCH 249/831] libxmlb: 0.3.25 -> 0.3.27

---
 pkgs/by-name/li/libxmlb/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libxmlb/package.nix b/pkgs/by-name/li/libxmlb/package.nix
index 1d480f08f1e0..9218433fbe62 100644
--- a/pkgs/by-name/li/libxmlb/package.nix
+++ b/pkgs/by-name/li/libxmlb/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxmlb";
-  version = "0.3.25";
+  version = "0.3.27";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "hughsie";
     repo = "libxmlb";
     rev = finalAttrs.version;
-    hash = "sha256-GBsaVJpnB6m1oItwD7t59BmoZcVQBU/sPz5fGGVzBG0=";
+    hash = "sha256-5RP794gBA67DcrjzqvguDYu/Sf+1X5kfRi9yvLx9b+c=";
   };
 
   patches = [

From 91518f18f5de0f58d3cd532a8eeb227d78b5159f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 13:41:00 -0700
Subject: [PATCH 250/831] ffmpeg_8: 8.1 -> 8.1.1

Changelog: https://github.com/FFmpeg/FFmpeg/blob/n8.1.1/Changelog
---
 pkgs/development/libraries/ffmpeg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index cd003aecd13e..ca123f87b955 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -30,8 +30,8 @@ let
     hash = "sha256-1w4OSlz88D2pnZVXQcI4uyX+triNK0NXzlsyt7GGSLU=";
   };
   v8 = {
-    version = "8.1";
-    hash = "sha256-FdKhhCveEo5UodEoyUh3aBHABv3OT2VXmwBXE1ce3p0=";
+    version = "8.1.1";
+    hash = "sha256-WPGfjTZjsgpR5QiANRWF4g6LF2ejGzFQUrLjhzw9cfQ=";
   };
 in
 

From 07e44fb25f474a24adf65c976ff72677ad637a4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 14:10:04 -0700
Subject: [PATCH 251/831] fftw: 3.3.10 -> 3.3.11

Changelog: https://github.com/FFTW/fftw3/blob/fftw-3.3.11/NEWS
---
 pkgs/by-name/ff/fftw/package.nix | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/ff/fftw/package.nix b/pkgs/by-name/ff/fftw/package.nix
index 0d9736335f68..a706799bf693 100644
--- a/pkgs/by-name/ff/fftw/package.nix
+++ b/pkgs/by-name/ff/fftw/package.nix
@@ -1,6 +1,5 @@
 {
   fetchurl,
-  fetchpatch,
   stdenv,
   lib,
   gfortran,
@@ -22,24 +21,16 @@ assert lib.elem precision [
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fftw-${precision}";
-  version = "3.3.10";
+  version = "3.3.11";
 
   src = fetchurl {
     urls = [
       "https://fftw.org/fftw-${finalAttrs.version}.tar.gz"
       "ftp://ftp.fftw.org/pub/fftw/fftw-${finalAttrs.version}.tar.gz"
     ];
-    hash = "sha256-VskyVJhSzdz6/as4ILAgDHdCZ1vpIXnlnmIVs0DiZGc=";
+    hash = "sha256-VjDCTN6zOxMWEvfrSxqZNCNHVPnziP+GF0WNC+byOaE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "remove_missing_FFTW3LibraryDepends.patch";
-      url = "https://github.com/FFTW/fftw3/pull/338/commits/f69fef7aa546d4477a2a3fd7f13fa8b2f6c54af7.patch";
-      hash = "sha256-lzX9kAHDMY4A3Td8necXwYLcN6j8Wcegi3A7OIECKeU=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -107,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
+    changelog = "https://github.com/FFTW/fftw3/blob/fftw-${finalAttrs.version}/NEWS";
     description = "Fastest Fourier Transform in the West library";
     homepage = "https://www.fftw.org/";
     license = lib.licenses.gpl2Plus;

From 0b780db8ebf8df374e506dbc70ca31d2da42ffa3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 09:50:57 -0700
Subject: [PATCH 252/831] python3Packages.chardet: 5.2.0 -> 6.0.0.post1

Diff: https://github.com/chardet/chardet/compare/5.2.0...6.0.0.post1

Changelog: https://github.com/chardet/chardet/releases/tag/6.0.0.post1
---
 .../python-modules/chardet/default.nix        | 26 +++++++++++++------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/chardet/default.nix b/pkgs/development/python-modules/chardet/default.nix
index 87f4b526b9b4..7e0b2344d250 100644
--- a/pkgs/development/python-modules/chardet/default.nix
+++ b/pkgs/development/python-modules/chardet/default.nix
@@ -1,26 +1,36 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
   hypothesis,
+  pytest-timeout,
+  pytest-xdist,
   pytestCheckHook,
-  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "chardet";
-  version = "5.2.0";
+  version = "6.0.0.post1";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Gztv9HmoxBS8P6LAhSmVaVxKAm3NbQYzst0JLKOcHPc=";
+  src = fetchFromGitHub {
+    owner = "chardet";
+    repo = "chardet";
+    tag = version;
+    hash = "sha256-7G998L4VRvNiGBBNAxPJB27lI2DtL1lTteowUH2NBDk=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
 
   nativeCheckInputs = [
     hypothesis
+    pytest-timeout
+    pytest-xdist
     pytestCheckHook
   ];
 
@@ -32,7 +42,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "chardet" ];
 
   meta = {
-    changelog = "https://github.com/chardet/chardet/releases/tag/${version}";
+    changelog = "https://github.com/chardet/chardet/releases/tag/${src.tag}";
     description = "Universal encoding detector";
     mainProgram = "chardetect";
     homepage = "https://github.com/chardet/chardet";

From 9dfc99b8d876daacfb34786a0af0ebcd3097e2c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 11:06:01 -0700
Subject: [PATCH 253/831] python3Packages.chardet: use finalAttrs

---
 pkgs/development/python-modules/chardet/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/chardet/default.nix b/pkgs/development/python-modules/chardet/default.nix
index 7e0b2344d250..1e6bf432037e 100644
--- a/pkgs/development/python-modules/chardet/default.nix
+++ b/pkgs/development/python-modules/chardet/default.nix
@@ -10,7 +10,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "chardet";
   version = "6.0.0.post1";
   pyproject = true;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "chardet";
     repo = "chardet";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-7G998L4VRvNiGBBNAxPJB27lI2DtL1lTteowUH2NBDk=";
   };
 
@@ -42,11 +42,11 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "chardet" ];
 
   meta = {
-    changelog = "https://github.com/chardet/chardet/releases/tag/${src.tag}";
+    changelog = "https://github.com/chardet/chardet/releases/tag/${finalAttrs.src.tag}";
     description = "Universal encoding detector";
     mainProgram = "chardetect";
     homepage = "https://github.com/chardet/chardet";
     license = lib.licenses.lgpl21Plus;
     maintainers = [ ];
   };
-}
+})

From 1e0590976310901b97d40324705d71746d9b63bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 21 May 2026 08:45:07 -0700
Subject: [PATCH 254/831] python3Packages.httpx: skip tests broken by chardet
 v6

---
 pkgs/development/python-modules/httpx/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/httpx/default.nix b/pkgs/development/python-modules/httpx/default.nix
index 2b146d05b658..a5e66abfcd68 100644
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@@ -96,6 +96,10 @@ buildPythonPackage rec {
     "test_sync_proxy_close"
     # ResourceWarning: Async generator 'httpx._content.ByteStream.__aiter__' was garbage collected before it had been exhausted. Surround its use in 'async with aclosing(...):' to ensure that it gets cleaned up as soon as you're done using it.
     "test_write_timeout" # trio variant
+    # chardet v6 recognizes the wrong encoding
+    "test_client_decode_text_using_autodetect"
+    "test_client_decode_text_using_explicit_encoding"
+    "test_response_decode_text_using_autodetect"
   ];
 
   disabledTestPaths = [ "tests/test_main.py" ];

From f21fec3871a704863b2e32afc818cf35337fd7ff Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Wed, 27 May 2026 09:20:26 -0400
Subject: [PATCH 255/831] tinysparql: include upstream patch for sqlite
 float-related test fixes

Issue: https://gitlab.gnome.org/GNOME/tinysparql/-/work_items/496
Merge request: https://gitlab.gnome.org/GNOME/tinysparql/-/merge_requests/811
---
 pkgs/by-name/ti/tinysparql/package.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/by-name/ti/tinysparql/package.nix b/pkgs/by-name/ti/tinysparql/package.nix
index 25e5d9aaa0f0..aeeae95159df 100644
--- a/pkgs/by-name/ti/tinysparql/package.nix
+++ b/pkgs/by-name/ti/tinysparql/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchurl,
+  fetchpatch,
   gettext,
   meson,
   mesonEmulatorHook,
@@ -49,6 +50,18 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-z9RgIe4VFK1DXnFPeqHsenh8f1FqlPTHQ4iX7j1uyh4=";
   };
 
+  patches = [
+    # sqlite changed the precision of float <-> text conversions, causing
+    # failures in the test suite. patch here until this appears in a release.
+    # https://gitlab.gnome.org/GNOME/tinysparql/-/work_items/496
+    # https://gitlab.gnome.org/GNOME/tinysparql/-/merge_requests/811
+    (fetchpatch {
+      name = "tinysparql-sqlite-double-value-precision.patch";
+      url = "https://gitlab.gnome.org/GNOME/tinysparql/-/commit/47d5bf9313d0ccb1feb7169eed9047d0e1597a39.patch";
+      hash = "sha256-k6eELZCEEtD8s7GiMckjTlf6QcAiUNY1Mraw7GROsm4=";
+    })
+  ];
+
   strictDeps = true;
 
   depsBuildBuild = [

From e38a2c417533158c391897e6e8d229e752f931e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 07:11:43 -0700
Subject: [PATCH 256/831] opencv4: use ffmpeg-headless

---
 pkgs/by-name/ml/mlt/package.nix           | 2 +-
 pkgs/development/libraries/opencv/4.x.nix | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ml/mlt/package.nix b/pkgs/by-name/ml/mlt/package.nix
index aba7a2d56717..735a503a011c 100644
--- a/pkgs/by-name/ml/mlt/package.nix
+++ b/pkgs/by-name/ml/mlt/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     gdk-pixbuf
-    (opencv4.override { inherit ffmpeg; })
+    (opencv4.override { ffmpeg-headless = ffmpeg; })
     ffmpeg
     fftw
     frei0r
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 3e81c8a5b008..3fcdb07c7607 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -58,7 +58,7 @@
   enableVtk ? false,
   vtk,
   enableFfmpeg ? true,
-  ffmpeg,
+  ffmpeg-headless,
   enableGStreamer ? true,
   elfutils,
   gst_all_1,
@@ -373,7 +373,7 @@ effectiveStdenv.mkDerivation {
     openjpeg
   ]
   ++ optionals enableFfmpeg [
-    ffmpeg
+    ffmpeg-headless
   ]
   ++ optionals (enableGStreamer && effectiveStdenv.hostPlatform.isLinux) [
     elfutils

From 057bd4a56cea3d910100441ab47ade8135efaf56 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Wed, 27 May 2026 17:17:49 +0200
Subject: [PATCH 257/831] 
 python314Packages.opentelemetry-semantic-conventions-ai: update meta.homepage

---
 .../opentelemetry-semantic-conventions-ai/default.nix           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
index 623e6501660a..14c16f870d03 100644
--- a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage {
 
   meta = {
     description = "Open-source observability for your GenAI or LLM application, based on OpenTelemetry";
-    homepage = "https://github.com/traceloop/openllmetry";
+    homepage = "https://github.com/traceloop/openllmetry/tree/main/packages/opentelemetry-semantic-conventions-ai";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ lach ];
   };

From 1daeb43ea555600ccc024e6a1a4e12fbd209cbe9 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Sun, 24 May 2026 14:52:17 +0200
Subject: [PATCH 258/831] mate-panel-with-applets: re-enable man output

This reverts commit 72a37f984c0417d8a741e50decd9f44aeca58c74.
Requires https://github.com/NixOS/nixpkgs/pull/511330 .
---
 .../ma/mate-panel-with-applets/package.nix        | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/ma/mate-panel-with-applets/package.nix b/pkgs/by-name/ma/mate-panel-with-applets/package.nix
index a3a52ced0d43..e5d5031ff9c9 100644
--- a/pkgs/by-name/ma/mate-panel-with-applets/package.nix
+++ b/pkgs/by-name/ma/mate-panel-with-applets/package.nix
@@ -34,12 +34,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "${mate-panel.pname}-with-applets";
-  inherit (mate-panel) version;
+  inherit (mate-panel) version outputs;
 
   src = null;
 
   paths = [
-    mate-panel
+    mate-panel.out
+    mate-panel.man
   ]
   ++ selectedApplets;
 
@@ -84,13 +85,5 @@ stdenv.mkDerivation {
 
   __structuredAttrs = true;
 
-  meta = {
-    inherit (mate-panel.meta)
-      description
-      homepage
-      license
-      teams
-      platforms
-      ;
-  };
+  inherit (mate-panel) meta;
 }

From 6f04e4e7027cb6ecb7d696cacc31ef785a142021 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Wed, 20 May 2026 09:46:01 -0400
Subject: [PATCH 259/831] rsync: 3.4.1 -> 3.4.3

https://download.samba.org/pub/rsync/NEWS.html#3.4.2
https://download.samba.org/pub/rsync/NEWS.html#3.4.3
---
 .../networking/sync/rsync/default.nix         | 22 ++++----
 .../rsync/fix-tests-in-darwin-sandbox.patch   | 56 -------------------
 2 files changed, 10 insertions(+), 68 deletions(-)
 delete mode 100644 pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch

diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index ab771e3c5057..e6f2fba8748d 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -1,10 +1,10 @@
 {
   lib,
   stdenv,
-  fetchpatch,
   fetchurl,
   updateAutotoolsGnuConfigScriptsHook,
   perl,
+  python3,
   libiconv,
   zlib,
   popt,
@@ -23,23 +23,17 @@
 
 stdenv.mkDerivation rec {
   pname = "rsync";
-  version = "3.4.1";
+  version = "3.4.3";
 
   src = fetchurl {
     # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
     url = "mirror://samba/rsync/src/rsync-${version}.tar.gz";
-    hash = "sha256-KSS8s6Hti1UfwQH3QLnw/gogKxFQJ2R89phQ1l/YjFI=";
+    hash = "sha256-xy5jyjAhy8gLqG7DAQJ3P0xWMfvEkrUudzs5WPgqU9M=";
   };
 
-  patches = [
-    # See: <https://github.com/RsyncProject/rsync/pull/790>
-    ./fix-tests-in-darwin-sandbox.patch
-    # fix compilation with gcc15
-    (fetchpatch {
-      url = "https://github.com/RsyncProject/rsync/commit/a4b926dcdce96b0f2cc0dc7744e95747b233500a.patch";
-      hash = "sha256-UiEQJ+p2gtIDYNJqnxx4qKgItKIZzCpkHnvsgoxBmSE=";
-    })
-  ];
+  preBuild = ''
+    patchShebangs ./runtests.py
+  '';
 
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
@@ -80,6 +74,10 @@ stdenv.mkDerivation rec {
 
   passthru.tests = { inherit (nixosTests) rsyncd; };
 
+  nativeCheckInputs = [
+    python3
+  ];
+
   # Test fails when built in a chroot store
   preCheck = ''
     rm testsuite/chgrp.test
diff --git a/pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch b/pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch
deleted file mode 100644
index d9209a97c1ed..000000000000
--- a/pkgs/applications/networking/sync/rsync/fix-tests-in-darwin-sandbox.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 9b104ed9859f17b6ed4c4ad01806c75a0c197dd7 Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Tue, 5 Aug 2025 15:55:24 +0100
-Subject: [PATCH] Allow `ls(1)` to fail in test setup
-
-This can happen when the tests are unable to `stat(2)` some files in
-`/etc`, `/bin`, or `/`, due to Unix permissions or other sandboxing. We
-still guard against serious errors, which use exit code 2.
----
- testsuite/longdir.test | 4 ++--
- testsuite/rsync.fns    | 8 ++++----
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/testsuite/longdir.test b/testsuite/longdir.test
-index 8d66bb5f..26747292 100644
---- a/testsuite/longdir.test
-+++ b/testsuite/longdir.test
-@@ -16,9 +16,9 @@ makepath "$longdir" || test_skipped "unable to create long directory"
- touch "$longdir/1" || test_skipped "unable to create files in long directory"
- date > "$longdir/1"
- if [ -r /etc ]; then
--    ls -la /etc >"$longdir/2"
-+    ls -la /etc >"$longdir/2" || [ $? -eq 1 ]
- else
--    ls -la / >"$longdir/2"
-+    ls -la / >"$longdir/2" || [ $? -eq 1 ]
- fi
- checkit "$RSYNC --delete -avH '$fromdir/' '$todir'" "$fromdir/" "$todir"
- 
-diff --git a/testsuite/rsync.fns b/testsuite/rsync.fns
-index 2ab97b69..f7da363f 100644
---- a/testsuite/rsync.fns
-+++ b/testsuite/rsync.fns
-@@ -195,15 +195,15 @@ hands_setup() {
-     echo some data > "$fromdir/dir/subdir/foobar.baz"
-     mkdir "$fromdir/dir/subdir/subsubdir"
-     if [ -r /etc ]; then
--	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
-+	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
-     else
--	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
-+	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
-     fi
-     mkdir "$fromdir/dir/subdir/subsubdir2"
-     if [ -r /bin ]; then
--	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
-+	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
-     else
--	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
-+	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
-     fi
- 
- #      echo testing head:
--- 
-2.50.1
-

From 481208bdff2dc2f61d4f4fde51e6bd2a939f7d68 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Wed, 27 May 2026 17:47:18 +0100
Subject: [PATCH 260/831] cc-wrapper, gcc, gnat, gnat-bootstrap: fix GCC 13 and
 GNAT 13/14/15 builds on darwin

---
 pkgs/build-support/cc-wrapper/default.nix     |   8 +-
 .../compilers/gcc/common/configure-flags.nix  |  19 +-
 .../compilers/gcc/common/dependencies.nix     |   3 +-
 pkgs/development/compilers/gcc/default.nix    |  14 +-
 .../13/gnat13-aarch64-darwin-trampoline.patch | 202 ++++++++++++++++++
 .../compilers/gcc/patches/default.nix         |  24 ++-
 .../gnat-darwin-dylib-install-name-13.patch   |  18 --
 .../compilers/gnat-bootstrap/default.nix      |  19 +-
 pkgs/top-level/all-packages.nix               |  37 ++--
 9 files changed, 278 insertions(+), 66 deletions(-)
 create mode 100644 pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
 delete mode 100644 pkgs/development/compilers/gcc/patches/gnat-darwin-dylib-install-name-13.patch

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index 3c30f5cd308e..d14dea8b7f60 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -27,6 +27,7 @@
   isGNU ? false,
   isClang ? cc.isClang or false,
   isFlang ? cc.isFlang or false,
+  isAlireGNAT ? false,
   isZig ? cc.isZig or false,
   isArocc ? cc.isArocc or false,
   isCcache ? cc.isCcache or false,
@@ -721,7 +722,7 @@ stdenvNoCC.mkDerivation {
         touch "$out/nix-support/libc-cflags"
         touch "$out/nix-support/libc-ldflags"
       ''
-      + optionalString (!isArocc) ''
+      + optionalString (!isArocc && !(isAlireGNAT && targetPlatform.isDarwin)) ''
         echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
       ''
       + ''
@@ -796,7 +797,9 @@ stdenvNoCC.mkDerivation {
     # ${cc_solib}/lib64 (even though it does actually search there...)..
     # This confuses libtool.  So add it to the compiler tool search
     # path explicitly.
-    + optionalString (!nativeTools && !isArocc) ''
+    # Injecting CFlags and LDFlags causes duplicate rpath at linking
+    # stage for Alire GNAT. Skip adding flags here.
+    + optionalString (!nativeTools && !isArocc && !isAlireGNAT) ''
       ccLDFlags=()
       ccCFlags=()
       if [ -e "${cc_solib}/lib64" -a ! -L "${cc_solib}/lib64" ]; then
@@ -811,7 +814,6 @@ stdenvNoCC.mkDerivation {
       touch "$out/nix-support/gnat-cflags"
       touch "$out/nix-support/gnat-ldflags"
       basePath=$(echo $cc/lib/*/*/*)
-      ccCFlags+=("-B$basePath" "-I$basePath/adainclude")
       gnatCFlags="-I$basePath/adainclude -I$basePath/adalib"
 
       echo "$gnatCFlags" >> $out/nix-support/gnat-cflags
diff --git a/pkgs/development/compilers/gcc/common/configure-flags.nix b/pkgs/development/compilers/gcc/common/configure-flags.nix
index 66099c229743..d7b9344574f1 100644
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -8,7 +8,9 @@
   threadsCross,
   version,
 
-  apple-sdk,
+  is13,
+  apple-sdk_14,
+  apple-sdk_15,
   binutils,
   gmp,
   mpfr,
@@ -53,6 +55,8 @@ let
     targetPlatform
     ;
 
+  appleSdk = if langAda && !is13 then apple-sdk_15 else apple-sdk_14;
+
   # See https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903
   disableBootstrap' = disableBootstrap && !langFortran && !langGo;
 
@@ -159,12 +163,11 @@ let
       # gcc builds for cross-compilers (build != host) or cross-built
       # gcc (host != target) always apply the offset prefix to disentangle
       # target headers from build or host headers:
-      #     ${with_build_sysroot}${native_system_header_dir}
-      #  or ${test_exec_prefix}/${target_noncanonical}/sys-include
-      #  or ${with_sysroot}${native_system_header_dir}
+      #        ${with_sysroot}${native_system_header_dir}
+      #    and ${with_build_sysroot}${native_system_header_dir}
       # While native build (build == host == target) uses passed headers
       # path as is:
-      #    ${with_build_sysroot}${native_system_header_dir}
+      #    ${with_sysroot}${native_system_header_dir}
       #
       # Nixpkgs uses flat directory structure for both native and cross
       # cases. As a result libc headers don't get found for cross case
@@ -175,10 +178,14 @@ let
       # We pick "/" path to effectively avoid sysroot offset and make it work
       # as a native case.
       # Darwin requires using the SDK as the sysroot for `SDKROOT` to work correctly.
-      "--with-build-sysroot=${if targetPlatform.isDarwin then apple-sdk.sdkroot else "/"}"
+      "--with-build-sysroot=${if targetPlatform.isDarwin then appleSdk.sdkroot else "/"}"
       # Same with the stdlibc++ headers embedded in the gcc output
       "--with-gxx-include-dir=${placeholder "out"}/include/c++/${version}/"
     ]
+    ++ lib.optionals (!withoutTargetLibc && targetPlatform.isDarwin && !crossDarwin) [
+      # Building on Darwin often requires --with-sysroot.
+      "--with-sysroot=${appleSdk.sdkroot}"
+    ]
 
     # Basic configuration
     ++ [
diff --git a/pkgs/development/compilers/gcc/common/dependencies.nix b/pkgs/development/compilers/gcc/common/dependencies.nix
index 9d8feadde99e..105fac5fe094 100644
--- a/pkgs/development/compilers/gcc/common/dependencies.nix
+++ b/pkgs/development/compilers/gcc/common/dependencies.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   version,
+  is13,
   buildPackages,
   targetPackages,
   texinfo,
@@ -43,9 +44,9 @@ in
   nativeBuildInputs = [
     texinfo
     which
-    gettext
     autoconf269
   ]
+  ++ optionals (!is13) [ gettext ]
   ++ optionals (perl != null) [ perl ]
   ++ optionals (with stdenv.targetPlatform; isVc4 || isRedox || isSnapshot && flex != null) [ flex ]
   ++ optionals langAda [ gnat-bootstrap ]
diff --git a/pkgs/development/compilers/gcc/default.nix b/pkgs/development/compilers/gcc/default.nix
index 615cd2b3b19a..3012bccba8d7 100644
--- a/pkgs/development/compilers/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/default.nix
@@ -58,7 +58,8 @@
   nukeReferences,
   callPackage,
   majorMinorVersion,
-  apple-sdk,
+  apple-sdk_14,
+  apple-sdk_15,
   darwin,
 }:
 
@@ -84,6 +85,8 @@ let
   majorVersion = versions.major version;
   is13 = majorVersion == "13";
 
+  appleSdk = if langAda && !is13 then apple-sdk_15 else apple-sdk_14;
+
   # releases have a form: MAJOR.MINOR.MICRO, like 14.2.1
   # snapshots have a form like MAJOR.MINOR.MICRO.DATE, like 14.2.1.20250322
   isSnapshot = lib.length (lib.splitVersion version) == 4;
@@ -127,7 +130,8 @@ let
       ;
     # inherit generated with 'nix eval --json --impure --expr "with import ./. {}; lib.attrNames (lib.functionArgs gcc${majorVersion}.cc.override)" | jq '.[]' --raw-output'
     inherit
-      apple-sdk
+      apple-sdk_14
+      apple-sdk_15
       autoconf269
       binutils
       buildPackages
@@ -149,6 +153,7 @@ let
       gnat-bootstrap
       gnused
       isl
+      is13
       langAda
       langC
       langCC
@@ -375,6 +380,11 @@ pipe
 
         NIX_LDFLAGS = optionalString hostPlatform.isSunOS "-lm";
 
+        # Override isysroot for GNAT on Darwin due to SDK version sensitivity; GNAT 14+ requires Apple SDK 15 or later.
+        NIX_CFLAGS_COMPILE = optionalString (
+          hostPlatform.isDarwin && langAda
+        ) "-isysroot ${appleSdk.sdkroot}";
+
         inherit (callFile ./common/extra-target-flags.nix { })
           EXTRA_FLAGS_FOR_TARGET
           EXTRA_LDFLAGS_FOR_TARGET
diff --git a/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch b/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
new file mode 100644
index 000000000000..2065a90d136a
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/13/gnat13-aarch64-darwin-trampoline.patch
@@ -0,0 +1,202 @@
+From a41f0707bdcc9fb6dab39eb8ce7e392138d16dc0 Mon Sep 17 00:00:00 2001
+From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
+Date: Wed, 27 May 2026 18:25:14 +0100
+Subject: [PATCH] Allow GNAT 13 bootstrap on aarch64-darwin with nested
+ trampoline symbol mismatch
+
+This patch renames nested function trampoline helper symbols from the
+__gcc_* namespace to __builtin_* across GCC and libgcc in order to allow
+GNAT 13 to build on aarch64-darwin under bootstrap constraints where the
+prebuilt stage1 compiler does not provide the newer symbol set.
+
+The change updates builtin definitions, Darwin export lists,
+documentation,
+and libgcc implementations of the heap trampoline hooks used by
+-ftrampoline-impl=heap.
+
+This is a bootstrap compatibility workaround to bridge the ABI mismatch
+between the Alire/GNAT-FSF-build GNAT 13.2.0-2 compiler and the
+IainS/gcc-13-branch 13.4-darwin-r0 source tree.
+---
+ gcc/builtins.def                        | 4 ++--
+ gcc/config/darwin.h                     | 8 ++++----
+ gcc/doc/invoke.texi                     | 4 ++--
+ gcc/tree.cc                             | 8 ++++----
+ libgcc/config/aarch64/heap-trampoline.c | 8 ++++----
+ libgcc/config/i386/heap-trampoline.c    | 8 ++++----
+ libgcc/libgcc-std.ver.in                | 4 ++--
+ libgcc/libgcc2.h                        | 4 ++--
+ 8 files changed, 24 insertions(+), 24 deletions(-)
+
+diff --git a/gcc/builtins.def b/gcc/builtins.def
+index 448cf837ec8..5bf4769ae47 100644
+--- a/gcc/builtins.def
++++ b/gcc/builtins.def
+@@ -1067,8 +1067,8 @@ DEF_BUILTIN_STUB (BUILT_IN_ADJUST_TRAMPOLINE, "__builtin_adjust_trampoline")
+ DEF_BUILTIN_STUB (BUILT_IN_INIT_DESCRIPTOR, "__builtin_init_descriptor")
+ DEF_BUILTIN_STUB (BUILT_IN_ADJUST_DESCRIPTOR, "__builtin_adjust_descriptor")
+ DEF_BUILTIN_STUB (BUILT_IN_NONLOCAL_GOTO, "__builtin_nonlocal_goto")
+-DEF_EXT_LIB_BUILTIN (BUILT_IN_GCC_NESTED_PTR_CREATED, "__gcc_nested_func_ptr_created", BT_FN_VOID_PTR_PTR_PTR, ATTR_NOTHROW_LIST)
+-DEF_EXT_LIB_BUILTIN (BUILT_IN_GCC_NESTED_PTR_DELETED, "__gcc_nested_func_ptr_deleted", BT_FN_VOID, ATTR_NOTHROW_LIST)
++DEF_EXT_LIB_BUILTIN (BUILT_IN_GCC_NESTED_PTR_CREATED, "__builtin_nested_func_ptr_created", BT_FN_VOID_PTR_PTR_PTR, ATTR_NOTHROW_LIST)
++DEF_EXT_LIB_BUILTIN (BUILT_IN_GCC_NESTED_PTR_DELETED, "__builtin_nested_func_ptr_deleted", BT_FN_VOID, ATTR_NOTHROW_LIST)
+ 
+ /* Implementing __builtin_setjmp.  */
+ DEF_BUILTIN_STUB (BUILT_IN_SETJMP_SETUP, "__builtin_setjmp_setup")
+diff --git a/gcc/config/darwin.h b/gcc/config/darwin.h
+index 0cc6f021365..47bca6f1db1 100644
+--- a/gcc/config/darwin.h
++++ b/gcc/config/darwin.h
+@@ -433,10 +433,10 @@ extern GTY(()) int darwin_ms_struct;
+ 	   ___emutls_get_address -exported_symbol ___emutls_get_address \
+ 	  -U ___emutls_register_common \
+ 	  -exported_symbol ___emutls_register_common \
+-	  -U ___gcc_nested_func_ptr_created \
+-	  -exported_symbol ___gcc_nested_func_ptr_created \
+-	  -U ___gcc_nested_func_ptr_deleted \
+-	  -exported_symbol ___gcc_nested_func_ptr_deleted \
++	  -U ___builtin_nested_func_ptr_created \
++	  -exported_symbol ___builtin_nested_func_ptr_created \
++	  -U ___builtin_nested_func_ptr_deleted \
++	  -exported_symbol ___builtin_nested_func_ptr_deleted \
+       }} \
+     }}}\
+     %{!r:%{!nostdlib:%{!nostartfiles:%E}}} %{T*} %{F*} "\
+diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
+index 8f82ba0ecfa..4d5bba42fcd 100644
+--- a/gcc/doc/invoke.texi
++++ b/gcc/doc/invoke.texi
+@@ -18718,8 +18718,8 @@ for nested functions.
+ By default, trampolines are generated on stack.  However, certain platforms
+ (such as the Apple M1) do not permit an executable stack.  Compiling with
+ @option{-ftrampoline-impl=heap} generate calls to
+-@code{__gcc_nested_func_ptr_created} and
+-@code{__gcc_nested_func_ptr_deleted} in order to allocate and
++@code{__builtin_nested_func_ptr_created} and
++@code{__builtin_nested_func_ptr_deleted} in order to allocate and
+ deallocate trampoline space on the executable heap.  These functions are
+ implemented in libgcc, and will only be provided on specific targets:
+ x86_64 Darwin, x86_64 and aarch64 Linux.  @emph{PLEASE NOTE}: Heap
+diff --git a/gcc/tree.cc b/gcc/tree.cc
+index 032b87ee1c8..54abc791c88 100644
+--- a/gcc/tree.cc
++++ b/gcc/tree.cc
+@@ -9874,17 +9874,17 @@ build_common_builtin_nodes (void)
+ 					ptr_type_node, // void *func
+ 					ptr_ptr_type_node, // void **dst
+ 					NULL_TREE);
+-      local_define_builtin ("__builtin___gcc_nested_func_ptr_created", ftype,
++      local_define_builtin ("__builtin___builtin_nested_func_ptr_created", ftype,
+ 			    BUILT_IN_GCC_NESTED_PTR_CREATED,
+-			    "__gcc_nested_func_ptr_created", ECF_NOTHROW);
++			    "__builtin_nested_func_ptr_created", ECF_NOTHROW);
+     }
+ 
+   if (!builtin_decl_explicit_p (BUILT_IN_GCC_NESTED_PTR_DELETED))
+     {
+       ftype = build_function_type_list (void_type_node, NULL_TREE);
+-      local_define_builtin ("__builtin___gcc_nested_func_ptr_deleted", ftype,
++      local_define_builtin ("__builtin___builtin_nested_func_ptr_deleted", ftype,
+ 			    BUILT_IN_GCC_NESTED_PTR_DELETED,
+-			    "__gcc_nested_func_ptr_deleted", ECF_NOTHROW);
++			    "__builtin_nested_func_ptr_deleted", ECF_NOTHROW);
+     }
+ 
+   ftype = build_function_type_list (void_type_node,
+diff --git a/libgcc/config/aarch64/heap-trampoline.c b/libgcc/config/aarch64/heap-trampoline.c
+index b2c69aa5892..2e47cf56dc6 100644
+--- a/libgcc/config/aarch64/heap-trampoline.c
++++ b/libgcc/config/aarch64/heap-trampoline.c
+@@ -26,8 +26,8 @@ int get_trampolines_per_page (void);
+ struct tramp_ctrl_data *allocate_tramp_ctrl (struct tramp_ctrl_data *parent);
+ void *allocate_trampoline_page (void);
+ 
+-void __gcc_nested_func_ptr_created (void *chain, void *func, void **dst);
+-void __gcc_nested_func_ptr_deleted (void);
++void __builtin_nested_func_ptr_created (void *chain, void *func, void **dst);
++void __builtin_nested_func_ptr_deleted (void);
+ 
+ #if defined(__linux__)
+ static const unsigned char aarch64_trampoline_insns[6][4] = {
+@@ -115,7 +115,7 @@ allocate_tramp_ctrl (struct tramp_ctrl_data *parent)
+ 
+ HEAP_T_ATTR
+ void
+-__gcc_nested_func_ptr_created (void *chain, void *func, void **dst)
++__builtin_nested_func_ptr_created (void *chain, void *func, void **dst)
+ {
+   if (tramp_ctrl_curr == NULL)
+     {
+@@ -163,7 +163,7 @@ __gcc_nested_func_ptr_created (void *chain, void *func, void **dst)
+ 
+ HEAP_T_ATTR
+ void
+-__gcc_nested_func_ptr_deleted (void)
++__builtin_nested_func_ptr_deleted (void)
+ {
+   if (tramp_ctrl_curr == NULL)
+     abort ();
+diff --git a/libgcc/config/i386/heap-trampoline.c b/libgcc/config/i386/heap-trampoline.c
+index 2e8df1cfbd2..34aace2b5a6 100644
+--- a/libgcc/config/i386/heap-trampoline.c
++++ b/libgcc/config/i386/heap-trampoline.c
+@@ -26,8 +26,8 @@ int get_trampolines_per_page (void);
+ struct tramp_ctrl_data *allocate_tramp_ctrl (struct tramp_ctrl_data *parent);
+ void *allocate_trampoline_page (void);
+ 
+-void __gcc_nested_func_ptr_created (void *chain, void *func, void **dst);
+-void __gcc_nested_func_ptr_deleted (void);
++void __builtin_nested_func_ptr_created (void *chain, void *func, void **dst);
++void __builtin_nested_func_ptr_deleted (void);
+ 
+ #if __x86_64__
+ 
+@@ -179,7 +179,7 @@ allocate_tramp_ctrl (struct tramp_ctrl_data *parent)
+ 
+ HEAP_T_ATTR
+ void
+-__gcc_nested_func_ptr_created (void *chain, void *func, void **dst)
++__builtin_nested_func_ptr_created (void *chain, void *func, void **dst)
+ {
+   if (tramp_ctrl_curr == NULL)
+     {
+@@ -233,7 +233,7 @@ __gcc_nested_func_ptr_created (void *chain, void *func, void **dst)
+ 
+ HEAP_T_ATTR
+ void
+-__gcc_nested_func_ptr_deleted (void)
++__builtin_nested_func_ptr_deleted (void)
+ {
+   if (tramp_ctrl_curr == NULL)
+     abort ();
+diff --git a/libgcc/libgcc-std.ver.in b/libgcc/libgcc-std.ver.in
+index ad854bf0ded..acc4e6cfab8 100644
+--- a/libgcc/libgcc-std.ver.in
++++ b/libgcc/libgcc-std.ver.in
+@@ -1947,6 +1947,6 @@ GCC_7.0.0 {
+ 
+ %inherit GCC_14.0.0 GCC_7.0.0
+ GCC_14.0.0 {
+-  __gcc_nested_func_ptr_created
+-  __gcc_nested_func_ptr_deleted
++  __builtin_nested_func_ptr_created
++  __builtin_nested_func_ptr_deleted
+ }
+diff --git a/libgcc/libgcc2.h b/libgcc/libgcc2.h
+index a7a5dff0184..ac7eaab4f01 100644
+--- a/libgcc/libgcc2.h
++++ b/libgcc/libgcc2.h
+@@ -29,8 +29,8 @@ see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
+ #pragma GCC visibility push(default)
+ #endif
+ 
+-extern void __gcc_nested_func_ptr_created (void *, void *, void **);
+-extern void __gcc_nested_func_ptr_deleted (void);
++extern void __builtin_nested_func_ptr_created (void *, void *, void **);
++extern void __builtin_nested_func_ptr_deleted (void);
+ 
+ extern int __gcc_bcmp (const unsigned char *, const unsigned char *, size_t);
+ extern void __clear_cache (void *, void *);
+-- 
+2.50.1 (Apple Git-155)
+
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 5be64c16ce84..048cfee9ffde 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  is13,
   langC,
   langAda,
   langObjC,
@@ -139,16 +140,6 @@ optionals noSysDirs (
   atLeast14 && stdenv.hostPlatform.isDarwin && langAda
 ) ../patches/14/gcc-darwin-remove-coreservices.patch
 
-# Use absolute path in GNAT dylib install names on Darwin
-++ optionals (stdenv.hostPlatform.isDarwin && langAda) (
-  {
-    "15" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
-    "14" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
-    "13" = [ ./gnat-darwin-dylib-install-name-13.patch ];
-  }
-  .${majorVersion} or [ ]
-)
-
 # Here we apply patches by Iains (https://github.com/iains)
 # GitHub's "compare" API produces unstable diffs, so we resort to reusing
 # diffs from the Homebrew repo.
@@ -185,6 +176,19 @@ optionals noSysDirs (
   .${majorVersion} or [ ]
 )
 
+# Use absolute path in GNAT dylib install names on Darwin
+++ optionals (stdenv.hostPlatform.isDarwin && langAda) (
+  {
+    "15" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
+    "14" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
+    # After the Iains patch, GCC 13 and 14 share the same patch.
+    "13" = [ ../patches/14/gnat-darwin-dylib-install-name-14.patch ];
+  }
+  .${majorVersion} or [ ]
+)
+
+++ optional (langAda && is13) ./13/gnat13-aarch64-darwin-trampoline.patch
+
 ++ optional (targetPlatform.isWindows || targetPlatform.isCygwin) (fetchpatch {
   name = "libstdc-fix-compilation-in-freestanding-win32.patch";
   url = "https://inbox.sourceware.org/gcc-patches/20250922182808.2599390-2-corngood@gmail.com/raw";
diff --git a/pkgs/development/compilers/gcc/patches/gnat-darwin-dylib-install-name-13.patch b/pkgs/development/compilers/gcc/patches/gnat-darwin-dylib-install-name-13.patch
deleted file mode 100644
index 19c405d1226d..000000000000
--- a/pkgs/development/compilers/gcc/patches/gnat-darwin-dylib-install-name-13.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- a/gcc/ada/gcc-interface/Makefile.in
-+++ b/gcc/ada/gcc-interface/Makefile.in
-@@ -788,13 +788,13 @@ gnatlib-shared-darwin:
- 		-o libgnat$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		$(GNATRTL_NONTASKING_OBJS) $(LIBGNAT_OBJS) \
- 		$(SO_OPTS) \
--		-Wl,-install_name,@rpath/libgnat$(hyphen)$(LIBRARY_VERSION)$(soext) \
-+		-Wl,-install_name,$(ADA_RTL_DSO_DIR)/libgnat$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		$(MISCLIB)
- 	cd $(RTSDIR); $(GCC_FOR_ADA_RTS) -dynamiclib $(PICFLAG_FOR_TARGET) \
- 		-o libgnarl$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		$(GNATRTL_TASKING_OBJS) \
- 		$(SO_OPTS) \
--		-Wl,-install_name,@rpath/libgnarl$(hyphen)$(LIBRARY_VERSION)$(soext) \
-+		-Wl,-install_name,$(ADA_RTL_DSO_DIR)/libgnarl$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		$(THREADSLIB) -Wl,libgnat$(hyphen)$(LIBRARY_VERSION)$(soext)
- 	cd $(RTSDIR); $(LN_S) libgnat$(hyphen)$(LIBRARY_VERSION)$(soext) \
- 		libgnat$(soext)
diff --git a/pkgs/development/compilers/gnat-bootstrap/default.nix b/pkgs/development/compilers/gnat-bootstrap/default.nix
index ef7ed876e583..fad7f427fbe6 100644
--- a/pkgs/development/compilers/gnat-bootstrap/default.nix
+++ b/pkgs/development/compilers/gnat-bootstrap/default.nix
@@ -65,6 +65,11 @@ stdenv.mkDerivation (
             hash = "sha256-DC95udGSzRDE22ON4UpekxTYWOSBeUdJvILbSFj6MFQ=";
             upstreamTriplet = "x86_64-pc-linux-gnu";
           };
+          aarch64-darwin = {
+            inherit url;
+            hash = "sha256-Bjl6iuM2xLknezR92j/kpDYpxqTcxK1v8rffmivOAVw=";
+            upstreamTriplet = "aarch64-apple-darwin23.2.0";
+          };
         }
         .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
         "14" = {
@@ -87,6 +92,11 @@ stdenv.mkDerivation (
             hash = "sha256-SVW/0yyj6ZH1GAjvD+unII+zSLGd3KGFt1bjjQ3SEFU=";
             upstreamTriplet = "aarch64-linux-gnu";
           };
+          aarch64-darwin = {
+            inherit url;
+            hash = "sha256-/nARwdQzAMd41fslUbrgloxn0hVZp9PokfQ9yPmL1g8=";
+            upstreamTriplet = "aarch64-apple-darwin23.6.0";
+          };
         }
         .${stdenv.hostPlatform.system} or throwUnsupportedSystem;
       };
@@ -194,7 +204,7 @@ stdenv.mkDerivation (
     # [2]: https://gcc.gnu.org/onlinedocs/gcc-12.2.0/gcc/Fixed-Headers.html
 
     + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
-      upstreamBuildPrefix="/Users/runner/work/GNAT-FSF-builds/GNAT-FSF-builds/sbx/x86_64-darwin/gcc/install"
+      upstreamBuildPrefix="/Users/runner/work/GNAT-FSF-builds/GNAT-FSF-builds/sbx/${stdenv.hostPlatform.system}/gcc/install"
       for i in "$out"/lib/*.dylib "$out"/lib/gcc/*/*/adalib/*.dylib; do
         if [[ -f "$i" && ! -h "$i" ]]; then
           install_name_tool -id "$i" "$i" || true
@@ -236,7 +246,12 @@ stdenv.mkDerivation (
         "x86_64-linux"
         "x86_64-darwin"
       ]
-      ++ lib.optionals (lib.versionAtLeast majorVersion "14") [ "aarch64-linux" ];
+      ++ lib.optionals (lib.versionAtLeast majorVersion "13") [
+        "aarch64-darwin"
+      ]
+      ++ lib.optionals (lib.versionAtLeast majorVersion "14") [
+        "aarch64-linux"
+      ];
       sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     };
   }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ece4f96a5030..f43606b32c14 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3849,9 +3849,8 @@ with pkgs;
           stdenv.hostPlatform == stdenv.targetPlatform
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
-          && stdenv.buildPlatform.isx86_64
         then
-          overrideCC stdenv gnat-bootstrap13
+          overrideCC gccStdenv gnat-bootstrap13
         else
           stdenv;
     }
@@ -3877,9 +3876,8 @@ with pkgs;
           stdenv.hostPlatform == stdenv.targetPlatform
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
-          && stdenv.buildPlatform.isx86_64
         then
-          overrideCC stdenv gnat-bootstrap14
+          overrideCC gccStdenv gnat-bootstrap14
         else
           stdenv;
     }
@@ -3905,9 +3903,8 @@ with pkgs;
           stdenv.hostPlatform == stdenv.targetPlatform
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
-          && stdenv.buildPlatform.isx86_64
         then
-          overrideCC stdenv gnat-bootstrap14
+          overrideCC gccStdenv gnat-bootstrap14
         else
           stdenv;
     }
@@ -3933,31 +3930,23 @@ with pkgs;
           stdenv.hostPlatform == stdenv.targetPlatform
           && stdenv.buildPlatform == stdenv.hostPlatform
           && stdenv.buildPlatform.isDarwin
-          && stdenv.buildPlatform.isx86_64
         then
-          overrideCC stdenv gnat-bootstrap14
+          overrideCC gccStdenv gnat-bootstrap14
         else
           stdenv;
     }
   );
 
   gnat-bootstrap = gnat-bootstrap13;
-  gnat-bootstrap13 = wrapCCWith (
-    {
-      cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "13"; };
-    }
-    // lib.optionalAttrs (stdenv.hostPlatform.isDarwin) {
-      bintools = bintoolsDualAs;
-    }
-  );
-  gnat-bootstrap14 = wrapCCWith (
-    {
-      cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "14"; };
-    }
-    // lib.optionalAttrs (stdenv.hostPlatform.isDarwin) {
-      bintools = bintoolsDualAs;
-    }
-  );
+  gnat-bootstrap13 = wrapCCWith {
+    cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "13"; };
+    isAlireGNAT = true;
+  };
+
+  gnat-bootstrap14 = wrapCCWith {
+    cc = callPackage ../development/compilers/gnat-bootstrap { majorVersion = "14"; };
+    isAlireGNAT = true;
+  };
 
   gnat13Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat13; });
   gnat14Packages = recurseIntoAttrs (callPackage ./ada-packages.nix { gnat = buildPackages.gnat14; });

From 3df63464830fe406d9bdc3fdb209df94c164c370 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 28 May 2026 01:00:26 +0200
Subject: [PATCH 261/831] 
 python314Packages.opentelemetry-semantic-conventions-ai: run the test

There is only 1.
---
 .../opentelemetry-semantic-conventions-ai/default.nix        | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
index 14c16f870d03..b282e160d6ea 100644
--- a/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
+++ b/pkgs/development/python-modules/opentelemetry-semantic-conventions-ai/default.nix
@@ -5,6 +5,7 @@
   hatchling,
   opentelemetry-sdk,
   opentelemetry-semantic-conventions,
+  pytestCheckHook,
 }:
 let
   version = "0.4.15";
@@ -27,6 +28,10 @@ buildPythonPackage {
     opentelemetry-semantic-conventions
   ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
   pythonImportsCheck = [ "opentelemetry.semconv_ai" ];
 
   meta = {

From fea17e2a81c81a3a8141d23f4dc306d246db9487 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 May 2026 23:51:26 +0000
Subject: [PATCH 262/831] vim: 9.2.0389 -> 9.2.0541

---
 pkgs/applications/editors/vim/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
index 05ac73b9f13e..71848004202f 100644
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0389";
+  version = "9.2.0541";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-shhdJn1bPJ/68a54UZMn1fla7P4tjVUN4DGLbx3ohOg=";
+    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
   };
 
   enableParallelBuilding = true;

From 6787f46af71ab63b31f0d87110275c9a2d890ffd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 28 May 2026 09:15:22 +0000
Subject: [PATCH 263/831] libsodium: 1.0.22-unstable-2026-04-09 ->
 1.0.22-unstable-2026-04-16

---
 pkgs/by-name/li/libsodium/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libsodium/package.nix b/pkgs/by-name/li/libsodium/package.nix
index 7046a0a7d80d..3fc91abaf0ca 100644
--- a/pkgs/by-name/li/libsodium/package.nix
+++ b/pkgs/by-name/li/libsodium/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-04-09";
+  version = "1.0.22-unstable-2026-04-16";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "77e1ce5d6dee871c49ef211222ba18ef0c486bda";
-    hash = "sha256-k8u7iNqvjLA0PptbneDyE8zCtutJlV2LirrRb41tmBY=";
+    rev = "33cc75ab1565d9dcbe808354191bd572ad6b64d0";
+    hash = "sha256-8kS9FBoaFaJOjH7XZc8IG3GaQaUiYD/awQOhs7j0n1Y=";
   };
 
   outputs = [

From 20c65e561681133532832ed922e5906493dcc06b Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 28 May 2026 20:53:34 +0900
Subject: [PATCH 264/831] python3Packages.certbot-nginx: fix build with certbot
 5.6.0

---
 .../python-modules/certbot-nginx/default.nix          | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/certbot-nginx/default.nix b/pkgs/development/python-modules/certbot-nginx/default.nix
index e832f5e7ac09..ebe6f87ef6e3 100644
--- a/pkgs/development/python-modules/certbot-nginx/default.nix
+++ b/pkgs/development/python-modules/certbot-nginx/default.nix
@@ -1,9 +1,7 @@
 {
   buildPythonPackage,
-  acme,
   certbot,
   pyparsing,
-  pytestCheckHook,
   setuptools,
 }:
 
@@ -18,16 +16,13 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   dependencies = [
-    acme
     certbot
     pyparsing
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  pytestFlags = [
-    "-pno:cacheprovider"
-    "-Wignore::DeprecationWarning"
+  pythonImportsCheck = [
+    "certbot_nginx"
+    "certbot.plugins.nginx"
   ];
 
   meta = certbot.meta // {

From fd4f3737156ff8f2aa524f07771581c3b29ca103 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Fri, 22 May 2026 01:28:43 +0200
Subject: [PATCH 265/831] libheif: 1.21.2 -> 1.22.2

---
 pkgs/by-name/li/libheif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 7d4912e77598..a24d7986b884 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
-  version = "1.21.2";
+  version = "1.22.2";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-odkJ0wZSGoZ7mX9fkaNREDpMvQuQA9HKaf3so1dYrbc=";
+    hash = "sha256-z5vTfZATfwDn8Zwqt3piS7PaOQQ3UG+u20sR6j+dsUg=";
   };
 
   nativeBuildInputs = [

From 117c2f76a71c2185e4430cbe83f86d92ebf7eb8e Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 26 May 2026 13:37:33 -0400
Subject: [PATCH 266/831] rust: 1.95.0 -> 1.96.0

blog: https://blog.rust-lang.org/releases/1.96.0
changelog: https://github.com/rust-lang/rust/releases/tag/1.96.0
diff: https://github.com/rust-lang/rust/compare/1.95.0...1.96.0

Fixes: CVE-2026-5222, https://blog.rust-lang.org/2026/05/25/cve-2026-5222/
Fixes: CVE-2026-5223, https://blog.rust-lang.org/2026/05/25/cve-2026-5223/
---
 .../compilers/rust/{1_95.nix => 1_96.nix}     | 42 +++++++++----------
 pkgs/top-level/all-packages.nix               |  8 ++--
 2 files changed, 25 insertions(+), 25 deletions(-)
 rename pkgs/development/compilers/rust/{1_95.nix => 1_96.nix} (56%)

diff --git a/pkgs/development/compilers/rust/1_95.nix b/pkgs/development/compilers/rust/1_96.nix
similarity index 56%
rename from pkgs/development/compilers/rust/1_95.nix
rename to pkgs/development/compilers/rust/1_96.nix
index 0c69095341b4..26d58ab8474a 100644
--- a/pkgs/development/compilers/rust/1_95.nix
+++ b/pkgs/development/compilers/rust/1_96.nix
@@ -50,8 +50,8 @@ let
 in
 import ./default.nix
   {
-    rustcVersion = "1.95.0";
-    rustcSha256 = "sha256-6puCqD5GlnU3w1ac6db6FoEcBDqW5lE3bDSecCQcpRU=";
+    rustcVersion = "1.96.0";
+    rustcSha256 = "sha256-6QqesVOylIr6yEDb6dd7ZON2cG8oZDh+53F/dFAEO0Q=";
 
     llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
     llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -65,30 +65,30 @@ import ./default.nix
     # Note: the version MUST be the same version that we are building. Upstream
     # ensures that each released compiler can compile itself:
     # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.95.0";
+    bootstrapVersion = "1.96.0";
 
     # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
     bootstrapHashes = {
-      i686-unknown-linux-gnu = "3ef2320bdfa9b69b19c6ca42f950b6bfb9d2af3b925b0c43a6bfecc4d355a66e";
-      x86_64-unknown-linux-gnu = "a47ac940abd12399d59ad15c877e7113fa35f2b9ec7e6a8a045d4fd8b9741dea";
-      x86_64-unknown-linux-musl = "059086762ac6f4ebe15b5b10e629e4e33e96b372765e65741251f75c4fdfb4e0";
-      arm-unknown-linux-gnueabihf = "7d742098e8bb0d10415775634eed83240ae88c1bae6bc73b470ccf0be4629b4c";
-      armv7-unknown-linux-gnueabihf = "23a201e72c082c285e957a32b40e1c30805b15d344b84b984be3659e9aefadf6";
-      aarch64-unknown-linux-gnu = "3b9385d3144ac57616befa0ccbac524f857ba1b4ab074226e73a24d43568a98e";
-      aarch64-unknown-linux-musl = "ad35bcc6928ccb4fd8a12fe19ce88c8fb6e6e3690578a0cb4e0839008017484f";
-      x86_64-apple-darwin = "3f3d9f29f8eb7aa821bd8531cb9b1c3c74c3976aa558dfabfcc15c2febb3cfb8";
-      aarch64-apple-darwin = "ec23ad2e0e15a7397d2c3c232356149cc871b7df7f47e25c2acb1070157f5398";
-      powerpc64-unknown-linux-gnu = "6d89e3739cfb7b3a05880734513361d5860492385217dcd166d033f3e974e823";
-      powerpc64le-unknown-linux-gnu = "29e3430f38406c926ee24ff911357dba0c46ff1d3ea59e91625b03677bd51b30";
-      powerpc64le-unknown-linux-musl = "b8856b651d64f4f4a2e2ee009366d99ea6135bdf88d15cf2134fc9e166745030";
-      riscv64gc-unknown-linux-gnu = "8b527cb1a09f53f83aa3420b4e763c9ea64a54d89e6d7242da35c8aeaa325593";
-      s390x-unknown-linux-gnu = "e9598bdd3bc1438d965208ef5186f0dd671826cddd4bcbb20e22a3cec14c111d";
-      loongarch64-unknown-linux-gnu = "18038ce7a910930c6742cc76e06fdd4b21b879466a3e67d63a0b6cae955bb4dc";
-      loongarch64-unknown-linux-musl = "eef910858c7e833b13c9cb32e79e59d89434999bc2a7d0b6447ab4046eb40461";
-      x86_64-unknown-freebsd = "0ffb7aa1999ea12363bbfaea500e152565bb4918ad5a73e9713be40510d75e49";
+      i686-unknown-linux-gnu = "1547d452083642c33118cc7fce1697d702ff94fdb4875bf5448fe5b1a6300bbd";
+      x86_64-unknown-linux-gnu = "c1130e4f7976f230766ab062b105b1fb050d6a78177db2246a5878fd6a589680";
+      x86_64-unknown-linux-musl = "545aff63f37dea2fcbd8037b877219fca6fbba97660bdcb8d3a0fc5df5fa9edf";
+      arm-unknown-linux-gnueabihf = "31758cb4175a0b7d2868d149c711ebfbe7b780a9cba5d2f84dce58ddf5a283e4";
+      armv7-unknown-linux-gnueabihf = "737d8ab2ace6107e4a3af4189b0e18f805adcafcc00195d5a377fe33e36577ce";
+      aarch64-unknown-linux-gnu = "20d5ebe3916fe489891fc577574e47fc679cdf62080c1bb1be6b6905ff4e275b";
+      aarch64-unknown-linux-musl = "f55a1f02736d9bcd38969a30f2e6bde8184fd36f13e94f773cac068a56407f16";
+      x86_64-apple-darwin = "ddaf6a98ccc500891a74bcb95807a04c89a0d1ad7b9c58bd7116620ff6f903a8";
+      aarch64-apple-darwin = "d97daf14c5c346c2d5a3271880d5a06d9885ec9af7e1fd2f072986e338526f8c";
+      powerpc64-unknown-linux-gnu = "e49b9fb0671cadef9e5b81871bcfc1dc2c53d7503de7f2d7fa34b7cacc7f62e6";
+      powerpc64le-unknown-linux-gnu = "0a80537d96ea86e6520687fa03841f2dfde2c7154ae4bf517d9664d4f13b0c31";
+      powerpc64le-unknown-linux-musl = "1deb71349f7ba2af27b9f348429fdae1d7841e6ad6c1bfd5fa9e759922fc79c3";
+      riscv64gc-unknown-linux-gnu = "ffdf86a600890771414ada76c711800114501c390631aa7b9c3cbfb94a2f6db3";
+      s390x-unknown-linux-gnu = "d29755bb2292ca25ec35ae1407379132a5d87cd916247e895162b93cb91dc5ae";
+      loongarch64-unknown-linux-gnu = "3a86d71a43f434234d3ac578ef06a5da86fe5c75ac34e9e43f60fe650577bed2";
+      loongarch64-unknown-linux-musl = "6cf0e53ed4678306de34d0f38b934e6dea1b0de56a4f99b725d56be49e1ba8ee";
+      x86_64-unknown-freebsd = "5457c15df17ff963b582b95c55fae3bc3736468e4df765182c75c19b1b6e8e74";
     };
 
-    selectRustPackage = pkgs: pkgs.rust_1_95;
+    selectRustPackage = pkgs: pkgs.rust_1_96;
   }
 
   (
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index af651298aa25..2ca22a36260f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4475,15 +4475,15 @@ with pkgs;
   wrapRustcWith = { rustc-unwrapped, ... }@args: callPackage ../build-support/rust/rustc-wrapper args;
   wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
 
-  rust_1_95 = callPackage ../development/compilers/rust/1_95.nix { };
-  rust = rust_1_95;
+  rust_1_96 = callPackage ../development/compilers/rust/1_96.nix { };
+  rust = rust_1_96;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
   mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix { };
 
-  rustPackages_1_95 = rust_1_95.packages.stable;
-  rustPackages = rustPackages_1_95;
+  rustPackages_1_96 = rust_1_96.packages.stable;
+  rustPackages = rustPackages_1_96;
 
   inherit (rustPackages)
     cargo

From aa0e627f6e00f52ca5ca10cf48f71f73fb2f49a9 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 28 May 2026 21:32:04 +0100
Subject: [PATCH 267/831] libavif: 1.4.1 -> 1.4.2

Changes: https://github.com/AOMediaCodec/libavif/releases/tag/v1.4.2
---
 pkgs/by-name/li/libavif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libavif/package.nix b/pkgs/by-name/li/libavif/package.nix
index c778d78d66a7..8ec16503feee 100644
--- a/pkgs/by-name/li/libavif/package.nix
+++ b/pkgs/by-name/li/libavif/package.nix
@@ -31,7 +31,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libavif";
-  version = "1.4.1";
+  version = "1.4.2";
 
   outputs = [
     "out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "AOMediaCodec";
     repo = "libavif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-035SoxHfN121mp3LGwGykReCi1WJbl2/nZH8c/VwABU=";
+    hash = "sha256-AMQ1TRPGpuBBW7tJ8xuLEVTAeOsLWTHuE0dFJjI7+W4=";
   };
 
   postPatch = ''

From c87a95cbd3a3b06d829d86bf30c093016a47e2bb Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Sun, 17 May 2026 14:03:02 +0300
Subject: [PATCH 268/831] cc-wrapper: enable tlsdesc on i686, x86_64 linux

TLSDESC is a more performant way of doing TLS, since it has a custom
calling convention that does not require the caller (of what's usually
__tls_get_addr) to spill clobbered registers and assumes that the callee
preserves all registers.

This adds corresponding plumbing in the machineFlags in the cc-wrapper
that includes version gates for compilers. TLSDESC needs to be supported
by the bintools and libc, so I've only enabled it for architectures that
our packaged glibc, musl, GNU binutils support (x86, x86_64).
We package a lot of LLVM versions and support for -mtls-dialect in the
Clang driver has only landed in LLVM 19, so a version check is added
there too.

Ideally we'd set the default at GCC build-time, but LLVM lacks such an
option, so we'd have to keep it in the compiler wrapper for now.

Gentoo is already building with it by default [1], as is Fedora [2].

In glibc < 2.40 [3] there existed a bug with not all registers being
preserved, but it has since been resolved. x86 support has existed
since basically forever with LLVM adding support in LLVM >= 19.1.
LoongArch support has been added recently too, but it's only available
since musl 1.2.6 while we are stuck at 1.2.5 for now, so I haven't dug
deeper. Aarch64 uses TLSDESC by default already.

The support status on non-Linux is a bit unclear, so these defaults are
scoped only to linux targets.

Sadly RISC-V support is still cooking apparently [4].

See: https://maskray.me/blog/2021-02-14-all-about-thread-local-storage
See: https://groups.google.com/g/x86-64-abi/c/0tjmaQx6nZ0

[1]: https://github.com/gentoo/gentoo/commit/46191b478ebcb6bc6831627526da44f04dfcd1be
[2]: https://src.fedoraproject.org/rpms/gcc/c/8f8d2ea9c326784bce044ff86547107611dda338?branch=rawhide
[3]: https://sourceware.org/bugzilla/show_bug.cgi?id=31372
[4]: https://github.com/riscv-non-isa/riscv-elf-psabi-doc/issues/494
---
 pkgs/build-support/cc-wrapper/default.nix | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index d95fbddc4e89..617bd299a41d 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -316,6 +316,17 @@ let
   tune =
     if targetPlatform ? gcc.tune then findBestTuneApproximation targetPlatform.gcc.tune else null;
 
+  tlsDialect =
+    if
+      # Support status on non-Linux systems is a bit unclear.
+      targetPlatform.isLinux
+      # Support added in https://github.com/llvm/llvm-project/commit/36b4a9ccd9f7e04010476e6b2a311f2052a4ac20 (19.1.0)
+      && (isClang -> versionAtLeast ccVersion "19.1")
+    then
+      (if targetPlatform.isx86 then "gnu2" else null)
+    else
+      null;
+
   # Machine flags. These are necessary to support
 
   # TODO: We should make a way to support miscellaneous machine
@@ -353,7 +364,13 @@ let
         # TODO: clang on powerpcspe also needs a condition: https://github.com/llvm/llvm-project/issues/71356
         # https://releases.llvm.org/18.1.6/tools/clang/docs/ReleaseNotes.html#loongarch-support
         ((targetPlatform.isLoongArch64 && isClang) -> versionAtLeast ccVersion "18.1")
-    ) "-mcmodel=${targetPlatform.gcc.cmodel}";
+    ) "-mcmodel=${targetPlatform.gcc.cmodel}"
+    # Enable TLSDESC. This needs to be supported by the libc and bintools.
+    # See: https://maskray.me/blog/2021-02-14-all-about-thread-local-storage
+    # Aarch64 uses TLSDESC by default and the option is completely ignored (at least on LLVM).
+    # TODO: Enable by default in GCC via --with-tls since https://gcc.gnu.org/cgit/gcc/commit/?id=96a291c4bb0b8a00b0a125e6a60f60072ffe53a7 (GCC 16).
+    # No equivalent build-time option for LLVM yet.
+    ++ optional (tlsDialect != null) "-mtls-dialect=${tlsDialect}";
 
   defaultHardeningFlags = bintools.defaultHardeningFlags or [ ];
 

From 851fd9401f8f79454d1e3e0b786ba4afcaecd134 Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Wed, 13 May 2026 02:00:12 +0300
Subject: [PATCH 269/831] elfutils: apply patch allowing R_386_TLS_DESC in
 shared libraries with elflint

Submitted a patch upstream that already got merged to main, so grab it now.
Tests fail without it on i686-linux.

[1]: https://patchwork.sourceware.org/project/elfutils/patch/20260512211127.4157383-1-sergei@zimmerman.foo/
---
 pkgs/by-name/el/elfutils/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index 4a73d364c75c..fe3de1161954 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -57,6 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strndupa.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "sha256-7daehJj1t0wPtQzTv+/Rpuqqs5Ng/EYnZzrcf2o/Lb0=";
     })
+    (fetchpatch {
+      name = "fix-i386_tlsdesc_relocation.patch";
+      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=bfd519cc58e190544a6785d3f0a27fcfaf7d8da3";
+      hash = "sha256-N7DL2FG1AWLc+hcnxGMbUl5TuieoAc9OD6gc0sbsiGI=";
+    })
   ]
   ++ lib.optionals stdenv.hostPlatform.isMusl [ ./musl-error_h.patch ];
 

From 817b0e1338faca6deebeb9fca8beeef8409dbeea Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Wed, 13 May 2026 23:00:47 +0300
Subject: [PATCH 270/831] ffmpeg: use unwrapped clang for cuda-llvm support

The build system retargets clang for the appropriate nvidia arch
and doesn't depend on anything from the wrappers. Since the wrappped
compiler sets the flags for the original arch, it now includes
`-mtls-dialect=gnu2` on x86_64, which is not a supported flag for the
retargeted clang.
---
 pkgs/development/libraries/ffmpeg/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index b1f682050f21..26b365ad17de 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -841,7 +841,7 @@ stdenv.mkDerivation (
     ++ optionals stdenv.hostPlatform.isx86 [ nasm ]
     # Texinfo version 7.1 introduced breaking changes, which older versions of ffmpeg do not handle.
     ++ optionals (lib.versionAtLeast version "6") [ texinfo ]
-    ++ optionals withCudaLLVM [ clang ]
+    ++ optionals withCudaLLVM [ clang.cc ]
     ++ optionals withCudaNVCC [ cuda_nvcc ];
 
     buildInputs =

From 3bef031c681b7c166dfd94aff0054c674a9b83c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 11:32:16 -0700
Subject: [PATCH 271/831] python3Packages.fonttools: 4.61.1 -> 4.63.0

Diff: https://github.com/fonttools/fonttools/compare/4.61.1...4.63.0

Changelog: https://github.com/fonttools/fonttools/blob/4.63.0/NEWS.rst
---
 .../python-modules/fonttools/default.nix      | 23 +++++++++----------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index f93a7bd2152b..cdeeddf319ef 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -21,19 +21,20 @@
   xattr,
   skia-pathops,
   uharfbuzz,
+  addBinToPathHook,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "fonttools";
-  version = "4.61.1";
+  version = "4.63.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fonttools";
     repo = "fonttools";
     tag = version;
-    hash = "sha256-762bqAhOqqnuNSH8yFLTBnzYuigs716nt+uC1UwUqT4=";
+    hash = "sha256-XTE18TKpIa4MpbJ5tcHwCyLk3Q6CV/ElzMtddG86HJA=";
   };
 
   build-system = [
@@ -50,7 +51,7 @@ buildPythonPackage rec {
           (if isPyPy then brotlicffi else brotli)
           zopfli
         ];
-        unicode = lib.optional (pythonOlder "3.13") unicodedata2;
+        unicode = lib.optional (pythonOlder "3.15") unicodedata2;
         graphite = [ lz4 ];
         interpolatable = [
           pycairo
@@ -59,13 +60,14 @@ buildPythonPackage rec {
         plot = [ matplotlib ];
         symfont = [ sympy ];
         type1 = lib.optional stdenv.hostPlatform.isDarwin xattr;
-        pathops = lib.optional (lib.meta.availableOn stdenv.hostPlatform skia-pathops) skia-pathops;
+        pathops = [ skia-pathops ];
         repacker = [ uharfbuzz ];
       };
     in
     extras // { all = lib.concatLists (lib.attrValues extras); };
 
   nativeCheckInputs = [
+    addBinToPathHook
     pytestCheckHook
   ]
   ++ lib.concatLists (
@@ -75,20 +77,17 @@ buildPythonPackage rec {
         # "interpolatable" is not included because it only contains 2 tests at the time of writing but adds 270 extra dependencies
         "ufo"
       ]
-      ++ lib.optionals (!skia-pathops.meta.broken) [
-        "pathops" # broken
-      ]
+      ++
+        lib.optionals (lib.meta.availableOn stdenv.hostPlatform skia-pathops && !skia-pathops.meta.broken)
+          [
+            "pathops" # broken
+          ]
       ++ [ "repacker" ]
     ) optional-dependencies
   );
 
   pythonImportsCheck = [ "fontTools" ];
 
-  preCheck = ''
-    # tests want to execute the "fonttools" executable from $PATH
-    export PATH="$out/bin:$PATH"
-  '';
-
   # Timestamp tests have timing issues probably related
   # to our file timestamp normalization
   disabledTests = [

From b84bd317d02036f02ad3875e7bf83f1d3e90b165 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 11:39:22 -0700
Subject: [PATCH 272/831] python3Packages.fonttools: use finalAttrs

---
 pkgs/development/python-modules/fonttools/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index cdeeddf319ef..d854d9126cbc 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -25,7 +25,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fonttools";
   version = "4.63.0";
   pyproject = true;
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "fonttools";
     repo = "fonttools";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-XTE18TKpIa4MpbJ5tcHwCyLk3Q6CV/ElzMtddG86HJA=";
   };
 
@@ -83,7 +83,7 @@ buildPythonPackage rec {
             "pathops" # broken
           ]
       ++ [ "repacker" ]
-    ) optional-dependencies
+    ) finalAttrs.passthru.optional-dependencies
   );
 
   pythonImportsCheck = [ "fontTools" ];
@@ -99,8 +99,8 @@ buildPythonPackage rec {
   meta = {
     homepage = "https://github.com/fonttools/fonttools";
     description = "Library to manipulate font files from Python";
-    changelog = "https://github.com/fonttools/fonttools/blob/${src.tag}/NEWS.rst";
+    changelog = "https://github.com/fonttools/fonttools/blob/${finalAttrs.src.tag}/NEWS.rst";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})

From ca04963848648973a36563cbe75246df5451361e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 May 2026 17:02:39 -0700
Subject: [PATCH 273/831] python3Packages.redis: 7.4.0 -> 8.0.0

Diff: https://github.com/redis/redis-py/compare/v7.4.0...v8.0.0

Changelog: https://github.com/redis/redis-py/releases/tag/v8.0.0
---
 .../python-modules/redis/default.nix           | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 66f7a75717a5..0271f7d5c5ed 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -23,18 +23,26 @@
   cryptography,
   pyopenssl,
   requests,
+
+  # extras: otel
+  opentelemetry-api,
+  opentelemetry-exporter-otlp-proto-http,
+  opentelemetry-sdk,
+
+  # extras: xxhash
+  xxhash,
 }:
 
 buildPythonPackage rec {
   pname = "redis";
-  version = "7.4.0";
+  version = "8.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis-py";
     tag = "v${version}";
-    hash = "sha256-alrfAYzjvoYsaA2NYVgI56f3R+5ed4CsA35ZmvXnk6k=";
+    hash = "sha256-ze9Q8IfSWDAEH0sR+ql0tOu7ajeXF78AKYD6SHpZqRU=";
   };
 
   build-system = [ hatchling ];
@@ -52,6 +60,12 @@ buildPythonPackage rec {
       pyopenssl
       requests
     ];
+    otel = [
+      opentelemetry-api
+      opentelemetry-exporter-otlp-proto-http
+      opentelemetry-sdk
+    ];
+    xxhash = [ xxhash ];
   };
 
   pythonImportsCheck = [

From c0bb1a038834705436cc4e266b75e74f7920c26a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 May 2026 17:11:55 -0700
Subject: [PATCH 274/831] python3Packages.redis: use finalAttrs

---
 pkgs/development/python-modules/redis/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 0271f7d5c5ed..24a401f4e3f6 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -33,7 +33,7 @@
   xxhash,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "redis";
   version = "8.0.0";
   pyproject = true;
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis-py";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ze9Q8IfSWDAEH0sR+ql0tOu7ajeXF78AKYD6SHpZqRU=";
   };
 
@@ -84,8 +84,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python client for Redis key-value store";
     homepage = "https://github.com/redis/redis-py";
-    changelog = "https://github.com/redis/redis-py/releases/tag/${src.tag}";
+    changelog = "https://github.com/redis/redis-py/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.dotlambda ];
   };
-}
+})

From 580c4bea8e9685918e83c71d5dfaa40c0f313ba0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 May 2026 17:08:27 -0700
Subject: [PATCH 275/831] python3Packages.redis: add passthru.tests

---
 .../python-modules/redis/default.nix          | 48 ++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/redis/default.nix b/pkgs/development/python-modules/redis/default.nix
index 24a401f4e3f6..801be1ce99c8 100644
--- a/pkgs/development/python-modules/redis/default.nix
+++ b/pkgs/development/python-modules/redis/default.nix
@@ -31,6 +31,12 @@
 
   # extras: xxhash
   xxhash,
+
+  # tests
+  numpy,
+  pytest-asyncio,
+  pytestCheckHook,
+  redisTestHook,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -78,9 +84,49 @@ buildPythonPackage (finalAttrs: {
     "redis.utils"
   ];
 
-  # Tests require a running redis
+  nativeCheckInputs = [
+    numpy
+    pytest-asyncio
+    pytestCheckHook
+    redisTestHook
+  ]
+  ++ finalAttrs.passthru.optional-dependencies.circuit_breaker
+  ++ finalAttrs.passthru.optional-dependencies.otel;
+
+  enabledTestMarks = [
+    "onlynoncluster"
+  ];
+
+  disabledTestMarks = [
+    "onlycluster"
+    "redismod"
+  ];
+
+  disabledTestPaths = [
+    # requires Redis Sentinel
+    "tests/test_asyncio/test_sentinel.py"
+    "tests/test_sentinel.py"
+    # FIXME package redis-entraid
+    "tests/test_asyncio/test_credentials.py"
+    "tests/test_credentials.py"
+  ];
+
+  disabledTests = [
+    # requires a Redis cluster
+    "test_readonly_invalid_cluster_state"
+    # we run Valkey, not Redis
+    "test_lolwut"
+  ];
+
+  # circular dependency via pybreaker
   doCheck = false;
 
+  passthru.tests = {
+    pytest = finalAttrs.finalPackage.overrideAttrs {
+      doInstallCheck = true;
+    };
+  };
+
   meta = {
     description = "Python client for Redis key-value store";
     homepage = "https://github.com/redis/redis-py";

From a2e41bb76c7f3b1fca68f135e4029254225c5aa9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 28 May 2026 21:59:59 +0200
Subject: [PATCH 276/831] rust-cbindgen: 0.29.2 -> 0.29.3

https://github.com/mozilla/cbindgen/blob/v0.29.3/CHANGES
---
 pkgs/by-name/ru/rust-cbindgen/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rust-cbindgen/package.nix b/pkgs/by-name/ru/rust-cbindgen/package.nix
index 14374532ff52..88bb855e800b 100644
--- a/pkgs/by-name/ru/rust-cbindgen/package.nix
+++ b/pkgs/by-name/ru/rust-cbindgen/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-cbindgen";
-  version = "0.29.2";
+  version = "0.29.3";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cbindgen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P2A+XSLrcuYsI48gnZSNNs5qX+EatiuEJSEJbMvMSxg=";
+    hash = "sha256-d0rY7Sk37s8HEZlQq9Sbjj1P+DgygD0Yjx8cXlFKEIA=";
   };
 
-  cargoHash = "sha256-DbmlpjiOraLWPh5RgJqCIGIYzE1h82MH2S6gpLH+CIQ=";
+  cargoHash = "sha256-UeierkQpfCiB5ES9ZW9hO+0AcI9Ip8qSJ/Nd+I1xrmQ=";
 
   nativeCheckInputs = [
     cmake

From bec5224047e5eea5ec52f7ef11c9d7c391f78cb2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 28 May 2026 21:37:07 +0100
Subject: [PATCH 277/831] gssdp_1_6: 1.6.4 -> 1.6.5, gupnp_1_6: 1.6.9 -> 1.6.10

Changes:
- https://gitlab.gnome.org/GNOME/gssdp/-/blob/gssdp-1.6.5/NEWS?ref_type=tags
- https://gitlab.gnome.org/GNOME/gupnp/-/blob/gupnp-1.6.10/NEWS?ref_type=tags
---
 pkgs/by-name/gs/gssdp_1_6/package.nix | 4 ++--
 pkgs/by-name/gu/gupnp_1_6/package.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/gs/gssdp_1_6/package.nix b/pkgs/by-name/gs/gssdp_1_6/package.nix
index b4d8daba12c1..a25d7c8f1547 100644
--- a/pkgs/by-name/gs/gssdp_1_6/package.nix
+++ b/pkgs/by-name/gs/gssdp_1_6/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gssdp";
-  version = "1.6.4";
+  version = "1.6.5";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor finalAttrs.version}/gssdp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/5f9+39WHT5oE7T2ohRSWefC7/Q8wOY/P9Ax0LYmYDI=";
+    hash = "sha256-NP2CTDbvn1dVlNVXJyhBLduMUi9ga2yRPvi1qACq/E4=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/gu/gupnp_1_6/package.nix b/pkgs/by-name/gu/gupnp_1_6/package.nix
index f9c9c50a629c..357eff882818 100644
--- a/pkgs/by-name/gu/gupnp_1_6/package.nix
+++ b/pkgs/by-name/gu/gupnp_1_6/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gupnp";
-  version = "1.6.9";
+  version = "1.6.10";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor finalAttrs.version}/gupnp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Lttu42E1WOYvU4c1NoruJxUbfgnU4uLFFgaDPagBhps=";
+    hash = "sha256-oe4Ht7Emc8Mtf8c8oVilDBpNxpqzW2XpTSTTish1NF4=";
   };
 
   depsBuildBuild = [

From ddda3ed831d0d9f26f2fb446f8986b2c2fae4bc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Silva?= <andrerfosilva@gmail.com>
Date: Fri, 29 May 2026 10:01:50 +0100
Subject: [PATCH 278/831] rustPlatform.fetchCargoVendor: remove duplicate
 fetcher

---
 .../rust/fetch-cargo-vendor-util-v2.py        | 416 ------------------
 .../rust/fetch-cargo-vendor-util.py           |   5 +-
 .../build-support/rust/fetch-cargo-vendor.nix |  39 +-
 3 files changed, 18 insertions(+), 442 deletions(-)
 delete mode 100644 pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py b/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
deleted file mode 100644
index 5dc789c93ad9..000000000000
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
+++ /dev/null
@@ -1,416 +0,0 @@
-import functools
-import hashlib
-import json
-import multiprocessing as mp
-import re
-import shutil
-import subprocess
-import sys
-import tomllib
-from os.path import islink, realpath
-from pathlib import Path
-from typing import Any, TypedDict, cast
-from urllib.parse import unquote
-
-import requests
-import tomli_w
-from requests.adapters import HTTPAdapter, Retry
-
-eprint = functools.partial(print, file=sys.stderr)
-
-
-def load_toml(path: Path) -> dict[str, Any]:
-    with open(path, "rb") as f:
-        return tomllib.load(f)
-
-
-def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
-    # lockfile v1 and v2 don't have the `version` key, so assume v2
-    version = cargo_lock_toml.get("version", 2)
-
-    # TODO: add logic for differentiating between v1 and v2
-
-    return version
-
-
-def create_http_session() -> requests.Session:
-    retries = Retry(
-        total=5,
-        backoff_factor=0.5,
-        status_forcelist=[500, 502, 503, 504]
-    )
-    session = requests.Session()
-    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
-    session.mount('http://', HTTPAdapter(max_retries=retries))
-    session.mount('https://', HTTPAdapter(max_retries=retries))
-    return session
-
-
-def download_file_with_checksum(session: requests.Session, url: str, destination_path: Path) -> str:
-    sha256_hash = hashlib.sha256()
-    with session.get(url, stream=True) as response:
-        if not response.ok:
-            raise Exception(f"Failed to fetch file from {url}. Status code: {response.status_code}")
-        with open(destination_path, "wb") as file:
-            for chunk in response.iter_content(1024):  # Download in chunks
-                if chunk:  # Filter out keep-alive chunks
-                    file.write(chunk)
-                    sha256_hash.update(chunk)
-
-    # Compute the final checksum
-    checksum = sha256_hash.hexdigest()
-    return checksum
-
-
-def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
-    # TODO: support other registries
-    #       maybe fetch config.json from the registry root and get the dl key
-    #       See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-    if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
-        raise Exception("Only the default crates.io registry is supported.")
-
-    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
-    # rate limit on the API servers.
-    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
-
-
-def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
-
-    url = get_download_url_for_tarball(pkg)
-    filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-    # TODO: allow legacy checksum specification, see importCargoLock for example
-    #       also, don't forget about the other usage of the checksum
-    expected_checksum = pkg["checksum"]
-
-    tarball_out_dir = out_dir / "tarballs" / filename
-    eprint(f"Fetching {url} -> tarballs/{filename}")
-
-    calculated_checksum = download_file_with_checksum(session, url, tarball_out_dir)
-
-    if calculated_checksum != expected_checksum:
-        raise Exception(f"Hash mismatch! File fetched from {url} had checksum {calculated_checksum}, expected {expected_checksum}.")
-
-
-def download_git_tree(url: str, git_sha_rev: str, out_dir: Path) -> None:
-
-    tree_out_dir = out_dir / "git" / git_sha_rev
-    eprint(f"Fetching {url}#{git_sha_rev} -> git/{git_sha_rev}")
-
-    cmd = ["nix-prefetch-git", "--builder", "--quiet", "--fetch-submodules", "--url", url, "--rev", git_sha_rev, "--out", str(tree_out_dir)]
-    subprocess.check_output(cmd)
-
-
-GIT_SOURCE_REGEX = re.compile("git\\+(?P<url>[^?]+)(\\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
-
-
-class GitSourceInfo(TypedDict):
-    url: str
-    type: str | None
-    value: str | None
-    git_sha_rev: str
-
-
-def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
-    match = GIT_SOURCE_REGEX.match(source)
-    if match is None:
-        raise Exception(f"Unable to process git source: {source}.")
-
-    source_info = cast(GitSourceInfo, match.groupdict(default=None))
-
-    # the source URL is URL-encoded in lockfile_version >=4
-    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
-    if lockfile_version >= 4 and source_info["value"] is not None:
-        source_info["value"] = unquote(source_info["value"])
-
-    return source_info
-
-
-def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    git_packages: list[dict[str, Any]] = []
-    registry_packages: list[dict[str, Any]] = []
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            eprint(f"Skipping local dependency: {pkg["name"]}")
-            continue
-        source = pkg["source"]
-
-        if source.startswith("git+"):
-            git_packages.append(pkg)
-        elif source.startswith("registry+"):
-            registry_packages.append(pkg)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-    git_sha_rev_to_url: dict[str, str] = {}
-    for pkg in git_packages:
-        source_info = parse_git_source(pkg["source"], lockfile_version)
-        git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
-
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    # fetch git trees sequentially, since fetching concurrently leads to flaky behaviour
-    if len(git_packages) != 0:
-        (out_dir / "git").mkdir()
-        for git_sha_rev, url in git_sha_rev_to_url.items():
-            download_git_tree(url, git_sha_rev, out_dir)
-
-    # run tarball download jobs in parallel, with at most 5 concurrent download jobs
-    with mp.Pool(min(5, mp.cpu_count())) as pool:
-        if len(registry_packages) != 0:
-            (out_dir / "tarballs").mkdir()
-            session = create_http_session()
-            tarball_args_gen = ((session, pkg, out_dir) for pkg in registry_packages)
-            pool.starmap(download_tarball, tarball_args_gen)
-
-
-def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
-    cmd = ["cargo", "metadata", "--format-version", "1", "--no-deps", "--manifest-path", str(manifest_path)]
-    output = subprocess.check_output(cmd)
-    return json.loads(output)
-
-
-def try_get_crate_manifest_path_from_manifest_path(manifest_path: Path, crate_name: str) -> Path | None:
-    try:
-        metadata = get_manifest_metadata(manifest_path)
-    except subprocess.CalledProcessError:
-        eprint(f"Warning: cargo metadata failed for {manifest_path}, skipping")
-        return None
-
-    for pkg in metadata["packages"]:
-        if pkg["name"] == crate_name:
-            return Path(pkg["manifest_path"])
-
-    return None
-
-
-def find_crate_manifest_in_tree(tree: Path, crate_name: str) -> Path:
-    # Scan all Cargo.toml files; sort by depth/path to make ordering deterministic
-    # and prefer less-nested manifests first.
-    manifest_paths = sorted(
-        tree.glob("**/Cargo.toml"),
-        key=lambda path: (len(path.parts), str(path)),
-    )
-
-    for manifest_path in manifest_paths:
-        res = try_get_crate_manifest_path_from_manifest_path(manifest_path, crate_name)
-        if res is not None:
-            return res
-
-    raise Exception(f"Couldn't find manifest for crate {crate_name} inside {tree}.")
-
-
-def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_dir: Path) -> None:
-
-    # This function will get called by copytree to decide which entries of a directory should be copied
-    # We'll copy everything except symlinks that are invalid
-    def ignore_func(dir_str: str, path_strs: list[str]) -> list[str]:
-        ignorelist: list[str] = []
-
-        dir = Path(realpath(dir_str, strict=True))
-
-        for path_str in path_strs:
-            path = dir / path_str
-            if not islink(path):
-                continue
-
-            # Filter out cyclic symlinks and symlinks pointing at nonexistant files
-            try:
-                target_path = Path(realpath(path, strict=True))
-            except OSError:
-                ignorelist.append(path_str)
-                eprint(f"Failed to resolve symlink, ignoring: {path}")
-                continue
-
-            # Filter out symlinks that point outside of the current crate's base git tree
-            # This can be useful if the nix build sandbox is turned off and there is a symlink to a common absolute path
-            if not target_path.is_relative_to(git_tree):
-                ignorelist.append(path_str)
-                eprint(f"Symlink points outside of the crate's base git tree, ignoring: {path} -> {target_path}")
-                continue
-
-        return ignorelist
-
-    crate_manifest_path = find_crate_manifest_in_tree(git_tree, crate_name)
-    crate_tree = crate_manifest_path.parent
-
-    eprint(f"Copying to {crate_out_dir}")
-    shutil.copytree(crate_tree, crate_out_dir, ignore=ignore_func)
-    crate_out_dir.chmod(0o755)
-
-    with open(crate_manifest_path, "r") as f:
-        manifest_data = f.read()
-
-    if "workspace" in manifest_data:
-        crate_manifest_metadata = get_manifest_metadata(crate_manifest_path)
-        workspace_root = Path(crate_manifest_metadata["workspace_root"])
-
-        root_manifest_path = workspace_root / "Cargo.toml"
-        manifest_path = crate_out_dir / "Cargo.toml"
-
-        manifest_path.chmod(0o644)
-        eprint(f"Patching {manifest_path}")
-
-        cmd = ["replace-workspace-values", str(manifest_path), str(root_manifest_path)]
-        subprocess.check_output(cmd)
-
-
-def extract_crate_tarball_contents(tarball_path: Path, crate_out_dir: Path) -> None:
-    eprint(f"Unpacking to {crate_out_dir}")
-    crate_out_dir.mkdir()
-    cmd = ["tar", "xf", str(tarball_path), "-C", str(crate_out_dir), "--strip-components=1"]
-    subprocess.check_output(cmd)
-
-
-def make_git_source_selector(source_info: GitSourceInfo) -> dict[str, str]:
-    selector = {}
-    selector["git"] = source_info["url"]
-    if source_info["type"] is not None:
-        selector[source_info["type"]] = source_info["value"]
-    return selector
-
-
-def make_registry_source_selector(source: str) -> dict[str, str]:
-    registry = source[9:] if source.startswith("registry+") else source
-    selector = {}
-    selector["registry"] = registry
-    return selector
-
-
-def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
-    lockfile_path = vendor_staging_dir / "Cargo.lock"
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    source_to_ind: dict[str, str] = {}
-    source_config = {}
-    next_registry_ind = 0
-    next_git_ind = 0
-
-    def add_source_replacement(
-        orig_key: str,
-        orig_selector: dict[str, str],
-        vendored_key: str,
-        vendored_dir: str
-    ) -> None:
-        source_config[vendored_key] = {}
-        source_config[vendored_key]["directory"] = vendored_dir
-        source_config[orig_key] = orig_selector
-        source_config[orig_key]["replace-with"] = vendored_key
-
-    # we reserve registry index 0 for crates-io
-    source_to_ind["registry+https://github.com/rust-lang/crates.io-index"] = "registry-0"
-    source_to_ind["sparse+https://index.crates.io/"] = "registry-0"
-    add_source_replacement(
-        orig_key="crates-io",
-        orig_selector={},  # there is an internal selector defined for the `crates-io` source
-        vendored_key="vendored-source-registry-0",
-        vendored_dir="@vendor@/source-registry-0"
-    )
-    next_registry_ind += 1
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependencies
-        if "source" not in pkg.keys():
-            continue
-        source: str = pkg["source"]
-        if source in source_to_ind:
-            continue
-
-        if source.startswith("git+"):
-            ind = f"git-{next_git_ind}"
-            next_git_ind += 1
-            source_info = parse_git_source(source, lockfile_version)
-            selector = make_git_source_selector(source_info)
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            ind = f"registry-{next_registry_ind}"
-            next_registry_ind += 1
-            selector = make_registry_source_selector(source)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-        source_to_ind[source] = ind
-        add_source_replacement(
-            orig_key=f"original-source-{ind}",
-            orig_selector=selector,
-            vendored_key=f"vendored-source-{ind}",
-            vendored_dir=f"@vendor@/source-{ind}"
-        )
-
-    config_path = out_dir / ".cargo" / "config.toml"
-    config_path.parent.mkdir()
-
-    with open(config_path, "wb") as config_file:
-        tomli_w.dump({"source": source_config}, config_file)
-
-    for pkg in cargo_lock_toml["package"]:
-
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            continue
-
-        source: str = pkg["source"]
-        source_ind = source_to_ind[source]
-        crate_dir_name = f"{pkg["name"]}-{pkg["version"]}"
-        source_dir_name = f"source-{source_ind}"
-        crate_out_dir = out_dir / source_dir_name / crate_dir_name
-        crate_out_dir.parent.mkdir(exist_ok=True)
-
-        if source.startswith("git+"):
-
-            source_info = parse_git_source(source, lockfile_version)
-
-            git_sha_rev = source_info["git_sha_rev"]
-            git_tree = vendor_staging_dir / "git" / git_sha_rev
-
-            copy_and_patch_git_crate_subtree(git_tree, pkg["name"], crate_out_dir)
-
-            # git based crates allow having no checksum information
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}}, f)
-
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-            # TODO: change this when non-crates-io registries are supported
-            dir_name = "tarballs"
-
-            tarball_path = vendor_staging_dir / dir_name / filename
-
-            extract_crate_tarball_contents(tarball_path, crate_out_dir)
-
-            # non-git based crates need the package checksum at minimum
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}, "package": pkg["checksum"]}, f)
-
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-
-def main() -> None:
-    subcommand = sys.argv[1]
-
-    subcommand_func_dict = {
-        "create-vendor-staging": lambda: create_vendor_staging(lockfile_path=Path(sys.argv[2]), out_dir=Path(sys.argv[3])),
-        "create-vendor": lambda: create_vendor(vendor_staging_dir=Path(sys.argv[2]), out_dir=Path(sys.argv[3]))
-    }
-
-    subcommand_func = subcommand_func_dict.get(subcommand)
-
-    if subcommand_func is None:
-        raise Exception(f"Unknown subcommand: '{subcommand}'. Must be one of {list(subcommand_func_dict.keys())}")
-
-    subcommand_func()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 3bee7e150c8e..5dc789c93ad9 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -40,6 +40,7 @@ def create_http_session() -> requests.Session:
         status_forcelist=[500, 502, 503, 504]
     )
     session = requests.Session()
+    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
     session.mount('http://', HTTPAdapter(max_retries=retries))
     session.mount('https://', HTTPAdapter(max_retries=retries))
     return session
@@ -68,7 +69,9 @@ def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
     if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
         raise Exception("Only the default crates.io registry is supported.")
 
-    return f"https://crates.io/api/v1/crates/{pkg["name"]}/{pkg["version"]}/download"
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers.
+    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
 
 
 def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 2802bf9e73f1..8d554a8dc3e2 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -37,29 +37,18 @@ let
     "hash"
   ];
 
-  mkFetchCargoVendorUtil =
-    name: src:
-    writers.writePython3Bin name {
-      libraries =
-        with python3Packages;
-        [
-          requests
-          tomli-w
-        ]
-        ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
-      flakeIgnore = [
-        "E501"
-      ];
-    } (builtins.readFile src);
-
-  # Separate util used only by the FOD `vendorStaging` stage below. Kept
-  # distinct from fetchCargoVendorUtil so that changes to the network-facing
-  # bits (User-Agent, download URL) don't invalidate the input-addressed
-  # `-vendor` stage and force a mass rebuild of every Rust package in nixpkgs.
-  # vendorStaging is an FOD, so swapping its util is free for consumers.
-  # TODO: unify with fetchCargoVendorUtil on the next `staging` cycle.
-  fetchCargoVendorUtilV2 = mkFetchCargoVendorUtil "fetch-cargo-vendor-util-v2" ./fetch-cargo-vendor-util-v2.py;
-  fetchCargoVendorUtil = mkFetchCargoVendorUtil "fetch-cargo-vendor-util" ./fetch-cargo-vendor-util.py;
+  fetchCargoVendorUtil = writers.writePython3Bin "fetch-cargo-vendor-util" {
+    libraries =
+      with python3Packages;
+      [
+        requests
+        tomli-w
+      ]
+      ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
+    flakeIgnore = [
+      "E501"
+    ];
+  } (builtins.readFile ./fetch-cargo-vendor-util.py);
 in
 
 {
@@ -79,7 +68,7 @@ let
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
       nativeBuildInputs = [
-        fetchCargoVendorUtilV2
+        fetchCargoVendorUtil
         cacert
         nix-prefetch-git'
       ]
@@ -92,7 +81,7 @@ let
           cd "$cargoRoot"
         fi
 
-        fetch-cargo-vendor-util-v2 create-vendor-staging ./Cargo.lock "$out"
+        fetch-cargo-vendor-util create-vendor-staging ./Cargo.lock "$out"
 
         runHook postBuild
       '';

From 37ff020c2fefcccc4a354c0f8a193da9b700aea0 Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Thu, 28 May 2026 10:48:35 +0200
Subject: [PATCH 279/831] python3Packages.pillow-heif: disable tests that abuse
 spec and break in libheif 1.22.0, disable version check for libheif

---
 .../python-modules/pillow-heif/default.nix            | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/development/python-modules/pillow-heif/default.nix b/pkgs/development/python-modules/pillow-heif/default.nix
index eea442596817..cc00832bb662 100644
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -77,6 +77,17 @@ buildPythonPackage rec {
   disabledTests = [
     # Time sensitive speed test, not reproducible
     "test_decode_threads"
+    # Tests failing with libheif 1.22.0. To be removed in the next release
+    # https://github.com/bigcat88/pillow_heif/issues/424
+    # these check what happens when the ispe is not valid
+    "test_numpy_array_invalid_ispe"
+    "test_allow_incorrect_headers"
+    "test_invalid_ispe_ok"
+    "test_invalid_ispe_allow"
+    "test_invalid_ispe_stride"
+    "test_invalid_ispe_stride_pillow"
+    # disable version check for libheif
+    "test_libheif_info"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # https://github.com/bigcat88/pillow_heif/issues/89

From 1a817546620f1988b2330765f94db19f96b76210 Mon Sep 17 00:00:00 2001
From: Gavin John <gavinnjohn@gmail.com>
Date: Fri, 29 May 2026 01:45:05 -0700
Subject: [PATCH 280/831] nixos/pcscd: expose package as option

---
 nixos/modules/services/hardware/pcscd.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/hardware/pcscd.nix b/nixos/modules/services/hardware/pcscd.nix
index f7e23df84f01..0b9aae8e2bbd 100644
--- a/nixos/modules/services/hardware/pcscd.nix
+++ b/nixos/modules/services/hardware/pcscd.nix
@@ -10,8 +10,6 @@ let
     builtins.concatStringsSep "\n\n" config.services.pcscd.readerConfigs
   );
 
-  package = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
-
   pluginEnv = pkgs.buildEnv {
     name = "pcscd-plugins";
     paths = map (p: "${p}/pcsc/drivers") config.services.pcscd.plugins;
@@ -36,6 +34,11 @@ in
   options.services.pcscd = {
     enable = lib.mkEnableOption "PCSC-Lite daemon, to access smart cards using SCard API (PC/SC)";
 
+    package = (lib.mkPackageOption pkgs "pcsclite" { }) // {
+      default = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
+      defaultText = lib.literalExpression "if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite";
+    };
+
     plugins = lib.mkOption {
       type = lib.types.listOf lib.types.package;
       defaultText = lib.literalExpression "[ pkgs.ccid ]";
@@ -101,8 +104,8 @@ in
   config = lib.mkIf config.services.pcscd.enable {
     environment.etc."reader.conf".source = cfgFile;
 
-    environment.systemPackages = [ package ];
-    systemd.packages = [ package ];
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
 
     services.pcscd.plugins = [ pkgs.ccid ];
 
@@ -133,7 +136,7 @@ in
       # https://github.com/NixOS/nixpkgs/issues/121088
       serviceConfig.ExecStart = [
         ""
-        "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
+        "${lib.getExe cfg.package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
       ];
     };
 

From 1468d638d9872ddb999cfc3053cc66a0089eb59b Mon Sep 17 00:00:00 2001
From: Gavin John <gavinnjohn@gmail.com>
Date: Fri, 29 May 2026 01:48:27 -0700
Subject: [PATCH 281/831] pcsclite: enable structuredAttrs, separateDebugInfo,
 strictDeps

__structuredAttrs and strictDeps being enabled are obvious. separateDebugInfo is enabled as it helps with troubleshooting broken plugins.
---
 pkgs/by-name/pc/pcsclite/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/pc/pcsclite/package.nix b/pkgs/by-name/pc/pcsclite/package.nix
index c4d14fe7a137..271bf0fdd121 100644
--- a/pkgs/by-name/pc/pcsclite/package.nix
+++ b/pkgs/by-name/pc/pcsclite/package.nix
@@ -88,6 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
     moveToOutput bin/pcsc-spy "$dev"
   '';
 
+  __structuredAttrs = true;
+  separateDebugInfo = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja

From 629e94d9f8a60ac5d9ebf634722c0422371996f6 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Fri, 29 May 2026 19:17:22 +0200
Subject: [PATCH 282/831] libbacktrace: 0-unstable-2024-03-02 ->
 0-unstable-2026-05-03

---
 ...cktrace-avoid-libtool-wrapping-tests.patch | 201 ------------------
 ...acktrace-Allow-configuring-debug-dir.patch |  37 ++--
 pkgs/by-name/li/libbacktrace/package.nix      |  10 +-
 3 files changed, 26 insertions(+), 222 deletions(-)
 delete mode 100644 pkgs/by-name/li/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch

diff --git a/pkgs/by-name/li/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch b/pkgs/by-name/li/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch
deleted file mode 100644
index 61fd56ee0880..000000000000
--- a/pkgs/by-name/li/libbacktrace/0001-libbacktrace-avoid-libtool-wrapping-tests.patch
+++ /dev/null
@@ -1,201 +0,0 @@
-From eadfee17e7d3a1c1bb2a0ff8585772b40331ebd7 Mon Sep 17 00:00:00 2001
-From: Jan Tojnar <jtojnar@gmail.com>
-Date: Sat, 24 Dec 2022 15:31:51 +0100
-Subject: [PATCH 1/4] libbacktrace: avoid libtool wrapping tests
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When `--enable-shared` is used, libtool will produce shell scripts
-instead of programs, preventing separate debug info from being generated:
-
-    objcopy --only-keep-debug btest btest_gnudebuglink.debug
-    objcopy: btest: file format not recognized
-    make[2]: *** [Makefile:2615: btest_gnudebuglink] Error 1
-
-Let’s make it properly set rpath with `-no-install` flag,
-so that wrappers are not needed, as mentioned on
-https://autotools.info/libtool/wrappers.html
----
- Makefile.am | 28 +++++++++++++++++++++++-----
- 1 file changed, 23 insertions(+), 5 deletions(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 3d67909..06ccf3f 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -107,6 +107,8 @@ check_DATA =
- # Flags to use when compiling test programs.
- libbacktrace_TEST_CFLAGS = $(EXTRA_FLAGS) $(WARN_FLAGS) -g
- 
-+libbacktrace_TEST_LDFLAGS = -no-install
-+
- if USE_DSYMUTIL
- 
- %.dSYM: %
-@@ -171,48 +173,56 @@ xcoff_%.c: xcoff.c
- 
- test_elf_32_SOURCES = test_format.c testlib.c
- test_elf_32_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_elf_32_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_elf_32_LDADD = libbacktrace_noformat.la elf_32.lo
- 
- BUILDTESTS += test_elf_32
- 
- test_elf_64_SOURCES = test_format.c testlib.c
- test_elf_64_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_elf_64_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_elf_64_LDADD = libbacktrace_noformat.la elf_64.lo
- 
- BUILDTESTS += test_elf_64
- 
- test_macho_SOURCES = test_format.c testlib.c
- test_macho_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_macho_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_macho_LDADD = libbacktrace_noformat.la macho.lo
- 
- BUILDTESTS += test_macho
- 
- test_xcoff_32_SOURCES = test_format.c testlib.c
- test_xcoff_32_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_xcoff_32_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_xcoff_32_LDADD = libbacktrace_noformat.la xcoff_32.lo
- 
- BUILDTESTS += test_xcoff_32
- 
- test_xcoff_64_SOURCES = test_format.c testlib.c
- test_xcoff_64_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_xcoff_64_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_xcoff_64_LDADD = libbacktrace_noformat.la xcoff_64.lo
- 
- BUILDTESTS += test_xcoff_64
- 
- test_pecoff_SOURCES = test_format.c testlib.c
- test_pecoff_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_pecoff_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_pecoff_LDADD = libbacktrace_noformat.la pecoff.lo
- 
- BUILDTESTS += test_pecoff
- 
- test_unknown_SOURCES = test_format.c testlib.c
- test_unknown_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+test_unknown_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- test_unknown_LDADD = libbacktrace_noformat.la unknown.lo
- 
- BUILDTESTS += test_unknown
- 
- unittest_SOURCES = unittest.c testlib.c
- unittest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+unittest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- unittest_LDADD = libbacktrace.la
- 
- BUILDTESTS += unittest
-@@ -254,7 +264,7 @@ if HAVE_OBJCOPY_DEBUGLINK
- 
- b2test_SOURCES = $(btest_SOURCES)
- b2test_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--b2test_LDFLAGS = -Wl,--build-id
-+b2test_LDFLAGS = -Wl,--build-id $(libbacktrace_TEST_LDFLAGS)
- b2test_LDADD = libbacktrace_elf_for_test.la
- 
- check_PROGRAMS += b2test
-@@ -264,7 +274,7 @@ if HAVE_DWZ
- 
- b3test_SOURCES = $(btest_SOURCES)
- b3test_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--b3test_LDFLAGS = -Wl,--build-id
-+b3test_LDFLAGS = -Wl,--build-id $(libbacktrace_TEST_LDFLAGS)
- b3test_LDADD = libbacktrace_elf_for_test.la
- 
- check_PROGRAMS += b3test
-@@ -278,6 +288,7 @@ endif HAVE_ELF
- 
- btest_SOURCES = btest.c testlib.c
- btest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -O
-+btest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- btest_LDADD = libbacktrace.la
- 
- BUILDTESTS += btest
-@@ -332,6 +343,7 @@ endif HAVE_DWZ
- 
- stest_SOURCES = stest.c
- stest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+stest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- stest_LDADD = libbacktrace.la
- 
- BUILDTESTS += stest
-@@ -354,6 +366,7 @@ if HAVE_ELF
- 
- ztest_SOURCES = ztest.c testlib.c
- ztest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
-+ztest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- ztest_LDADD = libbacktrace.la
- ztest_alloc_LDADD = libbacktrace_alloc.la
- 
-@@ -373,6 +386,7 @@ BUILDTESTS += ztest_alloc
- 
- zstdtest_SOURCES = zstdtest.c testlib.c
- zstdtest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
-+zstdtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- zstdtest_LDADD = libbacktrace.la
- zstdtest_alloc_LDADD = libbacktrace_alloc.la
- 
-@@ -394,6 +408,7 @@ endif HAVE_ELF
- 
- edtest_SOURCES = edtest.c edtest2_build.c testlib.c
- edtest_CFLAGS = $(libbacktrace_TEST_CFLAGS)
-+edtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- edtest_LDADD = libbacktrace.la
- 
- BUILDTESTS += edtest
-@@ -424,6 +439,7 @@ BUILDTESTS += ttest
- 
- ttest_SOURCES = ttest.c testlib.c
- ttest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -pthread
-+ttest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- ttest_LDADD = libbacktrace.la
- 
- if USE_DSYMUTIL
-@@ -472,12 +488,12 @@ if HAVE_COMPRESSED_DEBUG
- 
- ctestg_SOURCES = btest.c testlib.c
- ctestg_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--ctestg_LDFLAGS = -Wl,--compress-debug-sections=zlib-gnu
-+ctestg_LDFLAGS = -Wl,--compress-debug-sections=zlib-gnu $(libbacktrace_TEST_LDFLAGS)
- ctestg_LDADD = libbacktrace.la
- 
- ctesta_SOURCES = btest.c testlib.c
- ctesta_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--ctesta_LDFLAGS = -Wl,--compress-debug-sections=zlib-gabi
-+ctesta_LDFLAGS = -Wl,--compress-debug-sections=zlib-gabi $(libbacktrace_TEST_LDFLAGS)
- ctesta_LDADD = libbacktrace.la
- 
- BUILDTESTS += ctestg ctesta
-@@ -486,7 +502,7 @@ if HAVE_COMPRESSED_DEBUG_ZSTD
- 
- ctestzstd_SOURCES = btest.c testlib.c
- ctestzstd_CFLAGS = $(libbacktrace_TEST_CFLAGS)
--ctestzstd_LDFLAGS = -Wl,--compress-debug-sections=zstd
-+ctestzstd_LDFLAGS = -Wl,--compress-debug-sections=zstd $(libbacktrace_TEST_LDFLAGS)
- ctestzstd_LDADD = libbacktrace.la
- 
- BUILDTESTS += ctestzstd
-@@ -533,6 +549,7 @@ endif
- 
- mtest_SOURCES = mtest.c testlib.c
- mtest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -O
-+mtest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- mtest_LDADD = libbacktrace.la
- 
- BUILDTESTS += mtest
-@@ -565,6 +582,7 @@ if HAVE_ELF
- 
- xztest_SOURCES = xztest.c testlib.c
- xztest_CFLAGS = $(libbacktrace_TEST_CFLAGS) -DSRCDIR=\"$(srcdir)\"
-+xztest_LDFLAGS = $(libbacktrace_TEST_LDFLAGS)
- xztest_LDADD = libbacktrace.la
- 
- xztest_alloc_SOURCES = $(xztest_SOURCES)
--- 
-2.43.1
-
diff --git a/pkgs/by-name/li/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch b/pkgs/by-name/li/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch
index ee6063875091..da1efae66365 100644
--- a/pkgs/by-name/li/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch
+++ b/pkgs/by-name/li/libbacktrace/0002-libbacktrace-Allow-configuring-debug-dir.patch
@@ -1,7 +1,7 @@
-From 2ceaa9bc8a9a0c8a02806a92e19bd21b3fccf3a0 Mon Sep 17 00:00:00 2001
+From f69f2a995d0c5c6bc44fd485a7f5d3b390f26fc4 Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
-Date: Sat, 24 Dec 2022 16:46:18 +0100
-Subject: [PATCH 2/4] libbacktrace: Allow configuring debug dir
+Date: Sat, 25 Apr 2026 23:01:23 +0200
+Subject: [PATCH] libbacktrace: Allow configuring debug dir
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -14,13 +14,13 @@ the path can be changed. The same flag is supported by gdb:
 
 https://github.com/bminor/binutils-gdb/blob/095f84c7e3cf85cd68c657c46b80be078f336bc9/gdb/configure.ac#L113-L115
 ---
- Makefile.am  | 13 +++++++------
+ Makefile.am  | 15 ++++++++-------
  configure.ac |  8 ++++++++
  elf.c        |  4 ++--
- 3 files changed, 17 insertions(+), 8 deletions(-)
+ 3 files changed, 18 insertions(+), 9 deletions(-)
 
 diff --git a/Makefile.am b/Makefile.am
-index 06ccf3f..6304faa 100644
+index 7b32e23..51431b9 100644
 --- a/Makefile.am
 +++ b/Makefile.am
 @@ -33,7 +33,8 @@ ACLOCAL_AMFLAGS = -I config
@@ -33,7 +33,7 @@ index 06ccf3f..6304faa 100644
  
  include_HEADERS = backtrace.h backtrace-supported.h
  
-@@ -134,7 +135,7 @@ libbacktrace_noformat_la_DEPENDENCIES = $(libbacktrace_noformat_la_LIBADD)
+@@ -136,7 +137,7 @@ libbacktrace_noformat_la_DEPENDENCIES = $(libbacktrace_noformat_la_LIBADD)
  if HAVE_ELF
  if HAVE_OBJCOPY_DEBUGLINK
  
@@ -42,7 +42,7 @@ index 06ccf3f..6304faa 100644
  
  check_LTLIBRARIES += libbacktrace_elf_for_test.la
  
-@@ -143,8 +144,8 @@ libbacktrace_elf_for_test_la_LIBADD = $(BACKTRACE_FILE) elf_for_test.lo \
+@@ -145,8 +146,8 @@ libbacktrace_elf_for_test_la_LIBADD = $(BACKTRACE_FILE) elf_for_test.lo \
  	$(VIEW_FILE) $(ALLOC_FILE)
  
  elf_for_test.c: elf.c
@@ -53,7 +53,7 @@ index 06ccf3f..6304faa 100644
  	$(SED) "s%$$SEARCH%$$REPLACE%" \
  		$< \
  		> $@.tmp
-@@ -474,13 +475,13 @@ endif HAVE_OBJCOPY_DEBUGLINK
+@@ -484,13 +485,13 @@ endif HAVE_OBJCOPY_DEBUGLINK
  
  %_buildid: %
  	./install-debuginfo-for-buildid.sh \
@@ -69,8 +69,17 @@ index 06ccf3f..6304faa 100644
  	  $<
  	$(OBJCOPY) --strip-all $< $@
  
+@@ -621,7 +622,7 @@ MAKETESTS += m2test_minidebug2
+ 	$(XZ) $<.mdbg2
+ 	$(OBJCOPY) --add-section .gnu_debugdata=$<.mdbg2.xz $<.dbg2
+ 	$(OBJCOPY) --add-section .gnu_debugdata=$<.mdbg2.xz $<.strip2
+-	$(SHELL) ./install-debuginfo-for-buildid.sh $(TEST_BUILD_ID_DIR) $<.dbg2
++	$(SHELL) ./install-debuginfo-for-buildid.sh "$(TEST_DEBUG_DIR)/.build-id" $<.dbg2
+ 	mv $<.strip2 $@
+ 
+ endif HAVE_OBJCOPY_DEBUGLINK
 diff --git a/configure.ac b/configure.ac
-index 69304ea..aeb2ee9 100644
+index 2267cc5..15cdc6e 100644
 --- a/configure.ac
 +++ b/configure.ac
 @@ -67,6 +67,14 @@ AM_MAINTAINER_MODE
@@ -89,10 +98,10 @@ index 69304ea..aeb2ee9 100644
  # the wrong, non-multilib-adjusted value will be used in multilibs.
  # As a side effect, we have to subst CFLAGS ourselves.
 diff --git a/elf.c b/elf.c
-index 3ef07bb..21fbe4f 100644
+index e93729d..4765fae 100644
 --- a/elf.c
 +++ b/elf.c
-@@ -856,7 +856,7 @@ elf_readlink (struct backtrace_state *state, const char *filename,
+@@ -857,7 +857,7 @@ elf_readlink (struct backtrace_state *state, const char *filename,
      }
  }
  
@@ -101,7 +110,7 @@ index 3ef07bb..21fbe4f 100644
  
  /* Open a separate debug info file, using the build ID to find it.
     Returns an open file descriptor, or -1.
-@@ -870,7 +870,7 @@ elf_open_debugfile_by_buildid (struct backtrace_state *state,
+@@ -871,7 +871,7 @@ elf_open_debugfile_by_buildid (struct backtrace_state *state,
  			       backtrace_error_callback error_callback,
  			       void *data)
  {
@@ -111,5 +120,5 @@ index 3ef07bb..21fbe4f 100644
    const char * const suffix = ".debug";
    const size_t suffix_len = strlen (suffix);
 -- 
-2.43.1
+2.51.2
 
diff --git a/pkgs/by-name/li/libbacktrace/package.nix b/pkgs/by-name/li/libbacktrace/package.nix
index 0f3abdba1ab9..d91ff3888190 100644
--- a/pkgs/by-name/li/libbacktrace/package.nix
+++ b/pkgs/by-name/li/libbacktrace/package.nix
@@ -10,20 +10,16 @@
 
 stdenv.mkDerivation {
   pname = "libbacktrace";
-  version = "0-unstable-2024-03-02";
+  version = "0-unstable-2026-05-03";
 
   src = fetchFromGitHub {
     owner = "ianlancetaylor";
     repo = "libbacktrace";
-    rev = "28824f2cc9069e3fdc39d3702acdf753e35c41b4";
-    sha256 = "1k1O1GT22hZAWPF8NYP0y4qe+e3pGfzT9Mz2TH+H/v4=";
+    rev = "96664e69b1ecdb76e824be1d9e8f475b76dd08cf";
+    hash = "sha256-+tV6W8SnFWKweAASvFfb+i6bz73ssVGikNhVpq3YbT4=";
   };
 
   patches = [
-    # Fix tests with shared library.
-    # https://github.com/ianlancetaylor/libbacktrace/pull/99
-    ./0001-libbacktrace-avoid-libtool-wrapping-tests.patch
-
     # Support multiple debug dirs.
     # https://github.com/ianlancetaylor/libbacktrace/pull/100
     ./0002-libbacktrace-Allow-configuring-debug-dir.patch

From 783dea20a27c7e49ab239583288166c2fdf3cac6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 25 Mar 2026 22:56:21 +0000
Subject: [PATCH 283/831] svt-av1: 3.1.2 -> 4.1.0

---
 pkgs/by-name/sv/svt-av1/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sv/svt-av1/package.nix b/pkgs/by-name/sv/svt-av1/package.nix
index 23c007f26a50..4ad68f820e08 100644
--- a/pkgs/by-name/sv/svt-av1/package.nix
+++ b/pkgs/by-name/sv/svt-av1/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "svt-av1";
-  version = "3.1.2";
+  version = "4.1.0";
 
   src = fetchFromGitLab {
     owner = "AOMediaCodec";
     repo = "SVT-AV1";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/CpcxdyC4qf9wdzzySMYw17FbjYpasT+QVykXSlx28U=";
+    hash = "sha256-NPJG1SsRlG9kGtUwdJa/uP6DAtF09nCctzeorrvjAhQ=";
   };
 
   nativeBuildInputs = [

From 8cd7c741b06e03540da23de65cfd0868cb716bf4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 29 May 2026 11:14:40 -0700
Subject: [PATCH 284/831] ffmpeg_7: add patch for svt-av1 4.0

Co-authored-by: Alex James <git@alextjam.es>
---
 pkgs/development/libraries/ffmpeg/generic.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 3b799a0cf9e7..b37b1fced907 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -511,6 +511,13 @@ stdenv.mkDerivation (
           url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/d1ed5c06e3edc5f2b5f3664c80121fa55b0baa95";
           hash = "sha256-2NVkIhQVS1UQJVYuDdeH+ZvWYKVbtwW9Myu5gx7JnbA=";
         })
+      ]
+      ++ optionals (lib.versionAtLeast version "6" && lib.versionOlder version "7.1.4") [
+        (fetchpatch2 {
+          name = "svt-av1-4.0.0-compat.patch";
+          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/a5d4c398b411a00ac09d8fe3b66117222323844c";
+          hash = "sha256-peIXXU5+5DRQc3Xdpz5V+xIN7Vohs0Dlal6mHiMryXc=";
+        })
       ];
 
     configurePlatforms = [ ];

From e64abb9c87f7cb0758d29d84f630bc88802c56a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 29 May 2026 08:55:26 -0700
Subject: [PATCH 285/831] handbrake: drop unused patches

---
 pkgs/development/libraries/ffmpeg/generic.nix | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 06cf679cd2cd..22432b5c85ae 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -482,9 +482,6 @@ stdenv.mkDerivation (
           hash = "sha256-OLiQHKBNp2p63ZmzBBI4GEGz3WSSP+rMd8ITfZSVRgY=";
         })
       ]
-      ++ optionals (lib.versionAtLeast version "7.1" && lib.versionOlder version "7.1.1") [
-        ./fix-fate-ffmpeg-spec-disposition-7.1.patch
-      ]
       ++ optionals (lib.versionAtLeast version "7.1.1") [
         # Expose a private API for Chromium / Qt WebEngine.
         (fetchpatch2 {
@@ -492,19 +489,6 @@ stdenv.mkDerivation (
           hash = "sha256-DbH6ieJwDwTjKOdQ04xvRcSLeeLP2Z2qEmqeo8HsPr4=";
         })
       ]
-      ++ optionals (lib.versionAtLeast version "7.1" && lib.versionOlder version "7.1.4") [
-        (fetchpatch2 {
-          name = "lcevcdec-4.0.0-compat.patch";
-          url = "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fa23202cc7baab899894e8d22d82851a84967848.patch";
-          hash = "sha256-Ixkf1xzuDGk5t8J/apXKtghY0X9cfqSj/q987zrUuLQ=";
-        })
-      ]
-      ++ optionals (lib.versionAtLeast version "7.1.1" && lib.versionOlder version "7.1.3") [
-        (fetchpatch2 {
-          url = "https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/d8ffec5bf9a2803f55cc0822a97b7815f24bee83";
-          hash = "sha256-lmSI5arShb2/W84FMnSNs3lb6rd5vWdUSzfU8oza0Ic=";
-        })
-      ]
       ++ optionals (lib.versionOlder version "7.1.2") [
         (fetchpatch2 {
           name = "unbreak-svt-av1-3.0.0.patch";

From 1c2d1b16049b36ebec45c8cc17f16e5a702b3e0f Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 29 May 2026 21:58:09 +0100
Subject: [PATCH 286/831] libdrm: 2.4.133 -> 2.4.134

Changes: https://lists.x.org/archives/xorg-announce/2026-May/003701.html
---
 pkgs/by-name/li/libdrm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libdrm/package.nix b/pkgs/by-name/li/libdrm/package.nix
index caa0e573221a..7e0b8d177df9 100644
--- a/pkgs/by-name/li/libdrm/package.nix
+++ b/pkgs/by-name/li/libdrm/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdrm";
-  version = "2.4.133";
+  version = "2.4.134";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/libdrm/libdrm-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/Gj50LoupjyUMqKZ4U/qCfrXqKZugDn814AspZ93tPU=";
+    hash = "sha256-rF500VeDDri+5Exqa/OtSXdO8N0qcr2tdKjyAwi1KpU=";
   };
 
   outputs = [

From 4f574aac567ca60ec3bd37a2a670b99491cad5e6 Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Sat, 30 May 2026 00:07:32 +0300
Subject: [PATCH 287/831] {khronos-ocl-icd-loader,opencl-clhpp,opencl-headers}:
 2025.07.22 -> 2026.05.29

Syncs with OpenCL 3.1. ocl-icd doesn't have a release yet.
---
 pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix | 4 ++--
 pkgs/by-name/op/opencl-clhpp/package.nix           | 4 ++--
 pkgs/by-name/op/opencl-headers/package.nix         | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix b/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
index ebd9e4b077f3..f36cfa1fa910 100644
--- a/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
+++ b/pkgs/by-name/kh/khronos-ocl-icd-loader/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencl-icd-loader";
-  version = "2025.07.22";
+  version = "2026.05.29";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-ICD-Loader";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jwviNwX7C7b9lqIS4oZ4YLEFBfBdmQfXHxW3FPPYxYs=";
+    hash = "sha256-PUfYCf2+0i+SatQerehPv97LOTDlBsQAmtHFX97UGzo=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/op/opencl-clhpp/package.nix b/pkgs/by-name/op/opencl-clhpp/package.nix
index b3b728561ade..0ef6776ff350 100644
--- a/pkgs/by-name/op/opencl-clhpp/package.nix
+++ b/pkgs/by-name/op/opencl-clhpp/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencl-clhpp";
-  version = "2025.07.22";
+  version = "2026.05.29";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-CLHPP";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    sha256 = "sha256-afiHjAhdhjtNkGggCO69MwHiQuJZb028lfpQl3HIvXw=";
+    sha256 = "sha256-VrI6cufrIXUizV2exKnQ5B1zjKzWsX5imp3ON39BkSw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opencl-headers/package.nix b/pkgs/by-name/op/opencl-headers/package.nix
index 86ab51dc5e33..52082350a991 100644
--- a/pkgs/by-name/op/opencl-headers/package.nix
+++ b/pkgs/by-name/op/opencl-headers/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencl-headers";
-  version = "2025.07.22";
+  version = "2026.05.29";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "OpenCL-Headers";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-XcDzBt4EAsip+5/lbZwPBO7/nDGAognUkJO/2Jg4OeY=";
+    sha256 = "sha256-qL8lFtjj+rYTsNz9RALx3pIlugAkcwclbGW7VIiijXk=";
   };
 
   nativeBuildInputs = [ cmake ];

From 64ae7d0e374a774bb78520e6b0f320e804317d70 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Fri, 29 May 2026 21:35:29 -0400
Subject: [PATCH 288/831] gnupatch: disable flaky test

Fixes #525260
---
 pkgs/tools/text/gnupatch/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index 99a801c4cc8e..188ac323543f 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -15,8 +15,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+Hzuae7CtPy/YKOWsDCtaqNBXxkqpffuhMrV4R9/WuM=";
   };
 
-  # This test is filesystem-dependent - observed failing on ZFS
-  postPatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+  # This test is filesystem-dependent - observed failing on ZFS.
+  # It is also just plain flaky: it has been observed failing about 10%
+  # of the time on btrfs and ext4 too.
+  postPatch = ''
     sed -E -i -e '/bad-filenames/d' tests/Makefile.am
   '';
 

From adb4fccdc759cc12b4791e486df9412190a308d9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 11 May 2026 22:18:34 +0200
Subject: [PATCH 289/831] python3: 3.13 -> 3.14

For 26.11 Python 3.14 will be the default Python release while 3.13 is
mostly provided for legacy compat.
---
 .../interpreters/python/default.nix           | 36 +++++++++----------
 pkgs/top-level/all-packages.nix               |  4 +--
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 1e70883b03a2..b2d04d79b56f 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -16,14 +16,14 @@
     passthruFun = import ./passthrufun.nix args;
 
     sources = {
-      python313 = {
+      python314 = {
         sourceVersion = {
           major = "3";
-          minor = "13";
-          patch = "13";
+          minor = "14";
+          patch = "5";
           suffix = "";
         };
-        hash = "sha256-Krkf9AF4PMymT3XRDIgulXvf1g4r9acvhCF5Nym3inE=";
+        hash = "sha256-fjJZe5nl2aOavtNd5Gk/oWnfPlhQ1MM0M3/9ahmjbbY=";
       };
     };
 
@@ -66,26 +66,26 @@
       inherit passthruFun;
     };
 
-    python313 = callPackage ./cpython (
-      {
-        self = __splicedPackages.python313;
-        inherit passthruFun;
-      }
-      // sources.python313
-    );
-
-    python314 = callPackage ./cpython {
-      self = __splicedPackages.python314;
+    python313 = callPackage ./cpython {
+      self = __splicedPackages.python313;
       sourceVersion = {
         major = "3";
-        minor = "14";
-        patch = "5";
+        minor = "13";
+        patch = "13";
         suffix = "";
       };
-      hash = "sha256-fjJZe5nl2aOavtNd5Gk/oWnfPlhQ1MM0M3/9ahmjbbY=";
+      hash = "sha256-Krkf9AF4PMymT3XRDIgulXvf1g4r9acvhCF5Nym3inE=";
       inherit passthruFun;
     };
 
+    python314 = callPackage ./cpython (
+      {
+        self = __splicedPackages.python314;
+        inherit passthruFun;
+      }
+      // sources.python314
+    );
+
     python315 = callPackage ./cpython {
       self = __splicedPackages.python315;
       sourceVersion = {
@@ -108,7 +108,7 @@
           # strip down that python version as much as possible
           withMinimalDeps = true;
         }
-        // sources.python313
+        // sources.python314
       )).overrideAttrs
         (old: {
           # TODO(@Artturin): Add this to the main cpython expr
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 304bce45d634..5d305e9d5258 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4899,11 +4899,11 @@ with pkgs;
   # available as `pythonPackages.tkinter` and can be used as any other Python package.
   # When switching these sets, please update docs at ../../doc/languages-frameworks/python.md
   python2 = python27;
-  python3 = python313;
+  python3 = python314;
 
   # pythonPackages further below, but assigned here because they need to be in sync
   python2Packages = dontRecurseIntoAttrs python27Packages;
-  python3Packages = dontRecurseIntoAttrs python313Packages;
+  python3Packages = dontRecurseIntoAttrs python314Packages;
 
   pypy = pypy2;
   pypy2 = pypy27;

From 2fb194308fdf9d22879c9bfc46228e2e991121e1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 11 May 2026 22:52:34 +0200
Subject: [PATCH 290/831] zstd: remove fetchpatch usage

Welcome to the fetchpatch bootstrap chain due to the Python 3.14 reverse
dependency.
---
 pkgs/tools/compression/zstd/default.nix   |  12 +-
 pkgs/tools/compression/zstd/man-fix.patch | 805 ++++++++++++++++++++++
 2 files changed, 811 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/tools/compression/zstd/man-fix.patch

diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index a014b652d313..03c614cb66e9 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   bashNonInteractive,
   gnugrep,
@@ -27,6 +26,11 @@
   testers,
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "zstd";
   version = "1.5.7";
@@ -49,11 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Pull missing manpages update:
     #   https://github.com/facebook/zstd/pull/4302
     # TODO: remove with 1.5.8 release
-    (fetchpatch {
-      name = "man-fix.patch";
-      url = "https://github.com/facebook/zstd/commit/6af3842118ea5325480b403213b2a9fbed3d3d74.patch";
-      hash = "sha256-i+iv+owUXbKU3UtZBsjfj86kFB3TDlpcVDNsDX8dyZE=";
-    })
+    ./man-fix.patch
   ];
 
   postPatch = lib.optionalString (!static) ''
diff --git a/pkgs/tools/compression/zstd/man-fix.patch b/pkgs/tools/compression/zstd/man-fix.patch
new file mode 100644
index 000000000000..7ef0a5a08d37
--- /dev/null
+++ b/pkgs/tools/compression/zstd/man-fix.patch
@@ -0,0 +1,805 @@
+From 6af3842118ea5325480b403213b2a9fbed3d3d74 Mon Sep 17 00:00:00 2001
+From: Yann Collet <cyan@fb.com>
+Date: Wed, 19 Feb 2025 16:25:00 -0800
+Subject: [PATCH] updated man pages and manual
+
+fixes #4301
+---
+ doc/zstd_manual.html |  55 +++++----
+ programs/zstd.1      | 260 +++++++++++++++++++++++++++++++++++++------
+ programs/zstdgrep.1  |   2 +-
+ programs/zstdless.1  |   2 +-
+ 4 files changed, 257 insertions(+), 62 deletions(-)
+
+diff --git a/doc/zstd_manual.html b/doc/zstd_manual.html
+index 485d5eafbe9..89f0761f492 100644
+--- a/doc/zstd_manual.html
++++ b/doc/zstd_manual.html
+@@ -110,6 +110,7 @@ <h3>Decompression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+            - ZSTD_CONTENTSIZE_UNKNOWN if the size cannot be determined
+            - ZSTD_CONTENTSIZE_ERROR if an error occurred (e.g. invalid magic number, srcSize too small)
+   note 1 : a 0 return value means the frame is valid but "empty".
++           When invoking this method on a skippable frame, it will return 0.
+   note 2 : decompressed size is an optional field, it may not be present (typically in streaming mode).
+            When `return==ZSTD_CONTENTSIZE_UNKNOWN`, data to decompress could be any size.
+            In which case, it's necessary to use streaming mode to decompress data.
+@@ -128,9 +129,8 @@ <h3>Decompression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+ </p></pre><BR>
+ 
+ <pre><b>ZSTD_DEPRECATED("Replaced by ZSTD_getFrameContentSize")
+-ZSTDLIB_API
+ unsigned long long ZSTD_getDecompressedSize(const void* src, size_t srcSize);
+-</b><p>  NOTE: This function is now obsolete, in favor of ZSTD_getFrameContentSize().
++</b><p>  This function is now obsolete, in favor of ZSTD_getFrameContentSize().
+   Both functions work the same way, but ZSTD_getDecompressedSize() blends
+   "empty", "unknown" and "error" results to the same return value (0),
+   while ZSTD_getFrameContentSize() gives them separate return values.
+@@ -142,7 +142,12 @@ <h3>Decompression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+  `srcSize` must be >= first frame size
+  @return : the compressed size of the first frame starting at `src`,
+            suitable to pass as `srcSize` to `ZSTD_decompress` or similar,
+-        or an error code if input is invalid 
++           or an error code if input is invalid
++  Note 1: this method is called _find*() because it's not enough to read the header,
++          it may have to scan through the frame's content, to reach its end.
++  Note 2: this method also works with Skippable Frames. In which case,
++          it returns the size of the complete skippable frame,
++          which is always equal to its content size + 8 bytes for headers. 
+ </p></pre><BR>
+ 
+ <h3>Compression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+@@ -166,8 +171,7 @@ <h3>Compression helper functions</h3><pre></pre><b><pre></pre></b><BR>
+  
+ </p></pre><BR>
+ 
+-<h3>Error helper functions</h3><pre></pre><b><pre>#include "zstd_errors.h" </b>/* list of errors */<b>
+-</b>/* ZSTD_isError() :<b>
++<h3>Error helper functions</h3><pre></pre><b><pre></b>/* ZSTD_isError() :<b>
+  * Most ZSTD_* functions returning a size_t value can be tested for error,
+  * using ZSTD_isError().
+  * @return 1 if error, 0 otherwise
+@@ -1239,7 +1243,7 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+ </p></pre><BR>
+ 
+ <pre><b>ZSTDLIB_STATIC_API size_t ZSTD_frameHeaderSize(const void* src, size_t srcSize);
+-</b><p>  srcSize must be >= ZSTD_FRAMEHEADERSIZE_PREFIX.
++</b><p>  srcSize must be large enough, aka >= ZSTD_FRAMEHEADERSIZE_PREFIX.
+  @return : size of the Frame Header,
+            or an error code (if srcSize is too small) 
+ </p></pre><BR>
+@@ -1252,20 +1256,20 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+     unsigned blockSizeMax;
+     ZSTD_FrameType_e frameType;          </b>/* if == ZSTD_skippableFrame, frameContentSize is the size of skippable content */<b>
+     unsigned headerSize;
+-    unsigned dictID;
++    unsigned dictID;                     </b>/* for ZSTD_skippableFrame, contains the skippable magic variant [0-15] */<b>
+     unsigned checksumFlag;
+     unsigned _reserved1;
+     unsigned _reserved2;
+-} ZSTD_frameHeader;
++} ZSTD_FrameHeader;
+ </b></pre><BR>
+-<pre><b>ZSTDLIB_STATIC_API size_t ZSTD_getFrameHeader(ZSTD_FrameHeader* zfhPtr, const void* src, size_t srcSize);   </b>/**< doesn't consume input */<b>
++<pre><b>ZSTDLIB_STATIC_API size_t ZSTD_getFrameHeader(ZSTD_FrameHeader* zfhPtr, const void* src, size_t srcSize);
+ </b>/*! ZSTD_getFrameHeader_advanced() :<b>
+  *  same as ZSTD_getFrameHeader(),
+  *  with added capability to select a format (like ZSTD_f_zstd1_magicless) */
+ ZSTDLIB_STATIC_API size_t ZSTD_getFrameHeader_advanced(ZSTD_FrameHeader* zfhPtr, const void* src, size_t srcSize, ZSTD_format_e format);
+-</b><p>  decode Frame Header, or requires larger `srcSize`.
+- @return : 0, `zfhPtr` is correctly filled,
+-          >0, `srcSize` is too small, value is wanted `srcSize` amount,
++</b><p>  decode Frame Header into `zfhPtr`, or requires larger `srcSize`.
++ @return : 0 => header is complete, `zfhPtr` is correctly filled,
++          >0 => `srcSize` is too small, @return value is the wanted `srcSize` amount, `zfhPtr` is not filled,
+            or an error code, which can be tested using ZSTD_isError() 
+ </p></pre><BR>
+ 
+@@ -1421,7 +1425,7 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+ ZSTD_compressSequencesAndLiterals(ZSTD_CCtx* cctx,
+                       void* dst, size_t dstCapacity,
+                 const ZSTD_Sequence* inSeqs, size_t nbSequences,
+-                const void* literals, size_t litSize, size_t litCapacity,
++                const void* literals, size_t litSize, size_t litBufCapacity,
+                 size_t decompressedSize);
+ </b><p> This is a variant of ZSTD_compressSequences() which,
+  instead of receiving (src,srcSize) as input parameter, receives (literals,litSize),
+@@ -1435,20 +1439,22 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+  - Not compatible with frame checksum, which must be disabled
+  - If any block is incompressible, will fail and return an error
+  - @litSize must be == sum of all @.litLength fields in @inSeqs. Any discrepancy will generate an error.
+- - the buffer @literals must have a size @litCapacity which is larger than @litSize by at least 8 bytes.
++ - @litBufCapacity is the size of the underlying buffer into which literals are written, starting at address @literals.
++   @litBufCapacity must be at least 8 bytes larger than @litSize.
+  - @decompressedSize must be correct, and correspond to the sum of all Sequences. Any discrepancy will generate an error.
+  @return : final compressed size, or a ZSTD error code.
+  
+ </p></pre><BR>
+ 
+ <pre><b>ZSTDLIB_STATIC_API size_t ZSTD_writeSkippableFrame(void* dst, size_t dstCapacity,
+-                                const void* src, size_t srcSize, unsigned magicVariant);
++                                 const void* src, size_t srcSize,
++                                       unsigned magicVariant);
+ </b><p> Generates a zstd skippable frame containing data given by src, and writes it to dst buffer.
+ 
+  Skippable frames begin with a 4-byte magic number. There are 16 possible choices of magic number,
+  ranging from ZSTD_MAGIC_SKIPPABLE_START to ZSTD_MAGIC_SKIPPABLE_START+15.
+- As such, the parameter magicVariant controls the exact skippable frame magic number variant used, so
+- the magic number used will be ZSTD_MAGIC_SKIPPABLE_START + magicVariant.
++ As such, the parameter magicVariant controls the exact skippable frame magic number variant used,
++ so the magic number used will be ZSTD_MAGIC_SKIPPABLE_START + magicVariant.
+ 
+  Returns an error if destination buffer is not large enough, if the source size is not representable
+  with a 4-byte unsigned int, or if the parameter magicVariant is greater than 15 (and therefore invalid).
+@@ -1457,13 +1463,14 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+  
+ </p></pre><BR>
+ 
+-<pre><b>size_t ZSTD_readSkippableFrame(void* dst, size_t dstCapacity, unsigned* magicVariant,
+-                                const void* src, size_t srcSize);
+-</b><p> Retrieves a zstd skippable frame containing data given by src, and writes it to dst buffer.
++<pre><b>ZSTDLIB_STATIC_API size_t ZSTD_readSkippableFrame(void* dst, size_t dstCapacity,
++                                      unsigned* magicVariant,
++                                      const void* src, size_t srcSize);
++</b><p> Retrieves the content of a zstd skippable frame starting at @src, and writes it to @dst buffer.
+ 
+- The parameter magicVariant will receive the magicVariant that was supplied when the frame was written,
+- i.e. magicNumber - ZSTD_MAGIC_SKIPPABLE_START.  This can be NULL if the caller is not interested
+- in the magicVariant.
++ The parameter @magicVariant will receive the magicVariant that was supplied when the frame was written,
++ i.e. magicNumber - ZSTD_MAGIC_SKIPPABLE_START.
++ This can be NULL if the caller is not interested in the magicVariant.
+ 
+  Returns an error if destination buffer is not large enough, or if the frame is not skippable.
+ 
+@@ -1471,7 +1478,7 @@ <h3>Streaming decompression functions</h3><pre></pre><b><pre></pre></b><BR>
+  
+ </p></pre><BR>
+ 
+-<pre><b>unsigned ZSTD_isSkippableFrame(const void* buffer, size_t size);
++<pre><b>ZSTDLIB_STATIC_API unsigned ZSTD_isSkippableFrame(const void* buffer, size_t size);
+ </b><p>  Tells if the content of `buffer` starts with a valid Frame Identifier for a skippable frame.
+  
+ </p></pre><BR>
+diff --git a/programs/zstd.1 b/programs/zstd.1
+index 5f1519f3323..5503a5b86f4 100644
+--- a/programs/zstd.1
++++ b/programs/zstd.1
+@@ -1,392 +1,580 @@
+-.TH "ZSTD" "1" "October 2024" "zstd 1.5.6" "User Commands"
++.
++.TH "ZSTD" "1" "February 2025" "zstd 1.5.7" "User Commands"
++.
+ .SH "NAME"
+ \fBzstd\fR \- zstd, zstdmt, unzstd, zstdcat \- Compress or decompress \.zst files
++.
+ .SH "SYNOPSIS"
+-.TS
+-allbox;
+-\fBzstd\fR [\fIOPTIONS\fR] [\-	\fIINPUT\-FILE\fR] [\-o \fIOUTPUT\-FILE\fR]
+-.TE
++\fBzstd\fR [\fIOPTIONS\fR] [\-|\fIINPUT\-FILE\fR] [\-o \fIOUTPUT\-FILE\fR]
++.
+ .P
+ \fBzstdmt\fR is equivalent to \fBzstd \-T0\fR
++.
+ .P
+ \fBunzstd\fR is equivalent to \fBzstd \-d\fR
++.
+ .P
+ \fBzstdcat\fR is equivalent to \fBzstd \-dcf\fR
++.
+ .SH "DESCRIPTION"
+ \fBzstd\fR is a fast lossless compression algorithm and data compression tool, with command line syntax similar to \fBgzip\fR(1) and \fBxz\fR(1)\. It is based on the \fBLZ77\fR family, with further FSE & huff0 entropy stages\. \fBzstd\fR offers highly configurable compression speed, from fast modes at > 200 MB/s per core, to strong modes with excellent compression ratios\. It also features a very fast decoder, with speeds > 500 MB/s per core, which remains roughly stable at all compression settings\.
++.
+ .P
+ \fBzstd\fR command line syntax is generally similar to gzip, but features the following few differences:
++.
+ .IP "\(bu" 4
+-Source files are preserved by default\. It's possible to remove them automatically by using the \fB\-\-rm\fR command\.
++Source files are preserved by default\. It\'s possible to remove them automatically by using the \fB\-\-rm\fR command\.
++.
+ .IP "\(bu" 4
+ When compressing a single file, \fBzstd\fR displays progress notifications and result summary by default\. Use \fB\-q\fR to turn them off\.
++.
+ .IP "\(bu" 4
+ \fBzstd\fR displays a short help page when command line is an error\. Use \fB\-q\fR to turn it off\.
++.
+ .IP "\(bu" 4
+-\fBzstd\fR does not accept input from console, though it does accept \fBstdin\fR when it's not the console\.
++\fBzstd\fR does not accept input from console, though it does accept \fBstdin\fR when it\'s not the console\.
++.
+ .IP "\(bu" 4
+-\fBzstd\fR does not store the input's filename or attributes, only its contents\.
++\fBzstd\fR does not store the input\'s filename or attributes, only its contents\.
++.
+ .IP "" 0
++.
+ .P
+ \fBzstd\fR processes each \fIfile\fR according to the selected operation mode\. If no \fIfiles\fR are given or \fIfile\fR is \fB\-\fR, \fBzstd\fR reads from standard input and writes the processed data to standard output\. \fBzstd\fR will refuse to write compressed data to standard output if it is a terminal: it will display an error message and skip the file\. Similarly, \fBzstd\fR will refuse to read compressed data from standard input if it is a terminal\.
++.
+ .P
+ Unless \fB\-\-stdout\fR or \fB\-o\fR is specified, \fIfiles\fR are written to a new file whose name is derived from the source \fIfile\fR name:
++.
+ .IP "\(bu" 4
+ When compressing, the suffix \fB\.zst\fR is appended to the source filename to get the target filename\.
++.
+ .IP "\(bu" 4
+ When decompressing, the \fB\.zst\fR suffix is removed from the source filename to get the target filename
++.
+ .IP "" 0
++.
+ .SS "Concatenation with \.zst Files"
+ It is possible to concatenate multiple \fB\.zst\fR files\. \fBzstd\fR will decompress such agglomerated file as if it was a single \fB\.zst\fR file\.
++.
+ .SH "OPTIONS"
++.
+ .SS "Integer Suffixes and Special Values"
+ In most places where an integer argument is expected, an optional suffix is supported to easily indicate large integers\. There must be no space between the integer and the suffix\.
++.
+ .TP
+ \fBKiB\fR
+-Multiply the integer by 1,024 (2\e^10)\. \fBKi\fR, \fBK\fR, and \fBKB\fR are accepted as synonyms for \fBKiB\fR\.
++Multiply the integer by 1,024 (2^10)\. \fBKi\fR, \fBK\fR, and \fBKB\fR are accepted as synonyms for \fBKiB\fR\.
++.
+ .TP
+ \fBMiB\fR
+-Multiply the integer by 1,048,576 (2\e^20)\. \fBMi\fR, \fBM\fR, and \fBMB\fR are accepted as synonyms for \fBMiB\fR\.
++Multiply the integer by 1,048,576 (2^20)\. \fBMi\fR, \fBM\fR, and \fBMB\fR are accepted as synonyms for \fBMiB\fR\.
++.
+ .SS "Operation Mode"
+ If multiple operation mode options are given, the last one takes effect\.
++.
+ .TP
+ \fB\-z\fR, \fB\-\-compress\fR
+ Compress\. This is the default operation mode when no operation mode option is specified and no other operation mode is implied from the command name (for example, \fBunzstd\fR implies \fB\-\-decompress\fR)\.
++.
+ .TP
+ \fB\-d\fR, \fB\-\-decompress\fR, \fB\-\-uncompress\fR
+ Decompress\.
++.
+ .TP
+ \fB\-t\fR, \fB\-\-test\fR
+ Test the integrity of compressed \fIfiles\fR\. This option is equivalent to \fB\-\-decompress \-\-stdout > /dev/null\fR, decompressed data is discarded and checksummed for errors\. No files are created or removed\.
++.
+ .TP
+ \fB\-b#\fR
+ Benchmark file(s) using compression level \fI#\fR\. See \fIBENCHMARK\fR below for a description of this operation\.
++.
+ .TP
+ \fB\-\-train FILES\fR
+ Use \fIFILES\fR as a training set to create a dictionary\. The training set should contain a lot of small files (> 100)\. See \fIDICTIONARY BUILDER\fR below for a description of this operation\.
++.
+ .TP
+ \fB\-l\fR, \fB\-\-list\fR
+-Display information related to a zstd compressed file, such as size, ratio, and checksum\. Some of these fields may not be available\. This command's output can be augmented with the \fB\-v\fR modifier\.
++Display information related to a zstd compressed file, such as size, ratio, and checksum\. Some of these fields may not be available\. This command\'s output can be augmented with the \fB\-v\fR modifier\.
++.
+ .SS "Operation Modifiers"
++.
+ .IP "\(bu" 4
+-\fB\-#\fR: selects \fB#\fR compression level [1\-19] (default: 3)\. Higher compression levels \fIgenerally\fR produce higher compression ratio at the expense of speed and memory\. A rough rule of thumb is that compression speed is expected to be divided by 2 every 2 levels\. Technically, each level is mapped to a set of advanced parameters (that can also be modified individually, see below)\. Because the compressor's behavior highly depends on the content to compress, there's no guarantee of a smooth progression from one level to another\.
++\fB\-#\fR: selects \fB#\fR compression level [1\-19] (default: 3)\. Higher compression levels \fIgenerally\fR produce higher compression ratio at the expense of speed and memory\. A rough rule of thumb is that compression speed is expected to be divided by 2 every 2 levels\. Technically, each level is mapped to a set of advanced parameters (that can also be modified individually, see below)\. Because the compressor\'s behavior highly depends on the content to compress, there\'s no guarantee of a smooth progression from one level to another\.
++.
+ .IP "\(bu" 4
+ \fB\-\-ultra\fR: unlocks high compression levels 20+ (maximum 22), using a lot more memory\. Note that decompression will also require more memory when using these levels\.
++.
+ .IP "\(bu" 4
+ \fB\-\-fast[=#]\fR: switch to ultra\-fast compression levels\. If \fB=#\fR is not present, it defaults to \fB1\fR\. The higher the value, the faster the compression speed, at the cost of some compression ratio\. This setting overwrites compression level if one was set previously\. Similarly, if a compression level is set after \fB\-\-fast\fR, it overrides it\.
++.
+ .IP "\(bu" 4
+ \fB\-T#\fR, \fB\-\-threads=#\fR: Compress using \fB#\fR working threads (default: 1)\. If \fB#\fR is 0, attempt to detect and use the number of physical CPU cores\. In all cases, the nb of threads is capped to \fBZSTDMT_NBWORKERS_MAX\fR, which is either 64 in 32\-bit mode, or 256 for 64\-bit environments\. This modifier does nothing if \fBzstd\fR is compiled without multithread support\.
++.
+ .IP "\(bu" 4
+ \fB\-\-single\-thread\fR: Use a single thread for both I/O and compression\. As compression is serialized with I/O, this can be slightly slower\. Single\-thread mode features significantly lower memory usage, which can be useful for systems with limited amount of memory, such as 32\-bit systems\.
++.
+ .IP
+ Note 1: this mode is the only available one when multithread support is disabled\.
++.
+ .IP
+ Note 2: this mode is different from \fB\-T1\fR, which spawns 1 compression thread in parallel with I/O\. Final compressed result is also slightly different from \fB\-T1\fR\.
++.
+ .IP "\(bu" 4
+ \fB\-\-auto\-threads={physical,logical} (default: physical)\fR: When using a default amount of threads via \fB\-T0\fR, choose the default based on the number of detected physical or logical cores\.
++.
+ .IP "\(bu" 4
+ \fB\-\-adapt[=min=#,max=#]\fR: \fBzstd\fR will dynamically adapt compression level to perceived I/O conditions\. Compression level adaptation can be observed live by using command \fB\-v\fR\. Adaptation can be constrained between supplied \fBmin\fR and \fBmax\fR levels\. The feature works when combined with multi\-threading and \fB\-\-long\fR mode\. It does not work with \fB\-\-single\-thread\fR\. It sets window size to 8 MiB by default (can be changed manually, see \fBwlog\fR)\. Due to the chaotic nature of dynamic adaptation, compressed result is not reproducible\.
++.
+ .IP
+ \fINote\fR: at the time of this writing, \fB\-\-adapt\fR can remain stuck at low speed when combined with multiple worker threads (>=2)\.
++.
+ .IP "\(bu" 4
+ \fB\-\-long[=#]\fR: enables long distance matching with \fB#\fR \fBwindowLog\fR, if \fB#\fR is not present it defaults to \fB27\fR\. This increases the window size (\fBwindowLog\fR) and memory usage for both the compressor and decompressor\. This setting is designed to improve the compression ratio for files with long matches at a large distance\.
++.
+ .IP
+ Note: If \fBwindowLog\fR is set to larger than 27, \fB\-\-long=windowLog\fR or \fB\-\-memory=windowSize\fR needs to be passed to the decompressor\.
++.
++.IP "\(bu" 4
++\fB\-\-max\fR: set advanced parameters to maximum compression\. warning: this setting is very slow and uses a lot of resources\. It\'s inappropriate for 32\-bit mode and therefore disabled in this mode\.
++.
+ .IP "\(bu" 4
+ \fB\-D DICT\fR: use \fBDICT\fR as Dictionary to compress or decompress FILE(s)
++.
+ .IP "\(bu" 4
+-\fB\-\-patch\-from FILE\fR: Specify the file to be used as a reference point for zstd's diff engine\. This is effectively dictionary compression with some convenient parameter selection, namely that \fIwindowSize\fR > \fIsrcSize\fR\.
++\fB\-\-patch\-from FILE\fR: Specify the file to be used as a reference point for zstd\'s diff engine\. This is effectively dictionary compression with some convenient parameter selection, namely that \fIwindowSize\fR > \fIsrcSize\fR\.
++.
+ .IP
+ Note: cannot use both this and \fB\-D\fR together\.
++.
+ .IP
+ Note: \fB\-\-long\fR mode will be automatically activated if \fIchainLog\fR < \fIfileLog\fR (\fIfileLog\fR being the \fIwindowLog\fR required to cover the whole file)\. You can also manually force it\.
++.
+ .IP
+-Note: up to level 15, you can use \fB\-\-patch\-from\fR in \fB\-\-single\-thread\fR mode to improve compression ratio marginally at the cost of speed\. Using '\-\-single\-thread' above level 15 will lead to lower compression ratios\.
++Note: up to level 15, you can use \fB\-\-patch\-from\fR in \fB\-\-single\-thread\fR mode to improve compression ratio marginally at the cost of speed\. Using \'\-\-single\-thread\' above level 15 will lead to lower compression ratios\.
++.
+ .IP
+ Note: for level 19, you can get increased compression ratio at the cost of speed by specifying \fB\-\-zstd=targetLength=\fR to be something large (i\.e\. 4096), and by setting a large \fB\-\-zstd=chainLog=\fR\.
++.
+ .IP "\(bu" 4
+-\fB\-\-rsyncable\fR: \fBzstd\fR will periodically synchronize the compression state to make the compressed file more rsync\-friendly\. There is a negligible impact to compression ratio, and a potential impact to compression speed, perceptible at higher speeds, for example when combining \fB\-\-rsyncable\fR with many parallel worker threads\. This feature does not work with \fB\-\-single\-thread\fR\. You probably don't want to use it with long range mode, since it will decrease the effectiveness of the synchronization points, but your mileage may vary\.
++\fB\-\-rsyncable\fR: \fBzstd\fR will periodically synchronize the compression state to make the compressed file more rsync\-friendly\. There is a negligible impact to compression ratio, and a potential impact to compression speed, perceptible at higher speeds, for example when combining \fB\-\-rsyncable\fR with many parallel worker threads\. This feature does not work with \fB\-\-single\-thread\fR\. You probably don\'t want to use it with long range mode, since it will decrease the effectiveness of the synchronization points, but your mileage may vary\.
++.
+ .IP "\(bu" 4
+ \fB\-C\fR, \fB\-\-[no\-]check\fR: add integrity check computed from uncompressed data (default: enabled)
++.
+ .IP "\(bu" 4
+ \fB\-\-[no\-]content\-size\fR: enable / disable whether or not the original size of the file is placed in the header of the compressed file\. The default option is \fB\-\-content\-size\fR (meaning that the original size will be placed in the header)\.
++.
+ .IP "\(bu" 4
+-\fB\-\-no\-dictID\fR: do not store dictionary ID within frame header (dictionary compression)\. The decoder will have to rely on implicit knowledge about which dictionary to use, it won't be able to check if it's correct\.
++\fB\-\-no\-dictID\fR: do not store dictionary ID within frame header (dictionary compression)\. The decoder will have to rely on implicit knowledge about which dictionary to use, it won\'t be able to check if it\'s correct\.
++.
+ .IP "\(bu" 4
+ \fB\-M#\fR, \fB\-\-memory=#\fR: Set a memory usage limit\. By default, \fBzstd\fR uses 128 MiB for decompression as the maximum amount of memory the decompressor is allowed to use, but you can override this manually if need be in either direction (i\.e\. you can increase or decrease it)\.
++.
+ .IP
+ This is also used during compression when using with \fB\-\-patch\-from=\fR\. In this case, this parameter overrides that maximum size allowed for a dictionary\. (128 MiB)\.
++.
+ .IP
+ Additionally, this can be used to limit memory for dictionary training\. This parameter overrides the default limit of 2 GiB\. zstd will load training samples up to the memory limit and ignore the rest\.
++.
+ .IP "\(bu" 4
+ \fB\-\-stream\-size=#\fR: Sets the pledged source size of input coming from a stream\. This value must be exact, as it will be included in the produced frame header\. Incorrect stream sizes will cause an error\. This information will be used to better optimize compression parameters, resulting in better and potentially faster compression, especially for smaller source sizes\.
++.
+ .IP "\(bu" 4
+ \fB\-\-size\-hint=#\fR: When handling input from a stream, \fBzstd\fR must guess how large the source size will be when optimizing compression parameters\. If the stream size is relatively small, this guess may be a poor one, resulting in a higher compression ratio than expected\. This feature allows for controlling the guess when needed\. Exact guesses result in better compression ratios\. Overestimates result in slightly degraded compression ratios, while underestimates may result in significant degradation\.
++.
+ .IP "\(bu" 4
+ \fB\-\-target\-compressed\-block\-size=#\fR: Attempt to produce compressed blocks of approximately this size\. This will split larger blocks in order to approach this target\. This feature is notably useful for improved latency, when the receiver can leverage receiving early incomplete data\. This parameter defines a loose target: compressed blocks will target this size "on average", but individual blocks can still be larger or smaller\. Enabling this feature can decrease compression speed by up to ~10% at level 1\. Higher levels will see smaller relative speed regression, becoming invisible at higher settings\.
++.
+ .IP "\(bu" 4
+ \fB\-f\fR, \fB\-\-force\fR: disable input and output checks\. Allows overwriting existing files, input from console, output to stdout, operating on links, block devices, etc\. During decompression and when the output destination is stdout, pass\-through unrecognized formats as\-is\.
++.
+ .IP "\(bu" 4
+ \fB\-c\fR, \fB\-\-stdout\fR: write to standard output (even if it is the console); keep original files (disable \fB\-\-rm\fR)\.
++.
+ .IP "\(bu" 4
+ \fB\-o FILE\fR: save result into \fBFILE\fR\. Note that this operation is in conflict with \fB\-c\fR\. If both operations are present on the command line, the last expressed one wins\.
++.
+ .IP "\(bu" 4
+ \fB\-\-[no\-]sparse\fR: enable / disable sparse FS support, to make files with many zeroes smaller on disk\. Creating sparse files may save disk space and speed up decompression by reducing the amount of disk I/O\. default: enabled when output is into a file, and disabled when output is stdout\. This setting overrides default and can force sparse mode over stdout\.
++.
+ .IP "\(bu" 4
+ \fB\-\-[no\-]pass\-through\fR enable / disable passing through uncompressed files as\-is\. During decompression when pass\-through is enabled, unrecognized formats will be copied as\-is from the input to the output\. By default, pass\-through will occur when the output destination is stdout and the force (\fB\-f\fR) option is set\.
++.
+ .IP "\(bu" 4
+ \fB\-\-rm\fR: remove source file(s) after successful compression or decompression\. This command is silently ignored if output is \fBstdout\fR\. If used in combination with \fB\-o\fR, triggers a confirmation prompt (which can be silenced with \fB\-f\fR), as this is a destructive operation\.
++.
+ .IP "\(bu" 4
+ \fB\-k\fR, \fB\-\-keep\fR: keep source file(s) after successful compression or decompression\. This is the default behavior\.
++.
+ .IP "\(bu" 4
+ \fB\-r\fR: operate recursively on directories\. It selects all files in the named directory and all its subdirectories\. This can be useful both to reduce command line typing, and to circumvent shell expansion limitations, when there are a lot of files and naming breaks the maximum size of a command line\.
++.
+ .IP "\(bu" 4
+ \fB\-\-filelist FILE\fR read a list of files to process as content from \fBFILE\fR\. Format is compatible with \fBls\fR output, with one file per line\.
++.
+ .IP "\(bu" 4
+ \fB\-\-output\-dir\-flat DIR\fR: resulting files are stored into target \fBDIR\fR directory, instead of same directory as origin file\. Be aware that this command can introduce name collision issues, if multiple files, from different directories, end up having the same name\. Collision resolution ensures first file with a given name will be present in \fBDIR\fR, while in combination with \fB\-f\fR, the last file will be present instead\.
++.
+ .IP "\(bu" 4
+ \fB\-\-output\-dir\-mirror DIR\fR: similar to \fB\-\-output\-dir\-flat\fR, the output files are stored underneath target \fBDIR\fR directory, but this option will replicate input directory hierarchy into output \fBDIR\fR\.
++.
+ .IP
+ If input directory contains "\.\.", the files in this directory will be ignored\. If input directory is an absolute directory (i\.e\. "/var/tmp/abc"), it will be stored into the "output\-dir/var/tmp/abc"\. If there are multiple input files or directories, name collision resolution will follow the same rules as \fB\-\-output\-dir\-flat\fR\.
++.
+ .IP "\(bu" 4
+ \fB\-\-format=FORMAT\fR: compress and decompress in other formats\. If compiled with support, zstd can compress to or decompress from other compression algorithm formats\. Possibly available options are \fBzstd\fR, \fBgzip\fR, \fBxz\fR, \fBlzma\fR, and \fBlz4\fR\. If no such format is provided, \fBzstd\fR is the default\.
++.
+ .IP "\(bu" 4
+ \fB\-h\fR/\fB\-H\fR, \fB\-\-help\fR: display help/long help and exit
++.
+ .IP "\(bu" 4
+ \fB\-V\fR, \fB\-\-version\fR: display version number and immediately exit\. note that, since it exits, flags specified after \fB\-V\fR are effectively ignored\. Advanced: \fB\-vV\fR also displays supported formats\. \fB\-vvV\fR also displays POSIX support\. \fB\-qV\fR will only display the version number, suitable for machine reading\.
++.
+ .IP "\(bu" 4
+ \fB\-v\fR, \fB\-\-verbose\fR: verbose mode, display more information
++.
+ .IP "\(bu" 4
+ \fB\-q\fR, \fB\-\-quiet\fR: suppress warnings, interactivity, and notifications\. specify twice to suppress errors too\.
++.
+ .IP "\(bu" 4
+ \fB\-\-no\-progress\fR: do not display the progress bar, but keep all other messages\.
++.
+ .IP "\(bu" 4
+ \fB\-\-show\-default\-cparams\fR: shows the default compression parameters that will be used for a particular input file, based on the provided compression level and the input size\. If the provided file is not a regular file (e\.g\. a pipe), this flag will output the parameters used for inputs of unknown size\.
++.
+ .IP "\(bu" 4
+ \fB\-\-exclude\-compressed\fR: only compress files that are not already compressed\.
++.
+ .IP "\(bu" 4
+ \fB\-\-\fR: All arguments after \fB\-\-\fR are treated as files
++.
+ .IP "" 0
++.
+ .SS "gzip Operation Modifiers"
+ When invoked via a \fBgzip\fR symlink, \fBzstd\fR will support further options that intend to mimic the \fBgzip\fR behavior:
++.
+ .TP
+ \fB\-n\fR, \fB\-\-no\-name\fR
+ do not store the original filename and timestamps when compressing a file\. This is the default behavior and hence a no\-op\.
++.
+ .TP
+ \fB\-\-best\fR
+ alias to the option \fB\-9\fR\.
++.
+ .SS "Environment Variables"
+ Employing environment variables to set parameters has security implications\. Therefore, this avenue is intentionally limited\. Only \fBZSTD_CLEVEL\fR and \fBZSTD_NBTHREADS\fR are currently supported\. They set the default compression level and number of threads to use during compression, respectively\.
++.
+ .P
+ \fBZSTD_CLEVEL\fR can be used to set the level between 1 and 19 (the "normal" range)\. If the value of \fBZSTD_CLEVEL\fR is not a valid integer, it will be ignored with a warning message\. \fBZSTD_CLEVEL\fR just replaces the default compression level (\fB3\fR)\.
++.
+ .P
+-\fBZSTD_NBTHREADS\fR can be used to set the number of threads \fBzstd\fR will attempt to use during compression\. If the value of \fBZSTD_NBTHREADS\fR is not a valid unsigned integer, it will be ignored with a warning message\. \fBZSTD_NBTHREADS\fR has a default value of (\fB1\fR), and is capped at ZSTDMT_NBWORKERS_MAX==200\. \fBzstd\fR must be compiled with multithread support for this variable to have any effect\.
++\fBZSTD_NBTHREADS\fR can be used to set the number of threads \fBzstd\fR will attempt to use during compression\. If the value of \fBZSTD_NBTHREADS\fR is not a valid unsigned integer, it will be ignored with a warning message\. \fBZSTD_NBTHREADS\fR has a default value of \fBmax(1, min(4, nbCores/4))\fR, and is capped at ZSTDMT_NBWORKERS_MAX==200\. \fBzstd\fR must be compiled with multithread support for this variable to have any effect\.
++.
+ .P
+ They can both be overridden by corresponding command line arguments: \fB\-#\fR for compression level and \fB\-T#\fR for number of compression threads\.
++.
+ .SH "ADVANCED COMPRESSION OPTIONS"
+ \fBzstd\fR provides 22 predefined regular compression levels plus the fast levels\. A compression level is translated internally into multiple advanced parameters that control the behavior of the compressor (one can observe the result of this translation with \fB\-\-show\-default\-cparams\fR)\. These advanced parameters can be overridden using advanced compression options\.
++.
+ .SS "\-\-zstd[=options]:"
+ The \fIoptions\fR are provided as a comma\-separated list\. You may specify only the options you want to change and the rest will be taken from the selected or default compression level\. The list of available \fIoptions\fR:
++.
+ .TP
+ \fBstrategy\fR=\fIstrat\fR, \fBstrat\fR=\fIstrat\fR
+ Specify a strategy used by a match finder\.
++.
+ .IP
+ There are 9 strategies numbered from 1 to 9, from fastest to strongest: 1=\fBZSTD_fast\fR, 2=\fBZSTD_dfast\fR, 3=\fBZSTD_greedy\fR, 4=\fBZSTD_lazy\fR, 5=\fBZSTD_lazy2\fR, 6=\fBZSTD_btlazy2\fR, 7=\fBZSTD_btopt\fR, 8=\fBZSTD_btultra\fR, 9=\fBZSTD_btultra2\fR\.
++.
+ .TP
+ \fBwindowLog\fR=\fIwlog\fR, \fBwlog\fR=\fIwlog\fR
+ Specify the maximum number of bits for a match distance\.
++.
+ .IP
+ The higher number of increases the chance to find a match which usually improves compression ratio\. It also increases memory requirements for the compressor and decompressor\. The minimum \fIwlog\fR is 10 (1 KiB) and the maximum is 30 (1 GiB) on 32\-bit platforms and 31 (2 GiB) on 64\-bit platforms\.
++.
+ .IP
+ Note: If \fBwindowLog\fR is set to larger than 27, \fB\-\-long=windowLog\fR or \fB\-\-memory=windowSize\fR needs to be passed to the decompressor\.
++.
+ .TP
+ \fBhashLog\fR=\fIhlog\fR, \fBhlog\fR=\fIhlog\fR
+ Specify the maximum number of bits for a hash table\.
++.
+ .IP
+ Bigger hash tables cause fewer collisions which usually makes compression faster, but requires more memory during compression\.
++.
+ .IP
+ The minimum \fIhlog\fR is 6 (64 entries / 256 B) and the maximum is 30 (1B entries / 4 GiB)\.
++.
+ .TP
+ \fBchainLog\fR=\fIclog\fR, \fBclog\fR=\fIclog\fR
+ Specify the maximum number of bits for the secondary search structure, whose form depends on the selected \fBstrategy\fR\.
++.
+ .IP
+ Higher numbers of bits increases the chance to find a match which usually improves compression ratio\. It also slows down compression speed and increases memory requirements for compression\. This option is ignored for the \fBZSTD_fast\fR \fBstrategy\fR, which only has the primary hash table\.
++.
+ .IP
+ The minimum \fIclog\fR is 6 (64 entries / 256 B) and the maximum is 29 (512M entries / 2 GiB) on 32\-bit platforms and 30 (1B entries / 4 GiB) on 64\-bit platforms\.
++.
+ .TP
+ \fBsearchLog\fR=\fIslog\fR, \fBslog\fR=\fIslog\fR
+ Specify the maximum number of searches in a hash chain or a binary tree using logarithmic scale\.
++.
+ .IP
+ More searches increases the chance to find a match which usually increases compression ratio but decreases compression speed\.
++.
+ .IP
+-The minimum \fIslog\fR is 1 and the maximum is 'windowLog' \- 1\.
++The minimum \fIslog\fR is 1 and the maximum is \'windowLog\' \- 1\.
++.
+ .TP
+ \fBminMatch\fR=\fImml\fR, \fBmml\fR=\fImml\fR
+ Specify the minimum searched length of a match in a hash table\.
++.
+ .IP
+ Larger search lengths usually decrease compression ratio but improve decompression speed\.
++.
+ .IP
+ The minimum \fImml\fR is 3 and the maximum is 7\.
++.
+ .TP
+ \fBtargetLength\fR=\fItlen\fR, \fBtlen\fR=\fItlen\fR
+ The impact of this field vary depending on selected strategy\.
++.
+ .IP
+ For \fBZSTD_btopt\fR, \fBZSTD_btultra\fR and \fBZSTD_btultra2\fR, it specifies the minimum match length that causes match finder to stop searching\. A larger \fBtargetLength\fR usually improves compression ratio but decreases compression speed\.
++.
+ .IP
+ For \fBZSTD_fast\fR, it triggers ultra\-fast mode when > 0\. The value represents the amount of data skipped between match sampling\. Impact is reversed: a larger \fBtargetLength\fR increases compression speed but decreases compression ratio\.
++.
+ .IP
+ For all other strategies, this field has no impact\.
++.
+ .IP
+ The minimum \fItlen\fR is 0 and the maximum is 128 KiB\.
++.
+ .TP
+ \fBoverlapLog\fR=\fIovlog\fR, \fBovlog\fR=\fIovlog\fR
+ Determine \fBoverlapSize\fR, amount of data reloaded from previous job\. This parameter is only available when multithreading is enabled\. Reloading more data improves compression ratio, but decreases speed\.
++.
+ .IP
+ The minimum \fIovlog\fR is 0, and the maximum is 9\. 1 means "no overlap", hence completely independent jobs\. 9 means "full overlap", meaning up to \fBwindowSize\fR is reloaded from previous job\. Reducing \fIovlog\fR by 1 reduces the reloaded amount by a factor 2\. For example, 8 means "windowSize/2", and 6 means "windowSize/8"\. Value 0 is special and means "default": \fIovlog\fR is automatically determined by \fBzstd\fR\. In which case, \fIovlog\fR will range from 6 to 9, depending on selected \fIstrat\fR\.
++.
++.TP
++\fBldmHashRateLog\fR=\fIlhrlog\fR, \fBlhrlog\fR=\fIlhrlog\fR
++Specify the frequency of inserting entries into the long distance matching hash table\.
++.
++.IP
++This option is ignored unless long distance matching is enabled\.
++.
++.IP
++Larger values will improve compression speed\. Deviating far from the default value will likely result in a decrease in compression ratio\.
++.
++.IP
++The default value varies between 4 and 7, depending on \fBstrategy\fR\.
++.
+ .TP
+ \fBldmHashLog\fR=\fIlhlog\fR, \fBlhlog\fR=\fIlhlog\fR
+ Specify the maximum size for a hash table used for long distance matching\.
++.
+ .IP
+ This option is ignored unless long distance matching is enabled\.
++.
+ .IP
+ Bigger hash tables usually improve compression ratio at the expense of more memory during compression and a decrease in compression speed\.
++.
+ .IP
+-The minimum \fIlhlog\fR is 6 and the maximum is 30 (default: 20)\.
++The minimum \fIlhlog\fR is 6 and the maximum is 30 (default: \fBwindowLog \- ldmHashRateLog\fR)\.
++.
+ .TP
+ \fBldmMinMatch\fR=\fIlmml\fR, \fBlmml\fR=\fIlmml\fR
+ Specify the minimum searched length of a match for long distance matching\.
++.
+ .IP
+ This option is ignored unless long distance matching is enabled\.
++.
+ .IP
+ Larger/very small values usually decrease compression ratio\.
++.
+ .IP
+-The minimum \fIlmml\fR is 4 and the maximum is 4096 (default: 64)\.
++The minimum \fIlmml\fR is 4 and the maximum is 4096 (default: 32 to 64, depending on \fBstrategy\fR)\.
++.
+ .TP
+ \fBldmBucketSizeLog\fR=\fIlblog\fR, \fBlblog\fR=\fIlblog\fR
+ Specify the size of each bucket for the hash table used for long distance matching\.
++.
+ .IP
+ This option is ignored unless long distance matching is enabled\.
++.
+ .IP
+ Larger bucket sizes improve collision resolution but decrease compression speed\.
++.
+ .IP
+-The minimum \fIlblog\fR is 1 and the maximum is 8 (default: 3)\.
+-.TP
+-\fBldmHashRateLog\fR=\fIlhrlog\fR, \fBlhrlog\fR=\fIlhrlog\fR
+-Specify the frequency of inserting entries into the long distance matching hash table\.
+-.IP
+-This option is ignored unless long distance matching is enabled\.
+-.IP
+-Larger values will improve compression speed\. Deviating far from the default value will likely result in a decrease in compression ratio\.
+-.IP
+-The default value is \fBwlog \- lhlog\fR\.
++The minimum \fIlblog\fR is 1 and the maximum is 8 (default: 4 to 8, depending on \fBstrategy\fR)\.
++.
+ .SS "Example"
+ The following parameters sets advanced compression options to something similar to predefined level 19 for files bigger than 256 KB:
++.
+ .P
+ \fB\-\-zstd\fR=wlog=23,clog=23,hlog=22,slog=6,mml=3,tlen=48,strat=6
++.
+ .SS "\-B#:"
+ Specify the size of each compression job\. This parameter is only available when multi\-threading is enabled\. Each compression job is run in parallel, so this value indirectly impacts the nb of active threads\. Default job size varies depending on compression level (generally \fB4 * windowSize\fR)\. \fB\-B#\fR makes it possible to manually select a custom size\. Note that job size must respect a minimum value which is enforced transparently\. This minimum is either 512 KB, or \fBoverlapSize\fR, whichever is largest\. Different job sizes will lead to non\-identical compressed frames\.
++.
+ .SH "DICTIONARY BUILDER"
+-\fBzstd\fR offers \fIdictionary\fR compression, which greatly improves efficiency on small files and messages\. It's possible to train \fBzstd\fR with a set of samples, the result of which is saved into a file called a \fBdictionary\fR\. Then, during compression and decompression, reference the same dictionary, using command \fB\-D dictionaryFileName\fR\. Compression of small files similar to the sample set will be greatly improved\.
++\fBzstd\fR offers \fIdictionary\fR compression, which greatly improves efficiency on small files and messages\. It\'s possible to train \fBzstd\fR with a set of samples, the result of which is saved into a file called a \fBdictionary\fR\. Then, during compression and decompression, reference the same dictionary, using command \fB\-D dictionaryFileName\fR\. Compression of small files similar to the sample set will be greatly improved\.
++.
+ .TP
+ \fB\-\-train FILEs\fR
+ Use FILEs as training set to create a dictionary\. The training set should ideally contain a lot of samples (> 100), and weight typically 100x the target dictionary size (for example, ~10 MB for a 100 KB dictionary)\. \fB\-\-train\fR can be combined with \fB\-r\fR to indicate a directory rather than listing all the files, which can be useful to circumvent shell expansion limits\.
++.
+ .IP
+ Since dictionary compression is mostly effective for small files, the expectation is that the training set will only contain small files\. In the case where some samples happen to be large, only the first 128 KiB of these samples will be used for training\.
++.
+ .IP
+ \fB\-\-train\fR supports multithreading if \fBzstd\fR is compiled with threading support (default)\. Additional advanced parameters can be specified with \fB\-\-train\-fastcover\fR\. The legacy dictionary builder can be accessed with \fB\-\-train\-legacy\fR\. The slower cover dictionary builder can be accessed with \fB\-\-train\-cover\fR\. Default \fB\-\-train\fR is equivalent to \fB\-\-train\-fastcover=d=8,steps=4\fR\.
++.
+ .TP
+ \fB\-o FILE\fR
+ Dictionary saved into \fBFILE\fR (default name: dictionary)\.
++.
+ .TP
+ \fB\-\-maxdict=#\fR
+-Limit dictionary to specified size (default: 112640 bytes)\. As usual, quantities are expressed in bytes by default, and it's possible to employ suffixes (like \fBKB\fR or \fBMB\fR) to specify larger values\.
++Limit dictionary to specified size (default: 112640 bytes)\. As usual, quantities are expressed in bytes by default, and it\'s possible to employ suffixes (like \fBKB\fR or \fBMB\fR) to specify larger values\.
++.
+ .TP
+ \fB\-#\fR
+ Use \fB#\fR compression level during training (optional)\. Will generate statistics more tuned for selected compression level, resulting in a \fIsmall\fR compression ratio improvement for this level\.
++.
+ .TP
+ \fB\-B#\fR
+ Split input files into blocks of size # (default: no split)
++.
+ .TP
+ \fB\-M#\fR, \fB\-\-memory=#\fR
+ Limit the amount of sample data loaded for training (default: 2 GB)\. Note that the default (2 GB) is also the maximum\. This parameter can be useful in situations where the training set size is not well controlled and could be potentially very large\. Since speed of the training process is directly correlated to the size of the training sample set, a smaller sample set leads to faster training\.
++.
+ .IP
+ In situations where the training set is larger than maximum memory, the CLI will randomly select samples among the available ones, up to the maximum allowed memory budget\. This is meant to improve dictionary relevance by mitigating the potential impact of clustering, such as selecting only files from the beginning of a list sorted by modification date, or sorted by alphabetical order\. The randomization process is deterministic, so training of the same list of files with the same parameters will lead to the creation of the same dictionary\.
++.
+ .TP
+ \fB\-\-dictID=#\fR
+-A dictionary ID is a locally unique ID\. The decoder will use this value to verify it is using the right dictionary\. By default, zstd will create a 4\-bytes random number ID\. It's possible to provide an explicit number ID instead\. It's up to the dictionary manager to not assign twice the same ID to 2 different dictionaries\. Note that short numbers have an advantage: an ID < 256 will only need 1 byte in the compressed frame header, and an ID < 65536 will only need 2 bytes\. This compares favorably to 4 bytes default\.
++A dictionary ID is a locally unique ID\. The decoder will use this value to verify it is using the right dictionary\. By default, zstd will create a 4\-bytes random number ID\. It\'s possible to provide an explicit number ID instead\. It\'s up to the dictionary manager to not assign twice the same ID to 2 different dictionaries\. Note that short numbers have an advantage: an ID < 256 will only need 1 byte in the compressed frame header, and an ID < 65536 will only need 2 bytes\. This compares favorably to 4 bytes default\.
++.
+ .IP
+-Note that RFC8878 reserves IDs less than 32768 and greater than or equal to 2\e^31, so they should not be used in public\.
++Note that RFC8878 reserves IDs less than 32768 and greater than or equal to 2^31, so they should not be used in public\.
++.
+ .TP
+ \fB\-\-train\-cover[=k#,d=#,steps=#,split=#,shrink[=#]]\fR
+ Select parameters for the default dictionary builder algorithm named cover\. If \fId\fR is not specified, then it tries \fId\fR = 6 and \fId\fR = 8\. If \fIk\fR is not specified, then it tries \fIsteps\fR values in the range [50, 2000]\. If \fIsteps\fR is not specified, then the default value of 40 is used\. If \fIsplit\fR is not specified or split <= 0, then the default value of 100 is used\. Requires that \fId\fR <= \fIk\fR\. If \fIshrink\fR flag is not used, then the default value for \fIshrinkDict\fR of 0 is used\. If \fIshrink\fR is not specified, then the default value for \fIshrinkDictMaxRegression\fR of 1 is used\.
++.
+ .IP
+ Selects segments of size \fIk\fR with highest score to put in the dictionary\. The score of a segment is computed by the sum of the frequencies of all the subsegments of size \fId\fR\. Generally \fId\fR should be in the range [6, 8], occasionally up to 16, but the algorithm will run faster with d <= \fI8\fR\. Good values for \fIk\fR vary widely based on the input data, but a safe range is [2 * \fId\fR, 2000]\. If \fIsplit\fR is 100, all input samples are used for both training and testing to find optimal \fId\fR and \fIk\fR to build dictionary\. Supports multithreading if \fBzstd\fR is compiled with threading support\. Having \fIshrink\fR enabled takes a truncated dictionary of minimum size and doubles in size until compression ratio of the truncated dictionary is at most \fIshrinkDictMaxRegression%\fR worse than the compression ratio of the largest dictionary\.
++.
+ .IP
+ Examples:
++.
+ .IP
+ \fBzstd \-\-train\-cover FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=k=50,d=8 FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=d=8,steps=500 FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=k=50 FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=k=50,split=60 FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=shrink FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-cover=shrink=2 FILEs\fR
++.
+ .TP
+ \fB\-\-train\-fastcover[=k#,d=#,f=#,steps=#,split=#,accel=#]\fR
+ Same as cover but with extra parameters \fIf\fR and \fIaccel\fR and different default value of split If \fIsplit\fR is not specified, then it tries \fIsplit\fR = 75\. If \fIf\fR is not specified, then it tries \fIf\fR = 20\. Requires that 0 < \fIf\fR < 32\. If \fIaccel\fR is not specified, then it tries \fIaccel\fR = 1\. Requires that 0 < \fIaccel\fR <= 10\. Requires that \fId\fR = 6 or \fId\fR = 8\.
++.
+ .IP
+ \fIf\fR is log of size of array that keeps track of frequency of subsegments of size \fId\fR\. The subsegment is hashed to an index in the range [0,2^\fIf\fR \- 1]\. It is possible that 2 different subsegments are hashed to the same index, and they are considered as the same subsegment when computing frequency\. Using a higher \fIf\fR reduces collision but takes longer\.
++.
+ .IP
+ Examples:
++.
+ .IP
+ \fBzstd \-\-train\-fastcover FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-fastcover=d=8,f=15,accel=2 FILEs\fR
++.
+ .TP
+ \fB\-\-train\-legacy[=selectivity=#]\fR
+ Use legacy dictionary builder algorithm with the given dictionary \fIselectivity\fR (default: 9)\. The smaller the \fIselectivity\fR value, the denser the dictionary, improving its efficiency but reducing its achievable maximum size\. \fB\-\-train\-legacy=s=#\fR is also accepted\.
++.
+ .IP
+ Examples:
++.
+ .IP
+ \fBzstd \-\-train\-legacy FILEs\fR
++.
+ .IP
+ \fBzstd \-\-train\-legacy=selectivity=8 FILEs\fR
++.
+ .SH "BENCHMARK"
+-The \fBzstd\fR CLI provides a benchmarking mode that can be used to easily find suitable compression parameters, or alternatively to benchmark a computer's performance\. \fBzstd \-b [FILE(s)]\fR will benchmark \fBzstd\fR for both compression and decompression using default compression level\. Note that results are very dependent on the content being compressed\. It's possible to pass multiple files to the benchmark, and even a directory with \fB\-r DIRECTORY\fR\. When no \fBFILE\fR is provided, the benchmark will use a procedurally generated \fBlorem ipsum\fR text\.
++The \fBzstd\fR CLI provides a benchmarking mode that can be used to easily find suitable compression parameters, or alternatively to benchmark a computer\'s performance\. \fBzstd \-b [FILE(s)]\fR will benchmark \fBzstd\fR for both compression and decompression using default compression level\. Note that results are very dependent on the content being compressed\.
++.
++.P
++It\'s possible to pass multiple files to the benchmark, and even a directory with \fB\-r DIRECTORY\fR\. When no \fBFILE\fR is provided, the benchmark will use a procedurally generated \fBlorem ipsum\fR text\.
++.
++.P
++Benchmarking will employ \fBmax(1, min(4, nbCores/4))\fR worker threads by default in order to match the behavior of the normal CLI I/O\.
++.
+ .IP "\(bu" 4
+ \fB\-b#\fR: benchmark file(s) using compression level #
++.
+ .IP "\(bu" 4
+ \fB\-e#\fR: benchmark file(s) using multiple compression levels, from \fB\-b#\fR to \fB\-e#\fR (inclusive)
++.
+ .IP "\(bu" 4
+ \fB\-d\fR: benchmark decompression speed only (requires providing a zstd\-compressed content)
++.
+ .IP "\(bu" 4
+ \fB\-i#\fR: minimum evaluation time, in seconds (default: 3s), benchmark mode only
++.
+ .IP "\(bu" 4
+ \fB\-B#\fR, \fB\-\-block\-size=#\fR: cut file(s) into independent chunks of size # (default: no chunking)
++.
+ .IP "\(bu" 4
+ \fB\-S\fR: output one benchmark result per input file (default: consolidated result)
++.
+ .IP "\(bu" 4
+ \fB\-D dictionary\fR benchmark using dictionary
++.
+ .IP "\(bu" 4
+ \fB\-\-priority=rt\fR: set process priority to real\-time (Windows)
++.
+ .IP "" 0
++.
+ .P
+ Beyond compression levels, benchmarking is also compatible with other parameters, such as number of threads (\fB\-T#\fR), advanced compression parameters (\fB\-\-zstd=###\fR), dictionary compression (\fB\-D dictionary\fR), or even disabling checksum verification for example\.
++.
+ .P
+ \fBOutput Format:\fR CompressionLevel#Filename: InputSize \-> OutputSize (CompressionRatio), CompressionSpeed, DecompressionSpeed
++.
+ .P
+ \fBMethodology:\fR For speed measurement, the entire input is compressed/decompressed in\-memory to measure speed\. A run lasts at least 1 sec, so when files are small, they are compressed/decompressed several times per run, in order to improve measurement accuracy\.
++.
+ .SH "SEE ALSO"
+ \fBzstdgrep\fR(1), \fBzstdless\fR(1), \fBgzip\fR(1), \fBxz\fR(1)
++.
+ .P
+-The \fIzstandard\fR format is specified in Y\. Collet, "Zstandard Compression and the 'application/zstd' Media Type", https://www\.ietf\.org/rfc/rfc8878\.txt, Internet RFC 8878 (February 2021)\.
++The \fIzstandard\fR format is specified in Y\. Collet, "Zstandard Compression and the \'application/zstd\' Media Type", https://www\.ietf\.org/rfc/rfc8878\.txt, Internet RFC 8878 (February 2021)\.
++.
+ .SH "BUGS"
+ Report bugs at: https://github\.com/facebook/zstd/issues
++.
+ .SH "AUTHOR"
+ Yann Collet
+diff --git a/programs/zstdgrep.1 b/programs/zstdgrep.1
+index d7fda583398..fc79e82e326 100644
+--- a/programs/zstdgrep.1
++++ b/programs/zstdgrep.1
+@@ -1,5 +1,5 @@
+ .
+-.TH "ZSTDGREP" "1" "March 2024" "zstd 1.5.6" "User Commands"
++.TH "ZSTDGREP" "1" "February 2025" "zstd 1.5.7" "User Commands"
+ .
+ .SH "NAME"
+ \fBzstdgrep\fR \- print lines matching a pattern in zstandard\-compressed files
+diff --git a/programs/zstdless.1 b/programs/zstdless.1
+index 7dd65f8fc44..ad5048a02c7 100644
+--- a/programs/zstdless.1
++++ b/programs/zstdless.1
+@@ -1,5 +1,5 @@
+ .
+-.TH "ZSTDLESS" "1" "March 2024" "zstd 1.5.6" "User Commands"
++.TH "ZSTDLESS" "1" "February 2025" "zstd 1.5.7" "User Commands"
+ .
+ .SH "NAME"
+ \fBzstdless\fR \- view zstandard\-compressed files

From 6c1d92dac9ae370ea4c8780d02ee23d1fbe28a2e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 11 May 2026 22:54:37 +0200
Subject: [PATCH 291/831] python3Minimal: exclude zstd on minimal

Evade eval errors during bootstrap.
---
 pkgs/development/interpreters/python/cpython/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index 849ed85648e0..1df3ba77044a 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -31,6 +31,7 @@
   sqlite,
   xz,
   zlib,
+  withZstd ? !withMinimalDeps,
   zstd,
 
   # platform-specific dependencies
@@ -289,7 +290,7 @@ let
     ++ optionals withExpat [
       expat
     ]
-    ++ optionals (passthru.pythonAtLeast "3.14") [
+    ++ optionals (withZstd && passthru.pythonAtLeast "3.14") [
       zstd
     ]
     ++ optionals bluezSupport [

From 7385b5369eb87464fc2a2ad05ad97699664beb90 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:03:48 +0200
Subject: [PATCH 292/831] python3Packages.installer: 1.0.0 -> 1.0.1

https://github.com/pypa/installer/blob/1.0.1/docs/changelog.md
---
 pkgs/development/python-modules/installer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/installer/default.nix b/pkgs/development/python-modules/installer/default.nix
index b0fcdf21f463..677be93995a5 100644
--- a/pkgs/development/python-modules/installer/default.nix
+++ b/pkgs/development/python-modules/installer/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "installer";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "installer";
     rev = version;
-    hash = "sha256-zOnDOaH+9h78Z1667n1Cr8HIm8+OPn2Vc1Zl4XksiCM=";
+    hash = "sha256-GkHLZfzHfTcBL8wQmIGlNkVodEw9Pih4i1SS36mSfBo=";
   };
 
   patches = [

From 202edcd58283cd0fa5e1a2a0770d6504c2de898a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:04:42 +0200
Subject: [PATCH 293/831] python3Packages.build: 1.4.4 -> 1.5.0

https://github.com/pypa/build/blob/1.5.0/CHANGELOG.rst
---
 pkgs/development/python-modules/build/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 5764651403a0..194e56dd34f9 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "build";
-  version = "1.4.4";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "build";
     tag = version;
-    hash = "sha256-QprU0sXL6FL0rSVJwu8cYpcPlnYKzKAbkyDaTV778js=";
+    hash = "sha256-Kxqqh9HfNC28CxFHzVkNVzqNM8MVkLgkaCU2jxpjceA=";
   };
 
   build-system = [ flit-core ];

From a76a96a0855da3a5c98444d4fc283e33adcca017 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:12:30 +0200
Subject: [PATCH 294/831] python3Packages.wheel: 0.46.1 -> 0.47.0

https://github.com/pypa/wheel/compare/0.46.1...0.47.0
---
 pkgs/development/python-modules/wheel/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/wheel/default.nix b/pkgs/development/python-modules/wheel/default.nix
index 50696d7c0cf5..4aca9e5d587d 100644
--- a/pkgs/development/python-modules/wheel/default.nix
+++ b/pkgs/development/python-modules/wheel/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "wheel";
-  version = "0.46.1";
+  version = "0.47.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "wheel";
     tag = version;
-    hash = "sha256-iyGfGr3pLVZSEIHetjsPbIIXkuXrmIPiSqqOw31l9Qw=";
+    hash = "sha256-/5OxFySesdsFsuUbhdhcgFPsry8RSy5ZshG0TWGncVY=";
   };
 
   nativeBuildInputs = [ flit-core ];

From 5aba6aebb6996044bc15a3bb11a3855fa486845e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 19 May 2026 01:08:40 +0200
Subject: [PATCH 295/831] python3Packages.distutils_80: init at 80.10.2

---
 .../python-modules/distutils/80.nix           | 91 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  3 +
 2 files changed, 94 insertions(+)
 create mode 100644 pkgs/development/python-modules/distutils/80.nix

diff --git a/pkgs/development/python-modules/distutils/80.nix b/pkgs/development/python-modules/distutils/80.nix
new file mode 100644
index 000000000000..8d9c304afded
--- /dev/null
+++ b/pkgs/development/python-modules/distutils/80.nix
@@ -0,0 +1,91 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonAtLeast,
+  setuptools-scm,
+  setuptools_80,
+  python,
+  docutils,
+  jaraco-collections,
+  jaraco-functools,
+  jaraco-envs,
+  jaraco-path,
+  jaraco-text,
+  libz,
+  more-itertools,
+  packaging,
+  path,
+  pyfakefs,
+  pytestCheckHook,
+  stdenv,
+}:
+
+buildPythonPackage {
+  pname = "distutils";
+  inherit (setuptools_80) version;
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "distutils";
+    rev = "5ad8291ff2ad3e43583bc72a4c09299ca6134f09"; # correlate commit from setuptools version
+    hash = "sha256-3Mqpe/Goj3lQ6GEbX3DHWjdoh7XsFIg9WkOCK138OAo=";
+  };
+
+  postPatch = ''
+    sed -i '/coherent\.licensed/d' pyproject.toml
+  '';
+
+  build-system = [ setuptools-scm ];
+
+  dependencies = [
+    jaraco-collections
+    jaraco-functools
+    more-itertools
+    packaging
+  ];
+
+  postInstall = ''
+    rm -r $out/${python.sitePackages}/distutils
+    ln -s ${setuptools_80}/${python.sitePackages}/setuptools/_distutils $out/${python.sitePackages}/distutils
+  '';
+
+  pythonImportsCheck = [ "distutils" ];
+
+  nativeCheckInputs = [
+    docutils
+    jaraco-envs
+    jaraco-path
+    jaraco-text
+    more-itertools
+    path
+    pyfakefs
+    pytestCheckHook
+  ];
+
+  checkInputs = [
+    # https://github.com/pypa/distutils/blob/5ad8291ff2ad3e43583bc72a4c09299ca6134f09/distutils/tests/test_build_ext.py#L107
+    libz
+  ];
+
+  # jaraco-path depends ob pyobjc
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  disabledTests = [
+    #  TypeError: byte_compile() got an unexpected keyword argument 'dry_run'
+    "test_byte_compile"
+    "test_byte_compile_optimized"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    #  AssertionError: assert '(?s:foo[^/]*)\\z' == '(?s:foo[^/]*)\\Z'
+    "test_glob_to_re"
+  ];
+
+  meta = {
+    description = "Distutils as found in cpython";
+    homepage = "https://github.com/pypa/distutils";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0927c751981e..bf307ade35ac 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4091,6 +4091,9 @@ self: super: with self; {
 
   distutils-extra = callPackage ../development/python-modules/distutils-extra { };
 
+  distutils_80 =
+    if pythonOlder "3.12" then null else callPackage ../development/python-modules/distutils/80.nix { };
+
   dj-database-url = callPackage ../development/python-modules/dj-database-url { };
 
   dj-email-url = callPackage ../development/python-modules/dj-email-url { };

From a0d82aa87667d55a44560f9f8e5e20d0660bf32e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:15:49 +0200
Subject: [PATCH 296/831] python3Packages.setuptools: 80.10.1 -> 82.0.1

https://setuptools.pypa.io/en/stable/history.html#v82-0-1
---
 .../python-modules/setuptools/default.nix          | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/setuptools/default.nix b/pkgs/development/python-modules/setuptools/default.nix
index 657d23f35073..7daa5062fbb8 100644
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@@ -7,16 +7,16 @@
   python,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "setuptools";
-  version = "80.10.1";
+  version = "82.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "setuptools";
-    tag = "v${version}";
-    hash = "sha256-s/gfJc3yxvCE6cjP03vtIZqNFmoZKR3d7+4gTPk1hQg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-M4fB+R4UNla2VlcWNhfDLvExQMpjLkPkgVsU4vg6ImU=";
   };
 
   patches = [
@@ -29,7 +29,7 @@ buildPythonPackage rec {
 
     # Substitute version for reproducible builds
     substituteInPlace setuptools/version.py \
-      --replace-fail '@version@' '${version}'
+      --replace-fail '@version@' '${finalAttrs.version}'
   '';
 
   preBuild = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
@@ -47,10 +47,10 @@ buildPythonPackage rec {
     description = "Utilities to facilitate the installation of Python packages";
     homepage = "https://github.com/pypa/setuptools";
     changelog = "https://setuptools.pypa.io/en/stable/history.html#v${
-      lib.replaceStrings [ "." ] [ "-" ] version
+      lib.replaceString "." "-" finalAttrs.version
     }";
     license = with lib.licenses; [ mit ];
     platforms = python.meta.platforms;
     teams = [ lib.teams.python ];
   };
-}
+})

From 388458978c392b723a844df7b5f906684a96f974 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 17 May 2026 22:52:46 +0200
Subject: [PATCH 297/831] python3Packages.distutils: 80.10.1 -> 82.0.1

---
 pkgs/development/python-modules/distutils/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/distutils/default.nix b/pkgs/development/python-modules/distutils/default.nix
index 727b109d64bc..1039dea6e13f 100644
--- a/pkgs/development/python-modules/distutils/default.nix
+++ b/pkgs/development/python-modules/distutils/default.nix
@@ -29,10 +29,14 @@ buildPythonPackage {
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "distutils";
-    rev = "5ad8291ff2ad3e43583bc72a4c09299ca6134f09"; # correlate commit from setuptools version
-    hash = "sha256-3Mqpe/Goj3lQ6GEbX3DHWjdoh7XsFIg9WkOCK138OAo=";
+    rev = "f10ac6219960991c98b821cf2544bf9c2864ebc2"; # correlate commit from setuptools version
+    hash = "sha256-KzC7zvrC7fsAQhLFZvep/F+yDRzsBDYtir1EA7gdpGM=";
   };
 
+  postPatch = ''
+    sed -i '/coherent\.licensed/d' pyproject.toml
+  '';
+
   build-system = [ setuptools-scm ];
 
   dependencies = [

From a03725a6c6bdaa098a6e48a70c447a102385ff7a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:27:01 +0200
Subject: [PATCH 298/831] python3Packages.setuptools_80: init at 80.10.2

81 is the last version with pkg_resources module.
80 is the last version with dry_run arg in copy_file function.
---
 .../python-modules/setuptools/80.nix          | 56 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 58 insertions(+)
 create mode 100644 pkgs/development/python-modules/setuptools/80.nix

diff --git a/pkgs/development/python-modules/setuptools/80.nix b/pkgs/development/python-modules/setuptools/80.nix
new file mode 100644
index 000000000000..a051cb776fa3
--- /dev/null
+++ b/pkgs/development/python-modules/setuptools/80.nix
@@ -0,0 +1,56 @@
+{
+  stdenv,
+  lib,
+  buildPythonPackage,
+  distutils_80,
+  fetchFromGitHub,
+  python,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "setuptools";
+  version = "80.10.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "setuptools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-kf2c4auQrZDGW8bM0SxOPFsR8IE4b0coevTxKWGtHp8=";
+  };
+
+  patches = [
+    ./reproducible-wheel.patch
+  ];
+
+  # Drop dependency on coherent.license, which in turn requires coherent.build
+  postPatch = ''
+    sed -i "/coherent.licensed/d" pyproject.toml
+
+    # Substitute version for reproducible builds
+    substituteInPlace setuptools/version.py \
+      --replace-fail '@version@' '${finalAttrs.version}'
+  '';
+
+  preBuild = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
+    export SETUPTOOLS_INSTALL_WINDOWS_SPECIFIC_FILES=0
+  '';
+
+  # Requires pytest, causing infinite recursion.
+  doCheck = false;
+
+  passthru.tests = {
+    inherit distutils_80;
+  };
+
+  meta = {
+    description = "Utilities to facilitate the installation of Python packages";
+    homepage = "https://github.com/pypa/setuptools";
+    changelog = "https://setuptools.pypa.io/en/stable/history.html#v${
+      lib.replaceString "." "-" finalAttrs.version
+    }";
+    license = with lib.licenses; [ mit ];
+    platforms = python.meta.platforms;
+    teams = [ lib.teams.python ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bf307ade35ac..126941497f48 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -27,6 +27,8 @@ self: super: with self; {
 
   setuptools = callPackage ../development/python-modules/setuptools { };
 
+  setuptools_80 = callPackage ../development/python-modules/setuptools/80.nix { };
+
   # by_regex ensures inherit statements are sorted after the (first) attribute name that is inherited.
   # keep-sorted start block=yes newline_separated=yes by_regex=["(?:inherit\\s+\\([^)]+\\)\\n?\\s*)?(.+)"]
   a2a-sdk = callPackage ../development/python-modules/a2a-sdk { };

From d00eb26967dfa68e63cd0d901e6a50e9ce0ea8b6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:53:38 +0200
Subject: [PATCH 299/831] python3Packages.vcs-versioning: init at 1.1.1

---
 .../python-modules/vcs-versioning/default.nix | 60 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/development/python-modules/vcs-versioning/default.nix

diff --git a/pkgs/development/python-modules/vcs-versioning/default.nix b/pkgs/development/python-modules/vcs-versioning/default.nix
new file mode 100644
index 000000000000..096da5eac421
--- /dev/null
+++ b/pkgs/development/python-modules/vcs-versioning/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  packaging,
+  setuptools,
+  git,
+  pytestCheckHook,
+  vcs-versioning,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "vcs-versioning";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "setuptools-scm";
+    tag = "vcs-versioning-v${finalAttrs.version}";
+    hash = "sha256-CfRzupWFtvmQLbubyr+eXRnLi4auZc2PA/Zz0aFNgaU=";
+  };
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = finalAttrs.version;
+
+  postPatch = ''
+    pushd vcs-versioning
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    packaging
+  ];
+
+  pythonImportsCheck = [
+    "vcs_versioning"
+  ];
+
+  doCheck = false; # infinite recursion with pytest
+
+  nativeCheckInputs = [
+    git
+    pytestCheckHook
+  ];
+
+  pytestFlags = [ "-vvv" ];
+
+  passthru.tests.pytest = vcs-versioning.overridePythonAttrs { doCheck = true; };
+
+  meta = {
+    changelog = "https://github.com/pypa/setuptools-scm/releases/tag/${finalAttrs.src.tag}";
+    description = "The blessed package to manage your versions by scm tags";
+    homepage = "https://github.com/pypa/setuptools-scm/tree/main/vcs-versioning";
+    license = lib.licenses.mit;
+    teams = [ lib.teams.python ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 126941497f48..0affe265a11a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -21069,6 +21069,8 @@ self: super: with self; {
 
   vcrpy = callPackage ../development/python-modules/vcrpy { };
 
+  vcs-versioning = callPackage ../development/python-modules/vcs-versioning { };
+
   vcversioner = callPackage ../development/python-modules/vcversioner { };
 
   vdf = callPackage ../development/python-modules/vdf { };

From 729d33e350be215e02394760f6caa6cea36766ad Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 01:54:00 +0200
Subject: [PATCH 300/831] python3Packages.setuptools-scm: 9.2.2 -> 10.0.5

https://github.com/pypa/setuptools_scm/blob/10.0.5/CHANGELOG.md
---
 .../python-modules/setuptools-scm/default.nix          | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/setuptools-scm/default.nix b/pkgs/development/python-modules/setuptools-scm/default.nix
index 876eb1e9cbd8..3b855063ad5e 100644
--- a/pkgs/development/python-modules/setuptools-scm/default.nix
+++ b/pkgs/development/python-modules/setuptools-scm/default.nix
@@ -8,8 +8,7 @@
   setuptools,
 
   # dependencies
-  packaging,
-  typing-extensions,
+  vcs-versioning,
 
   # optional-dependencies
   rich,
@@ -17,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "setuptools-scm";
-  version = "9.2.2";
+  version = "10.0.5";
   pyproject = true;
 
   src = fetchPypi {
     pname = "setuptools_scm";
     inherit version;
-    hash = "sha256-HGdKtGZWhqCIfX4kwDqyXyQgHCE+guponS8+Fp7371c=";
+    hash = "sha256-u7qP51RRbN79AX9EVnIXdebvlmK9eIf7Uq4mgT1IOMM=";
   };
 
   postPatch = null;
@@ -31,9 +30,8 @@ buildPythonPackage rec {
   build-system = [ setuptools ];
 
   dependencies = [
-    packaging
     setuptools
-    typing-extensions
+    vcs-versioning
   ];
 
   optional-dependencies = {

From 2372f065add76dcb494b003989827c862231c461 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:29:07 +0200
Subject: [PATCH 301/831] python3Packages.zope-event: 6.1 -> 6.2

https://github.com/zopefoundation/zope.event/blob/6.2/CHANGES.rst
---
 .../python-modules/zope-event/default.nix        | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/zope-event/default.nix b/pkgs/development/python-modules/zope-event/default.nix
index 0c33629346d7..5d8ff0a4d2a9 100644
--- a/pkgs/development/python-modules/zope-event/default.nix
+++ b/pkgs/development/python-modules/zope-event/default.nix
@@ -2,23 +2,23 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "zope-event";
-  version = "6.1";
+  version = "6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zopefoundation";
     repo = "zope.event";
-    tag = version;
-    hash = "sha256-ugyHPqqFcObgldThkkUQgZnl1fVEcXYFnXyAxNwUFIE=";
+    tag = finalAttrs.version;
+    hash = "sha256-FoE9bdr/JcOaB8/OQTUmxGrNgIDc1vPDlmZq0v+bjmQ=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   pythonImportsCheck = [ "zope.event" ];
 
@@ -31,8 +31,8 @@ buildPythonPackage rec {
   meta = {
     description = "Event publishing system";
     homepage = "https://github.com/zopefoundation/zope.event";
-    changelog = "https://github.com/zopefoundation/zope.event/blob/${src.tag}/CHANGES.rst";
+    changelog = "https://github.com/zopefoundation/zope.event/blob/${finalAttrs.src.tag}/CHANGES.rst";
     license = lib.licenses.zpl21;
     maintainers = [ ];
   };
-}
+})

From 73b7906d92df92fad0ca571aa6d52df7bc2e9aa7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 3 May 2026 11:02:59 -0700
Subject: [PATCH 302/831] python3Packages.poetry-core: 2.3.2 -> 2.4.0

Diff: https://github.com/python-poetry/poetry-core/compare/2.3.2...2.4.0

Changelog: https://github.com/python-poetry/poetry-core/blob/2.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/poetry-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/poetry-core/default.nix b/pkgs/development/python-modules/poetry-core/default.nix
index be7b67a21b50..d158236eff78 100644
--- a/pkgs/development/python-modules/poetry-core/default.nix
+++ b/pkgs/development/python-modules/poetry-core/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "poetry-core";
-  version = "2.3.2";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = "poetry-core";
     tag = version;
-    hash = "sha256-Rv6JCHsqu5rRvihGaUFcRk/NUT90bnIUM01QxUUkxh4=";
+    hash = "sha256-i9EucMsoX8Z0iyhNDVYaczv1CSY/KaZpMjn/FGzIJU4=";
   };
 
   nativeCheckInputs = [

From ed3453c6941da21956553959ece02f42bd119d09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 27 Apr 2026 07:29:39 -0700
Subject: [PATCH 303/831] python3Packages.uv-build: 0.10.0 -> 0.11.8

Diff: https://github.com/astral-sh/uv/compare/0.10.0...0.11.8

Changelog: https://github.com/astral-sh/uv/blob/0.11.8/CHANGELOG.md
---
 pkgs/development/python-modules/uv-build/default.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/uv-build/default.nix b/pkgs/development/python-modules/uv-build/default.nix
index c37b17d316c7..bf45da4ab785 100644
--- a/pkgs/development/python-modules/uv-build/default.nix
+++ b/pkgs/development/python-modules/uv-build/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uv-build";
-  version = "0.10.0";
+  version = "0.11.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-nD26zqKMK5LNkeYdqVYteeYL4mYaQQ/QlyjbMDDhLAY=";
+    hash = "sha256-wu9EA3z/qj29lfSj8wKE4p8XEAJQakQTg2AK8I/64us=";
   };
 
   nativeBuildInputs = [
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-lEynVemQHCI7ZKD2+1n4K/AtEYRld2+aRLkDMSX8ejM=";
+    hash = "sha256-ygGRoZgD88Q2EkN0U4SDTwya96Ds3Pqy3Llj8cjGwnY=";
   };
 
   buildAndTestSubdir = "crates/uv-build";
@@ -47,9 +47,10 @@ buildPythonPackage (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://github.com/astral-sh/uv/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Minimal build backend for uv";
     homepage = "https://docs.astral.sh/uv/reference/settings/#build-backend";
-    inherit (pkgs.uv.meta) changelog license;
+    inherit (pkgs.uv.meta) license;
     maintainers = with lib.maintainers; [ bengsparks ];
   };
 })

From ddb28fa0cb827873e6c51e86909433ed4312e627 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 26 Apr 2026 10:58:55 -0700
Subject: [PATCH 304/831] python3Packages.filelock: 3.20.3 -> 3.29.0

Diff: https://github.com/tox-dev/filelock/compare/3.20.3...3.29.0

Changelog: https://github.com/tox-dev/py-filelock/releases/tag/3.29.0
---
 .../python-modules/filelock/default.nix            | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index 54fc63da2f08..1ef40a71fc1f 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   hatch-vcs,
   hatchling,
   pytest-asyncio,
@@ -12,12 +12,14 @@
 
 buildPythonPackage rec {
   pname = "filelock";
-  version = "3.20.3";
+  version = "3.29.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-GMV+6RXH7GHP8Oz38Phpk2x8MBkbsM9AbxNBd40INOE=";
+  src = fetchFromGitHub {
+    owner = "tox-dev";
+    repo = "filelock";
+    tag = version;
+    hash = "sha256-efBEyjuCcLkHsfpG61eKN6ALk4QW4UMdNmD56rSgFLc=";
   };
 
   build-system = [
@@ -43,7 +45,7 @@ buildPythonPackage rec {
     changelog = "https://github.com/tox-dev/py-filelock/releases/tag/${version}";
     description = "Platform independent file lock for Python";
     homepage = "https://github.com/benediktschmitt/py-filelock";
-    license = lib.licenses.unlicense;
+    license = lib.licenses.mit;
     maintainers = [ ];
   };
 }

From 53b29af49e5ba0b41134cefdc725b4c1f16af357 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 26 Apr 2026 10:52:55 -0700
Subject: [PATCH 305/831] python3Packages.virtualenv: 20.36.1 -> 21.2.4

Diff: https://github.com/pypa/virtualenv/compare/20.36.1...21.2.4

Changelog: https://github.com/pypa/virtualenv/blob/21.2.4/docs/changelog.rst
---
 pkgs/development/python-modules/virtualenv/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index a51ae2bbd75e..dbdb04131e0d 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -12,19 +12,20 @@
   pytest-freezer,
   pytest-mock,
   pytestCheckHook,
+  python-discovery,
   time-machine,
 }:
 
 buildPythonPackage rec {
   pname = "virtualenv";
-  version = "20.36.1";
+  version = "21.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypa";
     repo = "virtualenv";
     tag = version;
-    hash = "sha256-8fiC7+9FzQnmoI+N4cA5kKBLH9tpU7LXZ7pVj8Bz8Wc=";
+    hash = "sha256-3Ed2h5zzjpm+D1fQW2urWYcO/6sFGuZtueQxUnIu3MY=";
   };
 
   build-system = [
@@ -36,6 +37,7 @@ buildPythonPackage rec {
     distlib
     filelock
     platformdirs
+    python-discovery
   ];
 
   nativeCheckInputs = [

From 01204a518c1c5d7cde86e36259f5fb3eb4e1c95e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 28 Apr 2026 20:56:42 -0700
Subject: [PATCH 306/831] python3Packages.starlette: cleanup

---
 .../development/python-modules/starlette/default.nix | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index e66a5cf7a80d..98974519d575 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   pyproject = true;
 
   src = fetchFromGitHub {
-    owner = "encode";
+    owner = "Kludex";
     repo = "starlette";
     tag = version;
     hash = "sha256-9iQXlpA1VDGw1c7X1zJPmJ3Dub46PwqrVIX1+fWOZ7M=";
@@ -56,12 +56,6 @@ buildPythonPackage rec {
   ]
   ++ lib.concatAttrValues optional-dependencies;
 
-  pytestFlags = [
-    "-Wignore::DeprecationWarning"
-    "-Wignore::trio.TrioDeprecationWarning"
-    "-Wignore::ResourceWarning" # FIXME remove once test suite is fully compatible with anyio 4.4.0
-  ];
-
   pythonImportsCheck = [ "starlette" ];
 
   passthru.tests = {
@@ -69,8 +63,8 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://www.starlette.io/release-notes/#${lib.replaceStrings [ "." ] [ "" ] version}";
-    downloadPage = "https://github.com/encode/starlette";
+    changelog = "https://github.com/Kludex/starlette/blob/${src.tag}/docs/release-notes.md";
+    downloadPage = "https://github.com/Kludex/starlette";
     homepage = "https://www.starlette.io/";
     description = "Little ASGI framework that shines";
     license = lib.licenses.bsd3;

From c04487ac166ea634cd2a2ab70604d2321dd48019 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 28 Apr 2026 21:19:06 -0700
Subject: [PATCH 307/831] python3Packages.fastapi-cli: 0.0.20 -> 0.0.24

Diff: https://github.com/fastapi/fastapi-cli/compare/0.0.20...0.0.24

Changelog: https://github.com/fastapi/fastapi-cli/releases/tag/0.0.24
---
 pkgs/development/python-modules/fastapi-cli/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi-cli/default.nix b/pkgs/development/python-modules/fastapi-cli/default.nix
index b13bcff26a20..9a314d21ca1b 100644
--- a/pkgs/development/python-modules/fastapi-cli/default.nix
+++ b/pkgs/development/python-modules/fastapi-cli/default.nix
@@ -15,14 +15,14 @@
 let
   self = buildPythonPackage rec {
     pname = "fastapi-cli";
-    version = "0.0.20";
+    version = "0.0.24";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "fastapi";
       repo = "fastapi-cli";
       tag = version;
-      hash = "sha256-RTxu6WmKmGMVsQ2izd8j8P+gGbXV91gVjb95JC52e8Q=";
+      hash = "sha256-LEo8to1mspauTMCQ5Zf6znG0ALqF5XtauPar5bqN6/Q=";
     };
 
     build-system = [ pdm-backend ];
@@ -37,6 +37,11 @@ let
     optional-dependencies = {
       standard = [
         uvicorn
+        # FIXME package fastapi-cloud-cli
+      ]
+      ++ uvicorn.optional-dependencies.standard;
+      standard-no-fastapi-cloud-cli = [
+        uvicorn
       ]
       ++ uvicorn.optional-dependencies.standard;
     };

From ec7194a37a87948f0e3de2411fed623a30d5775d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 28 Apr 2026 21:12:32 -0700
Subject: [PATCH 308/831] python3Packages.fastapi: update dependencies

---
 .../python-modules/fastapi/default.nix        | 49 +++++++------------
 1 file changed, 18 insertions(+), 31 deletions(-)

diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 3e29f81a9da2..886b6ecccd7c 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -11,6 +11,7 @@
   starlette,
   pydantic,
   typing-extensions,
+  typing-inspection,
 
   # tests
   anyio,
@@ -18,15 +19,11 @@
   dirty-equals,
   flask,
   inline-snapshot,
-  passlib,
   pwdlib,
   pyjwt,
-  pytest-asyncio,
   pytest-xdist,
   pytest-timeout,
   pytestCheckHook,
-  sqlalchemy,
-  trio,
 
   # optional-dependencies
   fastapi-cli,
@@ -35,8 +32,6 @@
   itsdangerous,
   python-multipart,
   pyyaml,
-  ujson,
-  orjson,
   email-validator,
   uvicorn,
   pydantic-settings,
@@ -57,16 +52,12 @@ buildPythonPackage rec {
 
   build-system = [ pdm-backend ];
 
-  pythonRelaxDeps = [
-    "anyio"
-    "starlette"
-  ];
-
   dependencies = [
     annotated-doc
     starlette
     pydantic
     typing-extensions
+    typing-inspection
   ];
 
   optional-dependencies = {
@@ -77,12 +68,8 @@ buildPythonPackage rec {
       python-multipart
       itsdangerous
       pyyaml
-      ujson
-      orjson
       email-validator
       uvicorn
-    ]
-    ++ lib.optionals (lib.versionAtLeast pydantic.version "2") [
       pydantic-settings
       pydantic-extra-types
     ]
@@ -90,56 +77,56 @@ buildPythonPackage rec {
     ++ uvicorn.optional-dependencies.standard;
     standard = [
       fastapi-cli
+      # FIXME package fastar
       httpx
       jinja2
       python-multipart
       email-validator
       uvicorn
+      pydantic-settings
+      pydantic-extra-types
     ]
     ++ fastapi-cli.optional-dependencies.standard
     ++ uvicorn.optional-dependencies.standard;
+    standard-no-fastapi-cloud-cli = [
+      fastapi-cli
+      httpx
+      jinja2
+      python-multipart
+      email-validator
+      uvicorn
+      pydantic-settings
+      pydantic-extra-types
+    ]
+    ++ fastapi-cli.optional-dependencies.standard-no-fastapi-cloud-cli
+    ++ uvicorn.optional-dependencies.standard;
   };
 
   nativeCheckInputs = [
+    a2wsgi
     anyio
     a2wsgi
     dirty-equals
     flask
     inline-snapshot
-    passlib
     pwdlib
     pyjwt
     pytestCheckHook
-    pytest-asyncio
     pytest-xdist
     pytest-timeout
-    trio
-    sqlalchemy
   ]
   ++ anyio.optional-dependencies.trio
-  ++ passlib.optional-dependencies.bcrypt
   ++ optional-dependencies.all;
 
-  pytestFlags = [
-    # ignoring deprecation warnings to avoid test failure from
-    # tests/test_tutorial/test_testing/test_tutorial001.py
-    "-Wignore::DeprecationWarning"
-    "-Wignore::pytest.PytestUnraisableExceptionWarning"
-  ];
-
   disabledTests = [
     # Coverage test
     "test_fastapi_cli"
-    # Likely pydantic compat issue
-    "test_exception_handler_body_access"
   ];
 
   disabledTestPaths = [
     # Don't test docs and examples
     "docs_src"
     "tests/test_tutorial/test_sql_databases"
-    "tests/test_tutorial/test_static_files"
-    "tests/test_tutorial/test_custom_docs_ui"
     # Infinite recursion with strawberry-graphql
     "tests/test_tutorial/test_graphql/test_tutorial001.py"
   ];

From b35c7a165927f2f25a9c9831670f8ecb37de0017 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:54:50 +0200
Subject: [PATCH 309/831] python3Packages.html5lib: pin to setuptools_80

Requires pkg_resources.
---
 pkgs/development/python-modules/html5lib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/html5lib/default.nix b/pkgs/development/python-modules/html5lib/default.nix
index dc252d84b8a1..63ccf4c8f2a5 100644
--- a/pkgs/development/python-modules/html5lib/default.nix
+++ b/pkgs/development/python-modules/html5lib/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   six,
   webencodings,
   pytest-expect,
@@ -29,7 +29,7 @@ buildPythonPackage {
     ./pytest9-compat.patch
   ];
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     six

From bffbd23fea6a2f260b60204fdd13e450641459b1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:56:52 +0200
Subject: [PATCH 310/831] python3Packages.packaging: 26.1 -> 26.2

https://github.com/pypa/packaging/blob/26.2/CHANGELOG.rst
---
 .../python-modules/packaging/default.nix      | 92 +++++++++----------
 1 file changed, 45 insertions(+), 47 deletions(-)

diff --git a/pkgs/development/python-modules/packaging/default.nix b/pkgs/development/python-modules/packaging/default.nix
index ebf39f5d92cd..25e98c490a21 100644
--- a/pkgs/development/python-modules/packaging/default.nix
+++ b/pkgs/development/python-modules/packaging/default.nix
@@ -7,56 +7,54 @@
   flit-core,
 
   # tests
+  packaging,
   pretend,
   pytestCheckHook,
 }:
 
-let
-  packaging = buildPythonPackage rec {
-    pname = "packaging";
-    version = "26.1";
-    pyproject = true;
+buildPythonPackage (finalAttrs: {
+  pname = "packaging";
+  version = "26.2";
+  pyproject = true;
 
-    src = fetchPypi {
-      inherit pname version;
-      hash = "sha256-8EIVK2gcS/rFyuJ0KlXhA9J6suwPPYgDcTa2v+fJxd4=";
-    };
-
-    nativeBuildInputs = [ flit-core ];
-
-    nativeCheckInputs = [
-      pytestCheckHook
-      pretend
-    ];
-
-    pythonImportsCheck = [
-      "packaging"
-      "packaging.metadata"
-      "packaging.requirements"
-      "packaging.specifiers"
-      "packaging.tags"
-      "packaging.version"
-    ];
-
-    # Prevent circular dependency with pytest
-    doCheck = false;
-
-    passthru.tests = packaging.overridePythonAttrs (_: {
-      doCheck = true;
-    });
-
-    meta = {
-      changelog = "https://github.com/pypa/packaging/blob/${version}/CHANGELOG.rst";
-      description = "Core utilities for Python packages";
-      downloadPage = "https://github.com/pypa/packaging";
-      homepage = "https://packaging.pypa.io/";
-      license = with lib.licenses; [
-        bsd2
-        asl20
-      ];
-      maintainers = with lib.maintainers; [ bennofs ];
-      teams = [ lib.teams.python ];
-    };
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-/0Uv9aPoKM4RAZD+/xF4ux8uoigfogdarbmHwvsiFmE=";
   };
-in
-packaging
+
+  nativeBuildInputs = [ flit-core ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pretend
+  ];
+
+  pythonImportsCheck = [
+    "packaging"
+    "packaging.metadata"
+    "packaging.requirements"
+    "packaging.specifiers"
+    "packaging.tags"
+    "packaging.version"
+  ];
+
+  # Prevent circular dependency with pytest
+  doCheck = false;
+
+  passthru.tests = packaging.overridePythonAttrs (_: {
+    doCheck = true;
+  });
+
+  meta = {
+    changelog = "https://github.com/pypa/packaging/blob/${finalAttrs.version}/CHANGELOG.rst";
+    description = "Core utilities for Python packages";
+    downloadPage = "https://github.com/pypa/packaging";
+    homepage = "https://packaging.pypa.io/";
+    license = with lib.licenses; [
+      bsd2
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ bennofs ];
+    teams = [ lib.teams.python ];
+  };
+})

From d937cb6e2d2d3f9e47dc7ae82bb54a27a64f2e99 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 03:59:54 +0200
Subject: [PATCH 311/831] python3Packages.certifi: 2026.01.04 -> 2026.04.22

https://github.com/certifi/python-certifi/compare/2026.01.04...2026.04.22
---
 pkgs/development/python-modules/certifi/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/certifi/default.nix b/pkgs/development/python-modules/certifi/default.nix
index 94ef983a6a8e..2f1d3be1e64d 100644
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@@ -7,16 +7,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "certifi";
-  version = "2026.01.04";
+  version = "2026.04.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "certifi";
     repo = "python-certifi";
-    rev = version;
-    hash = "sha256-JXv12im46xKabIRVZ4FMSZUbpw2k8WCcaZZLX2pFteY=";
+    tag = finalAttrs.version;
+    hash = "sha256-bGeOrYd7ZUG0VIbgRiYIBK3JDRC5wpST5IrFHyWO/cg=";
   };
 
   patches = [
@@ -47,4 +47,4 @@ buildPythonPackage rec {
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ koral ];
   };
-}
+})

From 11c393f1bd8e6177d463d051c3cb132e6148bfe2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:10:10 +0200
Subject: [PATCH 312/831] python3Packages.click: 8.3.1 -> 8.3.3

https://github.com/pallets/click/blob/8.3.3/CHANGES.rst
---
 pkgs/development/python-modules/click/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index 47f53fb6580b..13e65aa099c8 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "click";
-  version = "8.3.1";
+  version = "8.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pallets";
     repo = "click";
     tag = version;
-    hash = "sha256-MbaIQJr6GbM8JwdbUkbeC8TqWN5dH82pFOqHwJE2PBA=";
+    hash = "sha256-LcnAI4hyiuaJ4qnFnbAR5Cft/yvW5tAIjY6qc6K/Nrw=";
   };
 
   build-system = [ flit-core ];

From ff97264d4555e412ed674c38e24973eecdaf4127 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:01:13 +0200
Subject: [PATCH 313/831] python3Packages.idna: 3.13 -> 3.14

https://github.com/kjd/idna/releases/tag/v3.14
---
 pkgs/development/python-modules/idna/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index 9d4cbee7e5a1..08f1f6a1d6cf 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.13";
+  version = "3.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kjd";
     repo = "idna";
     tag = "v${version}";
-    hash = "sha256-D72KUEwiFA/LdU/xE3sN+Abc6NpAsIlGSdB07V1nk68=";
+    hash = "sha256-cCyJsZc7+DpYQjS3nOfahrUcyFX2WtmmBKw8trZlELU=";
   };
 
   build-system = [ flit-core ];

From 39e8a44dd31601b1ffd5a913aa1889de329ac845 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:13:19 +0200
Subject: [PATCH 314/831] python3Packages.wcwidth: 0.6.0 -> 0.7.0

https://github.com/jquast/wcwidth/releases/tag/0.7.0
---
 pkgs/development/python-modules/wcwidth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/wcwidth/default.nix b/pkgs/development/python-modules/wcwidth/default.nix
index 39e7931da584..d8c9b9cea8c5 100644
--- a/pkgs/development/python-modules/wcwidth/default.nix
+++ b/pkgs/development/python-modules/wcwidth/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "wcwidth";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jquast";
     repo = "wcwidth";
     tag = version;
-    hash = "sha256-J1uVqHMbOr9OZK6W7O3ilSgzB4i6R9jLN8RzwOxZZnA=";
+    hash = "sha256-XIOgDCoAP/shepasR41NbNW3cFlbemmdC0Xbd+9OOts=";
   };
 
   build-system = [ hatchling ];

From e80b4d990b1ef0abd8f988622856c056228059c7 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:03:53 +0200
Subject: [PATCH 315/831] python3Packages.babel: 2.17.0 -> 2.18.0

https://github.com/python-babel/babel/releases/tag/v2.18.0
---
 pkgs/development/python-modules/babel/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/babel/default.nix b/pkgs/development/python-modules/babel/default.nix
index 85466baf4573..5f51421c82e5 100644
--- a/pkgs/development/python-modules/babel/default.nix
+++ b/pkgs/development/python-modules/babel/default.nix
@@ -17,12 +17,12 @@
 
 buildPythonPackage rec {
   pname = "babel";
-  version = "2.17.0";
+  version = "2.18.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-DFTP+xn2kM3MUqO1C8v3HgeoCNHIDVSfJFm50s8K+50=";
+    hash = "sha256-uAuZoUvQhfys+hXJFl9lH7s0BuZsxgOr8RxXUJN8mS0=";
   };
 
   build-system = [ setuptools ];

From a0709bc85f0e6d181639caad91ea50aa871cc837 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:13:59 +0200
Subject: [PATCH 316/831] python3Packages.click-repl: 0.3.0 ->
 0.3.0-unstable-2026-03-26

---
 .../python-modules/click-repl/default.nix     | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/click-repl/default.nix b/pkgs/development/python-modules/click-repl/default.nix
index 7b57b60938b2..5dffa0168649 100644
--- a/pkgs/development/python-modules/click-repl/default.nix
+++ b/pkgs/development/python-modules/click-repl/default.nix
@@ -9,31 +9,31 @@
   # dependencies
   click,
   prompt-toolkit,
-  six,
+  typing-extensions,
 
   # tests
   pytest-cov-stub,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "click-repl";
-  version = "0.3.0";
+  version = "0.3.0-unstable-2026-03-26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "click-contrib";
     repo = "click-repl";
-    tag = version;
-    hash = "sha256-xCT3w0DDY73dtDL5jbssXM05Zlr44OOcy4vexgHyWiE=";
+    rev = "b84191aec21b407b3cb3374ff1ab000887d38f29";
+    hash = "sha256-5Xv6oeV6sIRE3K3sZq8DyAXOcY8fYobcJtW/ZN7C4U0=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     click
     prompt-toolkit
-    six
+    typing-extensions
   ];
 
   nativeCheckInputs = [
@@ -42,11 +42,9 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    # https://github.com/click-contrib/click-repl/issues/128
-    broken = lib.versionAtLeast click.version "8.2.0";
     homepage = "https://github.com/click-contrib/click-repl";
     description = "Subcommand REPL for click apps";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ twey ];
   };
-}
+})

From b4b0de8c2515e014a0509241522bb5152525f022 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 04:08:36 +0200
Subject: [PATCH 317/831] python3Packages.lxml: 6.0.2 -> 6.1.0

https://github.com/lxml/lxml/blob/lxml-6.1.0/CHANGES.txt
---
 pkgs/development/python-modules/lxml/default.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index 2892a70dd7c4..d3dd5022478f 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -18,21 +18,16 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "6.0.2";
+  version = "6.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
     tag = "lxml-${version}";
-    hash = "sha256-Ri5SzfQJFghRcMAKHS5QKD365OZlio895fSlumq83vs=";
+    hash = "sha256-crFUn1TmxdHXr3ULDKsRy4Y4PR/itaycsWiSDb+pbeg=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail 'Cython>=3.1.4' 'Cython'
-  '';
-
   build-system = [
     cython
     setuptools

From d7aa737a85346c2dc8c1bc80501949dc2174dcc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 8 May 2026 12:46:06 -0700
Subject: [PATCH 318/831] python3Packages.backports-zstd: 1.3.0 -> 1.4.0

Diff: https://github.com/rogdham/backports.zstd/compare/v1.3.0...v1.4.0

Changelog: https://github.com/rogdham/backports.zstd/blob/v1.4.0/CHANGELOG.md
---
 pkgs/development/python-modules/backports-zstd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/backports-zstd/default.nix b/pkgs/development/python-modules/backports-zstd/default.nix
index e8567cb41465..13c28638361f 100644
--- a/pkgs/development/python-modules/backports-zstd/default.nix
+++ b/pkgs/development/python-modules/backports-zstd/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "backports-zstd";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm -r "$out/src/c/zstd"
     '';
-    hash = "sha256-AF2Id4U2++RMCFICxz0E3DrgEVgGNsph4sIZ9YC87fE=";
+    hash = "sha256-dOzaenKu3sf1qaTWZfJ6W1l3KV4BYklUardpiPnSQWU=";
   };
 
   postPatch = ''

From 65a18839e72199f2a6ad332565b8a94e7776648d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 05:22:56 +0200
Subject: [PATCH 319/831] python3Packages.typeguard: 4.4.4 -> 4.5.1

https://github.com/agronholm/typeguard/releases/tag/4.5.1
---
 pkgs/development/python-modules/typeguard/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typeguard/default.nix b/pkgs/development/python-modules/typeguard/default.nix
index 81a5310ec78b..b1c969e2d398 100644
--- a/pkgs/development/python-modules/typeguard/default.nix
+++ b/pkgs/development/python-modules/typeguard/default.nix
@@ -15,12 +15,12 @@
 
 buildPythonPackage rec {
   pname = "typeguard";
-  version = "4.4.4";
+  version = "4.5.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-On/S3/twXU0O+u1DBqcEyJud7oULaI8GCosWFaeeX3Q=";
+    hash = "sha256-9vjsu8gZybx0mYPMZ8AjkeFqm0O4sn8V3HDtfEoAcnQ=";
   };
 
   outputs = [

From e59adf722657f3305cf80855365362c2c2281633 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:11:31 +0200
Subject: [PATCH 320/831] python3Packages.requests: 2.33.1 -> 2.34.0

https://github.com/psf/requests/blob/v2.34.0/HISTORY.md
---
 .../python-modules/requests/default.nix        | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 633658bec1ec..17fca3669c1e 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -15,18 +15,16 @@
   urllib3,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "requests";
-  version = "2.33.1";
+  version = "2.34.0";
   pyproject = true;
 
-  __darwinAllowLocalNetworking = true;
-
   src = fetchFromGitHub {
     owner = "psf";
     repo = "requests";
-    tag = "v${version}";
-    hash = "sha256-cQnCTMmpdkvWwt7RFAIhAfmhVwGVn0Y8Z5Tr6lzDmS8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DDx+UV3OuCLUXM7ESbURCGeZ7t2acFEfMTOMcJdfUbI=";
   };
 
   build-system = [ setuptools ];
@@ -49,7 +47,7 @@ buildPythonPackage rec {
     pytest-xdist
     pytestCheckHook
   ]
-  ++ optional-dependencies.socks;
+  ++ finalAttrs.passthru.optional-dependencies.socks;
 
   disabledTests = [
     # Disable tests that require network access and use httpbin
@@ -79,11 +77,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "requests" ];
 
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     description = "HTTP library for Python";
     homepage = "http://docs.python-requests.org/";
-    changelog = "https://github.com/psf/requests/blob/v${version}/HISTORY.md";
+    changelog = "https://github.com/psf/requests/blob/${finalAttrs.src.tag}/HISTORY.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From a9b867c25b3f7c5419547102286cee3e2dd89792 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:14:39 +0200
Subject: [PATCH 321/831] python3Packages.importlib-resources: 6.5.2 -> 7.1.0

---
 .../python-modules/importlib-resources/default.nix        | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/importlib-resources/default.nix b/pkgs/development/python-modules/importlib-resources/default.nix
index f5451a8e95ee..85dfcc8a7038 100644
--- a/pkgs/development/python-modules/importlib-resources/default.nix
+++ b/pkgs/development/python-modules/importlib-resources/default.nix
@@ -21,15 +21,19 @@
 
 buildPythonPackage rec {
   pname = "importlib-resources";
-  version = "6.5.2";
+  version = "7.1.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "importlib_resources";
     inherit version;
-    hash = "sha256-GF+Hre9bzCiESdmPtPugfOp4vANkVd1ExfxKL+eP7Sw=";
+    hash = "sha256-ByLUxiEkicUw8qFFo0wKejtHIbyWoV+tpZMOKgt2Bwg=";
   };
 
+  postPatch = ''
+    sed -i '/coherent.licensed/d' pyproject.toml
+  '';
+
   build-system = [
     setuptools
     setuptools-scm

From b8e8ef279380136c1ceccb4c442afec26d7ef41f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:33:47 +0200
Subject: [PATCH 322/831] python3Packages.cryptography: disable problematic
 test

Depending on the overcommit setting of the host system this test tries
to allocate up to 1 TiB of virtual memory.
---
 pkgs/development/python-modules/cryptography/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index 729c1801daa7..56fb295e6dd9 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -71,6 +71,12 @@ buildPythonPackage rec {
 
   pytestFlags = [ "--disable-pytest-warnings" ];
 
+  disabledTests = [
+    # Tries to allocate 1 TiB with vm.overcommit_memory=1
+    # https://github.com/pyca/cryptography/pull/14782
+    "test_argon2_malloc_failure"
+  ];
+
   disabledTestPaths = [
     # save compute time by not running benchmarks
     "tests/bench"

From 5d71cbbabe6aa159eaa35d0de1d95979cfbd2fff Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:44:21 +0200
Subject: [PATCH 323/831] python3Packages.pandas: 2.3.3 -> 3.0.3

https://pandas.pydata.org/docs/whatsnew/index.html
---
 pkgs/development/python-modules/pandas/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 947122608e8c..88c164c5a93f 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -63,14 +63,14 @@
 let
   pandas = buildPythonPackage rec {
     pname = "pandas";
-    version = "2.3.3";
+    version = "3.0.3";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "pandas-dev";
       repo = "pandas";
       tag = "v${version}";
-      hash = "sha256-jY1uM9HmJzoFk26ilbtzJnxAsQhmXS19r73JcFeFWRQ=";
+      hash = "sha256-G+pWdmft/kcxv97ySa+0ZFEgvMKuNaK33DseZQ8R1z8=";
     };
 
     # A NOTE regarding the Numpy version relaxing: Both Numpy versions 1.x &
@@ -86,7 +86,7 @@ let
     # that override globally the `numpy` attribute to point to `numpy_1`.
     postPatch = ''
       substituteInPlace pyproject.toml \
-        --replace-fail "numpy>=2.0" numpy
+        --replace-fail "numpy>=2.0.0" numpy
     '';
 
     build-system = [

From 527b10263179b75f9ad1f71aa2e74ad3a2641651 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 13:47:08 +0200
Subject: [PATCH 324/831] python3Packages.pycurl: 7.45.6 -> 7.46.0

https://github.com/pycurl/pycurl/blob/REL_7_46_0/ChangeLog
---
 .../python-modules/pycurl/default.nix         | 37 ++++---------------
 1 file changed, 7 insertions(+), 30 deletions(-)

diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index 49be840bf8f9..e37e001a3419 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -4,19 +4,19 @@
   buildPythonPackage,
   isPyPy,
   fetchFromGitHub,
-  fetchpatch,
   curl,
   openssl,
   bottle,
   pytestCheckHook,
   flaky,
   flask,
+  numpy,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pycurl";
-  version = "7.45.6";
+  version = "7.46.0";
   pyproject = true;
 
   disabled = isPyPy; # https://github.com/pycurl/pycurl/issues/208
@@ -25,24 +25,9 @@ buildPythonPackage rec {
     owner = "pycurl";
     repo = "pycurl";
     tag = "REL_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-M4rO0CaI2SmjdJVS7hWnJZrL72WvayB4aKn707KoNiQ=";
+    hash = "sha256-F40bJ7TYFK2dVkDJGGxl7XV46fKmjwvUYYulcwGL6hk=";
   };
 
-  patches = [
-    # curl 8.16 compatibility
-    (fetchpatch {
-      url = "https://github.com/pycurl/pycurl/commit/eb7f52eeef85feb6c117678d52803050bbdd7bc8.patch";
-      hash = "sha256-hdwazS7R9duuMd/7S3SNAxVcToo3GhtyWu/1Q6qTMYc=";
-    })
-    # curl 8.17+ compatibility
-    # https://github.com/pycurl/pycurl/pull/909
-    (fetchpatch {
-      name = "pycurl-8.17.0-compat.patch";
-      url = "https://github.com/pycurl/pycurl/commit/ea92e3ca230a3ff3d464cb6816102fa157177aca.patch";
-      hash = "sha256-kmlsG0SFfS9FdRNp8pPgudcWK6hSyD9x5oAedZLgBcY=";
-    })
-  ];
-
   preConfigure = ''
     substituteInPlace setup.py \
       --replace-fail '--static-libs' '--libs'
@@ -64,6 +49,7 @@ buildPythonPackage rec {
     bottle
     flaky
     flask
+    numpy
     pytestCheckHook
   ];
 
@@ -90,24 +76,15 @@ buildPythonPackage rec {
     "test_libcurl_ssl_gnutls"
     # AssertionError: assert 'crypto' in ['curl']
     "test_ssl_in_static_libs"
-    # https://github.com/pycurl/pycurl/issues/819
-    "test_multi_socket_select"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # https://github.com/pycurl/pycurl/issues/729
-    "test_easy_pause_unpause"
-    "test_multi_socket_action"
+    # expected socketp to be None again after unassign()
+    "test_clear_via_assign_none_inside_callback_resets_socketp"
+    "test_multi_unassign_inside_socket_callback"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     # Fatal Python error: Segmentation fault
     "cadata_test"
   ];
 
-  disabledTestPaths = [
-    # https://github.com/pycurl/pycurl/issues/856
-    "tests/multi_test.py"
-  ];
-
   meta = {
     description = "Python Interface To The cURL library";
     homepage = "http://pycurl.io/";

From 81d9d52bf7a580609f6885fda75f085617be2d9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 02:31:36 -0700
Subject: [PATCH 325/831] python3Packages.pydantic-core: 2.41.5 -> 2.46.4

---
 .../python-modules/pydantic-core/default.nix  | 26 ++++++++++---------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic-core/default.nix b/pkgs/development/python-modules/pydantic-core/default.nix
index c59679649a88..6f580895976f 100644
--- a/pkgs/development/python-modules/pydantic-core/default.nix
+++ b/pkgs/development/python-modules/pydantic-core/default.nix
@@ -2,9 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  cargo,
   rustPlatform,
-  rustc,
   typing-extensions,
   pytestCheckHook,
   hypothesis,
@@ -21,26 +19,31 @@
 let
   pydantic-core = buildPythonPackage rec {
     pname = "pydantic-core";
-    version = "2.41.5";
+    version = "2.46.4";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "pydantic";
-      repo = "pydantic-core";
-      tag = "v${version}";
-      hash = "sha256-oIYHLSep8tWOXEaUybXG8Gv9WBoPGQ1Aj7QyqYksvMw=";
+      repo = "pydantic";
+      tag = "core-v${version}";
+      hash = "sha256-G4Xo6BF6tOn4g/qG3RNDP3/+lYnCOuw3AB1OrVOGcSA=";
     };
 
+    sourceRoot = "${src.name}/pydantic-core";
+
     cargoDeps = rustPlatform.fetchCargoVendor {
-      inherit pname version src;
-      hash = "sha256-Kvc0a34C6oGc9oS/iaPaazoVUWn5ABUgrmPa/YocV+Y=";
+      inherit
+        pname
+        version
+        src
+        sourceRoot
+        ;
+      hash = "sha256-5L317YTV7/Bc/YJLLzc745oJntiYkcZupdeUxiQwcOU=";
     };
 
     nativeBuildInputs = [
-      cargo
       rustPlatform.cargoSetupHook
       rustPlatform.maturinBuildHook
-      rustc
     ];
 
     dependencies = [ typing-extensions ];
@@ -64,9 +67,8 @@ let
     ];
 
     meta = {
-      changelog = "https://github.com/pydantic/pydantic-core/releases/tag/${src.tag}";
       description = "Core validation logic for pydantic written in rust";
-      homepage = "https://github.com/pydantic/pydantic-core";
+      homepage = "https://github.com/pydantic/pydantic/tree/main/pydantic-core";
       license = lib.licenses.mit;
       inherit (pydantic.meta) maintainers;
     };

From a03c2ddc0f4f4e7727d46d0f1f7f3cde79074b33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 02:29:43 -0700
Subject: [PATCH 326/831] python3Packages.pydantic: 2.12.5 -> 2.13.4

Diff: https://github.com/pydantic/pydantic/compare/v2.12.5...v2.13.4

Changelog: https://github.com/pydantic/pydantic/blob/v2.13.4/HISTORY.md
---
 .../python-modules/pydantic/default.nix       | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/pydantic/default.nix b/pkgs/development/python-modules/pydantic/default.nix
index a34ffbb95b29..b84ef6f5aace 100644
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@@ -3,7 +3,6 @@
   python,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # build-system
   hatchling,
@@ -19,32 +18,27 @@
   cloudpickle,
   email-validator,
   dirty-equals,
+  hypothesis,
+  inline-snapshot,
   jsonschema,
   pytestCheckHook,
   pytest-mock,
   pytest-run-parallel,
+  pytest-timeout,
 }:
 
 buildPythonPackage rec {
   pname = "pydantic";
-  version = "2.12.5";
+  version = "2.13.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic";
     tag = "v${version}";
-    hash = "sha256-9TRLtVNBw2WHQnS0XFHg16Q7FdpTf3e2nb5qE5rlLUA=";
+    hash = "sha256-G4Xo6BF6tOn4g/qG3RNDP3/+lYnCOuw3AB1OrVOGcSA=";
   };
 
-  patches = lib.optionals (lib.versionAtLeast python.version "3.14.1") [
-    # Fix build with python 3.14.1
-    (fetchpatch {
-      url = "https://github.com/pydantic/pydantic/commit/53cb5f830207dd417d20e0e55aab2e6764f0d6fc.patch";
-      hash = "sha256-Y1Ob1Ei0rrw0ua+0F5L2iE2r2RdpI9DI2xuiu9pLr5Y=";
-    })
-  ];
-
   postPatch = ''
     sed -i "/--benchmark/d" pyproject.toml
   '';
@@ -68,15 +62,19 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     cloudpickle
     dirty-equals
+    hypothesis
+    (inline-snapshot.overridePythonAttrs { doCheck = false; })
     jsonschema
     pytest-mock
     pytest-run-parallel
+    pytest-timeout
     pytestCheckHook
   ]
   ++ lib.concatAttrValues optional-dependencies;
 
   disabledTestPaths = [
     "tests/benchmarks"
+    "tests/pydantic_core/benchmarks"
 
     # avoid cyclic dependency
     "tests/test_docs.py"

From ff4c4962d28ba2140f8b0bb8d2705d2c1903584d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 06:05:04 -0700
Subject: [PATCH 327/831] python3Packages.mashumaro: 3.17 -> 3.21

Diff: https://github.com/Fatal1ty/mashumaro/compare/v3.17...v3.21

Changelog: https://github.com/Fatal1ty/mashumaro/releases/tag/v3.21
---
 pkgs/development/python-modules/mashumaro/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mashumaro/default.nix b/pkgs/development/python-modules/mashumaro/default.nix
index 2a490f7d6e2c..88e4f1ad479e 100644
--- a/pkgs/development/python-modules/mashumaro/default.nix
+++ b/pkgs/development/python-modules/mashumaro/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "mashumaro";
-  version = "3.17";
+  version = "3.21";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Fatal1ty";
     repo = "mashumaro";
     tag = "v${version}";
-    hash = "sha256-oQKSIDrIPlY1m63uP9Jxpgf7ruaZpt9uZF4hTso503U=";
+    hash = "sha256-SWmZA/yoiElQ299+BkjwTdcPukKfgw/UgUwiesFRkqo=";
   };
 
   build-system = [ setuptools ];

From 5addde923dd9b990d839992a20ea379eab46333a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 06:05:08 -0700
Subject: [PATCH 328/831] python3Packages.platformdirs: 4.5.1 -> 4.9.6

Diff: https://github.com/tox-dev/platformdirs/compare/4.5.1...4.9.6

Changelog: https://github.com/tox-dev/platformdirs/releases/tag/4.9.6
---
 pkgs/development/python-modules/platformdirs/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/platformdirs/default.nix b/pkgs/development/python-modules/platformdirs/default.nix
index fd0cc9667c0d..3c81d609b50f 100644
--- a/pkgs/development/python-modules/platformdirs/default.nix
+++ b/pkgs/development/python-modules/platformdirs/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "platformdirs";
-  version = "4.5.1";
+  version = "4.9.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "platformdirs";
     tag = version;
-    hash = "sha256-wDhhfS8r0fCYOUJUu2kwH+fyTPmS+aPUiqWN21Fedoc=";
+    hash = "sha256-/aoJquWRn1UQZa96uZba15tDO+IGEHN9/duu9JYXmd4=";
   };
 
   build-system = [
@@ -34,6 +34,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "platformdirs" ];
 
+  preCheck = ''
+    unset XDG_DATA_DIRS
+  '';
+
   meta = {
     description = "Module for determining appropriate platform-specific directories";
     homepage = "https://platformdirs.readthedocs.io/";

From 7bd04c0097c8e274f1090eb2d3c6f390217c7605 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 14:23:11 +0200
Subject: [PATCH 329/831] python3Packages.pathspec: 1.0.4 -> 1.1.1

https://github.com/cpburnz/python-pathspec/blob/v1.1.1/CHANGES.rst
---
 pkgs/development/python-modules/pathspec/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pathspec/default.nix b/pkgs/development/python-modules/pathspec/default.nix
index 925f2896c54b..a0f0b47f599f 100644
--- a/pkgs/development/python-modules/pathspec/default.nix
+++ b/pkgs/development/python-modules/pathspec/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "pathspec";
-  version = "1.0.4";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AhDiroohqRN8DUcFeMsOWVr4ftqm6/Ev8XbxSgLg5kU=";
+    hash = "sha256-F9tezVJBBKEg4XOBTJA2epapjQfEWy4QwvORn/+Rv1o=";
   };
 
   nativeBuildInputs = [ flit-core ];

From 2d6cb39369369a3ba4d77291e1b2acb628427f2d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 14:55:21 +0200
Subject: [PATCH 330/831] python3Packages.zipp: 3.23.1 -> 4.0.0

https://github.com/jaraco/zipp/compare/v3.23.1...v4.0.0
---
 pkgs/development/python-modules/zipp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zipp/default.nix b/pkgs/development/python-modules/zipp/default.nix
index 9981e18a166e..bd2c8c65ad88 100644
--- a/pkgs/development/python-modules/zipp/default.nix
+++ b/pkgs/development/python-modules/zipp/default.nix
@@ -11,14 +11,14 @@
 let
   zipp = buildPythonPackage rec {
     pname = "zipp";
-    version = "3.23.1";
+    version = "4.0.0";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "jaraco";
       repo = "zipp";
       tag = "v${version}";
-      hash = "sha256-SC5aMiQsAPLNjCdOHDAMYX2iDSwZltjXxAJJgZnPlJ0=";
+      hash = "sha256-JkU35S+BpDvWca1+BP61z3W5oyxf/RI21WXZ9fZ65SQ=";
     };
 
     postPatch = ''

From 83fbf8ebee98139688e59d538b3c0e89191a80c4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 14:58:33 +0200
Subject: [PATCH 331/831] python3Packages.skia-pathops: 0.9.1 -> 0.9.2

---
 pkgs/development/python-modules/skia-pathops/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/skia-pathops/default.nix b/pkgs/development/python-modules/skia-pathops/default.nix
index 275f8814a9cb..8db6aca481ec 100644
--- a/pkgs/development/python-modules/skia-pathops/default.nix
+++ b/pkgs/development/python-modules/skia-pathops/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "skia-pathops";
-  version = "0.9.1";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "skia_pathops";
     inherit version;
-    hash = "sha256-8Sc+9NojVw8z5253U5CEhOWkokaPexCJ+REMzuYpP5k=";
+    hash = "sha256-S22EWfb0ppKCyyb8oMK7CzIcxYqb+cxleaUqOR7cAxk=";
   };
 
   postPatch = ''

From 95dd19e324a1bf808b8518b7c12836927ec4b266 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 15:02:44 +0200
Subject: [PATCH 332/831] python3Packages.mako: 1.3.10 -> 1.3.12

https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12
---
 .../python-modules/mako/default.nix            | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/mako/default.nix b/pkgs/development/python-modules/mako/default.nix
index ab4137e548bc..a317e542fc80 100644
--- a/pkgs/development/python-modules/mako/default.nix
+++ b/pkgs/development/python-modules/mako/default.nix
@@ -5,7 +5,7 @@
   isPyPy,
 
   # build-system
-  setuptools,
+  setuptools_80,
 
   # propagates
   markupsafe,
@@ -20,19 +20,19 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "mako";
-  version = "1.3.10";
+  version = "1.3.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlalchemy";
     repo = "mako";
-    tag = "rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-lxGlYyKbrDpr2LHcsqTow+s2l8+g+63M5j8xJt++tGo=";
+    tag = "rel_${lib.replaceString "." "_" finalAttrs.version}";
+    hash = "sha256-YIMmP8CIGUlgnB8/96lR9yDvEZTES766dSN0vT0JfbM=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [ markupsafe ];
 
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     mock
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   disabledTests = lib.optionals isPyPy [
     # https://github.com/sqlalchemy/mako/issues/315
@@ -59,12 +59,12 @@ buildPythonPackage rec {
   ];
 
   meta = {
+    changelog = "https://github.com/sqlalchemy/mako/releases/tag/${finalAttrs.src.tag}";
     description = "Super-fast templating language";
     mainProgram = "mako-render";
     homepage = "https://www.makotemplates.org/";
-    changelog = "https://docs.makotemplates.org/en/latest/changelog.html";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = [ ];
   };
-}
+})

From d59d282564af6ac82e99ca5915a4e95e27c7760c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 16:23:25 +0200
Subject: [PATCH 333/831] python3Packages.ast-serialize: init at 0.3.0

---
 .../python-modules/ast-serialize/default.nix  | 44 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/development/python-modules/ast-serialize/default.nix

diff --git a/pkgs/development/python-modules/ast-serialize/default.nix b/pkgs/development/python-modules/ast-serialize/default.nix
new file mode 100644
index 000000000000..71ee99cb9e62
--- /dev/null
+++ b/pkgs/development/python-modules/ast-serialize/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cargo,
+  rustPlatform,
+  rustc,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "ast-serialize";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "mypyc";
+    repo = "ast_serialize";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-R5hNpbJjKKZDOKQCdGZQ+0iW5vdh5CzSgzORESh4bDU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-uhUMaUkaL57X8CVy6T9pCQa62IsOeKN/dhZTPVXSn14=";
+  };
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  pythonImportsCheck = [
+    "ast_serialize"
+  ];
+
+  meta = {
+    description = "Fast Python parser that generates a serialized AST";
+    homepage = "https://github.com/mypyc/ast_serialize";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0affe265a11a..815153af375a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1094,6 +1094,8 @@ self: super: with self; {
 
   ast-grep-py = callPackage ../development/python-modules/ast-grep-py { };
 
+  ast-serialize = callPackage ../development/python-modules/ast-serialize { };
+
   asterisk-mbox = callPackage ../development/python-modules/asterisk-mbox { };
 
   asteroid-filterbanks = callPackage ../development/python-modules/asteroid-filterbanks { };

From c5d5b72238ae3cb8764a30d85691139a8d61e49a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 16:23:48 +0200
Subject: [PATCH 334/831] python3Packages.mypy: 1.20.1 -> 2.1.0

---
 pkgs/development/python-modules/mypy/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy/default.nix b/pkgs/development/python-modules/mypy/default.nix
index add7605c4a9b..b758998c6dbc 100644
--- a/pkgs/development/python-modules/mypy/default.nix
+++ b/pkgs/development/python-modules/mypy/default.nix
@@ -12,6 +12,7 @@
   setuptools,
   types-psutil,
   types-setuptools,
+  ast-serialize,
 
   # propagates
   librt,
@@ -33,7 +34,7 @@
 
 buildPythonPackage rec {
   pname = "mypy";
-  version = "1.20.1";
+  version = "2.1.0";
   pyproject = true;
 
   # relies on several CPython internals
@@ -43,7 +44,7 @@ buildPythonPackage rec {
     owner = "python";
     repo = "mypy";
     tag = "v${version}";
-    hash = "sha256-MQZZyGu6xFh3wO+0lWED+mingjK92v/onljtp9gylmM=";
+    hash = "sha256-sm/pxQGxH5XuPH7B8i3fpp30KaFU9aSp6BT67UcDPvU=";
   };
 
   passthru.updateScript = gitUpdater {
@@ -57,6 +58,7 @@ buildPythonPackage rec {
     types-psutil
     types-setuptools
     typing-extensions
+    ast-serialize
   ];
 
   dependencies = [

From a9349934d2f581c60de5018b20bdaa33a9f65788 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 17:33:58 +0200
Subject: [PATCH 335/831] python3Packages.charset-normaler: expose withMypyc
 flag

This is necessary to break the

     fetch-cargo-vendor
  -> ast-serialize
  -> mypy
  -> charset-normalizer
  -> requests
  -> fetch-cargo-vendor

infinite recursion
---
 .../python-modules/charset-normalizer/default.nix            | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index 5137ceb0e83f..da6efe28e397 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -8,6 +8,7 @@
   pytestCheckHook,
   requests,
   setuptools,
+  withMypyc ? !isPyPy,
 }:
 
 buildPythonPackage rec {
@@ -30,9 +31,9 @@ buildPythonPackage rec {
   build-system = [
     setuptools
   ]
-  ++ lib.optional (!isPyPy) mypy;
+  ++ lib.optional (withMypyc) mypy;
 
-  env.CHARSET_NORMALIZER_USE_MYPYC = lib.optionalString (!isPyPy) "1";
+  env.CHARSET_NORMALIZER_USE_MYPYC = lib.optionalString withMypyc "1";
 
   nativeCheckInputs = [ pytestCheckHook ];
 

From 3ca34d25fce6a6cf70a3284446ee2d96c6dbc558 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 17:35:11 +0200
Subject: [PATCH 336/831] fetchCargoVendor: break infinite recursion with
 ast-serialize

The ast-serialize package depends on fetchCargoVendor and is part of the
bootstrap chain for requests.
---
 pkgs/build-support/rust/fetch-cargo-vendor.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 2802bf9e73f1..23c746921c57 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   runCommand,
   writers,
-  python3Packages,
+  python3,
   cargo,
   gitMinimal,
   nix-prefetch-git,
@@ -11,6 +11,16 @@
 }:
 
 let
+  python = python3.override {
+    self = python;
+    packageOverrides = final: prev: {
+      # The ast-serialize package, a dependency for mypy, depends on
+      # fetchCargoVendor and is part of the bootstrap chain for requests.
+      charset-normalizer = prev.charset-normalizer.override { withMypyc = false; };
+    };
+  };
+  python3Packages = python.pkgs;
+
   replaceWorkspaceValues = writers.writePython3Bin "replace-workspace-values" {
     libraries = with python3Packages; [
       tomli

From ca8d5fbb3d8512fc85ef938839e6682d69e1df67 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 12 May 2026 18:05:42 +0200
Subject: [PATCH 337/831] python3Packages.librt: 0.9.0 -> 0.11.0

https://github.com/mypyc/librt/compare/v0.9.0...v0.11.0
---
 pkgs/development/python-modules/librt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/librt/default.nix b/pkgs/development/python-modules/librt/default.nix
index c1531eed6054..628f0e68b0ab 100644
--- a/pkgs/development/python-modules/librt/default.nix
+++ b/pkgs/development/python-modules/librt/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "librt";
-  version = "0.9.0";
+  version = "0.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mypyc";
     repo = "librt";
     tag = "v${version}";
-    hash = "sha256-RZGaOq8hmkwekCs1fKshDrx3vmHdJl/wI3IO9ZLH5rc=";
+    hash = "sha256-y9z1EdrZRiDtT8cxz/Ex/f6B/RfjnAXdGf7tM+77HGg=";
   };
 
   # https://github.com/mypyc/librt/blob/v0.7.8/.github/workflows/buildwheels.yml#L90-L93

From 0bb3a590b3da000f848a777f1b30d287b3761a71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 11:59:49 -0700
Subject: [PATCH 338/831] python3Packages.pytz: 2026.1.post1 -> 2026.2

Changelog: https://launchpad.net/pytz/+announcements
---
 pkgs/development/python-modules/pytz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytz/default.nix b/pkgs/development/python-modules/pytz/default.nix
index a6f0018e3fd1..7b8e9ddc2d6b 100644
--- a/pkgs/development/python-modules/pytz/default.nix
+++ b/pkgs/development/python-modules/pytz/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "pytz";
-  version = "2026.1.post1";
+  version = "2026.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-M3jd5qDD0mcZGCFCxW5gx/mvfpaAdvMarladcqA1juE=";
+    hash = "sha256-DmC0eynyFXQ3byGP4hq8AJiUojIeoWxnVPPK1ut83Wo=";
   };
 
   postPatch = ''

From 04038fded705355bb482068b3abd493c399ebe84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 12:02:32 -0700
Subject: [PATCH 339/831] python3Packages.pytest-subprocess: 1.5.4 -> 1.6.0

Diff: https://github.com/aklajnert/pytest-subprocess/compare/1.5.4...1.6.0

Changelog: https://github.com/aklajnert/pytest-subprocess/blob/1.6.0/HISTORY.rst
---
 .../python-modules/pytest-subprocess/default.nix   | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-subprocess/default.nix b/pkgs/development/python-modules/pytest-subprocess/default.nix
index b46373b85b9b..bdb8d2ef8591 100644
--- a/pkgs/development/python-modules/pytest-subprocess/default.nix
+++ b/pkgs/development/python-modules/pytest-subprocess/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   setuptools,
   pytest,
   pytestCheckHook,
@@ -16,25 +15,16 @@
 
 buildPythonPackage rec {
   pname = "pytest-subprocess";
-  version = "1.5.4";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aklajnert";
     repo = "pytest-subprocess";
     tag = version;
-    hash = "sha256-TFTY6enuyzQx0U+qHVde71VHqVa0oEGbSJUwhMAsI7Q=";
+    hash = "sha256-zPKExIrCt8ZwhKGU0l3tyTcDhRIGPSiM8OWy5cpmsuE=";
   };
 
-  patches = [
-    # https://github.com/aklajnert/pytest-subprocess/pull/202
-    (fetchpatch {
-      name = "fix-test_any_matching_program.patch";
-      url = "https://github.com/aklajnert/pytest-subprocess/commit/14c571b9b72a7b7e429189a9455fc715e6f0dbce.patch";
-      hash = "sha256-xDj5KSyv+JXRuMoUKpIr5oDN9y8V14LApRXbzNi9HI8=";
-    })
-  ];
-
   build-system = [ setuptools ];
 
   buildInputs = [ pytest ];

From 404b6579059b783d5dae16cc15662691b7abfd7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 12:07:00 -0700
Subject: [PATCH 340/831] python3Packages.trove-classifiers: 2026.4.28.13 ->
 2026.5.7.17

Changelog: https://github.com/pypa/trove-classifiers/releases/tag/2026.5.7.17
---
 pkgs/development/python-modules/trove-classifiers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 5771c7160515..88a82933636b 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -10,13 +10,13 @@
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2026.4.28.13";
+    version = "2026.5.7.17";
     pyproject = true;
 
     src = fetchPypi {
       pname = "trove_classifiers";
       inherit version;
-      hash = "sha256-yFu4pTw95zMNFpm4RO2fuAmmAqCawV3HmtbRpQm+BnY=";
+      hash = "sha256-oEpI+PCnh8uZZRTTlprHYIqjxgyxXQc8HgKAHmBTPoA=";
     };
 
     postPatch = ''

From bc9158e81e11c409651030dc153469b9c336fa9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 11:23:13 -0700
Subject: [PATCH 341/831] python3Packages.pendulum: 3.1.0-unstable-2025-10-28
 -> 3.2.0

Diff: https://github.com/sdispater/pendulum/compare/2982f25feaad2e58ad1530d3b53cc30fc1c82bd6...3.2.0

Changelog: https://github.com/sdispater/pendulum/blob/3.2.0/CHANGELOG.md
---
 .../python-modules/pendulum/default.nix       | 23 +++++++------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/pendulum/default.nix b/pkgs/development/python-modules/pendulum/default.nix
index 2a30200bf269..da2332bc0220 100644
--- a/pkgs/development/python-modules/pendulum/default.nix
+++ b/pkgs/development/python-modules/pendulum/default.nix
@@ -3,10 +3,8 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  isPyPy,
 
   # build-system
-  poetry-core,
   rustPlatform,
 
   # native dependencies
@@ -14,54 +12,49 @@
 
   # dependencies
   python-dateutil,
-  time-machine,
   tzdata,
 
   # tests
   pytestCheckHook,
-  pytz,
+  time-machine,
 }:
 
 buildPythonPackage rec {
   pname = "pendulum";
-  version = "3.1.0-unstable-2025-10-28";
+  version = "3.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sdispater";
     repo = "pendulum";
-    rev = "2982f25feaad2e58ad1530d3b53cc30fc1c82bd6";
-    hash = "sha256-1ULvlWLZx3z5eGmWJfrN46x0ohJ+mAxipm6l6rykGPY=";
+    tag = version;
+    hash = "sha256-zpBymeYhCy+yu6RPhOuN5xOVk6928hd3+oRsfiBPPuY=";
   };
 
   cargoRoot = "rust";
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
     sourceRoot = "${src.name}/rust";
-    hash = "sha256-Ozg+TW/woJsqmbmyDsgdMua3Lmnn+KBvBhd9kVik3XY=";
+    hash = "sha256-tC65lxI561ygOhBFujWzGk32XiQH6QB42nqboWSfQrg=";
   };
 
   nativeBuildInputs = [
-    poetry-core
     rustPlatform.maturinBuildHook
     rustPlatform.cargoSetupHook
   ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ iconv ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     python-dateutil
     tzdata
-  ]
-  ++ lib.optionals (!isPyPy) [
-    time-machine
   ];
 
   pythonImportsCheck = [ "pendulum" ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    pytz
+    time-machine
   ];
 
   disabledTestPaths = [
@@ -75,7 +68,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python datetimes made easy";
     homepage = "https://github.com/sdispater/pendulum";
-    changelog = "https://github.com/sdispater/pendulum/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/sdispater/pendulum/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };

From ca7a8d536044be0bdd903da251ff7552c052f543 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 12 May 2026 12:10:56 -0700
Subject: [PATCH 342/831] python3Packages.pendulum: use finalAttrs

---
 pkgs/development/python-modules/pendulum/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pendulum/default.nix b/pkgs/development/python-modules/pendulum/default.nix
index da2332bc0220..662acb08c292 100644
--- a/pkgs/development/python-modules/pendulum/default.nix
+++ b/pkgs/development/python-modules/pendulum/default.nix
@@ -19,7 +19,7 @@
   time-machine,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pendulum";
   version = "3.2.0";
   pyproject = true;
@@ -27,14 +27,14 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "sdispater";
     repo = "pendulum";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-zpBymeYhCy+yu6RPhOuN5xOVk6928hd3+oRsfiBPPuY=";
   };
 
   cargoRoot = "rust";
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    sourceRoot = "${src.name}/rust";
+    inherit (finalAttrs) pname version src;
+    sourceRoot = "${finalAttrs.src.name}/rust";
     hash = "sha256-tC65lxI561ygOhBFujWzGk32XiQH6QB42nqboWSfQrg=";
   };
 
@@ -68,8 +68,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python datetimes made easy";
     homepage = "https://github.com/sdispater/pendulum";
-    changelog = "https://github.com/sdispater/pendulum/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/sdispater/pendulum/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})

From 6b54753cb103db12dc383131d2e724f4847f91ee Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 13 May 2026 02:38:24 +0200
Subject: [PATCH 343/831] python3Packages.uvicorn: 0.40.0 -> 0.46.0

https://github.com/encode/uvicorn/blob/0.46.0/CHANGELOG.md
---
 pkgs/development/python-modules/uvicorn/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/uvicorn/default.nix b/pkgs/development/python-modules/uvicorn/default.nix
index 9bdc07615fe1..d9d4aba3e6e2 100644
--- a/pkgs/development/python-modules/uvicorn/default.nix
+++ b/pkgs/development/python-modules/uvicorn/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "uvicorn";
-  version = "0.40.0";
+  version = "0.46.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = "uvicorn";
     tag = version;
-    hash = "sha256-YpmvMZJxxpMdwbhFQSu+0fo7kcM6w3zJ7jI5LVamV1E=";
+    hash = "sha256-+21fEPLnH2nrwPCXNlRw7U1VcXdaUnNCeThTfzepQoY=";
   };
 
   outputs = [

From db883c3f8ea329bb682b750996e97e566a4ba0a0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 14 May 2026 17:20:56 +0200
Subject: [PATCH 344/831] python3Packages.filelock: disable flaky locking tests

Locally these work fine, on builders these timeout after 20s.
---
 pkgs/development/python-modules/filelock/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/filelock/default.nix b/pkgs/development/python-modules/filelock/default.nix
index 1ef40a71fc1f..80810b707766 100644
--- a/pkgs/development/python-modules/filelock/default.nix
+++ b/pkgs/development/python-modules/filelock/default.nix
@@ -39,6 +39,8 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # Circular dependency with virtualenv
     "tests/test_virtualenv.py"
+    # Very prone to timeouts on busy machines
+    "tests/test_filelock.py"
   ];
 
   meta = {

From 73599831a40bdf3e1e777de1721a73d446239d99 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 14 May 2026 19:09:38 +0200
Subject: [PATCH 345/831] python3Packages.charset-normalizer: provide
 ast-serialize build dep

Now that mypy requires ast-serialize at build time, charset-normalizer
wants it too.
---
 .../python-modules/charset-normalizer/default.nix           | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/charset-normalizer/default.nix b/pkgs/development/python-modules/charset-normalizer/default.nix
index da6efe28e397..7454c0643eb1 100644
--- a/pkgs/development/python-modules/charset-normalizer/default.nix
+++ b/pkgs/development/python-modules/charset-normalizer/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   isPyPy,
+  ast-serialize,
   mypy,
   pytestCheckHook,
   requests,
@@ -31,7 +32,10 @@ buildPythonPackage rec {
   build-system = [
     setuptools
   ]
-  ++ lib.optional (withMypyc) mypy;
+  ++ lib.optionals withMypyc [
+    ast-serialize
+    mypy
+  ];
 
   env.CHARSET_NORMALIZER_USE_MYPYC = lib.optionalString withMypyc "1";
 

From 29184d79fafd851f7f99926042c595eecd39cd48 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 14 May 2026 19:32:55 +0200
Subject: [PATCH 346/831] python3Packages.matplotlib: relax setuptools-scm
 constraint

---
 pkgs/development/python-modules/matplotlib/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index ff7fb38852a5..2311afef7a39 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -100,7 +100,8 @@ buildPythonPackage rec {
     ''
     + ''
       substituteInPlace pyproject.toml \
-        --replace-fail "meson-python>=0.13.1,<0.17.0" meson-python
+        --replace-fail "meson-python>=0.13.1,<0.17.0" meson-python \
+        --replace-fail "setuptools_scm>=7,<10" setuptools_scm
 
       patchShebangs tools
     ''

From 5a1cd9cc55dddb9a0ef3babd914f1f7d0cb8907f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 14 May 2026 19:34:07 +0200
Subject: [PATCH 347/831] python3Packages.rich: 14.3.3 -> 15.0.0

https://github.com/Textualize/rich/blob/v15.0.0/CHANGELOG.md
---
 pkgs/development/python-modules/rich/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/rich/default.nix b/pkgs/development/python-modules/rich/default.nix
index 78ad8add1fd9..7b055a98e0bb 100644
--- a/pkgs/development/python-modules/rich/default.nix
+++ b/pkgs/development/python-modules/rich/default.nix
@@ -25,16 +25,16 @@
   textual,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "rich";
-  version = "14.3.3";
+  version = "15.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Textualize";
     repo = "rich";
-    tag = "v${version}";
-    hash = "sha256-6udVO7N17ineQozlCG/tI9jJob811gqb4GtY50JZFb0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Uk3r6aYhrjYJ8GrMKfdlv3/muK/uUynd4pd1yWCwSOM=";
   };
 
   build-system = [ poetry-core ];
@@ -68,8 +68,8 @@ buildPythonPackage rec {
   meta = {
     description = "Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal";
     homepage = "https://github.com/Textualize/rich";
-    changelog = "https://github.com/Textualize/rich/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Textualize/rich/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ris ];
   };
-}
+})

From 8ea0b4f2556c15e9736c87e5bb9862f161986b4b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 15:24:22 +0200
Subject: [PATCH 348/831] python3Packages.pylama: pin to setuptools_80

---
 .../python-modules/pylama/default.nix         |  4 +--
 .../python-ldap/python-3.14.patch             | 29 -------------------
 2 files changed, 2 insertions(+), 31 deletions(-)
 delete mode 100644 pkgs/development/python-modules/python-ldap/python-3.14.patch

diff --git a/pkgs/development/python-modules/pylama/default.nix b/pkgs/development/python-modules/pylama/default.nix
index ed1a787eb7a1..5349ee627470 100644
--- a/pkgs/development/python-modules/pylama/default.nix
+++ b/pkgs/development/python-modules/pylama/default.nix
@@ -11,7 +11,7 @@
   pydocstyle,
   pyflakes,
   vulture,
-  setuptools,
+  setuptools_80,
   pylint,
   pytestCheckHook,
 }:
@@ -43,7 +43,7 @@ let
       pycodestyle
       pydocstyle
       pyflakes
-      setuptools
+      setuptools_80
       vulture
     ];
 
diff --git a/pkgs/development/python-modules/python-ldap/python-3.14.patch b/pkgs/development/python-modules/python-ldap/python-3.14.patch
deleted file mode 100644
index 831296d2607e..000000000000
--- a/pkgs/development/python-modules/python-ldap/python-3.14.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From c6bb3ea9d16f0e088151b87c7ff8184272aa0714 Mon Sep 17 00:00:00 2001
-From: Iwan <iwanb@users.noreply.github.com>
-Date: Sat, 17 Jan 2026 15:26:55 +0100
-Subject: [PATCH] Explicitly close url file to avoid ResourceWarning in Python
- 3.14
-
----
- Lib/ldap/schema/subentry.py | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/Lib/ldap/schema/subentry.py b/Lib/ldap/schema/subentry.py
-index b83d819b..3f73df71 100644
---- a/Lib/ldap/schema/subentry.py
-+++ b/Lib/ldap/schema/subentry.py
-@@ -476,10 +476,10 @@ def urlfetch(uri,trace_level=0):
-     l.unbind_s()
-     del l
-   else:
--    ldif_file = urlopen(uri)
--    ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
--    ldif_parser.parse()
--    subschemasubentry_dn,s_temp = ldif_parser.all_records[0]
-+    with urlopen(uri) as ldif_file:
-+      ldif_parser = ldif.LDIFRecordList(ldif_file,max_entries=1)
-+      ldif_parser.parse()
-+      subschemasubentry_dn,s_temp = ldif_parser.all_records[0]
-   # Work-around for mixed-cased attribute names
-   subschemasubentry_entry = ldap.cidict.cidict()
-   s_temp = s_temp or {}

From 1434d0780e5235485f7ab251f4be595ab2cf34ee Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 16:30:13 +0200
Subject: [PATCH 349/831] python3Packages.deprecated: pin to setuptools_80

---
 .../python-modules/deprecated/default.nix           | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/deprecated/default.nix b/pkgs/development/python-modules/deprecated/default.nix
index 195534a8add3..4dce3b873c78 100644
--- a/pkgs/development/python-modules/deprecated/default.nix
+++ b/pkgs/development/python-modules/deprecated/default.nix
@@ -3,13 +3,13 @@
   fetchFromGitHub,
   buildPythonPackage,
   pythonAtLeast,
-  setuptools,
+  setuptools_80,
   wrapt,
   pytestCheckHook,
   sphinxHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "deprecated";
   version = "1.3.1";
   pyproject = true;
@@ -22,15 +22,15 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tantale";
     repo = "deprecated";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-1mB9aRZOsaW7Mqcu1SWIYTusQ7MlMvUucdTyfu++Nx8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   nativeBuildInputs = [ sphinxHook ];
 
-  propagatedBuildInputs = [ wrapt ];
+  dependencies = [ wrapt ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
@@ -43,9 +43,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "deprecated" ];
 
   meta = {
+    changelog = "https://github.com/laurent-laporte-pro/deprecated/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/tantale/deprecated";
     description = "Python @deprecated decorator to deprecate old python classes, functions or methods";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ tilpner ];
   };
-}
+})

From fb8cdd0dba95d2d293b648e7156b1419a96725e1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 16:34:18 +0200
Subject: [PATCH 350/831] python3Packages.blockdiag: pin to setuptools_80

---
 pkgs/development/python-modules/blockdiag/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/blockdiag/default.nix b/pkgs/development/python-modules/blockdiag/default.nix
index ba1e71eab352..7ca2aece7bfa 100644
--- a/pkgs/development/python-modules/blockdiag/default.nix
+++ b/pkgs/development/python-modules/blockdiag/default.nix
@@ -10,7 +10,7 @@
   pillow,
   pytestCheckHook,
   reportlab,
-  setuptools,
+  setuptools_80,
   webcolors,
 }:
 
@@ -48,14 +48,14 @@ buildPythonPackage rec {
     # note: this is a postPatch as `seqdiag` uses them directly
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     docutils
     funcparserlib
     pillow
     reportlab
-    setuptools
+    setuptools_80
     webcolors
   ];
 

From f3964c18d6dc142d8cfda6bb1ade6f1e3fb0a09f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 16:46:05 +0200
Subject: [PATCH 351/831] python3Packages.uvloop: pin to setuptools_80

---
 pkgs/development/python-modules/uvloop/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix
index 629c2cba2e0d..994eef15ed08 100644
--- a/pkgs/development/python-modules/uvloop/default.nix
+++ b/pkgs/development/python-modules/uvloop/default.nix
@@ -3,11 +3,10 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # build-system
   cython,
-  setuptools,
+  setuptools_80,
 
   # native dependencies
   libuv,
@@ -39,7 +38,7 @@ buildPythonPackage rec {
 
   build-system = [
     cython
-    setuptools
+    setuptools_80
   ];
 
   env.LIBUV_CONFIGURE_HOST = stdenv.hostPlatform.config;

From 604a2a80c0026f8ed880ef5e6d6c05f5e535b57b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 17:03:45 +0200
Subject: [PATCH 352/831] python3Packages.distutils: disable failing tests

---
 pkgs/development/python-modules/distutils/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/distutils/default.nix b/pkgs/development/python-modules/distutils/default.nix
index 1039dea6e13f..292cf61b2fb9 100644
--- a/pkgs/development/python-modules/distutils/default.nix
+++ b/pkgs/development/python-modules/distutils/default.nix
@@ -72,7 +72,12 @@ buildPythonPackage {
   # jaraco-path depends ob pyobjc
   doCheck = !stdenv.hostPlatform.isDarwin;
 
-  disabledTests = lib.optionals (pythonAtLeast "3.14") [
+  disabledTests = [
+    #  TypeError: byte_compile() got an unexpected keyword argument 'dry_run'
+    "test_byte_compile"
+    "test_byte_compile_optimized"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
     #  AssertionError: assert '(?s:foo[^/]*)\\z' == '(?s:foo[^/]*)\\Z'
     "test_glob_to_re"
   ];

From b5c57c52c8bf0af4ef51b3f5a5023d07611ac29c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 17:04:06 +0200
Subject: [PATCH 353/831] python3Packages.python-ldap: 3.4.5 -> 3.4.6

https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.6
---
 .../python-modules/python-ldap/default.nix    | 22 +++++--------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/pkgs/development/python-modules/python-ldap/default.nix b/pkgs/development/python-modules/python-ldap/default.nix
index 26cba5d602e9..3e067291bab6 100644
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@@ -19,28 +19,18 @@
   jaraco-functools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-ldap";
-  version = "3.4.5";
+  version = "3.4.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-ldap";
     repo = "python-ldap";
-    tag = "python-ldap-${version}";
-    hash = "sha256-olRu5HacRKaAcNbQczA+UCbDxhySUOO7qH0KdWlSbT0=";
+    tag = "python-ldap-${finalAttrs.version}";
+    hash = "sha256-j0viogO02O8G53ORq0u1U+B5I0mcpuB+E1Xvl7ZQKQw=";
   };
 
-  patches = [
-    # https://github.com/python-ldap/python-ldap/pull/605
-    ./python-3.14.patch
-  ];
-
-  postPatch = ''
-    # unused in 3.4.5; https://github.com/python-ldap/python-ldap/pull/597
-    sed -i "/setuptools-scm/d" pyproject.toml
-  '';
-
   build-system = [
     distutils
     setuptools
@@ -80,8 +70,8 @@ buildPythonPackage rec {
     description = "Python modules for implementing LDAP clients";
     downloadPage = "https://github.com/python-ldap/python-ldap";
     homepage = "https://www.python-ldap.org/";
-    changelog = "https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-${version}";
+    changelog = "https://github.com/python-ldap/python-ldap/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.psfl;
     maintainers = [ ];
   };
-}
+})

From 16c46466218e025e73e6ad7de125069df62e82c0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 15 May 2026 17:14:51 +0200
Subject: [PATCH 354/831] python3Packages.tqdm: 4.67.1 -> 4.67.3

https://tqdm.github.io/releases/
---
 pkgs/development/python-modules/tqdm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tqdm/default.nix b/pkgs/development/python-modules/tqdm/default.nix
index 0ca33fd88fe7..82cb311ab284 100644
--- a/pkgs/development/python-modules/tqdm/default.nix
+++ b/pkgs/development/python-modules/tqdm/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage rec {
   pname = "tqdm";
-  version = "4.67.1";
+  version = "4.67.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+K75xSwIwTpl8w6jT05arD/Ro0lZh51+WeYwJyhmJ/I=";
+    hash = "sha256-fYJfA/iSRO9z8dTOGTyxd0qBef2W8x1+Hc3mIJK5YLs=";
   };
 
   nativeBuildInputs = [

From 3f544ddd49d65aadaea5fa53ee65bd1c1c129a6f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 01:18:59 +0200
Subject: [PATCH 355/831] python3Packages.scikit-build-core: 0.11.6 -> 0.12.2

https://github.com/scikit-build/scikit-build-core/blob/v0.12.2/docs/about/changelog.md
---
 .../scikit-build-core/default.nix              | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/scikit-build-core/default.nix b/pkgs/development/python-modules/scikit-build-core/default.nix
index c0ee37ecae8e..61cd4585d23c 100644
--- a/pkgs/development/python-modules/scikit-build-core/default.nix
+++ b/pkgs/development/python-modules/scikit-build-core/default.nix
@@ -28,27 +28,24 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "scikit-build-core";
-  version = "0.11.6";
+  version = "0.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-build";
     repo = "scikit-build-core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zBTDacTkeclz+/X0SUl1xkxLz4zsfeLOD4Ew0V1Y1iU=";
+    hash = "sha256-JE6z44u1FLfI+Gguhd2rVUvY8tyEoo/WviGJmPRT8kc=";
   };
 
   patches = [
-    # Backport an upstream commit to fix the tests on Darwin.
     (fetchpatch {
-      url = "https://github.com/scikit-build/scikit-build-core/commit/c30f52a3b2bd01dc05f23d3b89332c213006afe0.patch";
-      excludes = [ ".github/workflows/ci.yml" ];
-      hash = "sha256-5E9QfF5UcSNY1wzHzieEEHEPYzPjUTb66CKCodYb9vo=";
+      name = "setuptools-scm-10-compat.patch";
+      url = "https://github.com/scikit-build/scikit-build-core/commit/1b870c538bf7ca679fc4a6e0cbba301c98d9ac35.patch";
+      hash = "sha256-JUxBvKiAHpDlIIFkvU+CflTNA6m/auxW5wd5cVYpvcM=";
     })
   ];
 
-  postPatch = "";
-
   build-system = [
     hatch-vcs
     hatchling
@@ -84,6 +81,11 @@ buildPythonPackage (finalAttrs: {
     "network"
   ];
 
+  disabledTests = [
+    # wheel tags generated with wrong system name/version
+    "test_wheel_tag"
+  ];
+
   disabledTestPaths = [
     # store permissions issue in Nix:
     "tests/test_editable.py"

From e03a9010055c6c3c91c51ee529d29a5cd43dd601 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 15 May 2026 10:17:35 -0700
Subject: [PATCH 356/831] python3Packages.pikepdf: 10.5.1 -> 10.6.0

Diff: https://github.com/pikepdf/pikepdf/compare/v10.5.1...v10.6.0

Changelog: https://github.com/pikepdf/pikepdf/blob/v10.6.0/docs/releasenotes/version10.md
---
 .../python-modules/pikepdf/default.nix        | 23 ++++++++++---------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index cb7214e768fb..43e519ca3a96 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -2,6 +2,7 @@
   lib,
   attrs,
   buildPythonPackage,
+  cmake,
   fetchFromGitHub,
   hypothesis,
   jbig2dec,
@@ -9,23 +10,24 @@
   lxml,
   withMupdf ? false,
   mupdf-headless,
+  nanobind,
+  ninja,
   numpy,
   packaging,
   pillow,
   psutil,
-  pybind11,
   pytest-xdist,
   pytestCheckHook,
   python-dateutil,
   python-xmp-toolkit,
   qpdf,
-  setuptools,
   replaceVars,
+  scikit-build-core,
 }:
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.5.1";
+  version = "10.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -38,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-x17cRef8rB5UQQws48G/IqeSp4B3CaLzIoUIQ8fJeUg=";
+    hash = "sha256-COEAY9/H9KZ1Tyj89CFMBl9ydTro82qk1XYWbaI9AFY=";
   };
 
   patches = [
@@ -54,18 +56,17 @@ buildPythonPackage rec {
     })
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "shims_enabled = not cflags_defined" "shims_enabled = False"
-  '';
-
   buildInputs = [ qpdf ];
 
   build-system = [
-    pybind11
-    setuptools
+    cmake
+    nanobind
+    ninja
+    scikit-build-core
   ];
 
+  dontUseCmakeConfigure = true;
+
   nativeCheckInputs = [
     attrs
     hypothesis

From 3043c255b3f63d82df004cc8fa29b6a19013fbf1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 01:40:02 +0200
Subject: [PATCH 357/831] spidermonkey: pin to python 3.13

> AttributeError: module 'ast' has no attribute 'Str'
---
 pkgs/development/interpreters/spidermonkey/common.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/spidermonkey/common.nix b/pkgs/development/interpreters/spidermonkey/common.nix
index dd4bfcb45b7d..29b381e77476 100644
--- a/pkgs/development/interpreters/spidermonkey/common.nix
+++ b/pkgs/development/interpreters/spidermonkey/common.nix
@@ -15,7 +15,7 @@
   m4,
   perl,
   pkg-config,
-  python3,
+  python313,
   rust-cbindgen,
   rustPlatform,
   rustc,
@@ -80,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
     m4
     perl
     pkg-config
-    python3
+    python313
     rustc
     rustc.llvmPackages.llvm # for llvm-objdump
     which

From b7a93ec9e6b5dd233d70b1c9dc1ca2740773d881 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 02:00:36 +0200
Subject: [PATCH 358/831] buildMozillaMach: use python3.13 for versions below
 143.0

---
 pkgs/build-support/build-mozilla-mach/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 67312aa0e186..d6fce120abb7 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -58,6 +58,7 @@ in
   pkg-config,
   pkgsCross, # wasm32 rlbox
   python3,
+  python313,
   runCommand,
   rustc,
   rust-cbindgen,
@@ -364,7 +365,7 @@ buildStdenv.mkDerivation {
     makeBinaryWrapper
     nodejs
     perl
-    python3
+    (if lib.versionAtLeast version "143.0" then python3 else python313)
     rust-cbindgen
     rustPlatform.bindgenHook
     rustc

From 3ccd026063e5b6836980dad734554ebdcf59c533 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 02:03:14 +0200
Subject: [PATCH 359/831] python3Packages.face-recognition-models: pin
 setuptools_80

---
 .../python-modules/face-recognition/models.nix       | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/face-recognition/models.nix b/pkgs/development/python-modules/face-recognition/models.nix
index 40eb6ad5bbe2..aa2ef447dab8 100644
--- a/pkgs/development/python-modules/face-recognition/models.nix
+++ b/pkgs/development/python-modules/face-recognition/models.nix
@@ -2,21 +2,21 @@
   buildPythonPackage,
   lib,
   fetchPypi,
-  setuptools,
+  setuptools_80,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "face-recognition-models";
   version = "0.3.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "face_recognition_models";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-t5vSAKiMh8mp1EbJkK5xxaYm0fNzAXTm1XAVf/HYls8=";
   };
 
-  propagatedBuildInputs = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   # no tests
   doCheck = false;
@@ -29,4 +29,4 @@ buildPythonPackage rec {
     maintainers = [ ];
     description = "Trained models for the face_recognition python library";
   };
-}
+})

From a04da3fde40e75e24b1f22ab83281303e786602a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 02:03:42 +0200
Subject: [PATCH 360/831] python3Packages.apswutils: pin setuptools_80

---
 pkgs/development/python-modules/apswutils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/apswutils/default.nix b/pkgs/development/python-modules/apswutils/default.nix
index 035a74132ab5..707309af83a6 100644
--- a/pkgs/development/python-modules/apswutils/default.nix
+++ b/pkgs/development/python-modules/apswutils/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 
   # build-system
-  setuptools,
+  setuptools_80,
 
   # dependencies
   apsw,
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   build-system = [
-    setuptools
+    setuptools_80
   ];
 
   dependencies = [

From e4d45548b4aab765d44e0be313d8dbc0eada07eb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 09:57:07 +0200
Subject: [PATCH 361/831] python3Packages.zope-testing: relax setuptools
 constraint

---
 pkgs/development/python-modules/zope-testing/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/zope-testing/default.nix b/pkgs/development/python-modules/zope-testing/default.nix
index 79764e7fed27..d0a68e9b7b24 100644
--- a/pkgs/development/python-modules/zope-testing/default.nix
+++ b/pkgs/development/python-modules/zope-testing/default.nix
@@ -19,6 +19,11 @@ buildPythonPackage rec {
     hash = "sha256-dAUiG8DxlhQKMBXh49P0CDC9UjqAYjB+2vVCTI36cgc=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools >= 78.1.1,< 81" setuptools
+  '';
+
   build-system = [ setuptools ];
 
   doCheck = !isPyPy;

From 47cb1d0c8ef0815fdd2c2c5fc7c208c71c55b285 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 09:59:25 +0200
Subject: [PATCH 362/831] python3Packages.pytest-mypy-plugins: 4.0.2 -> 4.0.3

https://github.com/typeddjango/pytest-mypy-plugins/releases/tag/4.0.3
---
 .../python-modules/pytest-mypy-plugins/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-mypy-plugins/default.nix b/pkgs/development/python-modules/pytest-mypy-plugins/default.nix
index 4c073d30e042..9ba4e2bef69a 100644
--- a/pkgs/development/python-modules/pytest-mypy-plugins/default.nix
+++ b/pkgs/development/python-modules/pytest-mypy-plugins/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-mypy-plugins";
-  version = "4.0.2";
+  version = "4.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "typeddjango";
     repo = "pytest-mypy-plugins";
     tag = version;
-    hash = "sha256-py6sspmhQ2vjXEEn+X6kx1+fTiS1M0P8z+kbgVItW/k=";
+    hash = "sha256-RyHoZniVLtunqz42tuVeAoiUm/e5JvvwX2MMCAJBhy8=";
   };
 
   build-system = [ setuptools ];

From 116e9f56ccdbf7571273708dd4431896e317a4cd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 10:00:44 +0200
Subject: [PATCH 363/831] python3Packages.jupyter-packaging: disable
 FutureWarning

---
 .../python-modules/jupyter-packaging/default.nix       | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-packaging/default.nix b/pkgs/development/python-modules/jupyter-packaging/default.nix
index 9c56beb7f3a3..516cf273d441 100644
--- a/pkgs/development/python-modules/jupyter-packaging/default.nix
+++ b/pkgs/development/python-modules/jupyter-packaging/default.nix
@@ -31,9 +31,9 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = [ hatchling ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     deprecation
     packaging
     setuptools
@@ -45,7 +45,11 @@ buildPythonPackage rec {
     pytest-timeout
   ];
 
-  pytestFlags = [ "-Wignore::DeprecationWarning" ];
+  pytestFlags = [
+    "-Wignore::DeprecationWarning"
+    # The 'wheel' package is no longer the canonical location of the 'bdist_wheel' command, and will be removed in a future release. Please update to setuptools v70.1 or later which contains an integrated version of this command.
+    "-Wignore::FutureWarning"
+  ];
 
   preCheck = ''
     export HOME=$(mktemp -d)

From fc149bad32bfab5e8004960cc053e8b3748cc2df Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 10:17:26 +0200
Subject: [PATCH 364/831] python3Packages.aiohasupervisor: drop wheel build dep

---
 pkgs/development/python-modules/aiohasupervisor/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/aiohasupervisor/default.nix b/pkgs/development/python-modules/aiohasupervisor/default.nix
index a4a3aaf8d4c1..f9a93a152ce4 100644
--- a/pkgs/development/python-modules/aiohasupervisor/default.nix
+++ b/pkgs/development/python-modules/aiohasupervisor/default.nix
@@ -29,7 +29,8 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail 'version = "0.0.0"' 'version = "${version}"' \
-      --replace-fail "setuptools>=68.0,<82.1" "setuptools"
+      --replace-fail "setuptools>=68.0,<82.1" "setuptools" \
+      --replace-fail ', "wheel>=0.40,<0.47"' ""
   '';
 
   build-system = [ setuptools ];

From 720b51f8029f4a02f0dc010b3f3d9c5693067e26 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 16 May 2026 10:24:27 +0200
Subject: [PATCH 365/831] python3Packages.xlib: pin setuptools_80

---
 pkgs/development/python-modules/xlib/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/xlib/default.nix b/pkgs/development/python-modules/xlib/default.nix
index 73c1ff3eca83..13c97c7c9bb9 100644
--- a/pkgs/development/python-modules/xlib/default.nix
+++ b/pkgs/development/python-modules/xlib/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   six,
-  setuptools,
+  setuptools_80,
   setuptools-scm,
   libx11,
   xvfb,
@@ -19,8 +19,6 @@ buildPythonPackage rec {
   version = "0.33";
   pyproject = true;
 
-  build-system = [ setuptools ];
-
   src = fetchFromGitHub {
     owner = "python-xlib";
     repo = "python-xlib";
@@ -28,11 +26,13 @@ buildPythonPackage rec {
     hash = "sha256-u06OWlMIOUzHOVS4hvm72jGgTSXWUqMvEQd8bTpFog0=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    (setuptools-scm.override { setuptools = setuptools_80; })
+  ];
 
   buildInputs = [ libx11 ];
 
-  propagatedBuildInputs = [ six ];
+  dependencies = [ six ];
 
   doCheck = !stdenv.hostPlatform.isDarwin;
 

From 3dc26f2e52e702403288e7854101e5ee9e732d34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 16 May 2026 17:41:07 -0700
Subject: [PATCH 366/831] python3Packages.syrupy: 5.1.0 -> 5.2.0

Diff: https://github.com/syrupy-project/syrupy/compare/v5.1.0...v5.2.0

Changelog: https://github.com/syrupy-project/syrupy/blob/v5.2.0/CHANGELOG.md
---
 pkgs/development/python-modules/syrupy/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index 4b2b521e033c..0a04f704a740 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -1,9 +1,9 @@
 {
   lib,
-  attrs,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
+  hatchling,
+  hypothesis,
   pydantic,
   pytest,
   pytest-xdist,
@@ -12,22 +12,22 @@
 
 buildPythonPackage rec {
   pname = "syrupy";
-  version = "5.1.0";
+  version = "5.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "syrupy-project";
     repo = "syrupy";
     tag = "v${version}";
-    hash = "sha256-oogH5Q+0leZsfu/7r3tZmB2rxjcUOmGAsn4Z50oSlH8=";
+    hash = "sha256-tivRKADRYyyNmNOOd0w2qTseA3t7TMwkAkQ/Kr6wp6U=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];
 
   buildInputs = [ pytest ];
 
   nativeCheckInputs = [
-    attrs
+    hypothesis
     invoke
     pydantic
     pytest

From 065869b1b2d0a6894eba98a8967263c97dca45eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 16 May 2026 17:48:42 -0700
Subject: [PATCH 367/831] python3Packages.syrupy: use finalAttrs

---
 pkgs/development/python-modules/syrupy/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/syrupy/default.nix b/pkgs/development/python-modules/syrupy/default.nix
index 0a04f704a740..c4f84e150699 100644
--- a/pkgs/development/python-modules/syrupy/default.nix
+++ b/pkgs/development/python-modules/syrupy/default.nix
@@ -10,7 +10,7 @@
   invoke,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "syrupy";
   version = "5.2.0";
   pyproject = true;
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "syrupy-project";
     repo = "syrupy";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-tivRKADRYyyNmNOOd0w2qTseA3t7TMwkAkQ/Kr6wp6U=";
   };
 
@@ -44,10 +44,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "syrupy" ];
 
   meta = {
-    changelog = "https://github.com/syrupy-project/syrupy/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/syrupy-project/syrupy/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Pytest Snapshot Test Utility";
     homepage = "https://github.com/syrupy-project/syrupy";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

From 0d33bcce4ecd82a7568ff200c6c65dfc3af9357b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 17 May 2026 15:37:14 +0200
Subject: [PATCH 368/831] python3Packages.numcodecs: 0.16.3 -> 0.16.5

---
 .../python-modules/numcodecs/default.nix      | 22 ++++++++++++++-----
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/numcodecs/default.nix b/pkgs/development/python-modules/numcodecs/default.nix
index c32b3e679805..ef6f77ba48fe 100644
--- a/pkgs/development/python-modules/numcodecs/default.nix
+++ b/pkgs/development/python-modules/numcodecs/default.nix
@@ -11,15 +11,18 @@
   py-cpuinfo,
 
   # dependencies
-  deprecated,
   numpy,
+  typing-extensions,
 
   # optional-dependencies
   crc32c,
+  google-crc32c,
+  pcodec,
   pyzstd,
 
   # tests
   msgpack,
+  python,
   pytestCheckHook,
   importlib-metadata,
   zstd,
@@ -27,12 +30,12 @@
 
 buildPythonPackage rec {
   pname = "numcodecs";
-  version = "0.16.3";
+  version = "0.16.5";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-U9cFhl+q8KeSfJc683d1MgAcj7tlPeEZwehEYIYU15k=";
+    hash = "sha256-DQ+2CFL4TAvZVDzE0que79N/yO/MQQrNR3fmKh0wAxg=";
   };
 
   build-system = [
@@ -43,14 +46,15 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    deprecated
     numpy
+    typing-extensions
   ];
 
   optional-dependencies = {
     crc32c = [ crc32c ];
+    google_crc32c = [ google-crc32c ];
     msgpack = [ msgpack ];
-    pyzstd = [ pyzstd ];
+    pcodec = [ pcodec ];
     # zfpy = [ zfpy ];
   };
 
@@ -61,12 +65,18 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     importlib-metadata
+    pyzstd
     zstd
   ]
   ++ lib.concatAttrValues optional-dependencies;
 
+  disabledTestPaths = [
+    # https://github.com/zarr-developers/numcodecs/issues/815
+    "numcodecs/tests/test_pcodec.py"
+  ];
+
   # https://github.com/NixOS/nixpkgs/issues/255262
-  preCheck = "pushd $out";
+  preCheck = "pushd $out/${python.sitePackages}";
   postCheck = "popd";
 
   meta = {

From 3c13010a19b2e933f509109ea0ae3b63aef74853 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 17 May 2026 22:59:25 +0200
Subject: [PATCH 369/831] python3Packages.llvmlite: 0.46.0 -> 0.47.0

https://github.com/numba/llvmlite/blob/v0.47.0/CHANGE_LOG
---
 pkgs/development/python-modules/llvmlite/default.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/llvmlite/default.nix b/pkgs/development/python-modules/llvmlite/default.nix
index d932dd3c866d..cb855b02e33c 100644
--- a/pkgs/development/python-modules/llvmlite/default.nix
+++ b/pkgs/development/python-modules/llvmlite/default.nix
@@ -1,10 +1,8 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   buildPythonPackage,
   isPyPy,
-  pythonAtLeast,
 
   setuptools,
 
@@ -26,7 +24,7 @@ in
 
 buildPythonPackage rec {
   pname = "llvmlite";
-  version = "0.46.0";
+  version = "0.47.0";
   pyproject = true;
 
   disabled = isPyPy;
@@ -35,7 +33,7 @@ buildPythonPackage rec {
     owner = "numba";
     repo = "llvmlite";
     tag = "v${version}";
-    hash = "sha256-mQFNfcOLmFYvYQGcgLi7G6iJDoTCm7hJfPh5hH9jPGc=";
+    hash = "sha256-YEIdIdbk19JHYtgL2gWjnAUYu13CH+7ikoyBUkOPpws=";
   };
 
   build-system = [ setuptools ];

From 2b81f14fb44b825dbf2ef44e0da0842b823b3c78 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 17 May 2026 23:02:04 +0200
Subject: [PATCH 370/831] python3Packages.numba: 0.63.1 -> 0.65.1

https://numba.readthedocs.io/en/stable/release/0.65.1-notes.html
---
 .../python-modules/numba/default.nix          | 24 +++----------------
 1 file changed, 3 insertions(+), 21 deletions(-)

diff --git a/pkgs/development/python-modules/numba/default.nix b/pkgs/development/python-modules/numba/default.nix
index 506f0e10dfd6..0e38f0392cde 100644
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -37,7 +37,7 @@ let
   cudatoolkit = cudaPackages.cuda_nvcc;
 in
 buildPythonPackage (finalAttrs: {
-  version = "0.63.1";
+  version = "0.65.1";
   pname = "numba";
   pyproject = true;
 
@@ -53,7 +53,7 @@ buildPythonPackage (finalAttrs: {
     postFetch = ''
       sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${finalAttrs.src.tag})"/' $out/numba/_version.py
     '';
-    hash = "sha256-M7Hdc1Qakclz7i/HujBUqVEWFsHj9ZGQDzb8Ze9AztA=";
+    hash = "sha256-DMmUyTElDFyMK4BUQ4EhDNmG43lOWQHurKbnSyhAs5k=";
   };
 
   postPatch = ''
@@ -84,25 +84,7 @@ buildPythonPackage (finalAttrs: {
     llvmlite
   ];
 
-  patches = [
-    # Support Numpy 2.4, see:
-    #
-    # - https://github.com/numba/numba/pull/10393
-    # - https://github.com/numba/numba/issues/10263
-    (fetchpatch {
-      url = "https://github.com/numba/numba/commit/7ec267efb80d87f0652c00535e8843f35d006f20.patch";
-      hash = "sha256-oAOZa2/m2qs8CeX13/0lmRTg/lQj5aDIaaQeDeLAghc=";
-      excludes = [
-        "azure-pipelines.yml"
-        "buildscripts/azure/azure-windows.yml"
-      ];
-    })
-    # The above doesn't fix the source's build and run time checks of Numpy's
-    # version, it only fixes the tests and API. Upstream puts these checks only
-    # in release tarballs, and hence the patch has to be vendored.
-    ./numpy2.4.patch
-  ]
-  ++ lib.optionals cudaSupport [
+  patches = lib.optionals cudaSupport [
     (replaceVars ./cuda_path.patch {
       cuda_toolkit_path = cudatoolkit;
       cuda_toolkit_lib_path = lib.getLib cudatoolkit;

From ea45d1e8606c9b820d85f5c038b215957621406b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 00:51:49 +0200
Subject: [PATCH 371/831] python3Packages.torch: relax setuptools

---
 pkgs/development/python-modules/torch/source/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/torch/source/default.nix b/pkgs/development/python-modules/torch/source/default.nix
index d9a475d7512e..f547c1604476 100644
--- a/pkgs/development/python-modules/torch/source/default.nix
+++ b/pkgs/development/python-modules/torch/source/default.nix
@@ -348,7 +348,9 @@ buildPythonPackage.override { inherit stdenv; } (finalAttrs: {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=70.1.0,<80.0" "setuptools"
+      --replace-fail "setuptools>=70.1.0,<82" "setuptools"
+    substituteInPlace setup.py \
+      --replace-fail "setuptools<82" setuptools
   ''
   # Provide path to openssl binary for inductor code cache hash
   # InductorError: FileNotFoundError: [Errno 2] No such file or directory: 'openssl'

From 4143982e36f38bc219d93fae4069f0b32ab5e1ad Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 01:09:47 +0200
Subject: [PATCH 372/831] python3Packages.coreapi: pin to setuptools_80

---
 pkgs/development/python-modules/coreapi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/coreapi/default.nix b/pkgs/development/python-modules/coreapi/default.nix
index 7c810a0fb0c5..90c7c088308c 100644
--- a/pkgs/development/python-modules/coreapi/default.nix
+++ b/pkgs/development/python-modules/coreapi/default.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
-  setuptools,
+  setuptools_80,
   django,
   coreschema,
   itypes,
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     hash = "sha256-nNUzQbBaT7woI3fmvPvIM0SVDnt4iC2rQ9bDgUeFzLA=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     django

From b44ac20dfb04f54187e6a7dd95cdbfe83de341b2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:07:33 +0200
Subject: [PATCH 373/831] python3Packages.scales: pin to setuptools_80

---
 pkgs/development/python-modules/scales/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/scales/default.nix b/pkgs/development/python-modules/scales/default.nix
index e258bdf045f2..a0809ee2c5f3 100644
--- a/pkgs/development/python-modules/scales/default.nix
+++ b/pkgs/development/python-modules/scales/default.nix
@@ -5,7 +5,7 @@
   pytestCheckHook,
   fetchpatch2,
   six,
-  setuptools,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
@@ -34,7 +34,7 @@ buildPythonPackage rec {
     done;
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [ six ];
 

From 9e8a6e9c9bd02489a59ea0a637bbd58ea6866987 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:11:51 +0200
Subject: [PATCH 374/831] python3Packages.plaster-pastedeploy: pep517 build,
 setuptools 81 pin

---
 .../python-modules/plaster-pastedeploy/default.nix         | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/plaster-pastedeploy/default.nix b/pkgs/development/python-modules/plaster-pastedeploy/default.nix
index 05e7a02e49b7..ab5a8f6dd902 100644
--- a/pkgs/development/python-modules/plaster-pastedeploy/default.nix
+++ b/pkgs/development/python-modules/plaster-pastedeploy/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools_80,
   plaster,
   pastedeploy,
   pytestCheckHook,
@@ -10,7 +11,7 @@
 buildPythonPackage rec {
   pname = "plaster-pastedeploy";
   version = "1.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "plaster_pastedeploy";
@@ -18,7 +19,9 @@ buildPythonPackage rec {
     hash = "sha256-viYubS5BpyZIddqi/ihQy7BhVyi83JKCj9xyc244FBI=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools_80 ];
+
+  dependencies = [
     plaster
     pastedeploy
   ];

From e4c7627d6ae57a55fc178392aab0a1822eb09da0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:16:47 +0200
Subject: [PATCH 375/831] python3Packages.mcp: 1.26.0 -> 1.27.1

https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.1
---
 pkgs/development/python-modules/mcp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mcp/default.nix b/pkgs/development/python-modules/mcp/default.nix
index b8536ececaa5..f351b9ce4313 100644
--- a/pkgs/development/python-modules/mcp/default.nix
+++ b/pkgs/development/python-modules/mcp/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mcp";
-  version = "1.26.0";
+  version = "1.27.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "modelcontextprotocol";
     repo = "python-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TGkAyuBcIstL2BCZYBWoi7PhnhoBvap67sLWGe0QUoU=";
+    hash = "sha256-LhoLcFC5+7xOCfud23sbHyTMxKYmdeZh0c+UtGdvzCs=";
   };
 
   # time.sleep(0.1) feels a bit optimistic and it has been flaky whilst

From 7b235832bc2996c42b5b74d9952c41015dff71f4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:18:25 +0200
Subject: [PATCH 376/831] afew: pin to setuptools_80

---
 pkgs/by-name/af/afew/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/af/afew/package.nix b/pkgs/by-name/af/afew/package.nix
index 00349a77af67..d5aa04249411 100644
--- a/pkgs/by-name/af/afew/package.nix
+++ b/pkgs/by-name/af/afew/package.nix
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   nativeBuildInputs = with python3Packages; [
     sphinxHook
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 

From 4b583d748c40e8ddf8c309a710f81027ec9cf981 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:33:36 +0200
Subject: [PATCH 377/831] python3Packages.home-assistant-chip-wheels: provide
 ast-serialize

Mypy 2.0 wants ast-serialize in some cases but does not propagate it
itself.
---
 .../python-modules/home-assistant-chip-wheels/default.nix       | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
index 8ccc67b828a0..0ff3cc2c9dab 100644
--- a/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
+++ b/pkgs/development/python-modules/home-assistant-chip-wheels/default.nix
@@ -1,6 +1,7 @@
 {
   aiohttp,
   alive-progress,
+  ast-serialize,
   build,
   clang-tools,
   click,
@@ -196,6 +197,7 @@ stdenv.mkDerivation rec {
       dependencies = [
         aiohttp
         alive-progress
+        ast-serialize
         colorama
         coloredlogs
         click

From 9518afa893a183c0154b8597d6f5cd587dc1b5a1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:34:37 +0200
Subject: [PATCH 378/831] python3Packages.pycapnp: backport patch for py314
 compat

---
 pkgs/development/python-modules/pycapnp/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/python-modules/pycapnp/default.nix b/pkgs/development/python-modules/pycapnp/default.nix
index 2a60d3958e18..85505ac6c6e5 100644
--- a/pkgs/development/python-modules/pycapnp/default.nix
+++ b/pkgs/development/python-modules/pycapnp/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   replaceVars,
   fetchFromGitHub,
+  fetchpatch,
   setuptools,
   wheel,
   capnproto,
@@ -35,6 +36,12 @@ buildPythonPackage rec {
     # other than the builtin schemas (based on quick GitHub code search), so I don't
     # think it's worthwhile.
     (replaceVars ./include-paths.patch { inherit capnproto; })
+
+    (fetchpatch {
+      url = "https://github.com/capnproto/pycapnp/commit/aa90ab6844df4718f02e2ca4974858d5ab0b079c.patch";
+      name = "python314-compat.patch";
+      hash = "sha256-pscOdgPotLZsW0XWyRTJigIDl3uWOizA1W0gQGZHSyg=";
+    })
   ];
 
   build-system = [

From 654d103b12e185401fdbede9b6d543932fff6dd4 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:38:13 +0200
Subject: [PATCH 379/831] python3Packages.scikit-build: 0.18.1 -> 0.19.0

https://github.com/scikit-build/scikit-build/blob/0.19.0/CHANGES.rst
---
 .../python-modules/scikit-build/default.nix   | 15 +-----
 .../scikit-build/fix-cmake-4.patch            | 47 -------------------
 2 files changed, 2 insertions(+), 60 deletions(-)
 delete mode 100644 pkgs/development/python-modules/scikit-build/fix-cmake-4.patch

diff --git a/pkgs/development/python-modules/scikit-build/default.nix b/pkgs/development/python-modules/scikit-build/default.nix
index 31f0a1d2b65f..8bf1fbdc5ba7 100644
--- a/pkgs/development/python-modules/scikit-build/default.nix
+++ b/pkgs/development/python-modules/scikit-build/default.nix
@@ -22,26 +22,15 @@
 
 buildPythonPackage rec {
   pname = "scikit-build";
-  version = "0.18.1";
+  version = "0.19.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "scikit_build";
     inherit version;
-    hash = "sha256-pBUqxaCE1JnCineXvgYo2DZsM24vsOGgY+sy5V78uOc=";
+    hash = "sha256-RuGy1xND0U5MB9fmCQLmc8eN77miwoK3CtgPuFAq3i4=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "setuptools-75.0-compat.patch";
-      url = "https://github.com/scikit-build/scikit-build/commit/3992485c67331097553ec8f54233c4c295943f70.patch";
-      hash = "sha256-U34UY+m6RE3c3UN/jGHuR+sRUqTGmG7dT52NWCY7nIE=";
-    })
-
-    # <https://github.com/scikit-build/scikit-build/pull/1160>
-    ./fix-cmake-4.patch
-  ];
-
   # This line in the filterwarnings section of the pytest configuration leads to this error:
   #  E   UserWarning: Distutils was imported before Setuptools, but importing Setuptools also replaces the `distutils` module in `sys.modules`. This may lead to undesirable behaviors or errors. To avoid these issues, avoid using distutils directly, ensure that setuptools is installed in the traditional way (e.g. not an editable install), and/or make sure that setuptools is always imported before distutils.
   postPatch = ''
diff --git a/pkgs/development/python-modules/scikit-build/fix-cmake-4.patch b/pkgs/development/python-modules/scikit-build/fix-cmake-4.patch
deleted file mode 100644
index 35d1ef5ad931..000000000000
--- a/pkgs/development/python-modules/scikit-build/fix-cmake-4.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 9efbf7f9baa846867a9c5586e4cc82a8a19e2e84 Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Wed, 17 Sep 2025 19:00:01 +0100
-Subject: [PATCH 1/2] tests: fix `test_issue335_support_cmake_source_dir` with
- CMake 4
-
----
- tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt b/tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt
-index 7e391c46..18bae2bf 100644
---- a/tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt
-+++ b/tests/samples/issue-335-support-cmake-source-dir/CMakeLists.txt
-@@ -1,4 +1,4 @@
--cmake_minimum_required(VERSION 3.2)
-+cmake_minimum_required(VERSION 3.2...3.10)
- 
- project(hello NONE)
- 
-
-From 491d7494a3ec6cc181d37d02670c65b74c67cbfe Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Wed, 17 Sep 2025 19:00:01 +0100
-Subject: [PATCH 2/2] tests: fix `test_make_without_configure_fails` with CMake
- 4
-
----
- tests/test_cmaker.py | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/tests/test_cmaker.py b/tests/test_cmaker.py
-index cf166905..9b6c3758 100644
---- a/tests/test_cmaker.py
-+++ b/tests/test_cmaker.py
-@@ -82,7 +82,10 @@ def test_make_without_configure_fails(capfd):
-         CMaker().make()
-     _, err = capfd.readouterr()
-     assert "An error occurred while building with CMake." in str(excinfo.value)
--    assert "Error: could not load cache" in err
-+    # CMake 4 changed the error message.
-+    err_message_cmake_3 = "Error: could not load cache"
-+    err_message_cmake_4 = "Error: not a CMake build directory (missing CMakeCache.txt)"
-+    assert err_message_cmake_3 in err or err_message_cmake_4 in err
- 
- 
- @pytest.mark.parametrize("configure_with_cmake_source_dir", [True, False])

From 158b6a83f793b2f1ce7acd9c72b89dacd8291e76 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:38:46 +0200
Subject: [PATCH 380/831] python3Packages.apscheduler: pin to setuptools_80

---
 pkgs/development/python-modules/apscheduler/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/apscheduler/default.nix b/pkgs/development/python-modules/apscheduler/default.nix
index aaa64871ccb7..0d03b1775976 100644
--- a/pkgs/development/python-modules/apscheduler/default.nix
+++ b/pkgs/development/python-modules/apscheduler/default.nix
@@ -9,7 +9,7 @@
   pytest-tornado,
   pytest8_3CheckHook,
   pytz,
-  setuptools,
+  setuptools_80,
   setuptools-scm,
   tornado,
   twisted,
@@ -33,7 +33,7 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 

From b4538c1c7c54dfdee811dd694a4b7d8e0a4223d2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:41:20 +0200
Subject: [PATCH 381/831] python3Packages.makefun: pin to setuptools_80

and update pytest pin to 8.3.
---
 pkgs/development/python-modules/makefun/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/makefun/default.nix b/pkgs/development/python-modules/makefun/default.nix
index 2065105ac8b1..3f7c4872e4bc 100644
--- a/pkgs/development/python-modules/makefun/default.nix
+++ b/pkgs/development/python-modules/makefun/default.nix
@@ -4,11 +4,11 @@
   buildPythonPackage,
 
   # build-system
-  setuptools,
+  setuptools_80,
   setuptools-scm,
 
   # tests
-  pytest7CheckHook,
+  pytest8_3CheckHook,
 }:
 
 buildPythonPackage rec {
@@ -27,11 +27,13 @@ buildPythonPackage rec {
   '';
 
   build-system = [
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 
-  nativeCheckInputs = [ pytest7CheckHook ];
+  nativeCheckInputs = [
+    pytest8_3CheckHook
+  ];
 
   pythonImportsCheck = [ "makefun" ];
 

From 6c81b30e2cd1aa5d76191ae549726cfc4cc31ae1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:45:56 +0200
Subject: [PATCH 382/831] python313Packages.fs: pin to setuptools_80

---
 pkgs/development/python-modules/fs/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/fs/default.nix b/pkgs/development/python-modules/fs/default.nix
index 44715f97f82d..c579ac186a6e 100644
--- a/pkgs/development/python-modules/fs/default.nix
+++ b/pkgs/development/python-modules/fs/default.nix
@@ -12,7 +12,7 @@
   pytestCheckHook,
   pythonAtLeast,
   pytz,
-  setuptools,
+  setuptools_80,
   six,
 }:
 
@@ -35,10 +35,10 @@ buildPythonPackage rec {
       --replace ThreadedTestFTPd FtpdThreadWrapper
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
-    setuptools
+    setuptools_80
     six
     appdirs
     pytz

From b9c3d1c0ffa85fcaa1b757685771d92f8ba6425e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:47:23 +0200
Subject: [PATCH 383/831] python3Packages.cu2qu: pin to setuptools_80

---
 pkgs/development/python-modules/cu2qu/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cu2qu/default.nix b/pkgs/development/python-modules/cu2qu/default.nix
index 1e913c4f4aca..aa76138d3e46 100644
--- a/pkgs/development/python-modules/cu2qu/default.nix
+++ b/pkgs/development/python-modules/cu2qu/default.nix
@@ -6,7 +6,7 @@
   # build
   cython,
   setuptools-scm,
-  setuptools,
+  setuptools_80,
 
   # propagates
   defcon,
@@ -32,7 +32,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cython
-    setuptools
+    setuptools_80
     setuptools-scm
   ];
 

From b473e8448f2c8d47bffb9ef1411926c53b889579 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 02:51:01 +0200
Subject: [PATCH 384/831] python3Packages.omegaconf: pin to setuptools_80

---
 pkgs/development/python-modules/omegaconf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/omegaconf/default.nix b/pkgs/development/python-modules/omegaconf/default.nix
index a4542a21913a..e0f6acec894a 100644
--- a/pkgs/development/python-modules/omegaconf/default.nix
+++ b/pkgs/development/python-modules/omegaconf/default.nix
@@ -5,7 +5,7 @@
   attrs,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   jre_minimal,
   pydevd,
   pytest-mock,
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     sed -i 's/antlr4-python3-runtime==.*/antlr4-python3-runtime/' requirements/base.txt
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   nativeBuildInputs = [ jre_minimal ];
 

From eeaaa9d01b937c3a6760c662b0244d348925a607 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 03:08:43 +0200
Subject: [PATCH 385/831] python3Packages.duckdb: propagate typing-extensions

---
 pkgs/development/python-modules/duckdb/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/duckdb/default.nix b/pkgs/development/python-modules/duckdb/default.nix
index 9736c5eeae5f..4ce00e36200a 100644
--- a/pkgs/development/python-modules/duckdb/default.nix
+++ b/pkgs/development/python-modules/duckdb/default.nix
@@ -18,6 +18,7 @@
   pytz,
   scikit-build-core,
   setuptools-scm,
+  typing-extensions,
   pytest-reraise,
   pytestCheckHook,
 }:
@@ -71,6 +72,10 @@ buildPythonPackage rec {
     openssl
   ];
 
+  dependencies = [
+    typing-extensions
+  ];
+
   optional-dependencies = {
     all = [
       # FIXME package adbc_driver_manager

From 1aaa1baa60ff884f0cd68fa3ca969b6fc9237860 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 14:38:20 +0200
Subject: [PATCH 386/831] python3Packages.cmd2: disable failing test

This is due to expecting a rich version lt 15. Upstream yanked the test
after the rich 15 update.
---
 pkgs/development/python-modules/cmd2/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/cmd2/default.nix b/pkgs/development/python-modules/cmd2/default.nix
index 464b1187d40d..1ea710021d18 100644
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@@ -46,6 +46,8 @@ buildPythonPackage rec {
     # Don't require vim for tests, it causes lots of rebuilds
     "test_find_editor_not_specified"
     "test_transcript"
+    # Removed upstream after rich 15 update
+    "test_from_ansi_wrapper"
   ];
 
   pythonImportsCheck = [ "cmd2" ];

From fe760b16bc9d76d483406d5070bf171216d03fbd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 15:52:52 +0200
Subject: [PATCH 387/831] python3Packages.pyramid: 2.0.2 -> 2.1

https://github.com/Pylons/pyramid/blob/2.1/CHANGES.rst
---
 .../python-modules/pyramid/default.nix        | 32 +++++++------------
 1 file changed, 12 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/python-modules/pyramid/default.nix b/pkgs/development/python-modules/pyramid/default.nix
index 6b76dad2eb72..c04a3e45faee 100644
--- a/pkgs/development/python-modules/pyramid/default.nix
+++ b/pkgs/development/python-modules/pyramid/default.nix
@@ -1,8 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  fetchpatch2,
+  fetchFromGitHub,
   webtest,
   zope-component,
   hupper,
@@ -10,7 +9,7 @@
   plaster,
   plaster-pastedeploy,
   repoze-lru,
-  setuptools,
+  setuptools_80,
   translationstring,
   venusian,
   webob,
@@ -19,25 +18,19 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyramid";
-  version = "2.0.2";
+  version = "2.1";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-NyE4pzjkIWU1zHbczm7d1aGqypUTDyNU+4NCZMBvGN4=";
+  src = fetchFromGitHub {
+    owner = "Pylons";
+    repo = "pyramid";
+    tag = finalAttrs.version;
+    hash = "sha256-N0zH0BpS9ImSTWeADBOBSgLYI062sdLxTzwBENAawFc=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "python-3.13-compat.patch";
-      url = "https://github.com/Pylons/pyramid/commit/1079613eb07e2a67454378e1fc28815dfd64bb82.patch";
-      hash = "sha256-/jxbA2q0kAeXDvIwhNkO8h4KbKtdquWXAH7/0lV8MXc=";
-    })
-  ];
-
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     hupper
@@ -45,7 +38,6 @@ buildPythonPackage rec {
     plaster
     plaster-pastedeploy
     repoze-lru
-    setuptools # for pkg_resources
     translationstring
     venusian
     webob
@@ -64,8 +56,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python web framework";
     homepage = "https://trypyramid.com/";
-    changelog = "https://github.com/Pylons/pyramid/blob/${version}/CHANGES.rst";
+    changelog = "https://github.com/Pylons/pyramid/blob/${finalAttrs.src.tag}/CHANGES.rst";
     license = lib.licenses.bsd0;
     maintainers = [ ];
   };
-}
+})

From d5ff76f1cf5a04039ab8b0f2475aa01f7c6344a6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 18 May 2026 16:38:18 +0200
Subject: [PATCH 388/831] python3Packages.prawcore: disable failing test

---
 pkgs/development/python-modules/prawcore/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/prawcore/default.nix b/pkgs/development/python-modules/prawcore/default.nix
index 790594cde747..22c34f8302dd 100644
--- a/pkgs/development/python-modules/prawcore/default.nix
+++ b/pkgs/development/python-modules/prawcore/default.nix
@@ -39,6 +39,11 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # fixture out of date
+    "test_request__session_timeout_default"
+  ];
+
   disabledTestPaths = [
     # tests requiring network
     "tests/integration"

From 4f399b1dae36318a2ba050f91fa5c9b0c301f187 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 18:37:01 -0700
Subject: [PATCH 389/831] python3Packages.idna: 3.14 -> 3.15

Diff: https://github.com/kjd/idna/compare/v3.14...v3.15

Changelog: https://github.com/kjd/idna/releases/tag/v3.15
---
 pkgs/development/python-modules/idna/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index 08f1f6a1d6cf..c6c917852319 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.14";
+  version = "3.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kjd";
     repo = "idna";
     tag = "v${version}";
-    hash = "sha256-cCyJsZc7+DpYQjS3nOfahrUcyFX2WtmmBKw8trZlELU=";
+    hash = "sha256-z3Nd834inihGzquCAmejUQvRcM0Yn/VmMcWQP3oh4ak=";
   };
 
   build-system = [ flit-core ];

From ef431c73be68d3b9a1f968fd517621a7809a21f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 18 May 2026 20:35:07 -0700
Subject: [PATCH 390/831] python313Packages.backports-zstd: 1.4.0 -> 1.5.0

Diff: https://github.com/rogdham/backports.zstd/compare/v1.4.0...v1.5.0

Changelog: https://github.com/rogdham/backports.zstd/blob/v1.5.0/CHANGELOG.md
---
 pkgs/development/python-modules/backports-zstd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/backports-zstd/default.nix b/pkgs/development/python-modules/backports-zstd/default.nix
index 13c28638361f..db294f3527d7 100644
--- a/pkgs/development/python-modules/backports-zstd/default.nix
+++ b/pkgs/development/python-modules/backports-zstd/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "backports-zstd";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm -r "$out/src/c/zstd"
     '';
-    hash = "sha256-dOzaenKu3sf1qaTWZfJ6W1l3KV4BYklUardpiPnSQWU=";
+    hash = "sha256-0FGYh6o26oeovZ23VYKmmY2nNzDHXIKU8/lBqUxuGQw=";
   };
 
   postPatch = ''

From 8fc19d25f3bc2e6f58094390324a670e99889591 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 17 May 2026 13:19:24 -0400
Subject: [PATCH 391/831] darwin.stdenv: fix infinite recursion due to Python
 3.14 upgrade

---
 pkgs/stdenv/darwin/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 3cf47e5a7334..d1658b467c6a 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -603,6 +603,7 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
         python3-bootstrap = super.python3.override {
           self = self.python3-bootstrap;
           pythonAttr = "python3-bootstrap";
+          zstd = null; # Avoid infinite recursion due to zstd depending on libiconv, which depends on Python via Meson.
           enableLTO = false;
         };
 

From e9bb1dd3f36a813e4ce3d819326be3f2d42d4062 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 19 May 2026 11:30:20 -0700
Subject: [PATCH 392/831] python3Packages.pandas: make src reproducible

---
 pkgs/development/python-modules/pandas/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/pandas/default.nix b/pkgs/development/python-modules/pandas/default.nix
index 88c164c5a93f..e4b838dba6ba 100644
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -70,6 +70,9 @@ let
       owner = "pandas-dev";
       repo = "pandas";
       tag = "v${version}";
+      postFetch = ''
+        sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pandas/_version.py
+      '';
       hash = "sha256-G+pWdmft/kcxv97ySa+0ZFEgvMKuNaK33DseZQ8R1z8=";
     };
 

From 1d5c2a8b871c5b295897e3f3cf5f974ba6435f05 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 20 May 2026 01:03:29 +0200
Subject: [PATCH 393/831] python3Packages.cffsubr: pin to setuptools 80

---
 pkgs/development/python-modules/cffsubr/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/cffsubr/default.nix b/pkgs/development/python-modules/cffsubr/default.nix
index 082c6f493a58..7483086dbd13 100644
--- a/pkgs/development/python-modules/cffsubr/default.nix
+++ b/pkgs/development/python-modules/cffsubr/default.nix
@@ -3,13 +3,13 @@
   afdko,
   buildPythonPackage,
   cmake,
-  distutils,
+  distutils_80,
   fetchPypi,
   fonttools,
   ninja,
   pytestCheckHook,
   scikit-build,
-  setuptools,
+  setuptools_80,
   setuptools-scm,
 }:
 
@@ -31,11 +31,11 @@ buildPythonPackage rec {
   '';
 
   build-system = [
+    distutils_80
+    setuptools_80
     cmake
-    distutils
     ninja
     scikit-build
-    setuptools
     setuptools-scm
   ];
 

From 7676fdd6ad59e7444d0566d591edabdb11d56317 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 19 May 2026 17:03:39 -0700
Subject: [PATCH 394/831] python3Packages.yarl: 1.23.0 -> 1.24.2

Diff: https://github.com/aio-libs/yarl/compare/v1.23.0...v1.24.2

Changelog: https://github.com/aio-libs/yarl/blob/v1.24.2/CHANGES.rst
---
 pkgs/development/python-modules/yarl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/yarl/default.nix b/pkgs/development/python-modules/yarl/default.nix
index 4b517a019959..ba29a36fff8f 100644
--- a/pkgs/development/python-modules/yarl/default.nix
+++ b/pkgs/development/python-modules/yarl/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "yarl";
-  version = "1.23.0";
+  version = "1.24.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "yarl";
     tag = "v${version}";
-    hash = "sha256-vjWV9fgBg7Mw54hsXWnO81CxJCe9WzB0okMEUz1KRAc=";
+    hash = "sha256-GEe2GDXmqsQgWB0UxPZVMdSco3j2JYHg9BU9M6oqynw=";
   };
 
   build-system = [

From 4105de0322de93ff1b9d03b18e878d1bee15d6d8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:16:44 +0200
Subject: [PATCH 395/831] python3Packages.tabcmd: 2.0.18 -> 2.0.20

https://github.com/tableau/tabcmd/releases/tag/v2.0.20
---
 pkgs/development/python-modules/tabcmd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tabcmd/default.nix b/pkgs/development/python-modules/tabcmd/default.nix
index b2282677ee3b..c07319fbe6c8 100644
--- a/pkgs/development/python-modules/tabcmd/default.nix
+++ b/pkgs/development/python-modules/tabcmd/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "tabcmd";
-  version = "2.0.18";
+  version = "2.0.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tableau";
     repo = "tabcmd";
     tag = "v${version}";
-    hash = "sha256-Eb9ZboYdco6opKW3Tz0+U9VREWdEyt2xuG62n9WIXPk=";
+    hash = "sha256-BviaCIav8rz37ac126KS4p54gbxzd6vs1p5kTy42bv4=";
   };
 
   prePatch = ''

From b56b7a3671f8f56740b171abb779ec16602516e1 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:19:26 +0200
Subject: [PATCH 396/831] python3Packages.tank-utility: pin to setuptools 80

---
 pkgs/development/python-modules/tank-utility/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/tank-utility/default.nix b/pkgs/development/python-modules/tank-utility/default.nix
index f8eaa1592994..cd3673865689 100644
--- a/pkgs/development/python-modules/tank-utility/default.nix
+++ b/pkgs/development/python-modules/tank-utility/default.nix
@@ -6,7 +6,7 @@
   pytestCheckHook,
   requests,
   responses,
-  setuptools,
+  setuptools_80,
   urllib3,
 }:
 
@@ -22,9 +22,9 @@ buildPythonPackage rec {
     hash = "sha256-h9y3X+FSzSFt+bd/chz+x0nocHaKZ8DvreMxAYMs8/E=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     requests
     urllib3
   ];

From 9c013026b9854fa3c5ea38965ad0b55a94597824 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:26:12 +0200
Subject: [PATCH 397/831] python3Packages.typer: 0.24.0 -> 0.25.1

https://github.com/tiangolo/typer/releases/tag/0.25.1
---
 pkgs/development/python-modules/typer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/typer/default.nix b/pkgs/development/python-modules/typer/default.nix
index c9bc634b3549..65a0772135ad 100644
--- a/pkgs/development/python-modules/typer/default.nix
+++ b/pkgs/development/python-modules/typer/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "typer";
-  version = "0.24.0";
+  version = "0.25.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fastapi";
     repo = "typer";
     tag = version;
-    hash = "sha256-ha/cT2+I9/WUjb7ZXSKqLSocZ3vq0N1fm4RvRpsXIDc=";
+    hash = "sha256-HIvXseuR7zUXFuTWzntDfHhAp8BcFjxo35gn0i4+03w=";
   };
 
   postPatch = ''

From 292f1bcbd43dae3ba1103ebc1c9041b983c93492 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:29:03 +0200
Subject: [PATCH 398/831] python3Packages.pytokens: init at 0.4.1

New dependency for black.
---
 .../python-modules/pytokens/default.nix       | 47 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 49 insertions(+)
 create mode 100644 pkgs/development/python-modules/pytokens/default.nix

diff --git a/pkgs/development/python-modules/pytokens/default.nix b/pkgs/development/python-modules/pytokens/default.nix
new file mode 100644
index 000000000000..cd0346f06223
--- /dev/null
+++ b/pkgs/development/python-modules/pytokens/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  ast-serialize,
+  mypy,
+  setuptools,
+  pytestCheckHook,
+  pytest-cov-stub,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pytokens";
+  version = "0.4.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "tusharsadhwani";
+    repo = "pytokens";
+    tag = finalAttrs.version;
+    hash = "sha256-DOCOoZ3T7qh8me1vn7qYlEMiyc31d77sf1/5RsW5sUg=";
+  };
+
+  build-system = [
+    ast-serialize
+    mypy
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "pytokens"
+  ];
+
+  meta = {
+    changelog = "https://github.com/tusharsadhwani/pytokens/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    description = "Fast, spec compliant Python 3.14+ tokenizer that runs on older Pythons";
+    homepage = "https://github.com/tusharsadhwani/pytokens";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 815153af375a..8fb3255bb1da 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16358,6 +16358,8 @@ self: super: with self; {
 
   pytmx = callPackage ../development/python-modules/pytmx { };
 
+  pytokens = callPackage ../development/python-modules/pytokens { };
+
   pytomlpp = callPackage ../development/python-modules/pytomlpp { };
 
   pytomorrowio = callPackage ../development/python-modules/pytomorrowio { };

From cafee09a901be684d083111ff4483cbd93faa507 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:32:44 +0200
Subject: [PATCH 399/831] black: 25.1.0 -> 26.5.1

https://github.com/psf/black/blob/26.5.1/CHANGES.md
---
 .../python-modules/black/default.nix          | 48 ++++++-------------
 1 file changed, 15 insertions(+), 33 deletions(-)

diff --git a/pkgs/development/python-modules/black/default.nix b/pkgs/development/python-modules/black/default.nix
index ea56257d981f..ee547c137c06 100644
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@@ -2,8 +2,7 @@
   stdenv,
   lib,
   buildPythonPackage,
-  fetchPypi,
-  fetchpatch,
+  fetchFromGitHub,
   pytestCheckHook,
   aiohttp,
   click,
@@ -17,50 +16,36 @@
   pathspec,
   parameterized,
   platformdirs,
+  pytokens,
   tokenize-rt,
   uvloop,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "black";
-  version = "25.1.0";
+  version = "26.5.1";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-M0ltXNEiKtczkTUrSujaFSU8Xeibk6gLPiyNmhnsJmY=";
+  src = fetchFromGitHub {
+    owner = "psf";
+    repo = "black";
+    tag = finalAttrs.version;
+    hash = "sha256-xALg9ta0U2V6i/b7VYiPKu0oNnHfg9T+XuK3CvqJmjs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "click-8.2-compat-1.patch";
-      url = "https://github.com/psf/black/commit/14e1de805a5d66744a08742cad32d1660bf7617a.patch";
-      hash = "sha256-fHRlMetE6+09MKkuFNQQr39nIKeNrqwQuBNqfIlP4hc=";
-    })
-    (fetchpatch {
-      name = "click-8.2-compat-2.patch";
-      url = "https://github.com/psf/black/commit/ed64d89faa7c738c4ba0006710f7e387174478af.patch";
-      hash = "sha256-df/J6wiRqtnHk3mAY3ETiRR2G4hWY1rmZMfm2rjP2ZQ=";
-    })
-    (fetchpatch {
-      name = "click-8.2-compat-3.patch";
-      url = "https://github.com/psf/black/commit/b0f36f5b4233ef4cf613daca0adc3896d5424159.patch";
-      hash = "sha256-SGLCxbgrWnAi79IjQOb2H8mD/JDbr2SGfnKyzQsJrOA=";
-    })
-  ];
-
-  nativeBuildInputs = [
+  build-system = [
     hatch-fancy-pypi-readme
     hatch-vcs
     hatchling
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     click
     mypy-extensions
     packaging
     pathspec
     platformdirs
+    pytokens
   ];
 
   optional-dependencies = {
@@ -81,7 +66,7 @@ buildPythonPackage rec {
     pytestCheckHook
     parameterized
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   pytestFlags = [
     "-Wignore::DeprecationWarning"
@@ -102,9 +87,6 @@ buildPythonPackage rec {
   disabledTests = [
     # requires network access
     "test_gen_check_output"
-    # broken on Python 3.13.4
-    # FIXME: remove this when fixed upstream
-    "test_simple_format[pep_701]"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # fails on darwin
@@ -119,7 +101,7 @@ buildPythonPackage rec {
   meta = {
     description = "Uncompromising Python code formatter";
     homepage = "https://github.com/psf/black";
-    changelog = "https://github.com/psf/black/blob/${version}/CHANGES.md";
+    changelog = "https://github.com/psf/black/blob/${finalAttrs.src.tag}/CHANGES.md";
     license = lib.licenses.mit;
     mainProgram = "black";
     maintainers = with lib.maintainers; [
@@ -127,4 +109,4 @@ buildPythonPackage rec {
       autophagy
     ];
   };
-}
+})

From 5bb6e1f605eddcb72957fdc2a2bfa9912cecfb9d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:45:42 +0200
Subject: [PATCH 400/831] python3Packages.masky: pep517 build, pin setuptools
 80

---
 pkgs/development/python-modules/masky/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/masky/default.nix b/pkgs/development/python-modules/masky/default.nix
index d8ecee4241ec..8f11f1e2cb30 100644
--- a/pkgs/development/python-modules/masky/default.nix
+++ b/pkgs/development/python-modules/masky/default.nix
@@ -7,12 +7,13 @@
   fetchFromGitHub,
   impacket,
   pyasn1,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
   pname = "masky";
   version = "0.2.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Z4kSec";
@@ -21,7 +22,9 @@ buildPythonPackage rec {
     hash = "sha256-npRuszHkxwjJ+B+q8eQywXPd0OX0zS+AfCro4TM83Uc=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools_80 ];
+
+  dependencies = [
     asn1crypto
     colorama
     cryptography

From 8d493968f57ace53c0f4ee7bc3e3511ce9996c4a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:52:48 +0200
Subject: [PATCH 401/831] python3Packages.pytest-logdog: pep517 build, pin
 setuptools 80

---
 .../python-modules/pytest-logdog/default.nix          | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-logdog/default.nix b/pkgs/development/python-modules/pytest-logdog/default.nix
index 4ddb31f54c58..cf479422c759 100644
--- a/pkgs/development/python-modules/pytest-logdog/default.nix
+++ b/pkgs/development/python-modules/pytest-logdog/default.nix
@@ -4,14 +4,14 @@
   fetchFromGitHub,
   pytest,
   pytestCheckHook,
-  setuptools,
+  setuptools_80,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "pytest-logdog";
   version = "0.1.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ods";
@@ -20,12 +20,13 @@ buildPythonPackage rec {
     hash = "sha256-Tmoq+KAGzn0MMj29rukDfAc4LSIwC8DoMTuBAppV32I=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools_80
+    setuptools-scm
+  ];
 
   buildInputs = [ pytest ];
 
-  propagatedBuildInputs = [ setuptools ];
-
   nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "pytest_logdog" ];

From 16d1c62a28f584d97f28746a04c099ff1a0be837 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 01:55:29 +0200
Subject: [PATCH 402/831] python3Packages.python-ldap: 3.4.6 -> 3.4.7

https://github.com/python-ldap/python-ldap/releases/tag/python-ldap-3.4.7
---
 pkgs/development/python-modules/python-ldap/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-ldap/default.nix b/pkgs/development/python-modules/python-ldap/default.nix
index 3e067291bab6..23186b37e8db 100644
--- a/pkgs/development/python-modules/python-ldap/default.nix
+++ b/pkgs/development/python-modules/python-ldap/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-ldap";
-  version = "3.4.6";
+  version = "3.4.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-ldap";
     repo = "python-ldap";
     tag = "python-ldap-${finalAttrs.version}";
-    hash = "sha256-j0viogO02O8G53ORq0u1U+B5I0mcpuB+E1Xvl7ZQKQw=";
+    hash = "sha256-uSP8c5gid5TBenBaNVdlteHatkctAafz6yFHuIYKiTY=";
   };
 
   build-system = [

From e936451e5803e96160c892826dd8d236289b4b4e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 02:00:25 +0200
Subject: [PATCH 403/831] python3Packages.certomancer: 0.13.0 -> 0.14.0

---
 .../python-modules/certomancer/default.nix           | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/certomancer/default.nix b/pkgs/development/python-modules/certomancer/default.nix
index d54ae914cde0..1a0d61e8f6c2 100644
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -2,9 +2,11 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
   # build-system
   setuptools,
-  wheel,
+  setuptools-scm,
+
   # dependencies
   asn1crypto,
   click,
@@ -12,11 +14,13 @@
   python-dateutil,
   pyyaml,
   tzlocal,
+
   # optional-dependencies
   requests-mock,
   jinja2,
   werkzeug,
   python-pkcs11,
+
   # nativeCheckInputs
   freezegun,
   pyhanko-certvalidator,
@@ -28,19 +32,19 @@
 
 buildPythonPackage rec {
   pname = "certomancer";
-  version = "0.13.0";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MatthiasValvekens";
     repo = "certomancer";
     tag = "v${version}";
-    hash = "sha256-2/qTTN/UuSMHjkSsOs/KbfzKLBjJSLHY51XtgQ6x1Wo=";
+    hash = "sha256-rsugn1g8iYESrC+IUSbxCAbwnKXWG+ubbUj9QdZB+Ow=";
   };
 
   build-system = [
     setuptools
-    wheel
+    setuptools-scm
   ];
 
   dependencies = [

From a41d6b2f06659724d1ee7bc7289c0b030341ad3b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 02:01:48 +0200
Subject: [PATCH 404/831] python3Packages.launchpadlib: pin setuptools 80

---
 pkgs/development/python-modules/launchpadlib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/launchpadlib/default.nix b/pkgs/development/python-modules/launchpadlib/default.nix
index db6e0c9ab8e0..02769d84b52f 100644
--- a/pkgs/development/python-modules/launchpadlib/default.nix
+++ b/pkgs/development/python-modules/launchpadlib/default.nix
@@ -5,7 +5,7 @@
   httplib2,
   lazr-restfulclient,
   lazr-uri,
-  setuptools,
+  setuptools_80,
   six,
   testresources,
   pytestCheckHook,
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     hash = "sha256-tMJYkLt1BQ1UwIEj0nMxVreKWaJVX1Rh9psORM2RJC8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     httplib2

From 3d53e58aad1a8a32670ad3b5f55a6cbc055a11fb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 21 May 2026 02:04:29 +0200
Subject: [PATCH 405/831] python3Packages.pyhanko: 0.34.1 -> 0.35.1

https://github.com/MatthiasValvekens/pyHanko/blob/v0.35.1/docs/changelog.rst#pyhanko
---
 pkgs/development/python-modules/pyhanko/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyhanko/default.nix b/pkgs/development/python-modules/pyhanko/default.nix
index 473a61694bc5..e82fe9b72499 100644
--- a/pkgs/development/python-modules/pyhanko/default.nix
+++ b/pkgs/development/python-modules/pyhanko/default.nix
@@ -63,11 +63,11 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     asn1crypto
     cryptography
+    lxml
     pyhanko-certvalidator
     pyyaml
     requests
     tzlocal
-    lxml
   ];
 
   optional-dependencies = {

From 7add03ebc953e3847fcea47e60a3a491a04a4232 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 22:09:25 -0700
Subject: [PATCH 406/831] python3Packages.pathable: 0.5.0 -> 0.6.0

Diff: https://github.com/p1c2u/pathable/compare/0.5.0...0.6.0

Changelog: https://github.com/p1c2u/pathable/releases/tag/0.6.0
---
 pkgs/development/python-modules/pathable/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pathable/default.nix b/pkgs/development/python-modules/pathable/default.nix
index 4921616d1c14..85e7f7593a8c 100644
--- a/pkgs/development/python-modules/pathable/default.nix
+++ b/pkgs/development/python-modules/pathable/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pathable";
-  version = "0.5.0";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "p1c2u";
     repo = "pathable";
     tag = version;
-    hash = "sha256-D3TYVMcKXPA6fmy2JND5o8ja3Rk8Ne17Sxm4+fLw3Dw=";
+    hash = "sha256-DjIn+hXZvx4tKyzQlWPwIxHD8vWy/jEvhdFY6HC+sdo=";
   };
 
   build-system = [ poetry-core ];

From 1010b888452029ebeb25d1e46cd4448cfc2ecba1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 22:08:46 -0700
Subject: [PATCH 407/831] python3Packages.jsonschema-path: 0.4.6 -> 0.5.0

Diff: https://github.com/p1c2u/jsonschema-path/compare/0.4.6...0.5.0

Changelog: https://github.com/p1c2u/jsonschema-path/releases/tag/0.5.0
---
 pkgs/development/python-modules/jsonschema-path/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jsonschema-path/default.nix b/pkgs/development/python-modules/jsonschema-path/default.nix
index 85cdc1f45b59..c5da88ac3732 100644
--- a/pkgs/development/python-modules/jsonschema-path/default.nix
+++ b/pkgs/development/python-modules/jsonschema-path/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "jsonschema-path";
-  version = "0.4.6";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "p1c2u";
     repo = "jsonschema-path";
     tag = version;
-    hash = "sha256-abAhWtBnZUeg1VGphfnvxPzSnPM6VjM/XKLPJVIrIXg=";
+    hash = "sha256-CDDwhIlwytUPVwq/+0T5kVzl8viJfSalSIxC5VrQdgs=";
   };
 
   build-system = [ poetry-core ];

From d8e3c884537f7f94e1a5ffbd42d64570c3435368 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 22:12:28 -0700
Subject: [PATCH 408/831] python3Packages.pikepdf: 10.6.0 -> 10.7.0

Diff: https://github.com/pikepdf/pikepdf/compare/v10.6.0...v10.7.0

Changelog: https://github.com/pikepdf/pikepdf/blob/v10.7.0/docs/releasenotes/version10.md
---
 pkgs/development/python-modules/pikepdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 43e519ca3a96..eb8e8090863d 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.6.0";
+  version = "10.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-COEAY9/H9KZ1Tyj89CFMBl9ydTro82qk1XYWbaI9AFY=";
+    hash = "sha256-+HnETz4+yS7RRxvFiJXv/LG6mnmwJJrfIsB19ruU9kc=";
   };
 
   patches = [

From cfc4aab3490772bea291b63818f3e077ed98e07d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 20 May 2026 22:15:14 -0700
Subject: [PATCH 409/831] python3Packages.trove-classifiers: 2026.5.7.17 ->
 2026.5.20.19

Changelog: https://github.com/pypa/trove-classifiers/releases/tag/2026.5.20.19
---
 pkgs/development/python-modules/trove-classifiers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/trove-classifiers/default.nix b/pkgs/development/python-modules/trove-classifiers/default.nix
index 88a82933636b..898180da3cd0 100644
--- a/pkgs/development/python-modules/trove-classifiers/default.nix
+++ b/pkgs/development/python-modules/trove-classifiers/default.nix
@@ -10,13 +10,13 @@
 let
   self = buildPythonPackage rec {
     pname = "trove-classifiers";
-    version = "2026.5.7.17";
+    version = "2026.5.20.19";
     pyproject = true;
 
     src = fetchPypi {
       pname = "trove_classifiers";
       inherit version;
-      hash = "sha256-oEpI+PCnh8uZZRTTlprHYIqjxgyxXQc8HgKAHmBTPoA=";
+      hash = "sha256-bmEZk5h8qTJpaK1wRScz2t0xRxWZ05iWBFsolwqbuB4=";
     };
 
     postPatch = ''

From 3c1a2152d0ed6c1fff4921d2065d0245eb0b4faf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 22 May 2026 12:28:13 -0700
Subject: [PATCH 410/831] python3Packages.pikepdf: 10.7.0 -> 10.7.1

Diff: https://github.com/pikepdf/pikepdf/compare/v10.7.0...v10.7.1

Changelog: https://github.com/pikepdf/pikepdf/blob/v10.7.1/docs/releasenotes/version10.md
---
 pkgs/development/python-modules/pikepdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index eb8e8090863d..4173d1cc9eda 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.7.0";
+  version = "10.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-+HnETz4+yS7RRxvFiJXv/LG6mnmwJJrfIsB19ruU9kc=";
+    hash = "sha256-qXpGopfiIG9dimJjHZlbHhXrtliSbgj2tWGQhbQwP5Q=";
   };
 
   patches = [

From aaa1dd2051a1e298b8d627a81282d5085d42e576 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 23 May 2026 18:54:00 +0200
Subject: [PATCH 411/831] python3Packages.cassandra-driver: 3.29.3 -> 3.30.0

https://github.com/apache/cassandra-python-driver/blob/3.30.0/CHANGELOG.rst
---
 .../python-modules/cassandra-driver/default.nix           | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cassandra-driver/default.nix b/pkgs/development/python-modules/cassandra-driver/default.nix
index da4ab5806aaf..a560f2598d8d 100644
--- a/pkgs/development/python-modules/cassandra-driver/default.nix
+++ b/pkgs/development/python-modules/cassandra-driver/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   cryptography,
   cython,
+  deprecated,
   eventlet,
   fetchFromGitHub,
   geomet,
@@ -17,6 +18,7 @@
   pyyaml,
   scales,
   sure,
+  tomli,
   twisted,
   setuptools,
   distutils,
@@ -24,14 +26,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cassandra-driver";
-  version = "3.29.3";
+  version = "3.30.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "cassandra-python-driver";
     tag = finalAttrs.version;
-    hash = "sha256-VynrUc7gqAi061FU2ln4B1fK4NaSUcjSgH1i1JQpmvk=";
+    hash = "sha256-4ElOiADaldT/TyLqg/5ijFk9Ygb3GEF37P2d8WdAxkw=";
   };
 
   pythonRelaxDeps = [ "geomet" ];
@@ -40,11 +42,13 @@ buildPythonPackage (finalAttrs: {
     distutils
     setuptools
     cython
+    tomli
   ];
 
   buildInputs = [ libev ];
 
   dependencies = [
+    deprecated
     geomet
   ];
 

From f90f7a646ab118ba24ac48c93cc9cc39e4127b93 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 24 May 2026 00:44:42 +0200
Subject: [PATCH 412/831] python3Packages.wxpython: 4.2.4 -> 4.2.5

https://github.com/wxWidgets/Phoenix/blob/wxPython-4.2.5/CHANGES.rst
---
 .../python-modules/wxpython/4.2.nix           | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/wxpython/4.2.nix b/pkgs/development/python-modules/wxpython/4.2.nix
index e33e4e871716..1e5cfaea6e75 100644
--- a/pkgs/development/python-modules/wxpython/4.2.nix
+++ b/pkgs/development/python-modules/wxpython/4.2.nix
@@ -48,14 +48,14 @@
   xvfb-run,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "wxpython";
-  version = "4.2.4";
+  version = "4.2.5";
   pyproject = false;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-LrEjl5yHvLMp6KJFImnWD/j59lHpvyXGdXnlPE67rjw=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-ROg20bzNmcOHkLsDS27PcNkGD2c0MgVg98Sw0AYUR5M=";
   };
 
   patches = [
@@ -65,13 +65,6 @@ buildPythonPackage rec {
       libcairo = "${lib.getLib cairo}/lib/libcairo${stdenv.hostPlatform.extensions.sharedLibrary}";
     })
     ./0001-add-missing-bool-c.patch # Add missing bool.c from old source
-    # TODO: drop when updating beyond version 4.2.4
-    # https://github.com/wxWidgets/Phoenix/pull/2822
-    (fetchpatch {
-      name = "Fix-wx.svg-to-work-with-cython-3.1-generated-code.patch";
-      url = "https://github.com/wxWidgets/Phoenix/commit/31303649ab0a0fed0789e0951a7487d172b65bfa.patch";
-      hash = "sha256-OAnAsyqHGPNEAiOxLLpdEGcd92K7TCxqEBYceuIb8so=";
-    })
   ];
 
   # https://github.com/wxWidgets/Phoenix/issues/2575
@@ -178,7 +171,7 @@ buildPythonPackage rec {
     '';
 
   meta = {
-    changelog = "https://github.com/wxWidgets/Phoenix/blob/wxPython-${version}/CHANGES.rst";
+    changelog = "https://github.com/wxWidgets/Phoenix/blob/wxPython-${finalAttrs.version}/CHANGES.rst";
     description = "Cross platform GUI toolkit for Python, Phoenix version";
     homepage = "http://wxpython.org/";
     license = with lib.licenses; [
@@ -186,4 +179,4 @@ buildPythonPackage rec {
       wxWindowsException31
     ];
   };
-}
+})

From 0073ff9cf24341384998b94d3f1bf04f3d921417 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 24 May 2026 01:19:35 +0200
Subject: [PATCH 413/831] python3Packages.pysmi: 1.6.3 -> 2.0.2

https://github.com/lextudio/pysmi/blob/v2.0.2/CHANGES.rst
---
 pkgs/development/python-modules/pysmi/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pysmi/default.nix b/pkgs/development/python-modules/pysmi/default.nix
index 2c64e9f2ab8d..39ade30d993e 100644
--- a/pkgs/development/python-modules/pysmi/default.nix
+++ b/pkgs/development/python-modules/pysmi/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   flit-core,
   jinja2,
-  ply,
+  lark,
   pysmi,
   pysnmp,
   pytestCheckHook,
@@ -13,21 +13,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pysmi";
-  version = "1.6.3";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lextudio";
     repo = "pysmi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TpDrsBGym07JPIcnytyWI7Ebx9RR+7Ia36zOzWMWqPM=";
+    hash = "sha256-ft8R73eUgb+pnr35ZVc2Br3BGHhUDHEcQ9k/K6tjYBk=";
   };
 
   build-system = [ flit-core ];
 
   dependencies = [
-    ply
     jinja2
+    lark
     requests
   ];
 

From 9d95ab00dccb89e17616f57c0fb1f74fba95484f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 24 May 2026 02:06:44 +0200
Subject: [PATCH 414/831] python3Packages.pysnmp: 7.1.24 -> 7.1.27

https://github.com/lextudio/pysnmp/blob/refs/tags/v7.1.27/CHANGES.rst
---
 pkgs/development/python-modules/pysnmp/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pysnmp/default.nix b/pkgs/development/python-modules/pysnmp/default.nix
index b1fb2450970e..dcdf8d9f5b6a 100644
--- a/pkgs/development/python-modules/pysnmp/default.nix
+++ b/pkgs/development/python-modules/pysnmp/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "pysnmp";
-  version = "7.1.24";
+  version = "7.1.27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lextudio";
     repo = "pysnmp";
     tag = "v${version}";
-    hash = "sha256-jKTU6ivcg13naaKMVmCYtjmi16kh3nAScDN80OR0d+A=";
+    hash = "sha256-BFdPdEa5aZAYa6i7714k33wM36Sq1ExJO/6dmsGLzVg=";
   };
 
   build-system = [ flit-core ];
@@ -64,6 +64,7 @@ buildPythonPackage rec {
     "test_v2c_get_table_bulk_0_5_subtree"
     "test_v2c_get_table_bulk_0_6_subtree"
     # pysnmp.smi.error.MibNotFoundError
+    # mibs are not part of the repo and expensive to pull
     "test_send_v3_trap_notification"
     "test_addAsn1MibSource"
     "test_v1_walk"
@@ -72,6 +73,9 @@ buildPythonPackage rec {
     "test_syntax_unsigned"
     "test_add_asn1_mib_source"
     "test_syntax_fixed_length_octet_string"
+    "test_inet_address_ipv4_resolv"
+    "test_inet_address_ipv6_resolv"
+    "test_inet_address_roundtrip"
   ];
 
   disabledTestPaths = [

From b77987ff5cdd4c90094cea50949428a12587bc23 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 18:45:31 -0700
Subject: [PATCH 415/831] python3Packages.db-dtypes: 1.5.0 -> 1.6.0

Diff: https://github.com/googleapis/google-cloud-python/compare/db-dtypes-v1.5.0...db-dtypes-v1.6.0

Changelog: https://github.com/googleapis/google-cloud-python/blob/db-dtypes-v1.6.0/packages/db-dtypes/CHANGELOG.md
---
 .../python-modules/db-dtypes/default.nix      | 25 ++++++++-----------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index 82f7dde2133d..58617f0f9a66 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -6,22 +6,24 @@
   packaging,
   pandas,
   pyarrow,
-  pytest8_3CheckHook,
+  pytestCheckHook,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "db-dtypes";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
-    repo = "python-db-dtypes-pandas";
-    tag = "v${version}";
-    hash = "sha256-cF40Y2J944AojOXKoTzQ/ybTFY4GP5G8KWY6+NWyRT8=";
+    repo = "google-cloud-python";
+    tag = "db-dtypes-v${version}";
+    hash = "sha256-KJviH4dofYSvZu9S7VMBSnGjH66xMUEvhcmZN7GJ4Iw=";
   };
 
+  sourceRoot = "${src.name}/packages/db-dtypes";
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -31,21 +33,14 @@ buildPythonPackage rec {
     pyarrow
   ];
 
-  nativeCheckInputs = [ pytest8_3CheckHook ];
-
-  disabledTests = [
-    # ValueError: Unable to avoid copy while creating an array as requested.
-    "test_array_interface_copy"
-    # Failed: DID NOT RAISE <class 'TypeError'>
-    "test_reduce_series_numeric"
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "db_dtypes" ];
 
   meta = {
     description = "Pandas Data Types for SQL systems (BigQuery, Spanner)";
-    homepage = "https://github.com/googleapis/python-db-dtypes-pandas";
-    changelog = "https://github.com/googleapis/python-db-dtypes-pandas/blob/${src.tag}/CHANGELOG.md";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/db-dtypes";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${src.tag}/packages/db-dtypes/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };

From e00dc7175e90e5d3cc4cfc6d847a1044102d1744 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 18:48:20 -0700
Subject: [PATCH 416/831] python3Packages.db-dtypes: support pandas 3.0

---
 pkgs/development/python-modules/db-dtypes/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index 58617f0f9a66..ef3848830186 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   numpy,
   packaging,
   pandas,
@@ -24,6 +25,15 @@ buildPythonPackage rec {
 
   sourceRoot = "${src.name}/packages/db-dtypes";
 
+  patches = [
+    (fetchpatch {
+      name = "support-pandas-3.0.patch";
+      url = "https://github.com/googleapis/google-cloud-python/commit/2086b34d8b3418462c9bc89b96eac779a25a3afd.patch";
+      relative = "packages/db-dtypes";
+      hash = "sha256-0NvbTCnr95IW7rkQVu3iUDsNXU/LzXhJwwSDdliFZ+Y=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [

From e4599fe4ce68693b49609eeae449851e129a0d57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 18:49:48 -0700
Subject: [PATCH 417/831] python3Packages.db-dtypes: use finalAttrs

---
 pkgs/development/python-modules/db-dtypes/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/db-dtypes/default.nix b/pkgs/development/python-modules/db-dtypes/default.nix
index ef3848830186..c2bb9a49595a 100644
--- a/pkgs/development/python-modules/db-dtypes/default.nix
+++ b/pkgs/development/python-modules/db-dtypes/default.nix
@@ -11,7 +11,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "db-dtypes";
   version = "1.6.0";
   pyproject = true;
@@ -19,11 +19,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
-    tag = "db-dtypes-v${version}";
+    tag = "db-dtypes-v${finalAttrs.version}";
     hash = "sha256-KJviH4dofYSvZu9S7VMBSnGjH66xMUEvhcmZN7GJ4Iw=";
   };
 
-  sourceRoot = "${src.name}/packages/db-dtypes";
+  sourceRoot = "${finalAttrs.src.name}/packages/db-dtypes";
 
   patches = [
     (fetchpatch {
@@ -50,8 +50,8 @@ buildPythonPackage rec {
   meta = {
     description = "Pandas Data Types for SQL systems (BigQuery, Spanner)";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/db-dtypes";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/${src.tag}/packages/db-dtypes/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${finalAttrs.src.tag}/packages/db-dtypes/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})

From 05c1067067263ab0945cd6a68da869fea49160b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:11:56 -0700
Subject: [PATCH 418/831] python3Packages.openapi-core: fix build with
 jsonschema-path 0.5.0

---
 pkgs/development/python-modules/openapi-core/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/openapi-core/default.nix b/pkgs/development/python-modules/openapi-core/default.nix
index 3fafd9f25fd4..81fb76e51861 100644
--- a/pkgs/development/python-modules/openapi-core/default.nix
+++ b/pkgs/development/python-modules/openapi-core/default.nix
@@ -42,6 +42,10 @@ buildPythonPackage rec {
 
   build-system = [ poetry-core ];
 
+  pythonRelaxDeps = [
+    "jsonschema-path"
+  ];
+
   dependencies = [
     isodate
     more-itertools
@@ -86,6 +90,11 @@ buildPythonPackage rec {
     "tests/integration/contrib/django/"
   ];
 
+  disabledTests = [
+    # https://github.com/p1c2u/jsonschema-path/pull/262 broke comparison of `SchemaPath`s
+    "test_returns_default_server"
+  ];
+
   pythonImportsCheck = [
     "openapi_core"
     "openapi_core.validation.request.validators"

From 3bf49825cb3fdd061450222fee69420aa8cd4f58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:33:32 -0700
Subject: [PATCH 419/831] python3Packages.xmlsec: unpin lxml

---
 pkgs/development/python-modules/xmlsec/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/xmlsec/default.nix b/pkgs/development/python-modules/xmlsec/default.nix
index e1178ff3058f..81f4571b32e6 100644
--- a/pkgs/development/python-modules/xmlsec/default.nix
+++ b/pkgs/development/python-modules/xmlsec/default.nix
@@ -40,6 +40,7 @@ buildPythonPackage (finalAttrs: {
 
   postPatch = ''
     substituteInPlace pyproject.toml \
+      --replace-fail "lxml==" "lxml>=" \
       --replace-fail "setuptools==" "setuptools>="
   '';
 

From e09d96cba6f73c0d31009076f9a16b03a215408a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:43:09 -0700
Subject: [PATCH 420/831] python3Packages.google-cloud-bigquery: 3.40.0 ->
 3.41.0

Changelog: https://github.com/googleapis/python-bigquery/blob/v3.41.0/CHANGELOG.md
---
 .../python-modules/google-cloud-bigquery/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-bigquery/default.nix b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
index 9b9bf37da1f8..7d4b5748ba92 100644
--- a/pkgs/development/python-modules/google-cloud-bigquery/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigquery/default.nix
@@ -37,13 +37,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.40.0";
+  version = "3.41.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_bigquery";
     inherit version;
-    hash = "sha256-s8yxHK8AKfFbKVaVGPZnVT/gj28UWblZAgyD+72PLmg=";
+    hash = "sha256-IhfkiLR+1XY2DJsswH1Z2IOlS4MWfA7zf5FcJrAaBv4=";
   };
 
   build-system = [ setuptools ];

From 62a201505988284b8e63ba4a3caf5d457551834f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:53:07 -0700
Subject: [PATCH 421/831] python3Packages.ast-serialize: 0.3.0 -> 0.5.0

Diff: https://github.com/mypyc/ast_serialize/compare/v0.3.0...v0.5.0
---
 .../python-modules/ast-serialize/default.nix           | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/ast-serialize/default.nix b/pkgs/development/python-modules/ast-serialize/default.nix
index 71ee99cb9e62..0ce8d6d2a3f4 100644
--- a/pkgs/development/python-modules/ast-serialize/default.nix
+++ b/pkgs/development/python-modules/ast-serialize/default.nix
@@ -2,33 +2,29 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  cargo,
   rustPlatform,
-  rustc,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "ast-serialize";
-  version = "0.3.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mypyc";
     repo = "ast_serialize";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R5hNpbJjKKZDOKQCdGZQ+0iW5vdh5CzSgzORESh4bDU=";
+    hash = "sha256-GmhbMraI16J6ePtn7lXAWaJ+9zDH1GdebKIAzm5w9ok=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-uhUMaUkaL57X8CVy6T9pCQa62IsOeKN/dhZTPVXSn14=";
+    hash = "sha256-h+BklNeoQaRVWczsE9sFXgvFrnHW5vjWOVaOvLghv0U=";
   };
 
   build-system = [
-    cargo
     rustPlatform.cargoSetupHook
     rustPlatform.maturinBuildHook
-    rustc
   ];
 
   pythonImportsCheck = [

From e8a86698fb5a52c2fd64f274ba322f1aa1882110 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 19:58:10 -0700
Subject: [PATCH 422/831] python3Packages.coredis: 5.6.0 -> 6.6.1

Diff: https://github.com/alisaifee/coredis/compare/5.6.0...6.6.1

Changelog: https://github.com/alisaifee/coredis/blob/6.6.1/HISTORY.rst
---
 .../python-modules/coredis/default.nix        | 25 +++++++++----------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/coredis/default.nix b/pkgs/development/python-modules/coredis/default.nix
index d54d4e0a6525..8b1e0cf051ad 100644
--- a/pkgs/development/python-modules/coredis/default.nix
+++ b/pkgs/development/python-modules/coredis/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  async-timeout,
+  anyio,
   beartype,
   buildPythonPackage,
   hatchling,
@@ -8,36 +8,35 @@
   hatch-vcs,
   types-deprecated,
   deprecated,
+  exceptiongroup,
   fetchFromGitHub,
   packaging,
-  pympler,
   pytest-asyncio,
   pytest-lazy-fixtures,
+  pytest-mock,
   pytestCheckHook,
   redis,
   typing-extensions,
-  wrapt,
 }:
 
 buildPythonPackage rec {
   pname = "coredis";
-  version = "5.6.0";
+  version = "6.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alisaifee";
     repo = "coredis";
     tag = version;
-    hash = "sha256-84mFHEPvCv7c1u2giTwTmC+56KCB/3snl8vJ4c+sE2s=";
+    hash = "sha256-Jn6tqMpyk849/hwYM0DHuQnGbMltRpTXAVcN5Kt6lk4=";
   };
 
   postPatch = ''
     sed -i '/mypy==/d' pyproject.toml
-    sed -i '/packaging/d' pyproject.toml
-    sed -i '/pympler/d' pyproject.toml
-    sed -i '/types_deprecated/d' pyproject.toml
-    substituteInPlace pytest.ini \
-      --replace-fail "-K" ""
+    sed -i '/hatch-mypy/d' pyproject.toml
+    sed -i '/opentelemetry-sdk/d' pyproject.toml
+    substituteInPlace pyproject.toml \
+      --replace-fail '"-K"' ""
   '';
 
   build-system = [
@@ -48,13 +47,12 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    async-timeout
+    anyio
     beartype
     deprecated
+    exceptiongroup
     packaging
-    pympler
     typing-extensions
-    wrapt
   ];
 
   nativeCheckInputs = [
@@ -62,6 +60,7 @@ buildPythonPackage rec {
     redis
     pytest-asyncio
     pytest-lazy-fixtures
+    pytest-mock
   ];
 
   pythonImportsCheck = [ "coredis" ];

From d3ec3c976fbcf94dc6447ca30aab6fe5c0c87b9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 20:22:25 -0700
Subject: [PATCH 423/831] python3Packages.coredis: use finalAttrs

---
 pkgs/development/python-modules/coredis/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/coredis/default.nix b/pkgs/development/python-modules/coredis/default.nix
index 8b1e0cf051ad..7740b0a99efe 100644
--- a/pkgs/development/python-modules/coredis/default.nix
+++ b/pkgs/development/python-modules/coredis/default.nix
@@ -19,7 +19,7 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "coredis";
   version = "6.6.1";
   pyproject = true;
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "alisaifee";
     repo = "coredis";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-Jn6tqMpyk849/hwYM0DHuQnGbMltRpTXAVcN5Kt6lk4=";
   };
 
@@ -76,7 +76,7 @@ buildPythonPackage rec {
   meta = {
     description = "Async redis client with support for redis server, cluster & sentinel";
     homepage = "https://github.com/alisaifee/coredis";
-    changelog = "https://github.com/alisaifee/coredis/blob/${src.tag}/HISTORY.rst";
+    changelog = "https://github.com/alisaifee/coredis/blob/${finalAttrs.src.tag}/HISTORY.rst";
     license = lib.licenses.mit;
   };
-}
+})

From eb3b83f3573b46a7be1c65822df45974ef70de3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 20:07:00 -0700
Subject: [PATCH 424/831] python3Packages.litellm: unpin pydantic

---
 pkgs/development/python-modules/litellm/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index e4b8edc8ff16..e16a538321d1 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -162,6 +162,7 @@ buildPythonPackage rec {
     "importlib-metadata"
     "jsonschema"
     "openai"
+    "pydantic"
     "python-dotenv"
   ];
 

From df634ceed92b51d0f6815c4df320e7c338bfb8cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 21:48:10 -0700
Subject: [PATCH 425/831] python3Packages.slowapi: skip tests broken by
 starlette 1.0

---
 pkgs/development/python-modules/slowapi/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/slowapi/default.nix b/pkgs/development/python-modules/slowapi/default.nix
index bf4412ff471a..8a987739b28f 100644
--- a/pkgs/development/python-modules/slowapi/default.nix
+++ b/pkgs/development/python-modules/slowapi/default.nix
@@ -45,6 +45,10 @@ buildPythonPackage rec {
     # AssertionError: assert '1740326049.9886339' == '1740326049'
     "test_headers_no_breach"
     "test_headers_breach"
+    # tests use @app.route() removed in Starlette 1.0
+    # https://github.com/laurentS/slowapi/issues/271
+    "test_retry_after"
+    "test_exempt_decorator"
   ];
 
   pythonImportsCheck = [ "slowapi" ];

From d38ef98cdadcf520666a2b34851bcaccc9dc769e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 23 May 2026 22:15:38 -0700
Subject: [PATCH 426/831] python3Packages.uv-build: 0.11.8 -> 0.11.16

Diff: https://github.com/astral-sh/uv/compare/0.11.8...0.11.16

Changelog: https://github.com/astral-sh/uv/blob/0.11.16/CHANGELOG.md
---
 pkgs/development/python-modules/uv-build/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/uv-build/default.nix b/pkgs/development/python-modules/uv-build/default.nix
index bf45da4ab785..0750166192ce 100644
--- a/pkgs/development/python-modules/uv-build/default.nix
+++ b/pkgs/development/python-modules/uv-build/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uv-build";
-  version = "0.11.8";
+  version = "0.11.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-wu9EA3z/qj29lfSj8wKE4p8XEAJQakQTg2AK8I/64us=";
+    hash = "sha256-5LJspcHj/RjOMv7eRB7n+tofX4s51M3kqHCPymCg90A=";
   };
 
   nativeBuildInputs = [
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-ygGRoZgD88Q2EkN0U4SDTwya96Ds3Pqy3Llj8cjGwnY=";
+    hash = "sha256-2lg86WxPGVbJ91zi61lKrSqnzFgmmSrBrl+SfV5SJWU=";
   };
 
   buildAndTestSubdir = "crates/uv-build";

From d8055d7eba08187915876c6a6cbe49e41bf2d0e9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 24 May 2026 22:35:44 +0200
Subject: [PATCH 427/831] python3Packages.sqlalchemy: 2.0.49 -> 2.0.50

https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_2_0_50
---
 pkgs/development/python-modules/sqlalchemy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 43176c93edcd..1e57fb444030 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sqlalchemy";
-  version = "2.0.49";
+  version = "2.0.50";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     tag = "rel_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-+6g9TONKwCQWmWXHjpIDPDh96ng4lwLc1C009/l769Q=";
+    hash = "sha256-pZgkQa+qXuXSSlBXba5qByXFqegaIB/XGgp7Q2Bsz9U=";
   };
 
   postPatch = ''

From ccd892abf03a7edf54b3d19d7a50f7f0c11f14cc Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 May 2026 14:06:23 +0200
Subject: [PATCH 428/831] python3Packages.adax-local: pin to setuptools 80

---
 pkgs/development/python-modules/adax-local/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/adax-local/default.nix b/pkgs/development/python-modules/adax-local/default.nix
index 0dea9d257e5f..8f0f851408ea 100644
--- a/pkgs/development/python-modules/adax-local/default.nix
+++ b/pkgs/development/python-modules/adax-local/default.nix
@@ -6,7 +6,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   async-timeout,
-  setuptools,
+  setuptools_80,
 }:
 
 buildPythonPackage rec {
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     hash = "sha256-8gVpUYQoE4V3ATR6zFAz/sARyEmHu9lYyGchTpS1eX8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     aiohttp

From 61727d1d60cd321d089c72bd41c2a12329071053 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 25 May 2026 14:23:08 +0200
Subject: [PATCH 429/831] alerta-server: pep517, pin to setuptools 80

---
 pkgs/by-name/al/alerta-server/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alerta-server/package.nix b/pkgs/by-name/al/alerta-server/package.nix
index a8109b35fd33..0c83ccd4fbc6 100644
--- a/pkgs/by-name/al/alerta-server/package.nix
+++ b/pkgs/by-name/al/alerta-server/package.nix
@@ -7,14 +7,16 @@
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "alerta-server";
   version = "9.0.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
     hash = "sha256-v4+0l5Sx9RTxmNFnKCoKrWFl1xu1JIRZ/kiI6zi/y0I=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = [ python3.pkgs.setuptools_80 ];
+
+  dependencies = with python3.pkgs; [
     bcrypt
     blinker
     cryptography

From d8b6fe97fe680427d54c6d3a8f6bdc396bbe5f17 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 00:36:57 +0200
Subject: [PATCH 430/831] python3Packages.dropbox: pin to setuptools 80

---
 pkgs/development/python-modules/dropbox/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 6393b3d9fc1d..c4fd3dd51b3b 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -2,7 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  setuptools,
+  setuptools_80,
   requests,
   six,
   stone,
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     hash = "sha256-9Fsh06V226vIyJhrlLkh9Xr4UGoEIISnIFCtuKqI218=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [
     requests

From e3484937e9c5b26634d87d986eea005d3895d7a2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 00:47:10 +0200
Subject: [PATCH 431/831] python3Packages.decopatch: pep517 build, pin
 setuptools 80

---
 pkgs/development/python-modules/decopatch/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/decopatch/default.nix b/pkgs/development/python-modules/decopatch/default.nix
index 36dd006225db..c95f9339b39c 100644
--- a/pkgs/development/python-modules/decopatch/default.nix
+++ b/pkgs/development/python-modules/decopatch/default.nix
@@ -3,22 +3,26 @@
   buildPythonPackage,
   fetchPypi,
   makefun,
+  setuptools_80,
   setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "decopatch";
   version = "1.4.10";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-lX9JyT9BUBgsI/j7UdE7syE+DxenngnIzKcFdZi1VyA=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools_80
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [ makefun ];
+  dependencies = [ makefun ];
 
   postPatch = ''
     substituteInPlace setup.cfg \

From 08996ffcc0ab1bc8ef7fe6109452fb4023ec4858 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 26 May 2026 01:52:44 +0200
Subject: [PATCH 432/831] python3Packages.cohere: relax pydantic-core
 constraint

---
 pkgs/development/python-modules/cohere/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/cohere/default.nix b/pkgs/development/python-modules/cohere/default.nix
index c1d4d8d169d2..98bf148ea60c 100644
--- a/pkgs/development/python-modules/cohere/default.nix
+++ b/pkgs/development/python-modules/cohere/default.nix
@@ -47,6 +47,10 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
+  pythonRelaxDeps = [
+    "pydantic-core"
+  ];
+
   optional-dependencies = {
     aiohttp = [
       aiohttp

From 27e7bd612280bdc48e0d84424ee95ecb8d7b8605 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 09:47:42 -0700
Subject: [PATCH 433/831] python3Packages.pytest-asyncio: 1.3.0 -> 1.4.0

Diff: https://github.com/pytest-dev/pytest-asyncio/compare/v1.3.0...v1.4.0

Changelog: https://github.com/pytest-dev/pytest-asyncio/blob/v1.4.0/docs/reference/changelog.rst
---
 pkgs/development/python-modules/pytest-asyncio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-asyncio/default.nix b/pkgs/development/python-modules/pytest-asyncio/default.nix
index 87062960a7cb..a166439fdac9 100644
--- a/pkgs/development/python-modules/pytest-asyncio/default.nix
+++ b/pkgs/development/python-modules/pytest-asyncio/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-asyncio";
-  version = "1.3.0"; # N.B.: when updating, tests bleak and aioesphomeapi tests
+  version = "1.4.0"; # N.B.: when updating, tests bleak and aioesphomeapi tests
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = "pytest-asyncio";
     tag = "v${version}";
-    hash = "sha256-MWKMJkvxdvuOyxE8rNlf15j7C+MwJibnNsbfS0biKwo=";
+    hash = "sha256-MuTLCRHCuD9TwJkMiFIC5Xv5Xz6NL8j4JZpW8BA45SI=";
   };
 
   outputs = [

From 72e057ef7f328b787071d8e1c3016576f5ebd2ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 06:57:43 -0700
Subject: [PATCH 434/831] python3Packages.tensorboard: fix build with
 setuptools 82

---
 .../python-modules/tensorboard/default.nix    | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pkgs/development/python-modules/tensorboard/default.nix b/pkgs/development/python-modules/tensorboard/default.nix
index d96daa9ed04e..80df6401b747 100644
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@@ -1,7 +1,9 @@
 {
   lib,
+  fetchpatch,
   fetchPypi,
   buildPythonPackage,
+  python,
 
   # dependencies
   absl-py,
@@ -57,6 +59,26 @@ buildPythonPackage rec {
     standard-imghdr
   ];
 
+  postInstall =
+    let
+      patch = fetchpatch {
+        name = "remove-runtime-pkg_resources-dependency.patch";
+        url = "https://github.com/tensorflow/tensorboard/commit/29f809f4737489912612635d9079a61f8e570bb8.patch";
+        excludes = [
+          "tensorboard/BUILD"
+          "tensorboard/data/BUILD"
+          "tensorboard/default_test.py"
+          "tensorboard/version_test.py"
+        ];
+        hash = "sha256-+jaXI4fVQP4mOg6y94KPMMCg3XuHV/gBUDNsp3ogS6c=";
+      };
+    in
+    ''
+      pushd $out/${python.sitePackages}
+      patch -p1 < ${patch}
+      popd
+    '';
+
   pythonImportsCheck = [
     "tensorboard"
     "tensorboard.backend"

From 7b925925a5e1633f0257be7d2aba46224557f653 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 30 May 2026 03:14:07 +0200
Subject: [PATCH 435/831] python3Packages.dramatiq: pin to setuptools 80

---
 pkgs/development/python-modules/dramatiq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dramatiq/default.nix b/pkgs/development/python-modules/dramatiq/default.nix
index 3600b0aa51fb..4e0c76774c88 100644
--- a/pkgs/development/python-modules/dramatiq/default.nix
+++ b/pkgs/development/python-modules/dramatiq/default.nix
@@ -11,7 +11,7 @@
   pytest-benchmark,
   pytest-cov-stub,
   redis,
-  setuptools,
+  setuptools_80,
   watchdog,
   watchdog-gevent,
 }:
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     hash = "sha256-VqMHSn2mdkO140t7IpZt32OHoEU0nEXiRWJ0w6Km0o8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ setuptools_80 ];
 
   dependencies = [ prometheus-client ];
 

From a916df7c891adfbd522416c38c0131881bd2cacf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 30 May 2026 03:18:04 +0200
Subject: [PATCH 436/831] python3Packages.dramatiq: 2.0.1 -> 2.1.0

https://github.com/Bogdanp/dramatiq/compare/v2.0.1...v2.1.0
---
 pkgs/development/python-modules/dramatiq/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dramatiq/default.nix b/pkgs/development/python-modules/dramatiq/default.nix
index 4e0c76774c88..af59efd2d91b 100644
--- a/pkgs/development/python-modules/dramatiq/default.nix
+++ b/pkgs/development/python-modules/dramatiq/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "dramatiq";
-  version = "2.0.1";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bogdanp";
     repo = "dramatiq";
     tag = "v${version}";
-    hash = "sha256-VqMHSn2mdkO140t7IpZt32OHoEU0nEXiRWJ0w6Km0o8=";
+    hash = "sha256-wUE3R/lFafP7P9tjKjFC+jwCc3jkvGeXunC8AhkBLbM=";
   };
 
   build-system = [ setuptools_80 ];

From 7d288b00ad501dfbfa0e37f17b3c29a50377173b Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 30 May 2026 12:37:07 +0200
Subject: [PATCH 437/831] python3Packages.psautohint: fix build

Prunes dependencies, migrates to finalAttrs and a PEP517 build.
---
 .../python-modules/psautohint/default.nix     | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/psautohint/default.nix b/pkgs/development/python-modules/psautohint/default.nix
index ae962b95e978..3a00ad840176 100644
--- a/pkgs/development/python-modules/psautohint/default.nix
+++ b/pkgs/development/python-modules/psautohint/default.nix
@@ -2,10 +2,9 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fonttools,
-  lxml,
-  fs, # for fonttools extras
+  setuptools,
   setuptools-scm,
+  fonttools,
   pytestCheckHook,
   pytest-cov-stub,
   pytest-xdist,
@@ -13,31 +12,32 @@
   psautohint, # for passthru.tests
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "psautohint";
   version = "2.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adobe-type-tools";
     repo = "psautohint";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "125nx7accvbk626qlfar90va1995kp9qfrz6a978q4kv2kk37xai";
     fetchSubmodules = true; # data dir for tests
   };
 
   postPatch = ''
-    echo '#define PSAUTOHINT_VERSION "${version}"' > libpsautohint/src/version.h
+    echo '#define PSAUTOHINT_VERSION "${finalAttrs.version}"' > libpsautohint/src/version.h
     sed -i '/use_scm_version/,+3d' setup.py
-    sed -i '/setup(/a \     version="${version}",' setup.py
+    sed -i '/setup(/a \     version="${finalAttrs.version}",' setup.py
   '';
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     fonttools
-    lxml
-    fs
   ];
 
   nativeCheckInputs = [
@@ -45,6 +45,7 @@ buildPythonPackage rec {
     pytest-cov-stub
     pytest-xdist
   ];
+
   disabledTests = lib.optionals (!runAllTests) [
     # Slow tests, reduces test time from ~5 mins to ~30s
     "test_mmufo"
@@ -69,4 +70,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})

From 06028a8aa5018ac8e70ae8edaff5c7397143e08c Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Thu, 21 May 2026 10:42:50 +0200
Subject: [PATCH 438/831] curl: backport performance patch

https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23

See https://curl.se/mail/distros-2026-05/0000.html

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 .../curlMinimal/fix-wakeup-consumption.patch  | 32 +++++++++++++++++++
 pkgs/by-name/cu/curlMinimal/package.nix       |  7 ++++
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch

diff --git a/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch b/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
new file mode 100644
index 000000000000..0bc04b60bb87
--- /dev/null
+++ b/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
@@ -0,0 +1,32 @@
+From 2a2104f3cff44bb28bb570a093be52bbeeed8f23 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 11 May 2026 14:56:04 +0200
+Subject: [PATCH] event: fix wakeup consumption
+
+The events on a multi wakeup socketpair were only consumed via
+curl_multi_poll()/curl_multi_wait() but not in event based processing on
+a curl_multi_socket() call. That led to busy loops as reported in
+
+Fixes #21547
+Reported-by: Earnestly on github
+Closes #21549
+---
+ lib/multi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/multi.c b/lib/multi.c
+index be32740a7097..5e84133f13fd 100644
+--- a/lib/multi.c
++++ b/lib/multi.c
+@@ -2703,6 +2703,11 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
+   Curl_uint32_bset_remove(&multi->dirty, data->mid);
+ 
+   if(data == multi->admin) {
++#ifdef ENABLE_WAKEUP
++    /* Consume any pending wakeup signals before processing.
++     * This is necessary for event based processing. See #21547 */
++    (void)Curl_wakeup_consume(multi->wakeup_pair, TRUE);
++#endif
+ #ifdef USE_RESOLV_THREADED
+     Curl_async_thrdd_multi_process(multi);
+ #endif
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 3bc05f122f6e..51208baea4b0 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -96,6 +96,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Y/4twUi6DOromSLvg49+XJRicsLni3xZ+rS3nTziuJY=";
   };
 
+  patches = [
+    # https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
+    # According to <https://curl.se/mail/distros-2026-05/0000.html>, this fixes
+    # a performance regression, causing high CPU usage
+    ./fix-wakeup-consumption.patch
+  ];
+
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''

From 42073baefa3d15729563d3a1aca59f0cc2c9b033 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 30 May 2026 13:19:51 +0200
Subject: [PATCH 439/831] libbacktrace: Disable mtest_minidebug test on
 powerpc64-linux

---
 pkgs/by-name/li/libbacktrace/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/li/libbacktrace/package.nix b/pkgs/by-name/li/libbacktrace/package.nix
index 0f3abdba1ab9..2568b21be126 100644
--- a/pkgs/by-name/li/libbacktrace/package.nix
+++ b/pkgs/by-name/li/libbacktrace/package.nix
@@ -33,6 +33,15 @@ stdenv.mkDerivation {
     ./0004-libbacktrace-Support-NIX_DEBUG_INFO_DIRS-environment.patch
   ];
 
+  # https://github.com/ianlancetaylor/libbacktrace/issues/163
+  postPatch =
+    lib.optionalString
+      (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian && stdenv.hostPlatform.isAbiElfv1)
+      ''
+        substituteInPlace Makefile.am \
+          --replace-fail 'MAKETESTS += mtest_minidebug' '# MAKETESTS += mtest_minidebug'
+      '';
+
   nativeBuildInputs = [
     autoreconfHook
   ];

From ddf69fce53586a3154ef547ced79fd6a3b705dcc Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 30 May 2026 20:17:03 +0200
Subject: [PATCH 440/831] file: Apply patches to fix GUID parsing on big-endian

---
 .../tools/misc/file/0003-Add-LE-BE-GUID.patch | 631 ++++++++++++++++++
 ...parsing-guids-in-big-endian-machines.patch |  82 +++
 pkgs/tools/misc/file/default.nix              |  23 +
 3 files changed, 736 insertions(+)
 create mode 100644 pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
 create mode 100644 pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch

diff --git a/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch b/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
new file mode 100644
index 000000000000..69e52586b5f6
--- /dev/null
+++ b/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
@@ -0,0 +1,631 @@
+From 797a275514c80303accbd821df9692b04f6020e6 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Sun, 19 Apr 2026 19:56:49 +0000
+Subject: [PATCH] Add LE/BE GUID
+
+(OPNA2608: removed hunks that change file modification dates, as they
+make it more difficult to apply the patch)
+
+(OPNA2608: merge typo fix 2866af2e51beb40afe35d2ff5e765991ac459237)
+
+---
+ doc/magic.man    |   8 ++--
+ src/Makefile.am  |   3 +-
+ src/apprentice.c | 121 ++++++++++-------------------------------------
+ src/file.h       |  31 ++++++------
+ src/funcs.c      |  30 +++++++++---
+ src/print.c      |  11 +++--
+ src/softmagic.c  |  18 ++++++-
+ src/swap.c       | 101 +++++++++++++++++++++++++++++++++++++++
+ src/swap.h       |  48 +++++++++++++++++++
+ 9 files changed, 247 insertions(+), 124 deletions(-)
+ create mode 100644 src/swap.c
+ create mode 100644 src/swap.h
+
+diff --git a/doc/magic.man b/doc/magic.man
+index aa9f8da247..bad8111b28 100644
+--- a/doc/magic.man
++++ b/doc/magic.man
+@@ -373,7 +373,9 @@ The DER types are:
+ .Dv rel-oid-iri .
+ These types can be followed by an optional numeric size, which indicates
+ the field width in bytes.
+-.It Dv guid
++.It Dv guid ,
++.It Dv leguid ,
++.It Dv beguid 
+ A Globally Unique Identifier, parsed and printed as
+ XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.
+ Its format is a string.
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 64c0414367..10cf6fcb23 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -10,7 +10,8 @@ AM_CFLAGS = $(CFLAG_VISIBILITY) @WARNINGS@
+ libmagic_la_SOURCES = buffer.c magic.c apprentice.c softmagic.c ascmagic.c \
+ 	encoding.c compress.c is_csv.c is_json.c is_simh.c is_tar.c readelf.c \
+ 	print.c fsmagic.c funcs.c file.h readelf.h tar.h apptype.c der.c der.h \
+-	file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h
++	file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h \
++	swap.c swap.h
+ libmagic_la_LDFLAGS = -no-undefined -version-info 1:0:0
+ if MINGW
+ MINGWLIBS = -lgnurx -lshlwapi
+diff --git a/src/apprentice.c b/src/apprentice.c
+index a6ab9e7c30..b67897b45a 100644
+--- a/src/apprentice.c
++++ b/src/apprentice.c
+@@ -32,6 +32,7 @@
+ #endif	/* lint */
+ 
+ #include "magic.h"
++#include "swap.h"
+ #include <stdlib.h>
+ #ifdef HAVE_UNISTD_H
+ #include <unistd.h>
+@@ -50,12 +51,6 @@ FILE_RCSID("@(#)$File: apprentice.c,v 1.373 2026/04/17 14:58:57 christos Exp $")
+ #endif
+ #include <dirent.h>
+ #include <limits.h>
+-#ifdef HAVE_BYTESWAP_H
+-#include <byteswap.h>
+-#endif
+-#ifdef HAVE_SYS_BSWAP_H
+-#include <sys/bswap.h>
+-#endif
+ 
+ 
+ #define	EATAB {while (*l && isascii(CAST(unsigned char, *l)) && \
+@@ -131,20 +126,6 @@ file_private void mlist_free(struct mlist *);
+ file_private void byteswap(struct magic *, uint32_t);
+ file_private void bs1(struct magic *);
+ 
+-#if defined(HAVE_BYTESWAP_H)
+-#define swap2(x)	bswap_16(x)
+-#define swap4(x)	bswap_32(x)
+-#define swap8(x)	bswap_64(x)
+-#elif defined(HAVE_SYS_BSWAP_H)
+-#define swap2(x)	bswap16(x)
+-#define swap4(x)	bswap32(x)
+-#define swap8(x)	bswap64(x)
+-#else
+-file_private uint16_t swap2(uint16_t);
+-file_private uint32_t swap4(uint32_t);
+-file_private uint64_t swap8(uint64_t);
+-#endif
+-
+ file_private char *mkdbname(struct magic_set *, const char *, int);
+ file_private struct magic_map *apprentice_buf(struct magic_set *, struct magic *,
+     size_t);
+@@ -285,6 +266,8 @@ static const struct type_tbl_s type_tbl[] = {
+ 	{ XX("clear"),		FILE_CLEAR,		FILE_FMT_NONE },
+ 	{ XX("der"),		FILE_DER,		FILE_FMT_STR },
+ 	{ XX("guid"),		FILE_GUID,		FILE_FMT_STR },
++	{ XX("leguid"),		FILE_LEGUID,		FILE_FMT_STR },
++	{ XX("beguid"),		FILE_BEGUID,		FILE_FMT_STR },
+ 	{ XX("offset"),		FILE_OFFSET,		FILE_FMT_QUAD },
+ 	{ XX("bevarint"),	FILE_BEVARINT,		FILE_FMT_STR },
+ 	{ XX("levarint"),	FILE_LEVARINT,		FILE_FMT_STR },
+@@ -926,6 +909,8 @@ typesize(int type)
+ 	case FILE_LEVARINT:
+ 		return 8;
+ 
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 	case FILE_GUID:
+ 		return 16;
+ 
+@@ -989,6 +974,8 @@ apprentice_magic_strength_1(const struct magic *m)
+ 	case FILE_BEVARINT:
+ 	case FILE_LEVARINT:
+ 	case FILE_GUID:
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 	case FILE_BEID3:
+ 	case FILE_LEID3:
+ 	case FILE_OFFSET:
+@@ -1251,6 +1238,8 @@ set_test_type(struct magic *mstart, struct magic *m)
+ 	case FILE_LEVARINT:
+ 	case FILE_DER:
+ 	case FILE_GUID:
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 	case FILE_OFFSET:
+ 	case FILE_MSDOSDATE:
+ 	case FILE_BEMSDOSDATE:
+@@ -1733,6 +1722,8 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
+ 		case FILE_CLEAR:
+ 		case FILE_DER:
+ 		case FILE_GUID:
++		case FILE_LEGUID:
++		case FILE_BEGUID:
+ 		case FILE_OCTAL:
+ 			break;
+ 		default:
+@@ -2943,6 +2934,8 @@ getvalue(struct magic_set *ms, struct magic *m, const char **p, int action)
+ 		if (errno == 0)
+ 			*p = ep;
+ 		return 0;
++	case FILE_BEGUID:
++	case FILE_LEGUID:
+ 	case FILE_GUID:
+ 		if (file_parse_guid(*p, m->value.guid) == -1) {
+ 			file_magwarn(ms, "Error parsing guid `%s'", *p);
+@@ -3418,7 +3411,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
+ 
+ 	ptr = CAST(uint32_t *, map->p);
+ 	if (*ptr != MAGICNO) {
+-		if (swap4(*ptr) != MAGICNO) {
++		if (file_swap4(*ptr) != MAGICNO) {
+ 			file_error(ms, 0, "bad magic in `%s'", dbname);
+ 			return -1;
+ 		}
+@@ -3426,7 +3419,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
+ 	} else
+ 		needsbyteswap = 0;
+ 	if (needsbyteswap)
+-		version = swap4(ptr[1]);
++		version = file_swap4(ptr[1]);
+ 	else
+ 		version = ptr[1];
+ 	if (version != VERSIONNO) {
+@@ -3439,7 +3432,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
+ 	nentries = 0;
+ 	for (i = 0; i < MAGIC_SETS; i++) {
+ 		if (needsbyteswap)
+-			map->nmagic[i] = swap4(ptr[i + 2]);
++			map->nmagic[i] = file_swap4(ptr[i + 2]);
+ 		else
+ 			map->nmagic[i] = ptr[i + 2];
+ 		if (map->nmagic[i] > entries) {
+@@ -3577,69 +3570,6 @@ byteswap(struct magic *magic, uint32_t nmagic)
+ 		bs1(&magic[i]);
+ }
+ 
+-#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
+-/*
+- * swap a short
+- */
+-file_private uint16_t
+-swap2(uint16_t sv)
+-{
+-	uint16_t rv;
+-	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
+-	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
+-	d[0] = s[1];
+-	d[1] = s[0];
+-	return rv;
+-}
+-
+-/*
+- * swap an int
+- */
+-file_private uint32_t
+-swap4(uint32_t sv)
+-{
+-	uint32_t rv;
+-	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
+-	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
+-	d[0] = s[3];
+-	d[1] = s[2];
+-	d[2] = s[1];
+-	d[3] = s[0];
+-	return rv;
+-}
+-
+-/*
+- * swap a quad
+- */
+-file_private uint64_t
+-swap8(uint64_t sv)
+-{
+-	uint64_t rv;
+-	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
+-	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
+-# if 0
+-	d[0] = s[3];
+-	d[1] = s[2];
+-	d[2] = s[1];
+-	d[3] = s[0];
+-	d[4] = s[7];
+-	d[5] = s[6];
+-	d[6] = s[5];
+-	d[7] = s[4];
+-# else
+-	d[0] = s[7];
+-	d[1] = s[6];
+-	d[2] = s[5];
+-	d[3] = s[4];
+-	d[4] = s[3];
+-	d[5] = s[2];
+-	d[6] = s[1];
+-	d[7] = s[0];
+-# endif
+-	return rv;
+-}
+-#endif
+-
+ file_protected uintmax_t 
+ file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
+ {
+@@ -3676,16 +3606,16 @@ file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
+ file_private void
+ bs1(struct magic *m)
+ {
+-	m->flag = swap2(m->flag);
+-	m->offset = swap4(CAST(uint32_t, m->offset));
+-	m->in_offset = swap4(CAST(uint32_t, m->in_offset));
+-	m->lineno = swap4(CAST(uint32_t, m->lineno));
++	m->flag = file_swap2(m->flag);
++	m->offset = file_swap4(CAST(uint32_t, m->offset));
++	m->in_offset = file_swap4(CAST(uint32_t, m->in_offset));
++	m->lineno = file_swap4(CAST(uint32_t, m->lineno));
+ 	if (IS_STRING(m->type)) {
+-		m->str_range = swap4(m->str_range);
+-		m->str_flags = swap4(m->str_flags);
++		m->str_range = file_swap4(m->str_range);
++		m->str_flags = file_swap4(m->str_flags);
+ 	} else {
+-		m->value.q = swap8(m->value.q);
+-		m->num_mask = swap8(m->num_mask);
++		m->value.q = file_swap8(m->value.q);
++		m->num_mask = file_swap8(m->num_mask);
+ 	}
+ }
+ 
+@@ -3708,6 +3638,7 @@ file_pstring_length_size(struct magic_set *ms, const struct magic *m)
+ 		return FILE_BADSIZE;
+ 	}
+ }
++
+ file_protected size_t
+ file_pstring_get_length(struct magic_set *ms, const struct magic *m,
+     const char *ss)
+diff --git a/src/file.h b/src/file.h
+index 258b776976..25e365351d 100644
+--- a/src/file.h
++++ b/src/file.h
+@@ -179,7 +179,7 @@
+ #define MAXstring 128		/* max len of "string" types */
+ 
+ #define MAGICNO		0xF11E041C
+-#define VERSIONNO	20
++#define VERSIONNO	21
+ #define FILE_MAGICSIZE	432
+ 
+ #define FILE_GUID_SIZE	sizeof("XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX")
+@@ -292,17 +292,19 @@ struct magic {
+ #define				FILE_CLEAR		47
+ #define				FILE_DER		48
+ #define				FILE_GUID		49
+-#define				FILE_OFFSET		50
+-#define				FILE_BEVARINT		51
+-#define				FILE_LEVARINT		52
+-#define				FILE_MSDOSDATE		53
+-#define				FILE_LEMSDOSDATE	54
+-#define				FILE_BEMSDOSDATE	55
+-#define				FILE_MSDOSTIME		56
+-#define				FILE_LEMSDOSTIME	57
+-#define				FILE_BEMSDOSTIME	58
+-#define				FILE_OCTAL		59
+-#define				FILE_NAMES_SIZE		60 /* size of array to contain all names */
++#define				FILE_LEGUID		50
++#define				FILE_BEGUID		51
++#define				FILE_OFFSET		52
++#define				FILE_BEVARINT		53
++#define				FILE_LEVARINT		54
++#define				FILE_MSDOSDATE		55
++#define				FILE_LEMSDOSDATE	56
++#define				FILE_BEMSDOSDATE	57
++#define				FILE_MSDOSTIME		58
++#define				FILE_LEMSDOSTIME	59
++#define				FILE_BEMSDOSTIME	60
++#define				FILE_OCTAL		61
++#define				FILE_NAMES_SIZE		62 /* size of array to contain all names */
+ 
+ #define IS_STRING(t) \
+ 	((t) == FILE_STRING || \
+@@ -558,7 +560,8 @@ file_protected int file_separator(struct magic_set *);
+ file_protected char *file_copystr(char *, size_t, size_t, const char *);
+ file_protected int file_checkfmt(char *, size_t, const char *);
+ file_protected size_t file_printedlen(const struct magic_set *);
+-file_protected int file_print_guid(char *, size_t, const uint64_t *);
++file_protected int file_print_leguid(char *, size_t, const uint64_t *);
++file_protected int file_print_beguid(char *, size_t, const uint64_t *);
+ file_protected int file_parse_guid(const char *, uint64_t *);
+ file_protected int file_replace(struct magic_set *, const char *, const char *);
+ file_protected int file_printf(struct magic_set *, const char *, ...)
+diff --git a/src/funcs.c b/src/funcs.c
+index dd80198f36..e5782bf2e8 100644
+--- a/src/funcs.c
++++ b/src/funcs.c
+@@ -27,6 +27,7 @@
+ #endif	/* lint */
+ 
+ #include "magic.h"
++#include "swap.h"
+ #include <assert.h>
+ #include <stdarg.h>
+ #include <stdlib.h>
+@@ -934,12 +935,9 @@ file_parse_guid(const char *s, uint64_t *guid)
+ 	return 0;
+ }
+ 
+-file_protected int
+-file_print_guid(char *str, size_t len, const uint64_t *guid)
++file_private int
++file_print_guid(char *str, size_t len, const struct guid *g)
+ {
+-	const struct guid *g = CAST(const struct guid *,
+-	    CAST(const void *, guid));
+-
+ #ifndef WIN32
+ 	return snprintf(str, len, "%.8X-%.4hX-%.4hX-%.2hhX%.2hhX-"
+ 	    "%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX",
+@@ -955,6 +953,26 @@ file_print_guid(char *str, size_t len, const uint64_t *guid)
+ #endif
+ }
+ 
++file_protected int
++file_print_leguid(char *str, size_t len, const uint64_t *guid)
++{
++	const struct guid *g = CAST(const struct guid *,
++	    CAST(const void *, guid));
++	return file_print_guid(str, len, g);
++}
++
++file_protected int
++file_print_beguid(char *str, size_t len, const uint64_t *guid)
++{
++	const struct guid *g = CAST(const struct guid *,
++	    CAST(const void *, guid));
++	struct guid gg = *g;
++	gg.data1 = file_swap4(gg.data1);
++	gg.data2 = file_swap2(gg.data2);
++	gg.data3 = file_swap2(gg.data3);
++	return file_print_guid(str, len, &gg);
++}
++
+ file_protected int
+ file_pipe_closexec(int *fds)
+ {
+diff --git a/src/print.c b/src/print.c
+index 0740fd67e2..ac0802f309 100644
+--- a/src/print.c
++++ b/src/print.c
+@@ -227,12 +227,17 @@ file_mdump(struct magic *m)
+ 		case FILE_DER:
+ 			(void) fprintf(stderr, "'%s'", m->value.s);
+ 			break;
++		case FILE_LEGUID:
+ 		case FILE_GUID:
+-			(void) file_print_guid(tbuf, sizeof(tbuf),
++			(void) file_print_leguid(tbuf, sizeof(tbuf),
++			    m->value.guid);
++			(void) fprintf(stderr, "%s", tbuf);
++			break;
++		case FILE_BEGUID:
++			(void) file_print_beguid(tbuf, sizeof(tbuf),
+ 			    m->value.guid);
+ 			(void) fprintf(stderr, "%s", tbuf);
+ 			break;
+-
+ 		default:
+ 			(void) fprintf(stderr, "*bad type %d*", m->type);
+ 			break;
+diff --git a/src/softmagic.c b/src/softmagic.c
+index 370be0a54d..2f04b5ce6c 100644
+--- a/src/softmagic.c
++++ b/src/softmagic.c
+@@ -812,7 +812,13 @@ mprint(struct magic_set *ms, struct magic *m)
+ 			return -1;
+ 		break;
+ 	case FILE_GUID:
+-		(void) file_print_guid(buf, sizeof(buf), ms->ms_value.guid);
++	case FILE_LEGUID:
++		(void) file_print_leguid(buf, sizeof(buf), ms->ms_value.guid);
++		if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
++			return -1;
++		break;
++	case FILE_BEGUID:
++		(void) file_print_beguid(buf, sizeof(buf), ms->ms_value.guid);
+ 		if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
+ 			return -1;
+ 		break;
+@@ -972,6 +978,8 @@ moffset(struct magic_set *ms, struct magic *m, size_t nbytes,
+ 		}
+ 		break;
+ 
++	case FILE_BEGUID:
++	case FILE_LEGUID:
+ 	case FILE_GUID:
+ 		o = CAST(int32_t, (ms->offset + 2 * sizeof(uint64_t)));
+ 		break;
+@@ -1333,6 +1341,8 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
+ 	case FILE_USE:
+ 	case FILE_DER:
+ 	case FILE_GUID:
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 		return 1;
+ 	default:
+ 		file_magerror(ms, "invalid type %d in mconvert()", m->type);
+@@ -1903,6 +1913,8 @@ mget(struct magic_set *ms, struct magic *m, const struct buffer *b,
+ 			return 0;
+ 		break;
+ 
++	case FILE_LEGUID:
++	case FILE_BEGUID:
+ 	case FILE_GUID:
+ 		if (OFFSET_OOB(nbytes, offset, 16))
+ 			return 0;
+@@ -2416,6 +2428,8 @@ magiccheck(struct magic_set *ms, struct magic *m, file_regex_t **m_cache)
+ 			return 0;
+ 		}
+ 		return matched;
++	case FILE_BEGUID:
++	case FILE_LEGUID:
+ 	case FILE_GUID:
+ 		l = 0;
+ 		v = memcmp(m->value.guid, p->guid, sizeof(p->guid));
+diff --git a/src/swap.c b/src/swap.c
+new file mode 100644
+index 0000000000..f20e354237
+--- /dev/null
++++ b/src/swap.c
+@@ -0,0 +1,101 @@
++/*
++ * Copyright (c) Ian F. Darwin 1986-1995.
++ * Software written by Ian F. Darwin and others;
++ * maintained 1995-present by Christos Zoulas and others.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice immediately at the beginning of the file, without modification,
++ *    this list of conditions, and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
++ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++/*
++ * apprentice - make one pass through /etc/magic, learning its secrets.
++ */
++
++#include "file.h"
++
++#ifndef	lint
++FILE_RCSID("@(#)$File: swap.c,v 1.1 2026/04/19 19:56:49 christos Exp $")
++#endif	/* lint */
++
++#include "swap.h"
++
++#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
++/*
++ * swap a short
++ */
++file_protected uint16_t
++file_swap2(uint16_t sv)
++{
++	uint16_t rv;
++	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
++	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
++	d[0] = s[1];
++	d[1] = s[0];
++	return rv;
++}
++
++/*
++ * swap an int
++ */
++file_protected uint32_t
++file_swap4(uint32_t sv)
++{
++	uint32_t rv;
++	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
++	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
++	d[0] = s[3];
++	d[1] = s[2];
++	d[2] = s[1];
++	d[3] = s[0];
++	return rv;
++}
++
++/*
++ * swap a quad
++ */
++file_protected uint64_t
++file_swap8(uint64_t sv)
++{
++	uint64_t rv;
++	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
++	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
++# if 0
++	d[0] = s[3];
++	d[1] = s[2];
++	d[2] = s[1];
++	d[3] = s[0];
++	d[4] = s[7];
++	d[5] = s[6];
++	d[6] = s[5];
++	d[7] = s[4];
++# else
++	d[0] = s[7];
++	d[1] = s[6];
++	d[2] = s[5];
++	d[3] = s[4];
++	d[4] = s[3];
++	d[5] = s[2];
++	d[6] = s[1];
++	d[7] = s[0];
++# endif
++	return rv;
++}
++#endif
+diff --git a/src/swap.h b/src/swap.h
+new file mode 100644
+index 0000000000..9fc6428d7d
+--- /dev/null
++++ b/src/swap.h
+@@ -0,0 +1,48 @@
++/*
++ * Copyright (c) Ian F. Darwin 1986-1995.
++ * Software written by Ian F. Darwin and others;
++ * maintained 1995-present by Christos Zoulas and others.
++ *
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice immediately at the beginning of the file, without modification,
++ *    this list of conditions, and the following disclaimer.
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ *
++ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
++ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
++ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
++ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
++ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
++ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
++ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
++ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
++ * SUCH DAMAGE.
++ */
++
++#ifdef HAVE_BYTESWAP_H
++#include <byteswap.h>
++#endif
++#ifdef HAVE_SYS_BSWAP_H
++#include <sys/bswap.h>
++#endif
++
++#if defined(HAVE_BYTESWAP_H)
++#define file_swap2(x)	bswap_16(x)
++#define file_swap4(x)	bswap_32(x)
++#define file_swap8(x)	bswap_64(x)
++#elif defined(HAVE_SYS_BSWAP_H)
++#define file_swap2(x)	bswap16(x)
++#define file_swap4(x)	bswap32(x)
++#define file_swap8(x)	bswap64(x)
++#else
++file_protected uint16_t file_swap2(uint16_t);
++file_protected uint32_t file_swap4(uint32_t);
++file_protected uint64_t file_swap8(uint64_t);
++#endif
diff --git a/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch b/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch
new file mode 100644
index 000000000000..ede424aaba7c
--- /dev/null
+++ b/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch
@@ -0,0 +1,82 @@
+From 7a2b2a4b6e0f9de8682e6098c514155f2198cc8e Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Sun, 17 May 2026 17:10:25 +0000
+Subject: [PATCH] Handle parsing guids in big endian machines (Christoph Biedl)
+
+(OPNA2608: removed hunks that change file modification dates, as they
+make it more difficult to apply the patch)
+
+---
+ src/compress.c |  7 +++----
+ src/file.h     |  3 ++-
+ src/funcs.c    | 21 ++++++++++++++++++++-
+ 3 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/src/compress.c b/src/compress.c
+index 76b7aad18..7f1d584d0 100644
+--- a/src/compress.c
++++ b/src/compress.c
+@@ -125,12 +125,11 @@ static const char *zlib_args[] = { "python", "-c", zlibcode, NULL };
+ static int
+ zlibcmp(const unsigned char *buf)
+ {
+-	unsigned short x = 1;
+-	unsigned char *s = CAST(unsigned char *, CAST(void *, &x));
++	unsigned short x;
+ 
+ 	if ((buf[0] & 0xf) != 8 || (buf[0] & 0x80) != 0)
+ 		return 0;
+-	if (s[0] != 1)	/* endianness test */
++	if (file_bigendian())	/* endianness test */
+ 		x = buf[0] | (buf[1] << 8);
+ 	else
+ 		x = buf[1] | (buf[0] << 8);
+diff --git a/src/file.h b/src/file.h
+index 497de9b91..6a39801e4 100644
+--- a/src/file.h
++++ b/src/file.h
+@@ -597,6 +597,7 @@ file_protected uint64_t file_signextend(struct magic_set *, struct magic *,
+ file_protected uintmax_t file_varint2uintmax_t(const unsigned char *, int,
+     size_t *);
+ 
++file_protected int file_bigendian(void);
+ file_protected void file_badread(struct magic_set *);
+ file_protected void file_badseek(struct magic_set *);
+ file_protected void file_oomem(struct magic_set *, size_t);
+diff --git a/src/funcs.c b/src/funcs.c
+index 8698f3312..0f2e6942b 100644
+--- a/src/funcs.c
++++ b/src/funcs.c
+@@ -52,6 +52,18 @@ FILE_RCSID("@(#)$File: funcs.c,v 1.151 2026/05/16 15:21:40 christos Exp $")
+ #define SIZE_MAX	((size_t)~0)
+ #endif
+ 
++file_protected int
++file_bigendian(void)
++{
++	union {
++		unsigned short x;
++		unsigned char s[sizeof(unsigned short)];
++	} u;
++
++	u.x = 1;
++	return u.s[0] != 1;
++}
++
+ file_protected char *
+ file_copystr(char *buf, size_t blen, size_t width, const char *str)
+ {
+@@ -931,6 +943,13 @@ file_parse_guid(const char *s, uint64_t *guid)
+ 	    !getxvalue(&g->data4[6], s + 8, 2) ||
+ 	    !getxvalue(&g->data4[7], s + 10, 2))
+ 		return -1;
++
++	if (file_bigendian()) {
++		g->data1 = file_swap4(g->data1);
++		g->data2 = file_swap2(g->data2);
++		g->data3 = file_swap2(g->data3);
++
++	}
+ 	return 0;
+ }
+ 
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index ae27a481b38f..4bd56f4dcfb3 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -3,6 +3,8 @@
   stdenv,
   fetchurl,
   buildPackages,
+  autoconf,
+  automake,
   zlib,
   libgnurx,
   updateAutotoolsGnuConfigScriptsHook,
@@ -41,16 +43,37 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
     # Fixes breakage of python3Packages.python-magic and xdg-utils
     ./0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
+
+    # Splits byteswapping functions into a separate file & reuses them across the codebase
+    # (needed for GUID parsing fix below)
+    # https://github.com/file/file/commit/797a275514c80303accbd821df9692b04f6020e6
+    # https://github.com/file/file/commit/2866af2e51beb40afe35d2ff5e765991ac459237
+    ./0003-Add-LE-BE-GUID.patch
+
+    # Fixes GUID parsing on big-endian
+    # https://github.com/file/file/commit/7a2b2a4b6e0f9de8682e6098c514155f2198cc8e
+    ./0004-Handle-parsing-guids-in-big-endian-machines.patch
   ];
 
   strictDeps = true;
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
+    # 0003-Add-LE-BE-GUID.patch touches automake file, need to regenerate files
+    # autoreconfHook would cause inf rec (hook -> libtool -> file -> hook), adding the individual components we need
+    autoconf
+    automake
+
     updateAutotoolsGnuConfigScriptsHook
   ];
   buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW libgnurx;
 
+  # 0003-Add-LE-BE-GUID.patch touches automake file, need to regenerate files
+  # autoreconfHook would cause inf rec (hook -> libtool -> file -> hook), manually calling autoreconf
+  preConfigure = ''
+    autoreconf
+  '';
+
   # https://bugs.astron.com/view.php?id=382
   doCheck = !stdenv.buildPlatform.isMusl;
 

From 4ab3d2ee743058c1145e7b00f4a90f91e6d3b7e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 30 May 2026 12:11:52 -0700
Subject: [PATCH 441/831] python3Packages.fakeredis: 2.35.1 -> 2.36.0

Diff: https://github.com/cunla/fakeredis-py/compare/v2.35.1...v2.36.0

Changelog: https://github.com/cunla/fakeredis-py/releases/tag/v2.36.0
---
 pkgs/development/python-modules/fakeredis/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fakeredis/default.nix b/pkgs/development/python-modules/fakeredis/default.nix
index 74e0f892129b..f3255b611a25 100644
--- a/pkgs/development/python-modules/fakeredis/default.nix
+++ b/pkgs/development/python-modules/fakeredis/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fakeredis";
-  version = "2.35.1";
+  version = "2.36.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cunla";
     repo = "fakeredis-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-euhWKXFERpRoXX7G81ffAygt5e1mt7uy9Y9zAGacu38=";
+    hash = "sha256-rkq8fxQSNPMZE95mlNxSazdwxy5+DMlZKkVWweGVOtc=";
   };
 
   build-system = [ hatchling ];

From 6faf86656418e44e9936417490163cb95b3c45e5 Mon Sep 17 00:00:00 2001
From: Marcus Ramberg <marcus@means.no>
Date: Sat, 30 May 2026 17:00:51 +0200
Subject: [PATCH 442/831] perlPackages.HTTPDaemon: 6.16 -> 6.17

---
 pkgs/top-level/perl-packages.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 78b55a3f2817..d6da2712c7d7 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16650,12 +16650,12 @@ with self;
     };
   };
 
-  HTTPDaemon = buildPerlPackage {
+  HTTPDaemon = buildPerlModule {
     pname = "HTTP-Daemon";
-    version = "6.16";
+    version = "6.17";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Daemon-6.16.tar.gz";
-      hash = "sha256-s40JJyXm+k4MTcKkfhVwcEkbr6Db4Wx4o1joBqp+Fz0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Daemon-6.17.tar.gz";
+      hash = "sha256-FigVgMQOIxCNAoQ0aYtdfVNje/kEyd+CJIHiU8vskgw=";
     };
     buildInputs = [
       ModuleBuildTiny

From f244bd930e120b0fdf1933dc19f834d5ef504669 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 May 2026 00:30:06 +0000
Subject: [PATCH 443/831] msgpack-cxx: 7.0.0 -> 8.0.0

---
 pkgs/by-name/ms/msgpack-cxx/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ms/msgpack-cxx/package.nix b/pkgs/by-name/ms/msgpack-cxx/package.nix
index 02789eb707ae..0954f22c251d 100644
--- a/pkgs/by-name/ms/msgpack-cxx/package.nix
+++ b/pkgs/by-name/ms/msgpack-cxx/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "msgpack-cxx";
-  version = "7.0.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "msgpack";
     repo = "msgpack-c";
     tag = "cpp-${finalAttrs.version}";
-    hash = "sha256-kg4mpNiigfZ59ZeL8LXEHwtkLU8Po+vgRcUcgTJd+h4=";
+    hash = "sha256-11eRM63rjmbIi0glwY5dEuKG9wnVOLx8VXb7CXqCbJE=";
   };
 
   strictDeps = true;

From 956eb0479ae8376ffb13b36659a9a841f124dc5c Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Fri, 24 Oct 2025 23:13:01 -0700
Subject: [PATCH 444/831] nixos/test-driver: add utils to manipulate efi
 variables

```python
machine.create_efi_vars()
machine.write_efi_vars([
    EfiVariable(
        uuid.UUID("65a72bd9-f42b-4039-8084-66cd1702cb24"),
        "AbrNextBoot",
        b"a",
        flags=EfiVariable.Flags.NON_VOLATILE
    )
])

machine.start()
```
---
 nixos/lib/test-driver/default.nix             |   2 +
 nixos/lib/test-driver/src/test_driver/efi.py  | 233 ++++++++++++++++++
 .../src/test_driver/machine/__init__.py       |  43 +++-
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/nixos-test-driver/efivars.nix     | 110 +++++++++
 .../python-modules/ovmfvartool/default.nix    |  12 +-
 6 files changed, 397 insertions(+), 4 deletions(-)
 create mode 100644 nixos/lib/test-driver/src/test_driver/efi.py
 create mode 100644 nixos/tests/nixos-test-driver/efivars.nix

diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index 77638397d11c..f92e7981c55d 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -11,6 +11,7 @@
   ptpython,
   pydantic,
   python,
+  ovmfvartool,
   remote-pdb,
   ruff,
   ty,
@@ -49,6 +50,7 @@ buildPythonApplication {
     junit-xml
     ptpython
     pydantic
+    ovmfvartool
     remote-pdb
   ]
   ++ extraPythonPackages python.pkgs;
diff --git a/nixos/lib/test-driver/src/test_driver/efi.py b/nixos/lib/test-driver/src/test_driver/efi.py
new file mode 100644
index 000000000000..fb547ded5dd9
--- /dev/null
+++ b/nixos/lib/test-driver/src/test_driver/efi.py
@@ -0,0 +1,233 @@
+import binascii
+import io
+import os.path
+import uuid
+from collections.abc import Generator
+from contextlib import contextmanager
+from pathlib import Path
+from typing import IO, Any, TypeVar
+
+from ovmfvartool import (
+    AuthenticatedVariable,
+    FirmwareVolumeHeader,
+    UEFITime,
+    VariableStoreHeader,
+    resolveUUID,
+)
+
+import test_driver.machine
+from test_driver.errors import RequestedAssertionFailed
+
+EfiVariableT = TypeVar("EfiVariableT", bound="EfiVariable")
+
+# See edk2.git/OvmfPkg/Bhyve/VarStore.fdf.inc
+_NV_FTW_WORKING_OFFSET = 0x41000
+_NV_FTW_WORKING_VALUE = binascii.unhexlify(
+    b"2b29589e687c7d49a0ce6500fd9f1b952caf2c64feffffffe00f000000000000"
+)
+_NV_FTW_SIZE = 0x42000
+_NV_FTW_MAIN_PLUS_SPARE_SIZE = _NV_FTW_SIZE * 2
+
+
+class EfiVariable(AuthenticatedVariable):
+    class Flags:
+        NON_VOLATILE = 0x1
+        BOOTSERVICE_ACCESS = 0x2
+        RUNTIME_ACCESS = 0x4
+        TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x20
+
+    class State:
+        VAR_HEADER_VALID_ONLY = 0x7F
+        VAR_ADDED = 0x3F
+
+    volatile = False
+    boot_access = False
+    runtime_access = False
+    hardware_error_record = False
+    authenticated_write_access = False
+    time_based_authenticated_write_access = False
+    append_write = False
+
+    def __init__(
+        self,
+        vendor_uuid: uuid.UUID | None = None,
+        name: str | None = None,
+        data: bytes | None = None,
+        state: int | None = None,
+        flags: int | None = None,
+    ) -> None:
+        self.magic = 0x55AA
+        self.reserved1 = 0
+        self.monotonicCount = 0
+        self.timestamp = UEFITime()
+        self.pubKeyIdx = 0
+        self.state = 0
+        self.flags = 0
+
+        if vendor_uuid is not None:
+            self.vendorUUID = uuid.UUID(bytes=vendor_uuid.bytes_le)
+
+        if state is not None:
+            self.state = state ^ 0xFF
+        else:
+            self.state = (0x40 | 0x80) ^ 0xFF
+
+        if flags is not None:
+            self.flags = flags
+
+        if name is not None:
+            self.name = name
+            self.nameLen = len(name) * 2 + 2
+
+        if data is not None:
+            self.data = data
+            self.dataLen = len(data)
+
+    def _read_flags(self) -> None:
+        if not (self.flags & 0x1):
+            self.volatile = True
+        if self.flags & 0x2:
+            self.boot_access = True
+        if self.flags & 0x4:
+            self.runtime_access = True
+        if self.flags & 0x8:
+            self.hardware_error_record = True
+        if self.flags & 0x10:
+            self.authenticated_write_access = True
+        if self.flags & 0x20:
+            self.time_based_authenticated_write_access = True
+        if self.flags & 0x40:
+            self.append_write = True
+
+        self.flags &= ~(0x1 | 0x2 | 0x4 | 0x8 | 0x10 | 0x20 | 0x40)
+
+    @classmethod
+    def deserialize(cls: type[EfiVariableT], f: Any) -> EfiVariableT | None:
+        # pylint: disable=no-member
+        # false positive https://github.com/PyCQA/pylint/issues/981
+        ret = super().deserialize(f)
+        if ret:
+            ret._read_flags()
+        return ret
+
+    @classmethod
+    def deserializeFromDocument(  # noqa: N802
+        cls: type[EfiVariableT],
+        vendorID: str,  # noqa: N803
+        name: str,
+        doc: dict[str, Any],
+    ) -> EfiVariableT:
+        # pylint: disable=no-member
+        # false positive https://github.com/PyCQA/pylint/issues/981
+        ret = super(cls, cls).deserializeFromDocument(vendorID, name, doc)
+        if ret:
+            ret._read_flags()
+        return ret
+
+
+class EfiVars:
+    """A container around the ovmf variables"""
+
+    state_path: Path
+    machine: "test_driver.machine.QemuMachine"
+
+    def __init__(self, state_path: Path, machine: Any):
+        self.state_path = state_path
+        self.machine = machine
+
+    def _assert_stopped(self) -> None:
+        if self.machine.booted:
+            raise RequestedAssertionFailed(
+                "System is currently running and concurrent reads / writes to the OVMF variables is unsupported"
+            )
+
+    def read_content(self) -> dict[str, dict[str, EfiVariable]] | None:
+        self._assert_stopped()
+        try:
+            with open(self.state_path, "rb") as f:
+                fvh = FirmwareVolumeHeader.deserialize(f)
+                vsh = VariableStoreHeader.deserialize(f)
+                _ = fvh
+                _ = vsh
+                variables: dict[str, dict[str, EfiVariable]] = {}
+
+                while True:
+                    v = EfiVariable.deserialize(f)
+                    if not v:
+                        break
+                    if v.isDeleted:
+                        continue
+
+                    k = resolveUUID(v.vendorUUID)
+                    variables.setdefault(k, {})
+                    variables[k][v.name] = v
+
+                return variables
+
+        except FileNotFoundError:
+            return None
+
+    @contextmanager
+    def _write_store(self, *args, **kwargs) -> Generator[IO[bytes]]:
+        with open(self.state_path, "wb") as fo:
+            fm = io.BytesIO(b"\xff" * _NV_FTW_MAIN_PLUS_SPARE_SIZE)
+            fm.write(FirmwareVolumeHeader.create().serialize())
+            fm.write(VariableStoreHeader.create().serialize())
+
+            try:
+                yield fm
+            finally:
+                fm.seek(_NV_FTW_WORKING_OFFSET)
+                fm.write(_NV_FTW_WORKING_VALUE)
+                fm.seek(0)
+                fo.write(fm.read())
+
+    def create_empty(self) -> None:
+        self._assert_stopped()
+
+        if os.path.exists(self.state_path):
+            raise RequestedAssertionFailed("OVMF variables store exists")
+
+        with self._write_store():
+            pass
+
+    def write(self, add: list[EfiVariable]) -> None:
+        self._assert_stopped()
+
+        variables = self.read_content()
+        if not variables:
+            variables = {}
+
+        for var in add:
+            k = resolveUUID(var.vendorUUID)
+            variables.setdefault(k, {})
+            variables[k][var.name] = var
+
+        with self._write_store() as fm:
+            for _, vendor in variables.items():
+                for _, v in vendor.items():
+                    fm.write(v.serialize())
+                    if fm.tell() % 4:
+                        fm.write(b"\xff" * (4 - (fm.tell() % 4)))
+                    assert (fm.tell() % 4) == 0
+
+
+class EfiGuid:
+    from ovmfvartool import (
+        gEdkiiVarErrorFlagGuid,
+        gEfiAuthenticatedVariableGuid,
+        gEfiCertDbGuid,
+        gEfiCustomModeEnableGuid,
+        gEfiGlobalVariableGuid,
+        gEfiImageSecurityDatabaseGuid,
+        gEfiIp4Config2ProtocolGuid,
+        gEfiIScsiInitiatorNameProtocolGuid,
+        gEfiMemoryTypeInformationGuid,
+        gEfiSecureBootEnableDisableGuid,
+        gEfiSystemNvDataFvGuid,
+        gEfiVendorKeysNvGuid,
+        gIScsiConfigGuid,
+        gMicrosoftVendorGuid,
+        gMtcVendorGuid,
+        mBmHardDriveBootVariableGuid,
+    )
diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index 790da705cf4f..f2ec18b00a56 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -22,6 +22,7 @@ from pathlib import Path
 from queue import Queue
 from typing import Any
 
+from test_driver.efi import EfiVariable, EfiVars
 from test_driver.errors import MachineError, RequestedAssertionFailed
 from test_driver.logger import AbstractLogger
 from test_driver.machine.ocr import (
@@ -192,6 +193,7 @@ class QemuStartCommand:
     def build_environment(
         state_dir: Path,
         shared_dir: Path,
+        efi_vars_path: Path | None = None,
     ) -> dict:
         # We make a copy to not update the current environment
         env = dict(os.environ)
@@ -202,6 +204,13 @@ class QemuStartCommand:
                 "USE_TMPDIR": "1",
             }
         )
+        if efi_vars_path is not None:
+            env.update(
+                {
+                    "NIX_EFI_VARS": str(efi_vars_path),
+                }
+            )
+
         return env
 
     def run(
@@ -212,6 +221,7 @@ class QemuStartCommand:
         qmp_socket_path: Path,
         shell_socket_path: Path,
         allow_reboot: bool,
+        efi_vars_path: Path | None = None,
         vsock_guest: Path | None = None,
     ) -> subprocess.Popen:
         return subprocess.Popen(
@@ -227,7 +237,9 @@ class QemuStartCommand:
             stderr=subprocess.STDOUT,
             shell=True,
             cwd=state_dir,
-            env=self.build_environment(state_dir, shared_dir),
+            env=self.build_environment(
+                state_dir, shared_dir, efi_vars_path=efi_vars_path
+            ),
         )
 
 
@@ -750,6 +762,9 @@ class QemuMachine(BaseMachine):
     # Store all console output for full log retrieval
     full_console_log: list[str]
 
+    efi_vars_path: Path
+    efi_vars: EfiVars
+
     def __init__(
         self,
         out_dir: Path,
@@ -791,6 +806,9 @@ class QemuMachine(BaseMachine):
         self.booted = False
         self.connected = False
 
+        self.efi_vars_path = self.state_dir / f"{self.name}-efi-vars.fd"
+        self.efi_vars = EfiVars(self.efi_vars_path, self)
+
     def ssh_backdoor_command(self) -> str:
         assert self.vsock_host is not None
         return f"ssh -o User=root vsock-mux/{self.vsock_host}"
@@ -1247,6 +1265,7 @@ class QemuMachine(BaseMachine):
             self.qmp_path,
             self.shell_path,
             allow_reboot,
+            self.efi_vars_path,
             self.vsock_guest,
         )
 
@@ -1431,6 +1450,28 @@ class QemuMachine(BaseMachine):
         self.connected = False
         self.connect()
 
+    def dump_efi_vars(self) -> None:
+        for var in self.read_efi_vars():
+            var.print()
+
+    def read_efi_vars(self) -> list[EfiVariable]:
+        config = self.efi_vars.read_content()
+        if not config:
+            return []
+
+        out = []
+        for vendor, variables in config.items():
+            for name, v in variables.items():
+                out.append(v)
+
+        return out
+
+    def create_efi_vars(self) -> None:
+        self.efi_vars.create_empty()
+
+    def write_efi_vars(self, add: list[EfiVariable]) -> None:
+        self.efi_vars.write(add)
+
 
 class NspawnMachine(BaseMachine):
     """
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index b669f33158ee..51f4cb0f5a2e 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -166,6 +166,7 @@ in
           [[ 143 = $(cat $failed/testBuildFailure.exit) ]]
           touch $out
         '';
+    efivars = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/efivars.nix;
   };
 
   # NixOS vm tests and non-vm unit tests
diff --git a/nixos/tests/nixos-test-driver/efivars.nix b/nixos/tests/nixos-test-driver/efivars.nix
new file mode 100644
index 000000000000..953c69a0257e
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/efivars.nix
@@ -0,0 +1,110 @@
+{ pkgs, lib, ... }:
+let
+  vendorUuid = "a19f72f8-b554-4bd7-a0c2-2762bd854691";
+  varName = "Demo";
+  readWriteVar = pkgs.writers.writePython3 "read-increment-efi-var" { } ''
+    import os
+    import sys
+    import fcntl
+    import array
+
+    if len(sys.argv) != 3:
+        print(f"Usage: {sys.argv[0]} NAME UUID", file=sys.stderr)
+        sys.exit(1)
+
+    name = sys.argv[1]
+    uuid = sys.argv[2]
+    path = f"/sys/firmware/efi/efivars/{name}-{uuid}"
+
+    FS_IMMUTABLE_FL = 0x00000010
+    FS_IOC_GETFLAGS = 0x80086601
+    FS_IOC_SETFLAGS = 0x40086602
+
+    if not os.path.exists(path):
+        print(f"{path}: does not exist", file=sys.stderr)
+        sys.exit(1)
+
+    with open(path, "rb") as f:
+        data = f.read()
+
+    # The first 4 bytes are attributes, the rest is the data
+    if data[4:] != b"\x2a":
+        print(f"0x2a value expected, got {data[4:]!r}", file=sys.stderr)
+        sys.exit(1)
+
+    fd = os.open(path, os.O_RDONLY)
+    arg = array.array("L", [0])
+    fcntl.ioctl(fd, FS_IOC_GETFLAGS, arg)
+    if arg[0] & FS_IMMUTABLE_FL:
+        arg[0] &= ~FS_IMMUTABLE_FL
+        fcntl.ioctl(fd, FS_IOC_SETFLAGS, arg)
+    os.close(fd)
+
+    with open(path, "wb") as f:
+        # Write 0x2b
+        data = bytes(list(data[:4]) + [0x2b])
+        f.write(data)
+  '';
+in
+{
+  name = "efivars";
+
+  nodes.machine = {
+    boot.loader.efi.canTouchEfiVariables = true;
+    virtualisation.useEFIBoot = true;
+  };
+
+  testScript = ''
+    import uuid
+    import unittest
+
+    from test_driver.efi import EfiVariable
+    from test_driver.errors import RequestedAssertionFailed
+
+
+    class TestConcurrentRead(unittest.TestCase):
+        def __init__(self, machine):
+            super().__init__()
+            self.machine = machine
+
+        def test_concurrent_read(self):
+            with self.assertRaises(RequestedAssertionFailed):
+                self.machine.read_efi_vars()
+
+
+    vendor_uuid = uuid.UUID('${vendorUuid}')
+    machine.create_efi_vars()
+    machine.write_efi_vars([
+        EfiVariable(
+            vendor_uuid=vendor_uuid,
+            name="${varName}",
+            data=bytes([0x2a]),
+            flags=EfiVariable.Flags.NON_VOLATILE | EfiVariable.Flags.BOOTSERVICE_ACCESS | EfiVariable.Flags.RUNTIME_ACCESS,
+        )
+    ])
+
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    print(machine.succeed('${readWriteVar} "${varName}" "${vendorUuid}"'))
+
+    TestConcurrentRead(machine).test_concurrent_read()
+    machine.crash()
+
+    machine.dump_efi_vars()
+    vars = machine.read_efi_vars()
+
+    guid = uuid.UUID(bytes=vendor_uuid.bytes_le)
+    predicate = lambda v: v.name == "${varName}" and v.vendorUUID == guid
+    var = next((v for v in vars if predicate(v)), None)
+
+    if var:
+        var.print()
+        if var.data == bytes([0x2b]):
+            print("Congrats!")
+        else:
+            raise ValueError("Value 0x2b expected")
+    else:
+        raise ValueError("Could not find ${varName} variable")
+  '';
+}
diff --git a/pkgs/development/python-modules/ovmfvartool/default.nix b/pkgs/development/python-modules/ovmfvartool/default.nix
index 9dea32157d9b..9518d6703921 100644
--- a/pkgs/development/python-modules/ovmfvartool/default.nix
+++ b/pkgs/development/python-modules/ovmfvartool/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   pyyaml,
+  nixosTests,
 }:
 
 buildPythonPackage {
@@ -11,10 +12,11 @@ buildPythonPackage {
   format = "setuptools";
 
   src = fetchFromGitHub {
-    owner = "hlandau";
+    # https://github.com/hlandau/ovmfvartool/pull/4
+    owner = "baloo";
     repo = "ovmfvartool";
-    rev = "45e6b1e53967ee6590faae454c076febce096931";
-    hash = "sha256-XbvcE/MXNj5S5N7A7jxdwgEE5yMuB82Xg+PYBsFRIm0=";
+    rev = "6a17190131bf44699ea27815543a65efff880142";
+    hash = "sha256-lIneg3kL21oxqjsraogGlOVsgmYnp38CPav1TwBg0p0=";
   };
 
   propagatedBuildInputs = [ pyyaml ];
@@ -24,6 +26,10 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "ovmfvartool" ];
 
+  passthru.tests = {
+    inherit (nixosTests.nixos-test-driver) efivars;
+  };
+
   meta = {
     description = "Parse and generate OVMF_VARS.fd from Yaml";
     mainProgram = "ovmfvartool";

From d08a97a02625f300a3c12da8fc5e5f7579cf38d8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 May 2026 10:06:49 +0000
Subject: [PATCH 445/831] systemd: 260.1 -> 260.2

---
 pkgs/os-specific/linux/systemd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a6dd663aef3c..43c90214fcea 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -202,13 +202,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "260.1";
+  version = "260.2";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FUKj3lvjz8TIsyu8NyJYtiNele+1BhdJPdw7r7nW6as=";
+    hash = "sha256-NXmmSV7/9WIW6C8wjdOwaerCy4v7Zcrd8+XDzcS8rEk=";
   };
 
   # PATCH POLICY

From 3dbcb86c1f33d575b16b78d576a16d4d3a2f0608 Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Sun, 31 May 2026 11:43:03 +0300
Subject: [PATCH 446/831] systemd: drop upstreamed tmpfiles noatime patch

---
 pkgs/os-specific/linux/systemd/default.nix | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 43c90214fcea..15f0fc9f1a79 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,7 +5,6 @@
   pkgsCross,
   testers,
   fetchFromGitHub,
-  fetchpatch,
   buildPackages,
   makeBinaryWrapper,
   ninja,
@@ -238,13 +237,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./0003-add-rootprefix-to-lookup-dir-paths.patch
     ./0004-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
     ./0005-core-don-t-taint-on-unmerged-usr.patch
-
-    # TODO: remove the following patch when systemd v261 is released.
-    # see upstream PR: https://github.com/systemd/systemd/pull/41232
-    (fetchpatch {
-      url = "https://github.com/systemd/systemd/commit/df45055942330fcd2b77389e449905e7f6ca34ec.patch";
-      hash = "sha256-PDh4mP9rYGCglp25346nExU2v6P0WYPfLZgu+YwzZ9c=";
-    })
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
     ./0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch

From af777a46648460e2a5274f0e59ee7893e330c7c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 May 2026 14:51:03 +0000
Subject: [PATCH 447/831] nghttp3: 1.15.0 -> 1.16.0

---
 pkgs/by-name/ng/nghttp3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 720cf47f0dd8..852ebfce6194 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nghttp3";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchurl {
     url = "https://github.com/ngtcp2/nghttp3/releases/download/v${finalAttrs.version}/nghttp3-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-xsSRpSgEgUCY5EZjDm78RZr8DT2nlS/+bL3As/mbK2I=";
+    hash = "sha256-IsBpidVL0mbUpx817vGS1JuJBlWfFqQfO4gssCNhdGM=";
   };
 
   outputs = [

From cb5f99314e980030c6f7367711ee0b87e33605ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 31 May 2026 14:57:19 +0000
Subject: [PATCH 448/831] ngtcp2: 1.22.1 -> 1.23.0

---
 pkgs/development/libraries/ngtcp2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index 12a385c9a946..a7f342c6eaf7 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ngtcp2";
-  version = "1.22.1";
+  version = "1.23.0";
 
   src = fetchurl {
     url = "https://github.com/ngtcp2/ngtcp2/releases/download/v${finalAttrs.version}/ngtcp2-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-hzVHltWssZvzEMt3vgS9IgDDImWmvnyUuGMeJsjpPKQ=";
+    hash = "sha256-3kuZ/8kNm5V0TESg2rYcnyqYSLiBuP3rl0rrXqEIAso=";
   };
 
   outputs = [

From 2483668ba5f034901c9bee6192cb4e014d2fd888 Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Sun, 31 May 2026 19:24:58 +0200
Subject: [PATCH 449/831] fuse2: fix aarch64 patch hash

---
 pkgs/os-specific/linux/fuse/common.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index 130d3e8c846c..935661f5aa00 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optional (!isFuse3 && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isLoongArch64))
       (fetchpatch {
         url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
-        hash = "sha256-UsLE14P50Ell0xo3PESk5tIHH2HLalsaWiEubO9KdPE=";
+        hash = "sha256-6hqu5npSUN8I7XLZRiCl+b60Sweb1n2ZZz5LroIzkvA=";
       })
     ++ (
       if isFuse3 then

From 8600fca3a438f1c9d3c71bcf331595d461291d1d Mon Sep 17 00:00:00 2001
From: Raphael Borun Das Gupta <jj@raphael.dasgupta.ch>
Date: Sun, 31 May 2026 16:22:26 +0200
Subject: [PATCH 450/831] =?UTF-8?q?python3Packages.pytest-rerunfailures:?=
 =?UTF-8?q?=2016.1=20=E2=86=92=2016.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

upstream diff: https://github.com/pytest-dev/pytest-rerunfailures/compare/16.1...16.3

upstream changelog:
 * https://github.com/pytest-dev/pytest-rerunfailures/blob/4b3a2200b07b357cecfe192f4997f35764869c6f/CHANGES.rst#162-2026-05-13
 * https://github.com/pytest-dev/pytest-rerunfailures/blob/4b3a2200b07b357cecfe192f4997f35764869c6f/CHANGES.rst#163-2026-05-22
---
 .../python-modules/pytest-rerunfailures/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-rerunfailures/default.nix b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
index 57bd62628ccd..7f681df0ce46 100644
--- a/pkgs/development/python-modules/pytest-rerunfailures/default.nix
+++ b/pkgs/development/python-modules/pytest-rerunfailures/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-rerunfailures";
-  version = "16.1";
+  version = "16.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytest-dev";
     repo = "pytest-rerunfailures";
     tag = version;
-    hash = "sha256-EvjgqJQb4Nw7rn/wVLfHoq9iUnJ4vQ1kwSL5fetHv6M=";
+    hash = "sha256-T4l4AoUHvT6GjHyRK2TA3vPTxRicZ5pvgFgDtbkOGMw=";
   };
 
   build-system = [ setuptools ];

From 0da5dbc05c158f9cddcf316e747c6df3ef952f18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:37:03 -0700
Subject: [PATCH 451/831] python3Packages.python-multipart: 0.0.29 -> 0.0.30

Diff: https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30

Changelog: https://github.com/Kludex/python-multipart/blob/0.0.30/CHANGELOG.md
---
 pkgs/development/python-modules/python-multipart/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-multipart/default.nix b/pkgs/development/python-modules/python-multipart/default.nix
index ed476d568dd8..f7abce349cc6 100644
--- a/pkgs/development/python-modules/python-multipart/default.nix
+++ b/pkgs/development/python-modules/python-multipart/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-multipart";
-  version = "0.0.29";
+  version = "0.0.30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kludex";
     repo = "python-multipart";
     tag = finalAttrs.version;
-    hash = "sha256-1aV7gWLuulINesm3L8Wm3+prmeD9+OY/ihm36rtQPRs=";
+    hash = "sha256-qW/OkOaM+7sN6+mxO5tm6tuDDJ/c703XDNqo6i6YnXo=";
   };
 
   build-system = [ hatchling ];

From c858fde9b4cee4fb2622d649fe03767cf84057dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:39:33 -0700
Subject: [PATCH 452/831] python3Packages.python-multipart: remove unused patch

---
 .../CVE-2026-40347-part-2.patch               | 106 ------------------
 1 file changed, 106 deletions(-)
 delete mode 100644 pkgs/development/python-modules/python-multipart/CVE-2026-40347-part-2.patch

diff --git a/pkgs/development/python-modules/python-multipart/CVE-2026-40347-part-2.patch b/pkgs/development/python-modules/python-multipart/CVE-2026-40347-part-2.patch
deleted file mode 100644
index ea8e5b2e95f8..000000000000
--- a/pkgs/development/python-modules/python-multipart/CVE-2026-40347-part-2.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-Based on upstream d4452a78bbde94995dd3c0d1b4aff3610a5c472f, adjusted
-to apply to 0.0.22
-
-diff --git a/python_multipart/multipart.py b/python_multipart/multipart.py
-index 0f238c2..d2a597e 100644
---- a/python_multipart/multipart.py
-+++ b/python_multipart/multipart.py
-@@ -1418,12 +1418,8 @@ class MultipartParser(BaseParser):
-                     state = MultipartState.END
- 
-             elif state == MultipartState.END:
--                # Don't do anything if chunk ends with CRLF.
--                if c == CR and i + 1 < length and data[i + 1] == LF:
--                    i += 2
--                    continue
--                # Skip data after the last boundary.
--                self.logger.warning("Skipping data after last boundary")
-+                # Silently discard any epilogue data (RFC 2046 section 5.1.1 allows a CRLF and optional
-+                # epilogue after the closing boundary). Django and Werkzeug do the same.
-                 i = length
-                 break
- 
-diff --git a/tests/test_multipart.py b/tests/test_multipart.py
-index 75982b6..3e8dd89 100644
---- a/tests/test_multipart.py
-+++ b/tests/test_multipart.py
-@@ -1,6 +1,5 @@
- from __future__ import annotations
- 
--import logging
- import os
- import random
- import sys
-@@ -722,6 +721,14 @@ single_byte_tests = [
-     "single_field_single_file",
- ]
- 
-+EPILOGUE_TEST_HEAD = (
-+    "--boundary\r\n"
-+    'Content-Disposition: form-data; name="file"; filename="filename.txt"\r\n'
-+    "Content-Type: text/plain\r\n\r\n"
-+    "hello\r\n"
-+    "--boundary--"
-+).encode("latin-1")
-+
- 
- def split_all(val: bytes) -> Iterator[tuple[bytes, bytes]]:
-     """
-@@ -1266,7 +1273,7 @@ class TestFormParser(unittest.TestCase):
-         self.assert_file_data(files[0], b"hello")
- 
-     def test_multipart_parser_data_after_last_boundary(self) -> None:
--        """This test makes sure that the parser does not handle when there is junk data after the last boundary."""
-+        """Parser must short-circuit on arbitrary epilogue data after the closing boundary (no O(N) scan)."""
-         num = 50_000_000
-         data = (
-             "--boundary\r\n"
-@@ -1284,29 +1291,32 @@ class TestFormParser(unittest.TestCase):
-         f = FormParser("multipart/form-data", on_field=Mock(), on_file=on_file, boundary="boundary")
-         f.write(data.encode("latin-1"))
- 
--    @pytest.fixture(autouse=True)
--    def inject_fixtures(self, caplog: pytest.LogCaptureFixture) -> None:
--        self._caplog = caplog
--
--    def test_multipart_parser_data_end_with_crlf_without_warnings(self) -> None:
--        """This test makes sure that the parser does not handle when the data ends with a CRLF."""
--        data = (
--            "--boundary\r\n"
--            'Content-Disposition: form-data; name="file"; filename="filename.txt"\r\n'
--            "Content-Type: text/plain\r\n\r\n"
--            "hello\r\n"
--            "--boundary--\r\n"
--        )
-+    @parametrize(
-+        "chunks",
-+        [
-+            [EPILOGUE_TEST_HEAD + b"\r\n"],
-+            [EPILOGUE_TEST_HEAD + b"\r", b"\n"],
-+            [EPILOGUE_TEST_HEAD, b"\r\n"],
-+            [EPILOGUE_TEST_HEAD + b"\r\n--boundary\r\nthis is not a valid header\r\n\r\nnot a real part"],
-+        ],
-+    )
-+    def test_multipart_parser_ignores_epilogue(self, chunks: list[bytes]) -> None:
-+        """Epilogue data after the closing boundary must be ignored.
- 
-+        Covers both the single-chunk case and the case where trailing CRLF is split across `write()` calls.
-+        The final case asserts that epilogue bytes are not parsed or validated.
-+        """
-         files: list[File] = []
- 
-         def on_file(f: FileProtocol) -> None:
-             files.append(cast(File, f))
- 
-         f = FormParser("multipart/form-data", on_field=Mock(), on_file=on_file, boundary="boundary")
--        with self._caplog.at_level(logging.WARNING):
--            f.write(data.encode("latin-1"))
--            assert len(self._caplog.records) == 0
-+        for chunk in chunks:
-+            f.write(chunk)
-+
-+        assert len(files) == 1
-+        self.assert_file_data(files[0], b"hello")
- 
-     def test_max_size_multipart(self) -> None:
-         # Load test data.

From 0d240aa0d2224b4913c8686a57e221673aa885a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:39:54 -0700
Subject: [PATCH 453/831] python3Packages.python-multipart: add dotlambda to
 maintainers

---
 pkgs/development/python-modules/python-multipart/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/python-multipart/default.nix b/pkgs/development/python-modules/python-multipart/default.nix
index f7abce349cc6..5403a419d768 100644
--- a/pkgs/development/python-modules/python-multipart/default.nix
+++ b/pkgs/development/python-modules/python-multipart/default.nix
@@ -50,6 +50,9 @@ buildPythonPackage (finalAttrs: {
     description = "Streaming multipart parser for Python";
     homepage = "https://github.com/Kludex/python-multipart";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ ris ];
+    maintainers = with lib.maintainers; [
+      dotlambda
+      ris
+    ];
   };
 })

From 225844edfec6332f0ce5bd247ac4c784d365b120 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:51:18 -0700
Subject: [PATCH 454/831] gflags: 2.2.2 -> 2.3.0

Diff: https://github.com/gflags/gflags/compare/v2.2.2...v2.3.0

Changelog: https://github.com/gflags/gflags/blob/v2.3.0/ChangeLog.txt
---
 pkgs/by-name/gf/gflags/package.nix | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/gf/gflags/package.nix b/pkgs/by-name/gf/gflags/package.nix
index 665ed686a51c..6fa9a27b5ccb 100644
--- a/pkgs/by-name/gf/gflags/package.nix
+++ b/pkgs/by-name/gf/gflags/package.nix
@@ -2,31 +2,21 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   enableShared ? !stdenv.hostPlatform.isStatic,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gflags";
-  version = "2.2.2";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "gflags";
     repo = "gflags";
-    rev = "v${finalAttrs.version}";
-    sha256 = "147i3md3nxkjlrccqg4mq1kyzc7yrhvqv5902iibc7znkvzdvlp0";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sud3c6XH24YA6vzGQ7LhSoiKycan5JYehC5l2gH6DEo=";
   };
 
-  patches = [
-    # Fix the build with CMake 4.
-    (fetchpatch {
-      name = "gflags-fix-cmake-4.patch";
-      url = "https://github.com/gflags/gflags/commit/70c01a642f08734b7bddc9687884844ca117e080.patch";
-      hash = "sha256-TYdroBbF27Wvvm/rOahBEvhezuKCcxbtgh/ZhpA5ESo=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   # This isn't used by the build and breaks the CMake build on case-insensitive filesystems (e.g., on Darwin)
@@ -48,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
       It was owned by Google. google-gflags project has been renamed to gflags and maintained by new community.
     '';
     homepage = "https://gflags.github.io/gflags/";
+    changelog = "https://github.com/gflags/gflags/blob/${finalAttrs.src.tag}/ChangeLog.txt";
     license = lib.licenses.bsd3;
     maintainers = [ ];
     platforms = lib.platforms.all;

From 6f5cb5357ce5f049e4571c5fe16afbdb3644e971 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 12:59:26 -0700
Subject: [PATCH 455/831] ghostscript: 10.07.0 -> 10.07.1

Changelog: https://ghostscript.readthedocs.io/en/gs10.07.1/News.html
---
 pkgs/by-name/gh/ghostscript/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gh/ghostscript/package.nix b/pkgs/by-name/gh/ghostscript/package.nix
index 36b9ced6f56b..6cd7c4b18ed1 100644
--- a/pkgs/by-name/gh/ghostscript/package.nix
+++ b/pkgs/by-name/gh/ghostscript/package.nix
@@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ghostscript${lib.optionalString x11Support "-with-X"}";
-  version = "10.07.0";
+  version = "10.07.1";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${
       lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
     }/ghostscript-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3azk4XIflnpVA5uv9WSEAiXguqHU9UMiR8oczRRzt8E=";
+    hash = "sha256-HNt2bejbjx5YnIF/CcWFXqX2XfyFQORlpprBTBhBYCU=";
   };
 
   patches = [
@@ -233,6 +233,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.ghostscript.com/";
+    changelog = "https://ghostscript.readthedocs.io/en/gs${finalAttrs.version}/News.html";
     description = "PostScript interpreter (mainline version)";
     longDescription = ''
       Ghostscript is the name of a set of tools that provides (i) an

From 29533d61c20a8014b1a24f002441ade41cad28b8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 31 May 2026 21:03:00 +0100
Subject: [PATCH 456/831] sdl3: 3.4.8 -> 3.4.10

Changes: https://github.com/libsdl-org/SDL/releases/tag/release-3.4.10
---
 pkgs/by-name/sd/sdl3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 19ee7429320d..c874d844d6a8 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -70,7 +70,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.4.8";
+  version = "3.4.10";
 
   outputs = [
     "lib"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-uBGyGxrUVx642Ku8qhR2sTy2JagcSioIhh/5RsXVAIM=";
+    hash = "sha256-6Dph2eLiJUmpQzPWe8EuY5LrWhrFwde2f2dwfgCcWNw=";
   };
 
   postPatch =

From 2ce99deb340dcee8037d514fdbddf5bc3b1606aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 13:04:21 -0700
Subject: [PATCH 457/831] giflib: 5.2.2 -> 6.1.3

---
 pkgs/by-name/gi/giflib/CVE-2021-40633.patch | 26 ---------------------
 pkgs/by-name/gi/giflib/CVE-2025-31344.patch | 15 ------------
 pkgs/by-name/gi/giflib/package.nix          |  6 ++---
 3 files changed, 2 insertions(+), 45 deletions(-)
 delete mode 100644 pkgs/by-name/gi/giflib/CVE-2021-40633.patch
 delete mode 100644 pkgs/by-name/gi/giflib/CVE-2025-31344.patch

diff --git a/pkgs/by-name/gi/giflib/CVE-2021-40633.patch b/pkgs/by-name/gi/giflib/CVE-2021-40633.patch
deleted file mode 100644
index 8a665bb1638b..000000000000
--- a/pkgs/by-name/gi/giflib/CVE-2021-40633.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From ccbc956432650734c91acb3fc88837f7b81267ff Mon Sep 17 00:00:00 2001
-From: "Eric S. Raymond" <esr@thyrsus.com>
-Date: Wed, 21 Feb 2024 18:55:00 -0500
-Subject: [PATCH] Clean up memory better at end of run (CVE-2021-40633)
-
----
- gif2rgb.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/gif2rgb.c b/gif2rgb.c
-index d51226d..fc2e683 100644
---- a/gif2rgb.c
-+++ b/gif2rgb.c
-@@ -517,6 +517,9 @@ static void GIF2RGB(int NumFiles, char *FileName, bool OneFileFlag,
- 	DumpScreen2RGB(OutFileName, OneFileFlag, ColorMap, ScreenBuffer,
- 	               GifFile->SWidth, GifFile->SHeight);
- 
-+	for (i = 0; i < GifFile->SHeight; i++) {
-+        	(void)free(ScreenBuffer[i]);
-+	}
- 	(void)free(ScreenBuffer);
- 
- 	{
--- 
-2.44.0
-
diff --git a/pkgs/by-name/gi/giflib/CVE-2025-31344.patch b/pkgs/by-name/gi/giflib/CVE-2025-31344.patch
deleted file mode 100644
index 04ef6c3ba755..000000000000
--- a/pkgs/by-name/gi/giflib/CVE-2025-31344.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff -up giflib-5.2.2/gif2rgb.c.omv~ giflib-5.2.2/gif2rgb.c
---- giflib-5.2.2/gif2rgb.c.omv~	2025-04-07 21:44:54.956355983 +0200
-+++ giflib-5.2.2/gif2rgb.c	2025-04-07 21:45:29.630769589 +0200
-@@ -329,6 +329,11 @@ static void DumpScreen2RGB(char *FileNam
- 			GifRow = ScreenBuffer[i];
- 			GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
- 			for (j = 0; j < ScreenWidth; j++) {
-+				/* Check if color is within color palete */
-+				if (GifRow[j] >= ColorMap->ColorCount) {
-+					GIF_EXIT(GifErrorString(
-+					    D_GIF_ERR_IMAGE_DEFECT));
-+				}
- 				ColorMapEntry = &ColorMap->Colors[GifRow[j]];
- 				Buffers[0][j] = ColorMapEntry->Red;
- 				Buffers[1][j] = ColorMapEntry->Green;
diff --git a/pkgs/by-name/gi/giflib/package.nix b/pkgs/by-name/gi/giflib/package.nix
index 579cbd5a3e3c..6763a9291735 100644
--- a/pkgs/by-name/gi/giflib/package.nix
+++ b/pkgs/by-name/gi/giflib/package.nix
@@ -8,16 +8,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "giflib";
-  version = "5.2.2";
+  version = "6.1.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/giflib/giflib-${finalAttrs.version}.tar.gz";
-    hash = "sha256-vn/70FfK3r4qoURUL9kMaDjGoIO16KkEi47jtmsp1fs=";
+    hash = "sha256-tltmuZ8EJLk1JfmHOG8i/F77naK/ySrUpTIkmq/7qw4=";
   };
 
   patches = [
-    ./CVE-2021-40633.patch
-    ./CVE-2025-31344.patch
   ]
   ++ lib.optionals stdenv.hostPlatform.isMinGW [
     # Build dll libraries.

From 802bd69ec7dee9f84283295128b74ff4e9b0f4ff Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sat, 2 Mar 2024 21:59:30 +0000
Subject: [PATCH 458/831] giflib: add some key reverse-dependencies to
 passthru.tests

---
 pkgs/by-name/gi/giflib/package.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/by-name/gi/giflib/package.nix b/pkgs/by-name/gi/giflib/package.nix
index 6763a9291735..b2142aa2869f 100644
--- a/pkgs/by-name/gi/giflib/package.nix
+++ b/pkgs/by-name/gi/giflib/package.nix
@@ -3,6 +3,17 @@
   lib,
   fetchurl,
   fixDarwinDylibNames,
+
+  # for passthru.tests
+  SDL2_image,
+  SDL_image,
+  gdal,
+  imlib2,
+  leptonica,
+  libjxl,
+  libwebp,
+  openimageio,
+  openjdk,
   pkgsStatic,
 }:
 
@@ -52,6 +63,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests = {
     static = pkgsStatic.giflib;
+    inherit
+      SDL2_image
+      SDL_image
+      gdal
+      imlib2
+      leptonica
+      libjxl
+      openimageio
+      openjdk
+      ;
   };
 
   meta = {

From cafb9bdee9ae9e947ba23cfb38aba28f49c18dbc Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 03:21:43 +0300
Subject: [PATCH 459/831] stdenv: distinguish stdenvNoCC name from stdenv

The default stdenvNoCC is constructed via stdenv.override and inherited
the parent stdenv's name verbatim. Every bootstrap stage thus produced
two derivations with identical names (one with a C compiler, one
without), which made bootstrap traces and per-stage drv counts
ambiguous.

Appending '-no-cc' makes each stage's stdenv/stdenvNoCC pair uniquely
identifiable in store paths and graph traces.
---
 pkgs/top-level/stage.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 4b0abd0361c6..b63aed1ce8d6 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -55,6 +55,7 @@ in
   # `stdenv` without a C compiler. Passing in this helps avoid infinite
   # recursions, and may eventually replace passing in the full stdenv.
   stdenvNoCC ? stdenv.override {
+    name = "${stdenv.name}-no-cc";
     cc = null;
     hasCC = false;
     # Darwin doesn’t need an SDK in `stdenvNoCC`.  Dropping it shrinks the closure

From bfb5cca84ea45d911a2badd9932ad2f064139e12 Mon Sep 17 00:00:00 2001
From: Hraban <hraban@0brg.net>
Date: Sun, 31 May 2026 17:24:14 -0400
Subject: [PATCH 460/831] sbcl: 2.6.4 -> 2.6.5

---
 pkgs/development/compilers/sbcl/default.nix |  2 +-
 pkgs/top-level/all-packages.nix             | 19 +++++++++----------
 2 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 36963b65f8d7..73d3cc08df88 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -30,8 +30,8 @@ let
     "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg=";
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.6.3".sha256 = "sha256-50MvtkKVLdJaX8DFbSGPPQqlls5C0z76gwkbyn1pmIo=";
     "2.6.4".sha256 = "sha256-O6U+ZUtg/rfE9QRmGZ1tUmDyZhxxG6ItS3cLZVQA1Xs=";
+    "2.6.5".sha256 = "sha256-kex19kclLtbmrq6bGhP0fHxs/ZtoSI3Gnxpv6lrMtEA=";
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8d0e11e21108..63838e08073a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7537,15 +7537,6 @@ with pkgs;
     ];
   };
 
-  sbcl_2_6_3 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.6.3"; };
-
-    faslExt = "fasl";
-    flags = [
-      "--dynamic-space-size"
-      "3000"
-    ];
-  };
   sbcl_2_6_4 = wrapLisp {
     pkg = callPackage ../development/compilers/sbcl { version = "2.6.4"; };
     faslExt = "fasl";
@@ -7554,7 +7545,15 @@ with pkgs;
       "3000"
     ];
   };
-  sbcl = sbcl_2_6_4;
+  sbcl_2_6_5 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.6.5"; };
+    faslExt = "fasl";
+    flags = [
+      "--dynamic-space-size"
+      "3000"
+    ];
+  };
+  sbcl = sbcl_2_6_5;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;
 

From 3b6cda4e40f81fada80e9cc10e040d59a2826a20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 15:01:48 -0700
Subject: [PATCH 461/831] python3Packages.pyjwt: 2.12.1 -> 2.13.0

Diff: https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0

Changelog: https://github.com/jpadilla/pyjwt/blob/2.13.0/CHANGELOG.rst
---
 pkgs/development/python-modules/pyjwt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 1d18045a863c..74754630a145 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.12.1";
+  version = "2.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jpadilla";
     repo = "pyjwt";
     tag = version;
-    hash = "sha256-wgOa5JhQT82ppoad6s8gPH7tGRNbbVWmJaaDF84d+r0=";
+    hash = "sha256-q4ynXCJVDsyZh70439dloyWgRTLVm+elDOahUVOT5vA=";
   };
 
   outputs = [

From c89633874a11ca514342575c7cda8e98fa73de54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 17:33:16 -0700
Subject: [PATCH 462/831] gperftools: 2.17.2 -> 2.18.1

Diff: https://github.com/gperftools/gperftools/compare/gperftools-2.17.2...gperftools-2.18.1

Changelog: https://github.com/gperftools/gperftools/releases/tag/gperftools-2.18.0
---
 pkgs/by-name/gp/gperftools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gp/gperftools/package.nix b/pkgs/by-name/gp/gperftools/package.nix
index a5888096c827..693d874cbf7b 100644
--- a/pkgs/by-name/gp/gperftools/package.nix
+++ b/pkgs/by-name/gp/gperftools/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gperftools";
-  version = "2.17.2";
+  version = "2.18.1";
 
   src = fetchFromGitHub {
     owner = "gperftools";
     repo = "gperftools";
     tag = "gperftools-${finalAttrs.version}";
-    hash = "sha256-WCEuiSjNIX/KhEBWndyVhrKlWs7H60mcHoPlWd7YWC4=";
+    hash = "sha256-LvLsq0UuMu51vcgxDrBkdnoUJ3qFH+tbXbTjreBxBqs=";
   };
 
   patches = [

From 07bc3407475405b03836980665277d31bfcb4b75 Mon Sep 17 00:00:00 2001
From: winston <hey@winston.sh>
Date: Mon, 1 Jun 2026 02:49:17 +0200
Subject: [PATCH 463/831] sdl3: increase test timeout for testrwlock

---
 pkgs/by-name/sd/sdl3/package.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 19ee7429320d..c388fb0fe874 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -87,10 +87,17 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postPatch =
-    # Tests timeout on Darwin
     lib.optionalString (finalAttrs.finalPackage.doCheck) ''
+      # Tests timeout on Darwin
       substituteInPlace test/CMakeLists.txt \
         --replace-fail 'set(noninteractive_timeout 10)' 'set(noninteractive_timeout 30)'
+
+      # intermittent test failure
+      # https://github.com/libsdl-org/SDL/issues/15346
+      substituteInPlace test/CMakeLists.txt \
+        --replace-fail \
+        'add_sdl_test_executable(testrwlock SOURCES testrwlock.c NONINTERACTIVE NONINTERACTIVE_TIMEOUT 20)' \
+        'add_sdl_test_executable(testrwlock SOURCES testrwlock.c NONINTERACTIVE NONINTERACTIVE_TIMEOUT 300)'
     ''
     + lib.optionalString waylandSupport ''
       substituteInPlace src/dialog/unix/SDL_zenitymessagebox.c \

From f382bf21aecb98e26d6c530c3e8db8b44c9fdedb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 17:53:47 -0700
Subject: [PATCH 464/831] graphviz: 12.2.1 -> 14.1.2

Diff: https://gitlab.com/graphviz/graphviz/-/compare/12.2.1...14.1.2

Changelog: https://gitlab.com/graphviz/graphviz/-/blob/14.1.2/CHANGELOG.md
---
 pkgs/by-name/gr/graphviz/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gr/graphviz/package.nix b/pkgs/by-name/gr/graphviz/package.nix
index 1172173dd326..f5686e0274d3 100644
--- a/pkgs/by-name/gr/graphviz/package.nix
+++ b/pkgs/by-name/gr/graphviz/package.nix
@@ -39,13 +39,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphviz";
-  version = "12.2.1";
+  version = "14.1.2";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
-    rev = finalAttrs.version;
-    hash = "sha256-Uxqg/7+LpSGX4lGH12uRBxukVw0IswFPfpb2EkLsaiI=";
+    tag = finalAttrs.version;
+    hash = "sha256-LkyiKl0ulS9ujEdVLfyeoc4CtjITd6CAc35IUtlHSfw=";
   };
 
   nativeBuildInputs = [
@@ -136,6 +136,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://graphviz.org";
+    changelog = "https://gitlab.com/graphviz/graphviz/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Graph visualization tools";
     license = lib.licenses.epl10;
     platforms = lib.platforms.unix;

From 0613f17f02ece886172619d25c4449a7d90a1c44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 18:43:14 -0700
Subject: [PATCH 465/831] python3Packages.pygraphviz: 1.14 ->
 1.14-unstable-2026-05-07

Diff: https://github.com/pygraphviz/pygraphviz/compare/pygraphviz-1.14...6b9efcd1a76a97836de79d1380c0d003c6f834e7
---
 .../python-modules/pygraphviz/default.nix     | 30 +++++++++++++++----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pygraphviz/default.nix b/pkgs/development/python-modules/pygraphviz/default.nix
index f8a7d37977dd..526fd967b103 100644
--- a/pkgs/development/python-modules/pygraphviz/default.nix
+++ b/pkgs/development/python-modules/pygraphviz/default.nix
@@ -2,24 +2,26 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   replaceVars,
   graphviz,
   coreutils,
   pkg-config,
   setuptools,
+  swig,
   pytest,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "pygraphviz";
-  version = "1.14";
+  version = "1.14-unstable-2026-05-07";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pygraphviz";
     repo = "pygraphviz";
-    tag = "pygraphviz-${version}";
-    hash = "sha256-RyUmT2djj2GnVG82xO9HULMAJZb2LYMUGDRvCwaYBg8=";
+    rev = "6b9efcd1a76a97836de79d1380c0d003c6f834e7";
+    hash = "sha256-ghtnwOevSnecshMBoASCZircgOsPF7+l+Cer+J+yEqM=";
   };
 
   patches = [
@@ -32,9 +34,27 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "swig>4.1.0"' ""
+
+    # https://github.com/pygraphviz/pygraphviz/pull/573
+    substituteInPlace pygraphviz/graphviz.i \
+      --replace-fail '%cstring_output_allocate_size(char **result, unsigned int* size, free(*$1));' \
+                     '%cstring_output_allocate_size(char **result, size_t* size, free(*$1));' \
+      --replace-fail 'int gvRenderData(GVC_t *gvc, Agraph_t* g, char *format, char **result, unsigned int *size);' \
+                     'int gvRenderData(GVC_t *gvc, Agraph_t* g, char *format, char **result, size_t *size);'
+  '';
+
+  env.GRAPHVIZ_PREFIX = graphviz;
+
+  build-system = [
+    setuptools
+  ];
+
   nativeBuildInputs = [
     pkg-config
-    setuptools
+    swig
   ];
 
   buildInputs = [ graphviz ];

From 5a9c85ccce989df44b76d84d057c89d235aa6fc5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 20:08:52 -0700
Subject: [PATCH 466/831] gtk-doc: 1.35.1 -> 1.36.1

Diff: https://gitlab.gnome.org/GNOME/gtk-doc/-/compare/1.35.1...1.36.1

Changelog: https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/1.36.1/NEWS
---
 pkgs/by-name/gt/gtk-doc/package.nix                 | 13 ++++---------
 .../gt/gtk-doc/respect-xml-catalog-files-var.patch  | 13 -------------
 2 files changed, 4 insertions(+), 22 deletions(-)
 delete mode 100644 pkgs/by-name/gt/gtk-doc/respect-xml-catalog-files-var.patch

diff --git a/pkgs/by-name/gt/gtk-doc/package.nix b/pkgs/by-name/gt/gtk-doc/package.nix
index a2db2fee4788..9f58e9fb8f75 100644
--- a/pkgs/by-name/gt/gtk-doc/package.nix
+++ b/pkgs/by-name/gt/gtk-doc/package.nix
@@ -16,7 +16,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gtk-doc";
-  version = "1.35.1";
+  version = "1.36.1";
 
   outputDevdoc = "out";
 
@@ -26,14 +26,10 @@ python3.pkgs.buildPythonApplication rec {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gtk-doc";
-    rev = version;
-    hash = "sha256-EqU7lnBnOn3gR3hT95yjdTUb3cqX2XJK5UAKsFw2Q10=";
+    tag = version;
+    hash = "sha256-8hB43BCAtT1B7/ak2i0FAlYD3Kb4rNCWfsJ+wqGu3FA=";
   };
 
-  patches = [
-    passthru.respect_xml_catalog_files_var_patch
-  ];
-
   postPatch = ''
     substituteInPlace meson.build \
       --replace "pkg-config" "$PKG_CONFIG"
@@ -83,8 +79,6 @@ python3.pkgs.buildPythonApplication rec {
   '';
 
   passthru = {
-    # Consumers are expected to copy the m4 files to their source tree, let them reuse the patch
-    respect_xml_catalog_files_var_patch = ./respect-xml-catalog-files-var.patch;
     updateScript = gnome.updateScript {
       packageName = "gtk-doc";
       versionPolicy = "none";
@@ -92,6 +86,7 @@ python3.pkgs.buildPythonApplication rec {
   };
 
   meta = {
+    changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${src.tag}/NEWS";
     description = "Tools to extract documentation embedded in GTK and GNOME source code";
     homepage = "https://gitlab.gnome.org/GNOME/gtk-doc";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/gt/gtk-doc/respect-xml-catalog-files-var.patch b/pkgs/by-name/gt/gtk-doc/respect-xml-catalog-files-var.patch
deleted file mode 100644
index 95f6879a0069..000000000000
--- a/pkgs/by-name/gt/gtk-doc/respect-xml-catalog-files-var.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/m4/gtkdoc_jh_check_xml_catalog.m4
-+++ b/m4/gtkdoc_jh_check_xml_catalog.m4
-@@ -5,8 +5,8 @@
- [
- 	AC_REQUIRE([JH_PATH_XML_CATALOG],[JH_PATH_XML_CATALOG(,[:])])dnl
- 	AC_MSG_CHECKING([for ifelse([$2],,[$1],[$2]) in XML catalog])
--	if $jh_found_xmlcatalog && \
--		AC_RUN_LOG([$XMLCATALOG --noout "$XML_CATALOG_FILE" "$1" >&2]); then
-+	# empty argument forces libxml to use XML_CATALOG_FILES variable
-+	if AC_RUN_LOG([$XMLCATALOG --noout "" "$1" >&2]); then
- 		AC_MSG_RESULT([found])
- 		ifelse([$3],,,[$3])
- 	else

From 10eb89c9785fa59847fbcadea0152e53c5512b8b Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Fri, 29 May 2026 01:22:29 +1000
Subject: [PATCH 467/831] gnat13: fix patch evaluation

The patch only applies on top of the iains gcc patchset, as it modifies
the abi added by that patchset.
---
 pkgs/development/compilers/gcc/patches/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 048cfee9ffde..cc0b5b47e9b4 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -187,7 +187,9 @@ optionals noSysDirs (
   .${majorVersion} or [ ]
 )
 
-++ optional (langAda && is13) ./13/gnat13-aarch64-darwin-trampoline.patch
+++ optional (
+  langAda && is13 && canApplyIainsDarwinPatches
+) ./13/gnat13-aarch64-darwin-trampoline.patch
 
 ++ optional (targetPlatform.isWindows || targetPlatform.isCygwin) (fetchpatch {
   name = "libstdc-fix-compilation-in-freestanding-win32.patch";

From e1e3ccda5d37e1796efbfbe2ca1b7e2887e17ab1 Mon Sep 17 00:00:00 2001
From: Yuxuan Shui <yshuiv7@gmail.com>
Date: Mon, 27 Apr 2026 12:22:29 +0100
Subject: [PATCH 468/831] ldacbt: use Sony AOSP source

Also build all functionalities into a single shared library: encoder,
decoder, and ABR.
---
 ...-support-for-dynamic-loading-libldac.patch | 164 ++++++++++++++++++
 pkgs/by-name/ld/ldacbt/package.nix            | 116 ++++++++++---
 2 files changed, 255 insertions(+), 25 deletions(-)
 create mode 100644 pkgs/by-name/ld/ldacbt/0001-abr-drop-support-for-dynamic-loading-libldac.patch

diff --git a/pkgs/by-name/ld/ldacbt/0001-abr-drop-support-for-dynamic-loading-libldac.patch b/pkgs/by-name/ld/ldacbt/0001-abr-drop-support-for-dynamic-loading-libldac.patch
new file mode 100644
index 000000000000..e054d75fd395
--- /dev/null
+++ b/pkgs/by-name/ld/ldacbt/0001-abr-drop-support-for-dynamic-loading-libldac.patch
@@ -0,0 +1,164 @@
+From 040210591a5e90fc3e0ca0ec438426273e86c497 Mon Sep 17 00:00:00 2001
+From: "yshuiv7@gmail.com" <Yuxuan Shui>
+Date: Mon, 27 Apr 2026 15:30:10 +0100
+Subject: [PATCH] abr: drop support for dynamic loading libldac
+
+---
+ abr/inc/ldacBT_abr.h |  2 +-
+ abr/src/ldacBT_abr.c | 76 +-------------------------------------------
+ 2 files changed, 2 insertions(+), 76 deletions(-)
+
+diff --git a/abr/inc/ldacBT_abr.h b/abr/inc/ldacBT_abr.h
+index 294e230..735ea67 100644
+--- a/abr/inc/ldacBT_abr.h
++++ b/abr/inc/ldacBT_abr.h
+@@ -89,7 +89,7 @@ typedef struct _ldacbt_abr_param * HANDLE_LDAC_ABR;
+  *  Return value
+  *      HANDLE_LDAC_ABR for success, NULL for failure.
+  */
+-LDAC_ABR_API HANDLE_LDAC_ABR ldac_ABR_get_handle(const char *libpath);
++LDAC_ABR_API HANDLE_LDAC_ABR ldac_ABR_get_handle(void);
+ 
+ /* Release of LDAC ABR handle.
+  *  Format
+diff --git a/abr/src/ldacBT_abr.c b/abr/src/ldacBT_abr.c
+index 0af6278..fad2dd0 100644
+--- a/abr/src/ldacBT_abr.c
++++ b/abr/src/ldacBT_abr.c
+@@ -8,10 +8,6 @@
+ 
+ #include <stdlib.h>
+ #include <string.h>
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-#include <dlfcn.h>
+-#include <errno.h>
+-#endif
+ 
+ #define LDAC_ABR_OBSERVING_TIME_MS 500   /* [ms] the time length for storing Tx Queue Depth */
+ #define LDAC_ABR_PENALTY_MAX 4
+@@ -56,18 +52,11 @@ typedef int (*tLDACBT_GET_ERR)(HANDLE_LDAC_BT hLdacBt);
+ 
+ typedef struct _ldacbt_api_param
+ {
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-    const char *lib_name;
+-    void *lib_handle;
+-#endif
+     tLDACBT_ALTER_EQMID_PRIORITY alter_eqmid_priority;
+     tLDACBT_GET_EQMID            get_eqmid;
+     tLDACBT_GET_ERR              get_error_code;
+ } LDACBT_API_PARAMS, * HANDLE_LDACBT_API;
+ 
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-static int open_lib(HANDLE_LDACBT_API hLdacBtApi, const char *lib_name );
+-#endif
+ 
+ static int load_ldacbt_api_functions(HANDLE_LDACBT_API hLdacBtApi);
+ 
+@@ -122,7 +111,7 @@ static const int sizeOfEqmidToBitrateSortedIdTable = (int)(sizeof(aEqmidToAbrQua
+                                                      / sizeof(aEqmidToAbrQualityModeID[0]));
+ 
+ /* Get LDAC ABR handle */
+-HANDLE_LDAC_ABR ldac_ABR_get_handle(const char *libpath)
++HANDLE_LDAC_ABR ldac_ABR_get_handle(void)
+ {
+     HANDLE_LDAC_ABR hLdacAbr;
+     ABRDBG( "" );
+@@ -131,15 +120,6 @@ HANDLE_LDAC_ABR ldac_ABR_get_handle(const char *libpath)
+         return NULL;
+     }
+     clear_data( hLdacAbr, sizeof(LDAC_ABR_PARAMS) );
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-    if (libpath != NULL) {
+-        if (open_lib( &hLdacAbr->ldacBtApi, libpath ) < 0) {
+-            ABRDBG( "[ERR] Failed to open shared library \"%s\".", libpath );
+-            ldac_ABR_free_handle(hLdacAbr);
+-            return NULL;
+-        }
+-    }
+-#endif
+     if( load_ldacbt_api_functions(&hLdacAbr->ldacBtApi) != 0 ){
+         ldac_ABR_free_handle(hLdacAbr);
+         return NULL;
+@@ -156,12 +136,6 @@ void ldac_ABR_free_handle(HANDLE_LDAC_ABR hLdacAbr)
+         if (hLdacAbr->TxQD_Info.pHist){
+             free(hLdacAbr->TxQD_Info.pHist);
+         }
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-        if (hLdacAbr->ldacBtApi.lib_handle != NULL) {
+-            dlclose(hLdacAbr->ldacBtApi.lib_handle);
+-            hLdacAbr->ldacBtApi.lib_handle = NULL;
+-        }
+-#endif
+         free(hLdacAbr);
+     }
+ }
+@@ -408,65 +382,17 @@ int ldac_ABR_Proc( HANDLE_LDAC_BT hLDAC, HANDLE_LDAC_ABR hLdacAbr,
+ }
+ 
+ 
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-static void *load_func(void *lib_handle, const char* func_name)
+-{
+-    void *func_ptr = dlsym(lib_handle, func_name);
+-    if(func_ptr == NULL){
+-        ABRDBG("[ERR] cannot find function '%s' in the library.\n", func_name);
+-        return NULL;
+-    }
+-    return func_ptr;
+-}
+-
+-static int open_lib(HANDLE_LDACBT_API hLdacBtApi, const char *lib_name )
+-{
+-    if( hLdacBtApi == NULL ){
+-        ABRDBG("[ERR] handle is NULL");
+-        return -1;
+-    }
+-    if( lib_name == NULL ){
+-        ABRDBG("[ERR] lib_name is NULL");
+-        return -1;
+-    }
+-    // open library
+-    hLdacBtApi->lib_handle = dlopen(lib_name, RTLD_NOW);
+-    if(hLdacBtApi->lib_handle == NULL){
+-#ifdef LOCAL_DEBUG
+-        char buffer_str[1024];
+-        strerror_r(errno, buffer_str, sizeof(buffer_str));
+-        ABRDBG("[ERR] cannot open library '%s': errno = %d (%s)\n",
+-                lib_name, errno, buffer_str);
+-#endif
+-        return -1;
+-    }
+-    return 0;
+-}
+-#endif /* LDAC_ABR_DYNAMIC_LINK_LDAC_API */
+-
+ // Load functions
+ static int load_ldacbt_api_functions(HANDLE_LDACBT_API hLdacBtApi)
+ {
+     hLdacBtApi->alter_eqmid_priority =
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-      load_func(hLdacBtApi->lib_handle, "ldacBT_alter_eqmid_priority");
+-#else
+       ldacBT_alter_eqmid_priority;
+-#endif
+ 
+     hLdacBtApi->get_eqmid =
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-      load_func(hLdacBtApi->lib_handle, "ldacBT_get_eqmid");
+-#else
+       ldacBT_get_eqmid;
+-#endif
+ 
+     hLdacBtApi->get_error_code =
+-#ifdef LDAC_ABR_DYNAMIC_LINK_LDAC_API
+-      load_func(hLdacBtApi->lib_handle, "ldacBT_get_error_code");
+-#else
+       ldacBT_get_error_code;
+-#endif
+ 
+     if( (hLdacBtApi->alter_eqmid_priority == NULL) ||
+         (hLdacBtApi->get_eqmid == NULL) ||
+-- 
+2.53.0
+
diff --git a/pkgs/by-name/ld/ldacbt/package.nix b/pkgs/by-name/ld/ldacbt/package.nix
index 72320637739d..de766de0d615 100644
--- a/pkgs/by-name/ld/ldacbt/package.nix
+++ b/pkgs/by-name/ld/ldacbt/package.nix
@@ -2,19 +2,17 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ldacBT";
-  version = "2.0.2.3";
+  version = "2.0.72";
 
   src = fetchFromGitHub {
-    repo = "ldacBT";
-    owner = "ehfive";
-    tag = "v${finalAttrs.version}";
-    sha256 = "09dalysx4fgrgpfdm9a51x6slnf4iik1sqba4xjgabpvq91bnb63";
-    fetchSubmodules = true;
+    owner = "open-vela";
+    repo = "external_libldac";
+    rev = "5b4bf66096ba0d69615efb2422ba3d023c34c2fd";
+    hash = "sha256-5jeqTyhSBtYky15Xw1lIbUxeGZMQQQdM/EQUFicyi3Y=";
   };
 
   outputs = [
@@ -22,31 +20,99 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  nativeBuildInputs = [
-    cmake
+  patches = [
+    ./0001-abr-drop-support-for-dynamic-loading-libldac.patch
   ];
 
-  cmakeFlags = [
-    # CMakeLists.txt by default points to $out
-    "-DINSTALL_INCLUDEDIR=${placeholder "dev"}/include"
-  ];
+  env.NIX_CFLAGS_COMPILE = "-O2 -fPIC -fno-merge-constants -Wall -Iinc -Isrc -Iabr/inc";
 
-  # Fix the build with CMake 4.
-  #
-  # See: <https://github.com/EHfive/ldacBT/pull/1>
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail \
-        'cmake_minimum_required(VERSION 3.0)' \
-        'cmake_minimum_required(VERSION 3.0...3.10)'
+  # Verify finalAttrs.version matches LDACBT_LIB_VER_* in upstream source.
+  # Guards against silent version drift when the pinned commit changes.
+  preBuild = ''
+    awk -v want=${finalAttrs.version} '
+      /^#define LDACBT_LIB_VER_/ { v = v sep ($3+0); sep = "." }
+      END {
+        if (v != want) { print "version mismatch: package says " want ", source reports " v > "/dev/stderr"; exit 1 }
+      }
+    ' src/ldacBT_api.c
+  '';
+
+  # Upstream ships AOSP build files and a gcc/ makefile that only knows
+  # about the in-tree layout. Compile and link directly; the entire
+  # library is two umbrella translation units.
+  buildPhase = ''
+    runHook preBuild
+
+    soname=libldacBT.so.${lib.versions.major finalAttrs.version}
+    sofile=libldacBT.so.${finalAttrs.version}
+
+    $CC -shared -Wl,-soname,$soname src/ldaclib.c src/ldacBT.c abr/src/ldacBT_abr.c -lm -o $sofile
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 -t $out/lib $sofile
+    ln -s $sofile $out/lib/$soname
+    ln -s $sofile $out/lib/libldacBT.so
+
+    install -Dm644 inc/ldacBT.h $dev/include/ldac/ldacBT.h
+    install -Dm644 abr/inc/ldacBT_abr.h $dev/include/ldac/ldacBT_abr.h
+
+    mkdir -p $dev/lib/pkgconfig
+    cat > $dev/lib/pkgconfig/ldacBT-dec.pc <<EOF
+    prefix=$out
+    exec_prefix=\''${prefix}
+    libdir=$out/lib
+    includedir=$dev/include/ldac
+
+    Name: ldacBT-dec
+    Description: LDAC Bluetooth decoder
+    Version: ${finalAttrs.version}
+    Libs: -L\''${libdir} -lldacBT
+    Libs.private: -lm
+    Cflags: -I\''${includedir}
+    EOF
+
+    cat > $dev/lib/pkgconfig/ldacBT-enc.pc <<EOF
+    prefix=$out
+    exec_prefix=\''${prefix}
+    libdir=$out/lib
+    includedir=$dev/include/ldac
+
+    Name: ldacBT-enc
+    Description: LDAC Bluetooth encoder
+    Version: ${finalAttrs.version}
+    Libs: -L\''${libdir} -lldacBT
+    Libs.private: -lm
+    Cflags: -I\''${includedir}
+    EOF
+
+    cat > $dev/lib/pkgconfig/ldacBT-abr.pc <<EOF
+    prefix=$out
+    exec_prefix=\''${prefix}
+    libdir=$out/lib
+    includedir=$dev/include/ldac
+
+    Name: ldacBT-abr
+    Description: LDAC Bluetooth ABR library
+    Version: ${finalAttrs.version}
+    Libs: -L\''${libdir} -lldacBT
+    Libs.private: -lm
+    Cflags: -I\''${includedir}
+    EOF
+
+    runHook postInstall
   '';
 
   meta = {
-    description = "AOSP libldac dispatcher";
-    homepage = "https://github.com/EHfive/ldacBT";
+    description = "Sony LDAC Bluetooth decoder library (from AOSP via open-vela)";
+    homepage = "https://github.com/open-vela/external_libldac";
     license = lib.licenses.asl20;
-    # libldac code detects & #error's out on non-LE byte order
+    # LDAC bitstream format assumes LE; source has endian checks
     platforms = lib.platforms.littleEndian;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ qweered ];
   };
 })

From 39cb5677cf18e5b73918647973fe8685600d4181 Mon Sep 17 00:00:00 2001
From: Yuxuan Shui <yshuiv7@gmail.com>
Date: Mon, 27 Apr 2026 12:41:51 +0100
Subject: [PATCH 469/831] pipewire: drop libldac-dec from buildInputs

The now unified ldacbt has decoding support as well.

Fixes #511056
---
 pkgs/by-name/pi/pipewire/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 3929f392ee6a..7f5ff1315146 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -52,7 +52,6 @@
   fdk_aac,
   libopus,
   ldacbt,
-  libldac-dec,
   spandsp,
   modemmanager,
   libpulseaudio,
@@ -176,7 +175,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional webrtcAudioProcessingSupport webrtc-audio-processing
   ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
   ++ lib.optional ldacbtSupport ldacbt
-  ++ lib.optional (ldacBtDecodeSupport && ldacbtSupport) libldac-dec
   ++ lib.optional libcameraSupport libcamera
   ++ lib.optional zeroconfSupport avahi
   ++ lib.optional raopSupport openssl

From 8d765834f4a0ec6e74938f52306ff24fc61fa951 Mon Sep 17 00:00:00 2001
From: Yuxuan Shui <yshuiv7@gmail.com>
Date: Mon, 27 Apr 2026 16:07:13 +0100
Subject: [PATCH 470/831] libldac-dec: drop

---
 pkgs/by-name/li/libldac-dec/package.nix | 85 -------------------------
 1 file changed, 85 deletions(-)
 delete mode 100644 pkgs/by-name/li/libldac-dec/package.nix

diff --git a/pkgs/by-name/li/libldac-dec/package.nix b/pkgs/by-name/li/libldac-dec/package.nix
deleted file mode 100644
index 89fa401ea258..000000000000
--- a/pkgs/by-name/li/libldac-dec/package.nix
+++ /dev/null
@@ -1,85 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libldac-dec";
-  version = "2.0.72";
-
-  src = fetchFromGitHub {
-    owner = "open-vela";
-    repo = "external_libldac";
-    rev = "5b4bf66096ba0d69615efb2422ba3d023c34c2fd";
-    hash = "sha256-5jeqTyhSBtYky15Xw1lIbUxeGZMQQQdM/EQUFicyi3Y=";
-  };
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = "-O2 -fPIC -Wall -D_DECODE_ONLY -Iinc -Isrc";
-
-  # Verify finalAttrs.version matches LDACBT_LIB_VER_* in upstream source.
-  # Guards against silent version drift when the pinned commit changes.
-  preBuild = ''
-    awk -v want=${finalAttrs.version} '
-      /^#define LDACBT_LIB_VER_/ { v = v sep ($3+0); sep = "." }
-      END {
-        if (v != want) { print "version mismatch: package says " want ", source reports " v > "/dev/stderr"; exit 1 }
-      }
-    ' src/ldacBT_api.c
-  '';
-
-  # Upstream ships AOSP build files and a gcc/ makefile that only knows
-  # about the in-tree layout. Compile and link directly; the entire
-  # library is two umbrella translation units.
-  buildPhase = ''
-    runHook preBuild
-
-    soname=libldacBT_dec.so.${lib.versions.major finalAttrs.version}
-    sofile=libldacBT_dec.so.${finalAttrs.version}
-
-    $CC -shared -Wl,-soname,$soname src/ldaclib.c src/ldacBT.c -lm -o $sofile
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 -t $out/lib $sofile
-    ln -s $sofile $out/lib/$soname
-    ln -s $sofile $out/lib/libldacBT_dec.so
-
-    install -Dm644 inc/ldacBT.h $dev/include/ldac/ldacBT.h
-
-    mkdir -p $dev/lib/pkgconfig
-    cat > $dev/lib/pkgconfig/ldacBT-dec.pc <<EOF
-    prefix=$out
-    exec_prefix=\''${prefix}
-    libdir=$out/lib
-    includedir=$dev/include/ldac
-
-    Name: ldacBT-dec
-    Description: LDAC Bluetooth decoder
-    Version: ${finalAttrs.version}
-    Libs: -L\''${libdir} -lldacBT_dec
-    Libs.private: -lm
-    Cflags: -I\''${includedir}
-    EOF
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Sony LDAC Bluetooth decoder library (from AOSP via open-vela)";
-    homepage = "https://github.com/open-vela/external_libldac";
-    license = lib.licenses.asl20;
-    # LDAC bitstream format assumes LE; source has endian checks
-    platforms = lib.platforms.littleEndian;
-    maintainers = with lib.maintainers; [ qweered ];
-  };
-})

From 67b7303494c3e9d2e34f81adbb2eaefc3300adfb Mon Sep 17 00:00:00 2001
From: Yuxuan Shui <yshuiv7@gmail.com>
Date: Mon, 1 Jun 2026 08:19:33 +0100
Subject: [PATCH 471/831] pipewire: remove the ldacBtDecodeSupport option

Always enable it if ldac is available.
---
 pkgs/by-name/pi/pipewire/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 7f5ff1315146..cd01b173b031 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -73,7 +73,6 @@
     x11Support
     && lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform
     && lib.meta.availableOn stdenv.hostPlatform ffado,
-  ldacBtDecodeSupport ? false,
   ffado,
   libselinux,
   libebur128,
@@ -243,7 +242,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "bluez5-codec-lc3plus" false)
     (lib.mesonEnable "bluez5-codec-lc3" bluezSupport)
     (lib.mesonEnable "bluez5-codec-ldac" (bluezSupport && ldacbtSupport))
-    (lib.mesonEnable "bluez5-codec-ldac-dec" (bluezSupport && ldacbtSupport && ldacBtDecodeSupport))
+    (lib.mesonEnable "bluez5-codec-ldac-dec" (bluezSupport && ldacbtSupport))
     (lib.mesonEnable "opus" true)
     (lib.mesonOption "sysconfdir" "/etc")
     (lib.mesonEnable "raop" raopSupport)

From b68c3b9b4d57cb70a18433316f8887fecc315d91 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 07:56:09 -0700
Subject: [PATCH 472/831] ibus: 1.5.33 -> 1.5.34

Diff: https://github.com/ibus/ibus/compare/1.5.33...1.5.34

Changelog: https://github.com/ibus/ibus/releases/tag/1.5.34
---
 pkgs/tools/inputmethods/ibus/default.nix            |  6 ++----
 pkgs/tools/inputmethods/ibus/vala-parallelism.patch | 13 -------------
 2 files changed, 2 insertions(+), 17 deletions(-)
 delete mode 100644 pkgs/tools/inputmethods/ibus/vala-parallelism.patch

diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 8e8502ff557a..b164f6ead3a7 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -67,13 +67,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ibus";
-  version = "1.5.33";
+  version = "1.5.34";
 
   src = fetchFromGitHub {
     owner = "ibus";
     repo = "ibus";
     tag = finalAttrs.version;
-    hash = "sha256-cpNZI6KbL9zUJHw1szpWl4lOEAvlBdd+FA6xGh1sYYY=";
+    hash = "sha256-MCxzMnG+g2FC4pZtDOP2c7vSRG5Zk6EfrkGnEyFvBfQ=";
   };
 
   patches = [
@@ -88,8 +88,6 @@ stdenv.mkDerivation (finalAttrs: {
       PYTHON = null;
     })
     ./build-without-dbus-launch.patch
-    # https://github.com/NixOS/nixpkgs/issues/230290
-    ./vala-parallelism.patch
   ];
 
   outputs = [
diff --git a/pkgs/tools/inputmethods/ibus/vala-parallelism.patch b/pkgs/tools/inputmethods/ibus/vala-parallelism.patch
deleted file mode 100644
index f4c47a76c39c..000000000000
--- a/pkgs/tools/inputmethods/ibus/vala-parallelism.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/ui/gtk3/Makefile.am b/ui/gtk3/Makefile.am
-index 3ada6501..2066a8f5 100644
---- a/ui/gtk3/Makefile.am
-+++ b/ui/gtk3/Makefile.am
-@@ -304,6 +304,8 @@ panelbinding.o: $(srcdir)/panelbinding.c
- 	$(AM_V_CC_no)$(COMPILE) -c -o $@ $<
- 	$(NULL)
- 
-+.NOTPARALLEL:
-+
- MAINTAINERCLEANFILES += extension.c panelbinding.c
- 
- man_seven_DATA = ibus-emoji.7

From 17cca6ef4b16679ac17fdf407ccf4ba730cb1621 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 11:00:21 -0700
Subject: [PATCH 473/831] python3Packages.ipython: 9.9.0 -> 9.14.0

Changelog: https://github.com/ipython/ipython/blob/9.14.0/docs/source/whatsnew/version9.rst
---
 .../python-modules/ipython/default.nix         | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/ipython/default.nix b/pkgs/development/python-modules/ipython/default.nix
index 556b9a91e21f..9d9e1d227c5b 100644
--- a/pkgs/development/python-modules/ipython/default.nix
+++ b/pkgs/development/python-modules/ipython/default.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
-  pythonAtLeast,
   pythonOlder,
 
   # Build dependencies
@@ -16,6 +15,7 @@
   matplotlib-inline,
   pexpect,
   prompt-toolkit,
+  psutil,
   pygments,
   stack-data,
   traitlets,
@@ -36,7 +36,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ipython";
-  version = "9.9.0";
+  version = "9.14.0";
   outputs = [
     "out"
     "man"
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-SPvtGy3l4scXfu+hRKun/LgtrFFPCbV+KsnaNN21QiA=";
+    hash = "sha256-byf/Dx2eoFDgVR9xVovEs02KuleejxEcW0F19ErGtKo=";
   };
 
   build-system = [ setuptools ];
@@ -57,6 +57,7 @@ buildPythonPackage (finalAttrs: {
     matplotlib-inline
     pexpect
     prompt-toolkit
+    psutil
     pygments
     stack-data
     traitlets
@@ -84,16 +85,7 @@ buildPythonPackage (finalAttrs: {
     testpath
   ];
 
-  disabledTests = [
-    # UnboundLocalError: local variable 'child' referenced before assignment
-    "test_system_interrupt"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.13") [
-    # AttributeError: 'Pdb' object has no attribute 'curframe'. Did you mean: 'botframe'?
-    "test_run_debug_twice"
-    "test_run_debug_twice_with_breakpoint"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+  disabledTests = lib.optionals (stdenv.hostPlatform.isDarwin) [
     # FileNotFoundError: [Errno 2] No such file or directory: 'pbpaste'
     "test_clipboard_get"
   ];

From 5a913250424c829e00c300968eefb71f5865d852 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 11:38:44 -0700
Subject: [PATCH 474/831] krb5: 1.22.1 -> 1.22.2

Changelog: https://web.mit.edu/Kerberos/krb5-1.22/
---
 pkgs/by-name/kr/krb5/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kr/krb5/package.nix b/pkgs/by-name/kr/krb5/package.nix
index 0b504c6dc8a6..3c402ff11721 100644
--- a/pkgs/by-name/kr/krb5/package.nix
+++ b/pkgs/by-name/kr/krb5/package.nix
@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krb5";
-  version = "1.22.1";
+  version = "1.22.2";
 
   __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://kerberos.org/dist/krb5/${lib.versions.majorMinor finalAttrs.version}/krb5-${finalAttrs.version}.tar.gz";
-    hash = "sha256-GogyuMrZI+u/E5T2fi789B46SfRgKFpm41reyPoAU68=";
+    hash = "sha256-MkP/vI6k1Kwi3cfdKh3FTFeHTEBki2D/lwCXY1VOrxM=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isFreeBSD [
@@ -170,6 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    changelog = "https://web.mit.edu/Kerberos/krb5-${lib.versions.majorMinor finalAttrs.version}/";
     description = "MIT Kerberos 5";
     homepage = "http://web.mit.edu/kerberos/";
     license = lib.licenses.mit;

From 857aca1e78b13278e34b95205aafd6ef757f4c78 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 24 May 2026 15:56:33 +0100
Subject: [PATCH 475/831] hyphen: 2.8.8 -> 2.8.9, switch to github

`hyphen` moved releases and repository to `github`. Switch source fetch
there and slightly refresh the derivation.

Co-authored-by: dotlambda <github@dotlambda.de>
---
 pkgs/development/libraries/hyphen/default.nix | 43 +++++++++----------
 1 file changed, 21 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/libraries/hyphen/default.nix b/pkgs/development/libraries/hyphen/default.nix
index 214149fc1f23..1be6ebb50247 100644
--- a/pkgs/development/libraries/hyphen/default.nix
+++ b/pkgs/development/libraries/hyphen/default.nix
@@ -1,33 +1,31 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
+  autoreconfHook,
   perl,
 }:
 
-let
-  version = "2.8.8";
-  folder =
-    with builtins;
-    let
-      parts = splitVersion version;
-    in
-    concatStringsSep "." [
-      (elemAt parts 0)
-      (elemAt parts 1)
-    ];
-in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hyphen";
-  inherit version;
+  version = "2.8.9";
 
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+  ];
 
-  src = fetchurl {
-    url = "https://sourceforge.net/projects/hunspell/files/Hyphen/${folder}/${pname}-${version}.tar.gz";
-    sha256 = "01ap9pr6zzzbp4ky0vy7i1983fwyqy27pl0ld55s30fdxka3ciih";
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "hunspell";
+    repo = "hyphen";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-F7PJQjEiE5t5i1gi5B8wzrwAJQl8FWzopRA8uDsaZBc=";
   };
 
+  enableParallelBuilding = true;
+
   # Do not install the en_US dictionary.
   installPhase = ''
     runHook preInstall
@@ -36,14 +34,15 @@ stdenv.mkDerivation rec {
     make install-includeHEADERS
 
     # license
-    install -D -m644 COPYING "$out/share/licenses/${pname}/LICENSE"
+    install -D -m644 COPYING "$out/share/licenses/hyphen/LICENSE"
     runHook postInstall
   '';
 
   meta = {
+    changelog = "https://github.com/hunspell/hyphen/blob/${finalAttrs.src.tag}/NEWS";
     description = "Text hyphenation library";
     mainProgram = "substrings.pl";
-    homepage = "https://sourceforge.net/projects/hunspell/files/Hyphen/";
+    homepage = "https://github.com/hunspell/hyphen";
     platforms = lib.platforms.all;
     license = with lib.licenses; [
       gpl2
@@ -51,4 +50,4 @@ stdenv.mkDerivation rec {
       mpl11
     ];
   };
-}
+})

From 783b53f760b46e44e1cf98dd94018566030b67c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 13:04:11 -0700
Subject: [PATCH 476/831] python3Packages.aiohttp: 3.13.5 -> 3.14.0

Diff: https://github.com/aio-libs/aiohttp/compare/v3.13.5...v3.14.0

Changelog: https://docs.aiohttp.org/en/v3.14.0/changes.html
---
 pkgs/development/python-modules/aiohttp/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 9b76c5565090..b9c21b556fc3 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -50,14 +50,14 @@
 
 buildPythonPackage rec {
   pname = "aiohttp";
-  version = "3.13.5";
+  version = "3.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
     tag = "v${version}";
-    hash = "sha256-bAP1/a2COHbe+39KY3GHXSo1Iq9x9xX8O2mLhmFlMlE=";
+    hash = "sha256-RRXdDDkQlL7erfYgs4+gSy6GMlVUG7PrDLTQBYJJ1To=";
   };
 
   postPatch = ''
@@ -68,6 +68,10 @@ buildPythonPackage rec {
     # don't install Cython using pip
     substituteInPlace Makefile \
       --replace-fail "cythonize: .install-cython" "cythonize:"
+
+    # don't depend on coverage for tests
+    substituteInPlace setup.cfg \
+      --replace-fail "ignore:Couldn't import C tracer:coverage.exceptions.CoverageWarning" ""
   '';
 
   build-system = [

From a5069b2b356a49d168890e5a25417a068f9ed7e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 13:06:00 -0700
Subject: [PATCH 477/831] python3Packages.aiohttp: use finalAttrs

---
 pkgs/development/python-modules/aiohttp/default.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index b9c21b556fc3..06844833573d 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -41,6 +41,7 @@
   pytest-codspeed,
   pytest-cov-stub,
   pytest-mock,
+  pytest-timeout,
   pytest-xdist,
   pytestCheckHook,
   re-assert,
@@ -48,7 +49,7 @@
   zlib-ng,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiohttp";
   version = "3.14.0";
   pyproject = true;
@@ -56,7 +57,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-RRXdDDkQlL7erfYgs4+gSy6GMlVUG7PrDLTQBYJJ1To=";
   };
 
@@ -99,7 +100,7 @@ buildPythonPackage rec {
     propcache
     yarl
   ]
-  ++ optional-dependencies.speedups;
+  ++ finalAttrs.passthru.optional-dependencies.speedups;
 
   optional-dependencies.speedups = [
     aiodns
@@ -119,6 +120,7 @@ buildPythonPackage rec {
     pytest-codspeed
     pytest-cov-stub
     pytest-mock
+    pytest-timeout
     pytest-xdist
     pytestCheckHook
     re-assert
@@ -167,10 +169,10 @@ buildPythonPackage rec {
   '';
 
   meta = {
-    changelog = "https://docs.aiohttp.org/en/${src.tag}/changes.html";
+    changelog = "https://docs.aiohttp.org/en/${finalAttrs.src.tag}/changes.html";
     description = "Asynchronous HTTP Client/Server for Python and asyncio";
     license = lib.licenses.asl20;
     homepage = "https://github.com/aio-libs/aiohttp";
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

From 4e5b779a751ed42eeb168c661a00e69b9c6b1a7f Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Mon, 1 Jun 2026 18:46:47 -0700
Subject: [PATCH 478/831] nixos/test-driver: rework timeout for
 wait_for_console_text

Before this commit, `wait_for_console_text` would read one line every
900ms before trying again to read the next line.

This commit fixes that behavior by greedily reading all buffer that is
available for match trying to find a match rather than reading one per
retry iteration.

In effect this moves the loop inside the `console_matches` helper and
makes the behavior of `wait_for_console_text` with timeout behave the
same way as with timeout.

This also provides a test that showcases the problem.
---
 .../src/test_driver/machine/__init__.py       | 21 ++++++++-------
 nixos/tests/all-tests.nix                     |  1 +
 .../nixos-test-driver/console-timeout.nix     | 26 +++++++++++++++++++
 3 files changed, 38 insertions(+), 10 deletions(-)
 create mode 100644 nixos/tests/nixos-test-driver/console-timeout.nix

diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
index db96445af912..0331e297a8a6 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py
@@ -1164,24 +1164,25 @@ class QemuMachine(BaseMachine):
         # to match multiline regexes.
         console = io.StringIO()
 
-        def console_matches(_last_try: bool) -> bool:
+        def console_matches(_last_try: bool, block: bool = False) -> bool:
             nonlocal console
             try:
-                # This will return as soon as possible and
-                # sleep 1 second.
-                console.write(self.last_lines.get(block=False))
+                while True:
+                    # This will return as soon as possible and
+                    # sleep 1 second.
+                    console.write(self.last_lines.get(block=block))
+                    console.seek(0)
+                    matches = re.search(regex, console.read())
+                    if matches is not None:
+                        return True
             except queue.Empty:
-                pass
-            console.seek(0)
-            matches = re.search(regex, console.read())
-            return matches is not None
+                return False
 
         with self.nested(f"waiting for {regex} to appear on console"):
             if timeout is not None:
                 retry(console_matches, timeout)
             else:
-                while not console_matches(False):
-                    pass
+                console_matches(False, block=True)
 
     def get_console_log(self) -> str:
         """
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a4c63fcbc368..32f63661803f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -153,6 +153,7 @@ in
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
     skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
+    console-timeout = runTest ./nixos-test-driver/console-timeout.nix;
     options-doc-regression = import ./nixos-test-driver/options-doc-regression.nix { inherit pkgs; };
     driver-timeout =
       pkgs.runCommand "ensure-timeout-induced-failure"
diff --git a/nixos/tests/nixos-test-driver/console-timeout.nix b/nixos/tests/nixos-test-driver/console-timeout.nix
new file mode 100644
index 000000000000..504f4504bf9d
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/console-timeout.nix
@@ -0,0 +1,26 @@
+{ pkgs, lib, ... }:
+{
+  name = "console-timeout";
+
+  nodes.machine = {
+    systemd.services.generate-output.script = ''
+      echo "match that"
+      sleep 1
+
+      for i in $(seq 15); do
+        echo "line $i"
+      done
+
+      echo "match this"
+    '';
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+
+    machine.systemctl("start generate-output")
+    machine.wait_for_console_text("match that")
+    machine.wait_for_console_text("match this", timeout=10)
+  '';
+}

From 8d6931faca5c74caec9d5d667cdca019fc9bd76a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 21:18:59 -0700
Subject: [PATCH 479/831] libcbor: add meta.changelog

---
 pkgs/by-name/li/libcbor/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libcbor/package.nix b/pkgs/by-name/li/libcbor/package.nix
index f4a3790f9bbe..5b26d0db9e12 100644
--- a/pkgs/by-name/li/libcbor/package.nix
+++ b/pkgs/by-name/li/libcbor/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "PJK";
     repo = "libcbor";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-zjajNtj4jKbt3pLjfLrgtYljyMDYJtnzAC5JPdt+Wys=";
   };
 
@@ -61,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    changelog = "https://github.com/PJK/libcbor/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "CBOR protocol implementation for C and others";
     homepage = "https://github.com/PJK/libcbor";
     license = lib.licenses.mit;

From 3c057b8e22a14e82a0899ad65542d32a72277fa1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 22:18:32 -0700
Subject: [PATCH 480/831] libconfig: 1.8 -> 1.8.2

Changelog: https://github.com/hyperrealm/libconfig/blob/v1.8.2/ChangeLog
---
 pkgs/by-name/li/libconfig/package.nix | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/li/libconfig/package.nix b/pkgs/by-name/li/libconfig/package.nix
index 0da2905d7725..d0c737104160 100644
--- a/pkgs/by-name/li/libconfig/package.nix
+++ b/pkgs/by-name/li/libconfig/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   # This also disables building tests.
   # on static windows cross-compile they fail to build
   doCheck ? with stdenv.hostPlatform; !(isWindows && isStatic),
@@ -10,24 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libconfig";
-  version = "1.8";
+  version = "1.8.2";
 
   src = fetchurl {
     url = "https://hyperrealm.github.io/libconfig/dist/libconfig-${finalAttrs.version}.tar.gz";
-    hash = "sha256-BR4V3Q6QfESQXzF5M/VIcxTypW6MZybIMEzpkIhIUKo=";
+    hash = "sha256-5Z/7kC3Vcx1dTk+4HTuYlpdhX+q3Lf18MGGBZ7kaQu4=";
   };
 
-  patches = [
-    # Fix tests on i686-linux:
-    #   https://github.com/hyperrealm/libconfig/pull/260
-    # TODO: remove with a next release
-    (fetchpatch {
-      name = "32-bit-tests.patch";
-      url = "https://github.com/hyperrealm/libconfig/commit/b90c45a18110fcca415d00a98ff79c908c42544b.patch";
-      hash = "sha256-8CihXbpKx0Rn0CFxyP6+f6m8vUYehCl/1EtTo98VpfM=";
-    })
-  ];
-
   inherit doCheck;
 
   configureFlags =
@@ -38,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://hyperrealm.github.io/libconfig/";
+    changelog = "https://github.com/hyperrealm/libconfig/blob/v${finalAttrs.version}/ChangeLog";
     description = "C/C++ library for processing configuration files";
     license = lib.licenses.lgpl3;
     maintainers = with lib.maintainers; [ stv0g ];

From eb64ffdbce253915ec1e43f6f055cfbbab87d586 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 1 Jun 2026 22:25:35 -0700
Subject: [PATCH 481/831] libde265: 1.0.19 -> 1.1.0

Diff: https://github.com/strukturag/libde265/compare/v1.0.19...v1.1.0

Changelog: https://github.com/strukturag/libde265/releases/tag/v1.1.0
---
 pkgs/by-name/li/libde265/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libde265/package.nix b/pkgs/by-name/li/libde265/package.nix
index 65121864428c..80293886a1e1 100644
--- a/pkgs/by-name/li/libde265/package.nix
+++ b/pkgs/by-name/li/libde265/package.nix
@@ -15,14 +15,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.0.19";
+  version = "1.1.0";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-77OIclR2TwOigo/k5ps9S0TrDNvEjf290PqZyqBcydo=";
+    hash = "sha256-QhBi23HttVdIJCueSeKj3ZKwqX1iFcuAX7GmnMRCyN8=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/strukturag/libde265";
+    changelog = "https://github.com/strukturag/libde265/releases/tag/${finalAttrs.src.tag}";
     description = "Open h.265 video codec implementation";
     mainProgram = "dec265";
     license = lib.licenses.lgpl3;

From 55b813b5d77c96dce549930e1449e902839a1bad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Silva?= <andrerfosilva@gmail.com>
Date: Fri, 29 May 2026 10:01:50 +0100
Subject: [PATCH 482/831] rustPlatform.fetchCargoVendor: remove duplicate
 fetcher

---
 .../rust/fetch-cargo-vendor-util-v2.py        | 416 ------------------
 .../rust/fetch-cargo-vendor-util.py           |   5 +-
 .../build-support/rust/fetch-cargo-vendor.nix |  39 +-
 3 files changed, 18 insertions(+), 442 deletions(-)
 delete mode 100644 pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py b/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
deleted file mode 100644
index 5dc789c93ad9..000000000000
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
+++ /dev/null
@@ -1,416 +0,0 @@
-import functools
-import hashlib
-import json
-import multiprocessing as mp
-import re
-import shutil
-import subprocess
-import sys
-import tomllib
-from os.path import islink, realpath
-from pathlib import Path
-from typing import Any, TypedDict, cast
-from urllib.parse import unquote
-
-import requests
-import tomli_w
-from requests.adapters import HTTPAdapter, Retry
-
-eprint = functools.partial(print, file=sys.stderr)
-
-
-def load_toml(path: Path) -> dict[str, Any]:
-    with open(path, "rb") as f:
-        return tomllib.load(f)
-
-
-def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
-    # lockfile v1 and v2 don't have the `version` key, so assume v2
-    version = cargo_lock_toml.get("version", 2)
-
-    # TODO: add logic for differentiating between v1 and v2
-
-    return version
-
-
-def create_http_session() -> requests.Session:
-    retries = Retry(
-        total=5,
-        backoff_factor=0.5,
-        status_forcelist=[500, 502, 503, 504]
-    )
-    session = requests.Session()
-    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
-    session.mount('http://', HTTPAdapter(max_retries=retries))
-    session.mount('https://', HTTPAdapter(max_retries=retries))
-    return session
-
-
-def download_file_with_checksum(session: requests.Session, url: str, destination_path: Path) -> str:
-    sha256_hash = hashlib.sha256()
-    with session.get(url, stream=True) as response:
-        if not response.ok:
-            raise Exception(f"Failed to fetch file from {url}. Status code: {response.status_code}")
-        with open(destination_path, "wb") as file:
-            for chunk in response.iter_content(1024):  # Download in chunks
-                if chunk:  # Filter out keep-alive chunks
-                    file.write(chunk)
-                    sha256_hash.update(chunk)
-
-    # Compute the final checksum
-    checksum = sha256_hash.hexdigest()
-    return checksum
-
-
-def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
-    # TODO: support other registries
-    #       maybe fetch config.json from the registry root and get the dl key
-    #       See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-    if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
-        raise Exception("Only the default crates.io registry is supported.")
-
-    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
-    # rate limit on the API servers.
-    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
-
-
-def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
-
-    url = get_download_url_for_tarball(pkg)
-    filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-    # TODO: allow legacy checksum specification, see importCargoLock for example
-    #       also, don't forget about the other usage of the checksum
-    expected_checksum = pkg["checksum"]
-
-    tarball_out_dir = out_dir / "tarballs" / filename
-    eprint(f"Fetching {url} -> tarballs/{filename}")
-
-    calculated_checksum = download_file_with_checksum(session, url, tarball_out_dir)
-
-    if calculated_checksum != expected_checksum:
-        raise Exception(f"Hash mismatch! File fetched from {url} had checksum {calculated_checksum}, expected {expected_checksum}.")
-
-
-def download_git_tree(url: str, git_sha_rev: str, out_dir: Path) -> None:
-
-    tree_out_dir = out_dir / "git" / git_sha_rev
-    eprint(f"Fetching {url}#{git_sha_rev} -> git/{git_sha_rev}")
-
-    cmd = ["nix-prefetch-git", "--builder", "--quiet", "--fetch-submodules", "--url", url, "--rev", git_sha_rev, "--out", str(tree_out_dir)]
-    subprocess.check_output(cmd)
-
-
-GIT_SOURCE_REGEX = re.compile("git\\+(?P<url>[^?]+)(\\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
-
-
-class GitSourceInfo(TypedDict):
-    url: str
-    type: str | None
-    value: str | None
-    git_sha_rev: str
-
-
-def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
-    match = GIT_SOURCE_REGEX.match(source)
-    if match is None:
-        raise Exception(f"Unable to process git source: {source}.")
-
-    source_info = cast(GitSourceInfo, match.groupdict(default=None))
-
-    # the source URL is URL-encoded in lockfile_version >=4
-    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
-    if lockfile_version >= 4 and source_info["value"] is not None:
-        source_info["value"] = unquote(source_info["value"])
-
-    return source_info
-
-
-def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    git_packages: list[dict[str, Any]] = []
-    registry_packages: list[dict[str, Any]] = []
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            eprint(f"Skipping local dependency: {pkg["name"]}")
-            continue
-        source = pkg["source"]
-
-        if source.startswith("git+"):
-            git_packages.append(pkg)
-        elif source.startswith("registry+"):
-            registry_packages.append(pkg)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-    git_sha_rev_to_url: dict[str, str] = {}
-    for pkg in git_packages:
-        source_info = parse_git_source(pkg["source"], lockfile_version)
-        git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
-
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    # fetch git trees sequentially, since fetching concurrently leads to flaky behaviour
-    if len(git_packages) != 0:
-        (out_dir / "git").mkdir()
-        for git_sha_rev, url in git_sha_rev_to_url.items():
-            download_git_tree(url, git_sha_rev, out_dir)
-
-    # run tarball download jobs in parallel, with at most 5 concurrent download jobs
-    with mp.Pool(min(5, mp.cpu_count())) as pool:
-        if len(registry_packages) != 0:
-            (out_dir / "tarballs").mkdir()
-            session = create_http_session()
-            tarball_args_gen = ((session, pkg, out_dir) for pkg in registry_packages)
-            pool.starmap(download_tarball, tarball_args_gen)
-
-
-def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
-    cmd = ["cargo", "metadata", "--format-version", "1", "--no-deps", "--manifest-path", str(manifest_path)]
-    output = subprocess.check_output(cmd)
-    return json.loads(output)
-
-
-def try_get_crate_manifest_path_from_manifest_path(manifest_path: Path, crate_name: str) -> Path | None:
-    try:
-        metadata = get_manifest_metadata(manifest_path)
-    except subprocess.CalledProcessError:
-        eprint(f"Warning: cargo metadata failed for {manifest_path}, skipping")
-        return None
-
-    for pkg in metadata["packages"]:
-        if pkg["name"] == crate_name:
-            return Path(pkg["manifest_path"])
-
-    return None
-
-
-def find_crate_manifest_in_tree(tree: Path, crate_name: str) -> Path:
-    # Scan all Cargo.toml files; sort by depth/path to make ordering deterministic
-    # and prefer less-nested manifests first.
-    manifest_paths = sorted(
-        tree.glob("**/Cargo.toml"),
-        key=lambda path: (len(path.parts), str(path)),
-    )
-
-    for manifest_path in manifest_paths:
-        res = try_get_crate_manifest_path_from_manifest_path(manifest_path, crate_name)
-        if res is not None:
-            return res
-
-    raise Exception(f"Couldn't find manifest for crate {crate_name} inside {tree}.")
-
-
-def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_dir: Path) -> None:
-
-    # This function will get called by copytree to decide which entries of a directory should be copied
-    # We'll copy everything except symlinks that are invalid
-    def ignore_func(dir_str: str, path_strs: list[str]) -> list[str]:
-        ignorelist: list[str] = []
-
-        dir = Path(realpath(dir_str, strict=True))
-
-        for path_str in path_strs:
-            path = dir / path_str
-            if not islink(path):
-                continue
-
-            # Filter out cyclic symlinks and symlinks pointing at nonexistant files
-            try:
-                target_path = Path(realpath(path, strict=True))
-            except OSError:
-                ignorelist.append(path_str)
-                eprint(f"Failed to resolve symlink, ignoring: {path}")
-                continue
-
-            # Filter out symlinks that point outside of the current crate's base git tree
-            # This can be useful if the nix build sandbox is turned off and there is a symlink to a common absolute path
-            if not target_path.is_relative_to(git_tree):
-                ignorelist.append(path_str)
-                eprint(f"Symlink points outside of the crate's base git tree, ignoring: {path} -> {target_path}")
-                continue
-
-        return ignorelist
-
-    crate_manifest_path = find_crate_manifest_in_tree(git_tree, crate_name)
-    crate_tree = crate_manifest_path.parent
-
-    eprint(f"Copying to {crate_out_dir}")
-    shutil.copytree(crate_tree, crate_out_dir, ignore=ignore_func)
-    crate_out_dir.chmod(0o755)
-
-    with open(crate_manifest_path, "r") as f:
-        manifest_data = f.read()
-
-    if "workspace" in manifest_data:
-        crate_manifest_metadata = get_manifest_metadata(crate_manifest_path)
-        workspace_root = Path(crate_manifest_metadata["workspace_root"])
-
-        root_manifest_path = workspace_root / "Cargo.toml"
-        manifest_path = crate_out_dir / "Cargo.toml"
-
-        manifest_path.chmod(0o644)
-        eprint(f"Patching {manifest_path}")
-
-        cmd = ["replace-workspace-values", str(manifest_path), str(root_manifest_path)]
-        subprocess.check_output(cmd)
-
-
-def extract_crate_tarball_contents(tarball_path: Path, crate_out_dir: Path) -> None:
-    eprint(f"Unpacking to {crate_out_dir}")
-    crate_out_dir.mkdir()
-    cmd = ["tar", "xf", str(tarball_path), "-C", str(crate_out_dir), "--strip-components=1"]
-    subprocess.check_output(cmd)
-
-
-def make_git_source_selector(source_info: GitSourceInfo) -> dict[str, str]:
-    selector = {}
-    selector["git"] = source_info["url"]
-    if source_info["type"] is not None:
-        selector[source_info["type"]] = source_info["value"]
-    return selector
-
-
-def make_registry_source_selector(source: str) -> dict[str, str]:
-    registry = source[9:] if source.startswith("registry+") else source
-    selector = {}
-    selector["registry"] = registry
-    return selector
-
-
-def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
-    lockfile_path = vendor_staging_dir / "Cargo.lock"
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    source_to_ind: dict[str, str] = {}
-    source_config = {}
-    next_registry_ind = 0
-    next_git_ind = 0
-
-    def add_source_replacement(
-        orig_key: str,
-        orig_selector: dict[str, str],
-        vendored_key: str,
-        vendored_dir: str
-    ) -> None:
-        source_config[vendored_key] = {}
-        source_config[vendored_key]["directory"] = vendored_dir
-        source_config[orig_key] = orig_selector
-        source_config[orig_key]["replace-with"] = vendored_key
-
-    # we reserve registry index 0 for crates-io
-    source_to_ind["registry+https://github.com/rust-lang/crates.io-index"] = "registry-0"
-    source_to_ind["sparse+https://index.crates.io/"] = "registry-0"
-    add_source_replacement(
-        orig_key="crates-io",
-        orig_selector={},  # there is an internal selector defined for the `crates-io` source
-        vendored_key="vendored-source-registry-0",
-        vendored_dir="@vendor@/source-registry-0"
-    )
-    next_registry_ind += 1
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependencies
-        if "source" not in pkg.keys():
-            continue
-        source: str = pkg["source"]
-        if source in source_to_ind:
-            continue
-
-        if source.startswith("git+"):
-            ind = f"git-{next_git_ind}"
-            next_git_ind += 1
-            source_info = parse_git_source(source, lockfile_version)
-            selector = make_git_source_selector(source_info)
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            ind = f"registry-{next_registry_ind}"
-            next_registry_ind += 1
-            selector = make_registry_source_selector(source)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-        source_to_ind[source] = ind
-        add_source_replacement(
-            orig_key=f"original-source-{ind}",
-            orig_selector=selector,
-            vendored_key=f"vendored-source-{ind}",
-            vendored_dir=f"@vendor@/source-{ind}"
-        )
-
-    config_path = out_dir / ".cargo" / "config.toml"
-    config_path.parent.mkdir()
-
-    with open(config_path, "wb") as config_file:
-        tomli_w.dump({"source": source_config}, config_file)
-
-    for pkg in cargo_lock_toml["package"]:
-
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            continue
-
-        source: str = pkg["source"]
-        source_ind = source_to_ind[source]
-        crate_dir_name = f"{pkg["name"]}-{pkg["version"]}"
-        source_dir_name = f"source-{source_ind}"
-        crate_out_dir = out_dir / source_dir_name / crate_dir_name
-        crate_out_dir.parent.mkdir(exist_ok=True)
-
-        if source.startswith("git+"):
-
-            source_info = parse_git_source(source, lockfile_version)
-
-            git_sha_rev = source_info["git_sha_rev"]
-            git_tree = vendor_staging_dir / "git" / git_sha_rev
-
-            copy_and_patch_git_crate_subtree(git_tree, pkg["name"], crate_out_dir)
-
-            # git based crates allow having no checksum information
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}}, f)
-
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-            # TODO: change this when non-crates-io registries are supported
-            dir_name = "tarballs"
-
-            tarball_path = vendor_staging_dir / dir_name / filename
-
-            extract_crate_tarball_contents(tarball_path, crate_out_dir)
-
-            # non-git based crates need the package checksum at minimum
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}, "package": pkg["checksum"]}, f)
-
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-
-def main() -> None:
-    subcommand = sys.argv[1]
-
-    subcommand_func_dict = {
-        "create-vendor-staging": lambda: create_vendor_staging(lockfile_path=Path(sys.argv[2]), out_dir=Path(sys.argv[3])),
-        "create-vendor": lambda: create_vendor(vendor_staging_dir=Path(sys.argv[2]), out_dir=Path(sys.argv[3]))
-    }
-
-    subcommand_func = subcommand_func_dict.get(subcommand)
-
-    if subcommand_func is None:
-        raise Exception(f"Unknown subcommand: '{subcommand}'. Must be one of {list(subcommand_func_dict.keys())}")
-
-    subcommand_func()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 3bee7e150c8e..5dc789c93ad9 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -40,6 +40,7 @@ def create_http_session() -> requests.Session:
         status_forcelist=[500, 502, 503, 504]
     )
     session = requests.Session()
+    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
     session.mount('http://', HTTPAdapter(max_retries=retries))
     session.mount('https://', HTTPAdapter(max_retries=retries))
     return session
@@ -68,7 +69,9 @@ def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
     if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
         raise Exception("Only the default crates.io registry is supported.")
 
-    return f"https://crates.io/api/v1/crates/{pkg["name"]}/{pkg["version"]}/download"
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers.
+    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
 
 
 def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 2802bf9e73f1..8d554a8dc3e2 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -37,29 +37,18 @@ let
     "hash"
   ];
 
-  mkFetchCargoVendorUtil =
-    name: src:
-    writers.writePython3Bin name {
-      libraries =
-        with python3Packages;
-        [
-          requests
-          tomli-w
-        ]
-        ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
-      flakeIgnore = [
-        "E501"
-      ];
-    } (builtins.readFile src);
-
-  # Separate util used only by the FOD `vendorStaging` stage below. Kept
-  # distinct from fetchCargoVendorUtil so that changes to the network-facing
-  # bits (User-Agent, download URL) don't invalidate the input-addressed
-  # `-vendor` stage and force a mass rebuild of every Rust package in nixpkgs.
-  # vendorStaging is an FOD, so swapping its util is free for consumers.
-  # TODO: unify with fetchCargoVendorUtil on the next `staging` cycle.
-  fetchCargoVendorUtilV2 = mkFetchCargoVendorUtil "fetch-cargo-vendor-util-v2" ./fetch-cargo-vendor-util-v2.py;
-  fetchCargoVendorUtil = mkFetchCargoVendorUtil "fetch-cargo-vendor-util" ./fetch-cargo-vendor-util.py;
+  fetchCargoVendorUtil = writers.writePython3Bin "fetch-cargo-vendor-util" {
+    libraries =
+      with python3Packages;
+      [
+        requests
+        tomli-w
+      ]
+      ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
+    flakeIgnore = [
+      "E501"
+    ];
+  } (builtins.readFile ./fetch-cargo-vendor-util.py);
 in
 
 {
@@ -79,7 +68,7 @@ let
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
       nativeBuildInputs = [
-        fetchCargoVendorUtilV2
+        fetchCargoVendorUtil
         cacert
         nix-prefetch-git'
       ]
@@ -92,7 +81,7 @@ let
           cd "$cargoRoot"
         fi
 
-        fetch-cargo-vendor-util-v2 create-vendor-staging ./Cargo.lock "$out"
+        fetch-cargo-vendor-util create-vendor-staging ./Cargo.lock "$out"
 
         runHook postBuild
       '';

From 100e23324c871a3b9210bd50c59d4f22e6cc452c Mon Sep 17 00:00:00 2001
From: Cathal Mullan <contact@cathal.dev>
Date: Sat, 21 Mar 2026 16:08:18 +0000
Subject: [PATCH 483/831] rustPlatform.fetchCargoVendor: de-duplicate git
 sources by selector

---
 .../rust/fetch-cargo-vendor-util.py           | 28 +++++++++++++------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 5dc789c93ad9..825f07b175ee 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -292,6 +292,7 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
     lockfile_version = get_lockfile_version(cargo_lock_toml)
 
     source_to_ind: dict[str, str] = {}
+    selector_to_ind: dict[tuple, str] = {}
     source_config = {}
     next_registry_ind = 0
     next_git_ind = 0
@@ -327,24 +328,35 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
             continue
 
         if source.startswith("git+"):
-            ind = f"git-{next_git_ind}"
-            next_git_ind += 1
             source_info = parse_git_source(source, lockfile_version)
             selector = make_git_source_selector(source_info)
+            selector_key = (source_info["url"], source_info["type"], source_info["value"])
+            if selector_key in selector_to_ind:
+                ind = selector_to_ind[selector_key]
+            else:
+                ind = f"git-{next_git_ind}"
+                next_git_ind += 1
+                selector_to_ind[selector_key] = ind
+                add_source_replacement(
+                    orig_key=f"original-source-{ind}",
+                    orig_selector=selector,
+                    vendored_key=f"vendored-source-{ind}",
+                    vendored_dir=f"@vendor@/source-{ind}"
+                )
         elif source.startswith("registry+") or source.startswith("sparse+"):
             ind = f"registry-{next_registry_ind}"
             next_registry_ind += 1
             selector = make_registry_source_selector(source)
+            add_source_replacement(
+                orig_key=f"original-source-{ind}",
+                orig_selector=selector,
+                vendored_key=f"vendored-source-{ind}",
+                vendored_dir=f"@vendor@/source-{ind}"
+            )
         else:
             raise Exception(f"Can't process source: {source}.")
 
         source_to_ind[source] = ind
-        add_source_replacement(
-            orig_key=f"original-source-{ind}",
-            orig_selector=selector,
-            vendored_key=f"vendored-source-{ind}",
-            vendored_dir=f"@vendor@/source-{ind}"
-        )
 
     config_path = out_dir / ".cargo" / "config.toml"
     config_path.parent.mkdir()

From 536f85e8fc0b8bcf2a341b973d2c1eb4c20077cd Mon Sep 17 00:00:00 2001
From: kuflierl <41301536+kuflierl@users.noreply.github.com>
Date: Tue, 2 Jun 2026 15:07:04 +0200
Subject: [PATCH 484/831] libheif: 1.22.2 -> 1.23.0

changelog: https://github.com/strukturag/libheif/releases/tag/v1.23.0
---
 pkgs/by-name/li/libheif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index a24d7986b884..42171d469f5a 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
-  version = "1.22.2";
+  version = "1.23.0";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-z5vTfZATfwDn8Zwqt3piS7PaOQQ3UG+u20sR6j+dsUg=";
+    hash = "sha256-+LbYwDSxixy4TaraUCN2LiCnn32dkMppCA8EOFXbvtg=";
   };
 
   nativeBuildInputs = [

From 8310c133b7c8dfd173a135bdb9ac0b7a7fc6b5e6 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 2 Jun 2026 11:02:48 -0400
Subject: [PATCH 485/831] xvfb: 21.1.22 -> 21.1.23, drop rebuild avoidance

xorg announcement: https://lists.x.org/archives/xorg-announce/2026-June/003703.html
xorg advisory: https://lists.x.org/archives/xorg-announce/2026-June/003702.html
---
 pkgs/by-name/xv/xvfb/package.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix
index d14e35338776..934fade5a795 100644
--- a/pkgs/by-name/xv/xvfb/package.nix
+++ b/pkgs/by-name/xv/xvfb/package.nix
@@ -38,13 +38,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  # TODO: rebuild avoidance. revert on staging.
-  # inherit (xorg-server) src version;
-  version = "21.1.22";
-  src = fetchurl {
-    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-GiQsiRfEm6KczB9gIWE9iiuYBd0NJxpmrp0J9LC7BrM=";
-  };
+  inherit (xorg-server) src version;
 
   strictDeps = true;
 

From a1965737fa449140ba21039ec1e6bca06bb7828b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 2 Jun 2026 18:55:11 +0300
Subject: [PATCH 486/831] qt6.qtdeclarative: patch another upstream bug

---
 .../libraries/qt-6/modules/qtdeclarative/default.nix      | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 2f19e06a67fa..cfcdb5f6c59a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -49,6 +49,14 @@ qtModule {
       url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff";
       hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM=";
     })
+
+    # backport required at least for [musescore][1], and perhaps many other
+    # applications.
+    # [1]: https://github.com/musescore/MuseScore/issues/33015
+    (fetchpatch {
+      url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.diff";
+      hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
+    })
   ];
 
   cmakeFlags = [

From fb17c8b453298170781a86be83f6927e7810ac58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 2 Jun 2026 09:10:55 -0700
Subject: [PATCH 487/831] libdvdcss: 1.4.3 -> 1.5.0

Diff: https://code.videolan.org/videolan/libdvdcss/-/compare/1.4.3...1.5.0

Changelog: https://code.videolan.org/videolan/libdvdcss/blob/1.5.0/NEWS
---
 pkgs/by-name/li/libdvdcss/package.nix | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libdvdcss/package.nix b/pkgs/by-name/li/libdvdcss/package.nix
index 2f57d64b6145..dac50c6c439d 100644
--- a/pkgs/by-name/li/libdvdcss/package.nix
+++ b/pkgs/by-name/li/libdvdcss/package.nix
@@ -1,20 +1,31 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  meson,
+  ninja,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdvdcss";
-  version = "1.4.3";
+  version = "1.5.0";
 
-  src = fetchurl {
-    url = "https://get.videolan.org/libdvdcss/${finalAttrs.version}/libdvdcss-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-IzzJL13AHF06lvWzWCvn1c7lo1pS06CBWHRdPYYHAHk=";
+  src = fetchFromGitLab {
+    domain = "code.videolan.org";
+    owner = "videolan";
+    repo = "libdvdcss";
+    tag = finalAttrs.version;
+    hash = "sha256-xQWfAfxqsaLZN0HMozsqY5mSIO9KvZ5RAb4bj/f6WWo=";
   };
 
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
   meta = {
     homepage = "http://www.videolan.org/developers/libdvdcss.html";
+    changelog = "https://code.videolan.org/videolan/libdvdcss/blob/${finalAttrs.src.tag}/NEWS";
     description = "Library for decrypting DVDs";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;

From 28e00435eaa70225f2b912afc701d8364bc94e8a Mon Sep 17 00:00:00 2001
From: Conor <conorboyle07@protonmail.com>
Date: Tue, 2 Jun 2026 13:26:31 +0100
Subject: [PATCH 488/831] sdl2-compat: fix build on musl

---
 pkgs/by-name/sd/sdl2-compat/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix
index 5b6376cd9538..28746819a118 100644
--- a/pkgs/by-name/sd/sdl2-compat/package.nix
+++ b/pkgs/by-name/sd/sdl2-compat/package.nix
@@ -64,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "SDL2COMPAT_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeFeature "CMAKE_INSTALL_RPATH" (lib.makeLibraryPath [ sdl3' ]))
+    (lib.cmakeFeature "CMAKE_BUILD_RPATH" (lib.makeLibraryPath [ sdl3' ]))
   ];
 
   # skip timing-based tests as those are flaky

From a7b6fa34c1c4955920c50349475f41c2581981b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 31 May 2026 15:34:33 -0700
Subject: [PATCH 489/831] bzip2: patch CVE-2026-42250

---
 pkgs/tools/compression/bzip2/default.nix      |  3 ++
 .../bzip2/patches/CVE-2026-42250.patch        | 34 +++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch

diff --git a/pkgs/tools/compression/bzip2/default.nix b/pkgs/tools/compression/bzip2/default.nix
index de15b36aef1c..11d964fd2f06 100644
--- a/pkgs/tools/compression/bzip2/default.nix
+++ b/pkgs/tools/compression/bzip2/default.nix
@@ -30,6 +30,9 @@ stdenv.mkDerivation (
     patchFlags = [ "-p0" ];
 
     patches = [
+      # https://sourceware.org/cgit/bzip2/patch/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
+      ./patches/CVE-2026-42250.patch
+
       ./patches/bzip2-1.0.6.2-autoconfiscated.patch
     ];
     # Fix up hardcoded version from the above patch, e.g. seen in bzip2.pc or libbz2.so.1.0.N
diff --git a/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch b/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch
new file mode 100644
index 000000000000..db16326cdeb7
--- /dev/null
+++ b/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch
@@ -0,0 +1,34 @@
+From 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 Mon Sep 17 00:00:00 2001
+From: Mark Wielaard <mark@klomp.org>
+Date: Thu, 28 May 2026 16:15:45 +0200
+Subject: bzip2recover: Make sure to not process more than
+ BZ_MAX_HANDLED_BLOCKS
+
+There is an off-by-one in the check before calling tooManyBlocks. This
+causes the scanning loop to run one more time and cause a possible
+read or write one past the global bStart, bEnd, rbStart and rbEnd
+buffers. There are no known exploits of this issue and you will need
+to compile with something like gcc -fsanitize=address (ASAN
+AddressSanitizer) to observe the faulty read/write.
+
+This has been assigned CVE-2026-42250.
+---
+ bzip2recover.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git bzip2recover.c bzip2recover.c
+index a8131e0..4b1c219 100644
+--- bzip2recover.c
++++ bzip2recover.c
+@@ -402,7 +402,7 @@ Int32 main ( Int32 argc, Char** argv )
+             rbEnd[rbCtr] = bEnd[currBlock];
+             rbCtr++;
+          }
+-         if (currBlock >= BZ_MAX_HANDLED_BLOCKS)
++         if (currBlock >= BZ_MAX_HANDLED_BLOCKS - 1)
+             tooManyBlocks(BZ_MAX_HANDLED_BLOCKS);
+          currBlock++;
+ 
+-- 
+cgit 
+

From ced25ca9a913c9238668f049d813626393d805e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 2 Jun 2026 10:45:38 -0700
Subject: [PATCH 490/831] bzip2_1_1: mark insecure

---
 pkgs/tools/compression/bzip2/1_1.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/compression/bzip2/1_1.nix b/pkgs/tools/compression/bzip2/1_1.nix
index d6ff290fd1a4..1becf083055f 100644
--- a/pkgs/tools/compression/bzip2/1_1.nix
+++ b/pkgs/tools/compression/bzip2/1_1.nix
@@ -51,5 +51,8 @@ stdenv.mkDerivation (finalAttrs: {
     pkgConfigModules = [ "bz2" ];
     platforms = lib.platforms.all;
     maintainers = [ ];
+    knownVulnerabilities = [
+      "CVE-2026-42250"
+    ];
   };
 })

From 622480b3b0a933d5e80ef1306ae5b97c0e7ad75d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 2 Jun 2026 21:24:48 +0100
Subject: [PATCH 491/831] graphite2: 1.3.14 -> 1.3.15

Changes: https://github.com/silnrsi/graphite/releases/tag/1.3.15
---
 .../libraries/silgraphite/graphite2.nix       | 32 +++----------------
 1 file changed, 5 insertions(+), 27 deletions(-)

diff --git a/pkgs/development/libraries/silgraphite/graphite2.nix b/pkgs/development/libraries/silgraphite/graphite2.nix
index b5ed5a969db7..40ae39918d8c 100644
--- a/pkgs/development/libraries/silgraphite/graphite2.nix
+++ b/pkgs/development/libraries/silgraphite/graphite2.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   llvmPackages,
-  fetchpatch,
+  python3,
   fetchurl,
   pkg-config,
   freetype,
@@ -12,14 +12,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.3.14";
+  version = "1.3.15";
   pname = "graphite2";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/silnrsi/graphite/releases/download/${version}/${pname}-${version}.tgz";
-    sha256 = "1790ajyhk0ax8xxamnrk176gc9gvhadzy78qia4rd8jzm89ir7gr";
+    hash = "sha256-xryLQlJyRmUpf3ytDFWJcoXGc/m45ts1IqzoM1k/4LE=";
   };
 
   outputs = [
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
+    (python3.withPackages (ps: [ ps.fonttools ]))
     cmake
   ];
   buildInputs = [
@@ -40,14 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     }
   );
 
-  patches = [
-    # Fix build with gcc15
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/graphite2/raw/deba28323b0a3b7a3dcfd06df1efc2195b102ed7/f/graphite2-1.3.14-gcc15.patch";
-      hash = "sha256-vkkGkHkcsj1mD3OHCHLWWgpcmFDv8leC4YQm+TsbIUw=";
-    })
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
   postPatch = ''
     # disable broken 'nametabletest' test, fails on gcc-13:
     #   https://github.com/silnrsi/graphite/pull/74
@@ -61,22 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
     # headers are located in the dev output:
     substituteInPlace CMakeLists.txt \
       --replace-fail ' ''${CMAKE_INSTALL_PREFIX}/include' " ${placeholder "dev"}/include"
-
-    # Fix the build with CMake 4.
-    #
-    # See: <https://github.com/silnrsi/graphite/issues/98>
-    badCmakeFiles=(
-      CMakeLists.txt
-      src/CMakeLists.txt
-      tests/{bittwiddling,json,sparsetest,utftest}/CMakeLists.txt
-      gr2fonttest/CMakeLists.txt
-    )
-    for file in "''${badCmakeFiles[@]}"; do
-      substituteInPlace "$file" \
-        --replace-fail \
-          'CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0 FATAL_ERROR)' \
-          'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
-    done
   '';
 
   cmakeFlags = lib.optionals static [

From f69f2fb4f5cc041546425ee565b054f1b702dc70 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 2 Jun 2026 22:21:47 +0200
Subject: [PATCH 492/831] =?UTF-8?q?ocamlPackages.lsp:=201.25.0=20=E2=86=92?=
 =?UTF-8?q?=201.26.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

dune: 3.21.1 -> 3.22.2

ocamlPackages.merlin: 5.6-504 → 5.7.1-504

ocaml-lsp-server: mark old versions as broken
---
 pkgs/by-name/du/dune/package.nix                     | 4 ++--
 pkgs/development/ocaml-modules/ocaml-lsp/default.nix | 2 +-
 pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix | 7 ++++++-
 pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix     | 2 +-
 pkgs/development/tools/ocaml/merlin/4.x.nix          | 5 +++--
 5 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/du/dune/package.nix b/pkgs/by-name/du/dune/package.nix
index 2a5b9122740a..e4aa233bf37b 100644
--- a/pkgs/by-name/du/dune/package.nix
+++ b/pkgs/by-name/du/dune/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   buildPackages,
-  version ? "3.21.1",
+  version ? "3.22.2",
 }:
 let
   # needed for pkgsStatic
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
       "https://github.com/ocaml/dune/releases/download/${version}/dune-${sfx}${version}.tbz";
     hash =
       {
-        "3.21.1" = "sha256-hPeoLG2ApxJPOEfppInoDPvq+3vtNXOsAShu9W/QjZQ=";
+        "3.22.2" = "sha256-wsz4vGsXr6R8RQKXNXSWMDqnyGgOMpt52Yxo41AToRg=";
         "2.9.3" = "sha256:1ml8bxym8sdfz25bx947al7cvsi2zg5lcv7x9w6xb01cmdryqr9y";
       }
       ."${version}";
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/default.nix b/pkgs/development/ocaml-modules/ocaml-lsp/default.nix
index 04f8867cb0ad..cc22bd5e1502 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/default.nix
@@ -85,6 +85,6 @@ buildDunePackage (finalAttrs: {
   meta = lsp.meta // {
     description = "OCaml Language Server Protocol implementation";
     mainProgram = "ocamllsp";
-    broken = lib.versions.majorMinor ocaml.version == "4.13";
+    broken = lib.versionAtLeast ocaml.version "4.13" && lib.versionOlder ocaml.version "5.4";
   };
 })
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
index c273d70b2c75..1c6bd1dcab7a 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
@@ -10,7 +10,7 @@
   ocaml,
   version ?
     if lib.versionAtLeast ocaml.version "5.4" then
-      "1.25.0"
+      "1.26.0"
     else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"
     else if lib.versionAtLeast ocaml.version "5.2" then
@@ -28,6 +28,11 @@
 let
   params =
     {
+      "1.26.0" = {
+        name = "lsp";
+        minimalOCamlVersion = "5.3";
+        sha256 = "sha256-tMgQ1mZKW/F1pvmUbIDIzCsY5GqYWTTBRQss4IDkaDI=";
+      };
       "1.25.0" = {
         name = "lsp";
         minimalOCamlVersion = "5.3";
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
index 7900a7261c08..55ebec5fba50 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
@@ -26,7 +26,7 @@
   ocaml,
   version ?
     if lib.versionAtLeast ocaml.version "5.4" then
-      "1.25.0"
+      "1.26.0"
     else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"
     else if lib.versionAtLeast ocaml.version "5.2" then
diff --git a/pkgs/development/tools/ocaml/merlin/4.x.nix b/pkgs/development/tools/ocaml/merlin/4.x.nix
index 4029c36ad3f4..6a9c1622f0ff 100644
--- a/pkgs/development/tools/ocaml/merlin/4.x.nix
+++ b/pkgs/development/tools/ocaml/merlin/4.x.nix
@@ -31,8 +31,8 @@
       "5.2.0" = "5.3-502";
       "5.2.1" = "5.3-502";
       "5.3.0" = "5.6-503";
-      "5.4.0" = "5.6-504";
-      "5.4.1" = "5.6-504";
+      "5.4.0" = "5.7.1-504";
+      "5.4.1" = "5.7.1-504";
     }
     ."${ocaml.version}",
 }:
@@ -52,6 +52,7 @@ let
     "5.4.1-503" = "sha256-SbO0x3jBISX8dAXnN5CwsxLV15dJ3XPUg4tlYqJTMCI=";
     "5.6-503" = "sha256-sNytCSqq96I/ZauaCJ6HYb1mXMcjV5CeCsbCGC9PwtQ=";
     "5.6-504" = "sha256-gtZIpBgNbVqjoIMhjii/GX9OnxR4hN6TArtoEa2Yt38=";
+    "5.7.1-504" = "sha256-E5sHPPkUs4tyXFT3W4tkL2VMNJjQpLqM+oMf8CqJcNU=";
   };
 
 in

From b359a44a033e0c805540f60c26d9834357ba341c Mon Sep 17 00:00:00 2001
From: Leon Klingele <git@leonklingele.de>
Date: Tue, 2 Jun 2026 22:41:39 +0200
Subject: [PATCH 493/831] go_1_26: 1.26.3 -> 1.26.4

---
 pkgs/development/compilers/go/1.26.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix
index 01704593ad77..242fa4c91de8 100644
--- a/pkgs/development/compilers/go/1.26.nix
+++ b/pkgs/development/compilers/go/1.26.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-HGRoddCqh5kTMYTtV895/yS97+jIggRwYCqdPW2Rkrg=";
+    hash = "sha256-T2aKMvv8ETLmqIH7lowvHa2mMUkqM5IRc1+7JVpCYC0=";
   };
 
   strictDeps = true;

From 55d225453e03f4e831f175ca64f62c680e6d2a34 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Tue, 2 Jun 2026 18:17:10 -0400
Subject: [PATCH 494/831] fontconfig: add expat to propagatedBuildInputs

This is listed in the pkg-config Requires, so it is needed.
---
 pkgs/development/libraries/fontconfig/default.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index dee1e197dd6e..6441985fdfe0 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -41,12 +41,9 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  buildInputs = [
-    expat
-  ];
-
   propagatedBuildInputs = [
     freetype
+    expat
   ];
 
   postPatch = ''

From 30b9aa9ab81a4807e47f37470a470d2b449ca3b7 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Tue, 2 Jun 2026 18:22:33 -0400
Subject: [PATCH 495/831] libtiff: Add pkg-config required deps to
 propagatedBuildInputs

---
 pkgs/by-name/li/libtiff/package.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libtiff/package.nix b/pkgs/by-name/li/libtiff/package.nix
index 3b6ba2345148..66f679f6c677 100644
--- a/pkgs/by-name/li/libtiff/package.nix
+++ b/pkgs/by-name/li/libtiff/package.nix
@@ -80,14 +80,17 @@ stdenv.mkDerivation (finalAttrs: {
     sphinx
   ];
 
-  buildInputs = [
-    libdeflate
+  # Things listed in the
+  # pkg-config file need to be propagated or else
+  # they will not be picked up properly
+  propagatedBuildInputs = [
     libjpeg
-    # libwebp depends on us; this will cause infinite recursion otherwise
-    (libwebp.override { tiffSupport = false; })
-    xz
     zlib
     zstd
+    libdeflate
+    xz
+    # libwebp depends on us; this will cause infinite recursion otherwise
+    (libwebp.override { tiffSupport = false; })
   ]
   ++ lib.optionals withLerc [
     lerc

From ffe9da38cb3464ae3009e0c0bdd88092f2035a77 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 02:38:31 +0200
Subject: [PATCH 496/831] python3Packages.hatchling: 1.29.0 -> 1.30.1

https://github.com/pypa/hatch/releases/tag/hatchling-v1.30.1
---
 .../development/python-modules/hatchling/default.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/hatchling/default.nix b/pkgs/development/python-modules/hatchling/default.nix
index 569de133621d..e9c0556a05a5 100644
--- a/pkgs/development/python-modules/hatchling/default.nix
+++ b/pkgs/development/python-modules/hatchling/default.nix
@@ -17,14 +17,14 @@
   virtualenv,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "hatchling";
-  version = "1.29.0";
+  version = "1.30.1";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-eTwxgW2VLO5AW4NIjOABxxnzJdnNpp8fxM11BSdkDqY=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-7uT9RTV/cuuz16QuXXLPteKe1CbXnog2KIkmxCWNXy4=";
   };
 
   # listed in backend/pyproject.toml
@@ -65,11 +65,11 @@ buildPythonPackage rec {
     description = "Modern, extensible Python build backend";
     mainProgram = "hatchling";
     homepage = "https://hatch.pypa.io/latest/";
-    changelog = "https://github.com/pypa/hatch/releases/tag/hatchling-v${version}";
+    changelog = "https://github.com/pypa/hatch/releases/tag/hatchling-v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       hexa
       ofek
     ];
   };
-}
+})

From 48a07c243a9b20e4cc73082af7c55cee4ccb991a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:13:12 +0200
Subject: [PATCH 497/831] python3Packages.cython: 3.2.4 -> 3.2.5

https://github.com/cython/cython/blob/3.2.5/CHANGES.rst
---
 pkgs/development/python-modules/cython/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cython/default.nix b/pkgs/development/python-modules/cython/default.nix
index 5676bed17b70..34e82fb9f352 100644
--- a/pkgs/development/python-modules/cython/default.nix
+++ b/pkgs/development/python-modules/cython/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "cython";
-  version = "3.2.4";
+  version = "3.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cython";
     repo = "cython";
     tag = version;
-    hash = "sha256-8J5EcaQXexWEA+se5rCR06CwlEYao2XK5TnVNgFGHYQ=";
+    hash = "sha256-wes7UFSWW00tKTmp3Aqk0jDpMMRVHRIhonC6CD7pwB4=";
   };
 
   build-system = [

From 53d5fa93c30ae976777ddbb402ca15beeca00944 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:16:33 +0200
Subject: [PATCH 498/831] python3Packages.aiohappyeyeballs: 2.6.1 -> 2.7.0

https://github.com/bdraco/aiohappyeyeballs/blob/v2.7.0/CHANGELOG.md
---
 pkgs/development/python-modules/aiohappyeyeballs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohappyeyeballs/default.nix b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
index 8b66278e436f..61403273a997 100644
--- a/pkgs/development/python-modules/aiohappyeyeballs/default.nix
+++ b/pkgs/development/python-modules/aiohappyeyeballs/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "aiohappyeyeballs";
-  version = "2.6.1";
+  version = "2.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "aiohappyeyeballs";
     tag = "v${version}";
-    hash = "sha256-qqe/h633uEbJPpdsuCzZKW86Z6BQUmPdCju1vg7OLXc=";
+    hash = "sha256-BqwKo1zZ7CqkUZ9H05fbbHVj/z3m0xaERh5dGBDKFYI=";
   };
 
   outputs = [

From 299bfeb14d0ef2bc80150375195cd176bdc66da6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:16:45 +0200
Subject: [PATCH 499/831] python3Packages.propcache: 0.4.1 -> 0.5.2

https://github.com/aio-libs/propcache/blob/v0.5.2/CHANGES.rst
---
 pkgs/development/python-modules/propcache/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/propcache/default.nix b/pkgs/development/python-modules/propcache/default.nix
index d7d7db06793c..43aeadad29d1 100644
--- a/pkgs/development/python-modules/propcache/default.nix
+++ b/pkgs/development/python-modules/propcache/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "propcache";
-  version = "0.4.1";
+  version = "0.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "propcache";
     tag = "v${version}";
-    hash = "sha256-7HQUOggbFC7kWcXqatLeCTNJqo0fW9FRCy8UkYL6wvM=";
+    hash = "sha256-vn6FSdWEMk6c8Cu1mHyhZyH8ZlFK0kgYK8T7GKLHHwc=";
   };
 
   postPatch = ''

From 0035f9bcaf572609060a5c7aa40ea1bf7cdc2e11 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:17:29 +0200
Subject: [PATCH 500/831] python3Packages.pyjwt: 2.12.1 -> 2.13.0

https://github.com/jpadilla/pyjwt/blob/2.13.0/CHANGELOG.rst
---
 pkgs/development/python-modules/pyjwt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 1d18045a863c..74754630a145 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.12.1";
+  version = "2.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jpadilla";
     repo = "pyjwt";
     tag = version;
-    hash = "sha256-wgOa5JhQT82ppoad6s8gPH7tGRNbbVWmJaaDF84d+r0=";
+    hash = "sha256-q4ynXCJVDsyZh70439dloyWgRTLVm+elDOahUVOT5vA=";
   };
 
   outputs = [

From 2c8de341fc73e6577d1efc75b3d6bd9b4c21175f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 04:44:26 +0200
Subject: [PATCH 501/831] python3Packages.orjson: 3.11.7 -> 3.11.9

https://github.com/ijl/orjson/blob/3.11.9/CHANGELOG.md
---
 pkgs/development/python-modules/orjson/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/orjson/default.nix b/pkgs/development/python-modules/orjson/default.nix
index 4c59abd298a7..7232c5d0f8ea 100644
--- a/pkgs/development/python-modules/orjson/default.nix
+++ b/pkgs/development/python-modules/orjson/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "orjson";
-  version = "3.11.7";
+  version = "3.11.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ijl";
     repo = "orjson";
     tag = version;
-    hash = "sha256-4a8vNQEe1P1t2BcqSL+d+GLHi1lhUtbA7p5/vj/J0Lc=";
+    hash = "sha256-CCwpD6pzO80GlMvjJt4HURQxbghYg53OG/6ZIJWggNU=";
   };
 
   patches = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
@@ -46,7 +46,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-eB7jVTsvBSUjtaKsbRnRtYSd+SqnCaoDyG76iExmSHc=";
+    hash = "sha256-F1TFEj26trVV0TjK6tkS8kiorWRF0uijb1jQko7RDSM=";
   };
 
   nativeBuildInputs = [

From e3f1572c2fd58153366a183cd821fc20014d2328 Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Wed, 3 Jun 2026 01:53:47 -0400
Subject: [PATCH 502/831] alsa-lib: 1.2.15.3 -> 1.2.16

---
 pkgs/by-name/al/alsa-lib/package.nix | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/al/alsa-lib/package.nix b/pkgs/by-name/al/alsa-lib/package.nix
index 8d0bffd2b12f..4304bf4ef467 100644
--- a/pkgs/by-name/al/alsa-lib/package.nix
+++ b/pkgs/by-name/al/alsa-lib/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   alsa-topology-conf,
   alsa-ucm-conf,
   testers,
@@ -11,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.15.3";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-ewedYU1YLK3nq42yNk5lJx0Id6N9+HV6xKwMiXC+hh4=";
+    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
   };
 
   patches = [
@@ -24,11 +23,6 @@ stdenv.mkDerivation (finalAttrs: {
     # "libs" field to declare locations for both native and 32bit plugins, in
     # order to support apps with 32bit sound running on x86_64 architecture.
     ./alsa-plugin-conf-multilib.patch
-    (fetchpatch {
-      name = "CVE-2026-25068.patch";
-      url = "https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40.patch";
-      hash = "sha256-4memtcg+FDOctX6wgiCdmnlG+IUS+5rL1f3LcsWS5lw=";
-    })
   ];
 
   enableParallelBuilding = true;

From 23d0fc9c1103daf3ab58273c12d454661435c4bd Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Wed, 3 Jun 2026 01:54:08 -0400
Subject: [PATCH 503/831] alsa-utils: 1.2.15.2 -> 1.2.16

---
 pkgs/by-name/al/alsa-utils/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alsa-utils/package.nix b/pkgs/by-name/al/alsa-utils/package.nix
index ff627a73cc83..e293ed8d10e7 100644
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -32,11 +32,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-utils";
-  version = "1.2.15.2";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/utils/alsa-utils-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-eqqvv7AZQhE+wMMeUfcFkQ6BB5IFCIyi+PE3o4aeGjo=";
+    hash = "sha256-CSOZ1eh0mh1eGI45MVdSHOxLdWk7YOu3m7znKM/yIyw=";
   };
 
   nativeBuildInputs = [

From ef08008ae2d2321662e3cf83625dbf3ff2ea065f Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Wed, 3 Jun 2026 01:54:29 -0400
Subject: [PATCH 504/831] alsa-ucm-conf: 1.2.15.3 -> 1.2.16

---
 pkgs/by-name/al/alsa-ucm-conf/package.nix | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/al/alsa-ucm-conf/package.nix b/pkgs/by-name/al/alsa-ucm-conf/package.nix
index 5f0e2130bb84..176fb0e2086c 100644
--- a/pkgs/by-name/al/alsa-ucm-conf/package.nix
+++ b/pkgs/by-name/al/alsa-ucm-conf/package.nix
@@ -1,7 +1,6 @@
 {
   directoryListingUpdater,
   fetchurl,
-  fetchpatch,
   lib,
   stdenvNoCC,
   coreutils,
@@ -10,19 +9,15 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.15.3";
+  version = "1.2.16";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-n3noE8CPyGz6Rt11xPzaGkpRtILbJgfh/PqvuS9YijE=";
+    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
   };
 
   patches = [
-    # fix for typo in 1.2.15.3 – remove with subsequent release
-    (fetchpatch {
-      url = "https://github.com/alsa-project/alsa-ucm-conf/commit/95377000e849259764f37295e0ddd58fd8a55a76.patch";
-      hash = "sha256-o2qR69jiGXFWM0mxeIhXd+tCvGikYqnoalce1UOVppw=";
-    })
+
   ];
 
   dontBuild = true;

From efef7d2661da0fe1a31640df138cedeeb746b165 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 13:36:13 +0200
Subject: [PATCH 505/831] libxml2: 2.15.2 -> 2.15.3

Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.15.3/NEWS

Fixes CVE-2026-6732
Other security issues fixed here seem to not have CVEs assigned (yet)
---
 pkgs/development/libraries/libxml2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 52a3ab58ad61..015688e4474b 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -46,13 +46,13 @@ let
       };
     };
     libxml2 = callPackage ./common.nix {
-      version = "2.15.2";
+      version = "2.15.3";
       src = fetchFromGitLab {
         domain = "gitlab.gnome.org";
         owner = "GNOME";
         repo = "libxml2";
         tag = "v${packages.libxml2.version}";
-        hash = "sha256-k5dZ75D/BOouYAjrof9Jm2lY29XZhOqS1kudDGmGY9Q=";
+        hash = "sha256-fDntZDyITs223by8n7ueOXiO7yyzshtANoWbY0+yeqo=";
       };
       extraMeta = {
         maintainers = with lib.maintainers; [

From bb8b3495ed290b4845703046d454edd6ee945b3c Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 3 Jun 2026 19:59:56 +0700
Subject: [PATCH 506/831] python3Packages.asgiref: migrate to pyproject

---
 pkgs/development/python-modules/asgiref/default.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index 727587c610cd..630a0f9b0d2a 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -5,13 +5,14 @@
   fetchFromGitHub,
   pytest-asyncio,
   pytestCheckHook,
+  setuptools,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   version = "3.11.0";
   pname = "asgiref";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django";
@@ -20,7 +21,9 @@ buildPythonPackage rec {
     hash = "sha256-2ZaUIWGF5cQVNj95b7WiKGsn2wYsoJmJ/CfPhIEZdjc=";
   };
 
-  propagatedBuildInputs = [ typing-extensions ];
+  build-system = [ setuptools ];
+
+  dependencies = [ typing-extensions ];
 
   nativeCheckInputs = [
     pytestCheckHook

From 652746146f7777862e37bec8a94287779985ad21 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 3 Jun 2026 20:01:27 +0700
Subject: [PATCH 507/831] python3Packages.asgiref: convert to finalAttrs

---
 pkgs/development/python-modules/asgiref/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index 630a0f9b0d2a..1012db942066 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -9,7 +9,7 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   version = "3.11.0";
   pname = "asgiref";
   pyproject = true;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "django";
     repo = "asgiref";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-2ZaUIWGF5cQVNj95b7WiKGsn2wYsoJmJ/CfPhIEZdjc=";
   };
 
@@ -37,10 +37,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "asgiref" ];
 
   meta = {
-    changelog = "https://github.com/django/asgiref/blob/${src.tag}/CHANGELOG.txt";
+    changelog = "https://github.com/django/asgiref/blob/${finalAttrs.src.tag}/CHANGELOG.txt";
     description = "Reference ASGI adapters and channel layers";
     homepage = "https://github.com/django/asgiref";
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})

From 5bd4f7ca04f3d7ff331f87e72faccd369539226a Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 3 Jun 2026 20:26:31 +0700
Subject: [PATCH 508/831] python3Packages.asgiref: add miniharinn as maintainer

---
 pkgs/development/python-modules/asgiref/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index 1012db942066..c0740de29df9 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -41,6 +41,6 @@ buildPythonPackage (finalAttrs: {
     description = "Reference ASGI adapters and channel layers";
     homepage = "https://github.com/django/asgiref";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ miniharinn ];
   };
 })

From e62c6b2316897e4aa9d141a3a9529c72d69b990e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 3 Jun 2026 16:25:25 +0200
Subject: [PATCH 509/831] python3Packages.requests: 2.34.0 -> 2.34.2

https://github.com/psf/requests/blob/v2.34.2/HISTORY.md
---
 pkgs/development/python-modules/requests/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/requests/default.nix b/pkgs/development/python-modules/requests/default.nix
index 17fca3669c1e..6f5c636620f1 100644
--- a/pkgs/development/python-modules/requests/default.nix
+++ b/pkgs/development/python-modules/requests/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "requests";
-  version = "2.34.0";
+  version = "2.34.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "psf";
     repo = "requests";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DDx+UV3OuCLUXM7ESbURCGeZ7t2acFEfMTOMcJdfUbI=";
+    hash = "sha256-J2/sNpFUDHkNBeN7BfiMamv7YaWixZAZHxaqmPVEptc=";
   };
 
   build-system = [ setuptools ];

From 0d250a4f8d9b161f5520e083ffcb54c1aee8e74c Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Wed, 3 Jun 2026 21:26:10 +0700
Subject: [PATCH 510/831] python3Packages.atomicwrites-homeassistant: migrate
 to pyproject

---
 .../python-modules/atomicwrites-homeassistant/default.nix    | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/atomicwrites-homeassistant/default.nix b/pkgs/development/python-modules/atomicwrites-homeassistant/default.nix
index 7c7b1c87a056..871824449421 100644
--- a/pkgs/development/python-modules/atomicwrites-homeassistant/default.nix
+++ b/pkgs/development/python-modules/atomicwrites-homeassistant/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   pytestCheckHook,
+  setuptools,
 }:
 
 let
@@ -12,13 +13,15 @@ in
 
 buildPythonPackage {
   inherit pname version;
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-JWpnIQbxZ0VEUijZZiQLd7VfRqCW0gMFkBpXql0fTC8=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "atomicwrites" ];
 
   nativeCheckInputs = [ pytestCheckHook ];

From aca9a4c78cacffd210b8e55ba9f47ae3fe372ac5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 3 Jun 2026 10:14:01 -0700
Subject: [PATCH 511/831] libical: 3.0.20 -> 4.0.2

Diff: https://github.com/libical/libical/compare/v3.0.20...v4.0.2

Changelog: https://github.com/libical/libical/blob/v4.0.2/CHANGELOG.md
---
 pkgs/by-name/li/libical/package.nix           |  26 +--
 .../li/libical/respect-env-tzdir.patch        |  29 ---
 pkgs/by-name/li/libical/static.patch          | 205 ------------------
 3 files changed, 10 insertions(+), 250 deletions(-)
 delete mode 100644 pkgs/by-name/li/libical/respect-env-tzdir.patch
 delete mode 100644 pkgs/by-name/li/libical/static.patch

diff --git a/pkgs/by-name/li/libical/package.nix b/pkgs/by-name/li/libical/package.nix
index 63b3fae8a7ec..e0366ede8ad7 100644
--- a/pkgs/by-name/li/libical/package.nix
+++ b/pkgs/by-name/li/libical/package.nix
@@ -16,6 +16,7 @@
   fixDarwinDylibNames,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+    && !stdenv.hostPlatform.isStatic
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
   buildPackages,
   gobject-introspection,
@@ -24,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libical";
-  version = "3.0.20";
+  version = "4.0.2";
 
   outputs = [
     "out"
@@ -34,8 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libical";
     repo = "libical";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-KIMqZ6QAh+fTcKEYrcLlxgip91CLAwL9rwjUdKzBsQk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xrPG3FBUY5OCEHBqcNN4Rj4c4j7kLXUsC0hXRRh76Vg=";
   };
 
   strictDeps = true;
@@ -79,24 +80,17 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DENABLE_GTK_DOC=False"
+    "-DLIBICAL_GLIB_BUILD_DOCS=False"
     "-DLIBICAL_BUILD_EXAMPLES=False"
-    "-DGOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
-    "-DICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
-    "-DSTATIC_ONLY=${if stdenv.hostPlatform.isStatic then "True" else "False"}"
+    "-DLIBICAL_JAVA_BINDINGS=False"
+    "-DLIBICAL_GOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
+    "-DLIBICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
+    "-DLIBICAL_STATIC=${if stdenv.hostPlatform.isStatic then "True" else "False"}"
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-DIMPORT_ICAL_GLIB_SRC_GENERATOR=${lib.getDev pkgsBuildBuild.libical}/lib/cmake/LibIcal/IcalGlibSrcGenerator.cmake"
   ];
 
-  patches = [
-    # Will appear in 3.1.0
-    # https://github.com/libical/libical/issues/350
-    ./respect-env-tzdir.patch
-
-    ./static.patch
-  ];
-
   # Using install check so we do not have to manually set GI_TYPELIB_PATH
   # Musl does not support TZDIR.
   doInstallCheck = !stdenv.hostPlatform.isMusl;
@@ -124,7 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/libical/libical";
     description = "Open Source implementation of the iCalendar protocols";
-    changelog = "https://github.com/libical/libical/raw/v${finalAttrs.version}/ReleaseNotes.txt";
+    changelog = "https://github.com/libical/libical/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mpl20;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/li/libical/respect-env-tzdir.patch b/pkgs/by-name/li/libical/respect-env-tzdir.patch
deleted file mode 100644
index 59d23e490e5a..000000000000
--- a/pkgs/by-name/li/libical/respect-env-tzdir.patch
+++ /dev/null
@@ -1,29 +0,0 @@
---- a/src/libical/icaltz-util.c
-+++ b/src/libical/icaltz-util.c
-@@ -94,9 +94,9 @@
- static const char *zdir = NULL;
- 
- static const char *search_paths[] = {
-+    "/etc/zoneinfo",
-     "/usr/share/zoneinfo",
-     "/usr/lib/zoneinfo",
--    "/etc/zoneinfo",
-     "/usr/share/lib/zoneinfo"
- };
- 
-@@ -178,6 +178,15 @@
-     const char *fname = ZONES_TAB_SYSTEM_FILENAME;
-     size_t i, num_search_paths;
- 
-+   const char *env_tzdir = getenv ("TZDIR");
-+   if (env_tzdir) {
-+       sprintf (file_path, "%s/%s", env_tzdir, fname);
-+       if (!access (file_path, F_OK|R_OK)) {
-+           zdir = env_tzdir;
-+           return;
-+       }
-+   }
-+
-     num_search_paths = sizeof(search_paths) / sizeof(search_paths[0]);
-     for (i = 0; i < num_search_paths; i++) {
-         snprintf(file_path, MAXPATHLEN, "%s/%s", search_paths[i], fname);
diff --git a/pkgs/by-name/li/libical/static.patch b/pkgs/by-name/li/libical/static.patch
deleted file mode 100644
index 23678ecd50a6..000000000000
--- a/pkgs/by-name/li/libical/static.patch
+++ /dev/null
@@ -1,205 +0,0 @@
-From 38fe473fb2c90960a64ddda5c4305d958d460e05 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Thu, 3 Jul 2025 19:52:23 +0200
-Subject: [PATCH] Link ICU components in the right order
-
-When static linking, a library that refers to symbols in another
-library has to come before the latter library in the linker command
-line.
-
-Before this change, I get linker errors like the following.  With this
-change, no error.
-
-FAILED: src/test/icalrecurtest
-: && /nix/store/m8ggqv2dfrw6raz49ipnnab98cljx1k2-x86_64-unknown-linux-musl-gcc-wrapper-14.3.0/bin/x86_64-unknown-linux-musl-g++ -O2       -fvisibility=hidden       -Weffc++ -Wno-deprecated -Wall -Wextra -Woverloaded-virtual -Winit-self -Wunused       -Wno-div-by-zero -Wundef -Wpointer-arith -Wtype-limits -Wwrite-strings -Wreturn-type -Wunused-but-set-variable -Wlogical-op -Wsizeof-pointer-memaccess -Wreorder -Wformat-security -Wredundant-decls -Wunreachable-code -Wvarargs -D_XOPEN_SOURCE=500 -D_DEFAULT_SOURCE -D_GNU_SOURCE -Wall -Wextra -Wformat -Wformat=2 -Wconversion -Wsign-conversion -Wtrampolines -Wimplicit-fallthrough -Wbidi-chars=any -Wformat-security -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong -fcf-protection=full -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -O3 -DNDEBUG -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,relro -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,relro -Wl,--as-needed -Wl,--no-copy-dt-needed-entries src/test/CMakeFiles/icalrecurtest.dir/icalrecur_test.c.o -o src/test/icalrecurtest  lib/libical.a  lib/libicalss.a  lib/libicalvcal.a  lib/libical.a  /nix>
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_getAvailable_76':
-(.text.ucal_getAvailable_76+0x1): undefined reference to `uloc_getAvailable_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_countAvailable_76':
-(.text.ucal_countAvailable_76+0x1): undefined reference to `uloc_countAvailable_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_getKeywordValuesForLocale_76':
-(.text.ucal_getKeywordValuesForLocale_76+0xec): undefined reference to `ulist_createEmptyList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x132): undefined reference to `ulist_resetList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x260): undefined reference to `ulist_addItemEndList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x2e2): undefined reference to `ulist_containsString_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x2f6): undefined reference to `ulist_addItemEndList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x304): undefined reference to `ulist_deleteList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x333): undefined reference to `ulist_deleteList_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x10): undefined reference to `ulist_close_keyword_values_iterator_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x18): undefined reference to `ulist_count_keyword_values_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x28): undefined reference to `ulist_next_keyword_value_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x30): undefined reference to `ulist_reset_keyword_values_iterator_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::SharedCalendar::~SharedCalendar()':
-(.text._ZN6icu_7614SharedCalendarD2Ev+0x32): undefined reference to `icu_76::SharedObject::~SharedObject()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::BasicCalendarFactory::~BasicCalendarFactory()':
-(.text._ZN6icu_7620BasicCalendarFactoryD2Ev+0xf): undefined reference to `icu_76::LocaleKeyFactory::~LocaleKeyFactory()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::DefaultCalendarFactory::~DefaultCalendarFactory()':
-(.text._ZN6icu_7622DefaultCalendarFactoryD2Ev+0xf): undefined reference to `icu_76::ICUResourceBundleFactory::~ICUResourceBundleFactory()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::CalendarService::~CalendarService()':
-(.text._ZN6icu_7615CalendarServiceD2Ev+0xf): undefined reference to `icu_76::ICULocaleService::~ICULocaleService()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::clone() const':
-(.text._ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE5cloneEv[_ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE5cloneEv]+0x65): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::CalendarService::isDefault() const':
-(.text._ZNK6icu_7615CalendarService9isDefaultEv[_ZNK6icu_7615CalendarService9isDefaultEv]+0x5): undefined reference to `icu_76::ICUService::countFactories() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::initCalendarService(UErrorCode&) [clone .cold]':
-(.text.unlikely._ZN6icu_76L19initCalendarServiceER10UErrorCode+0x16): undefined reference to `icu_76::ICULocaleService::~ICULocaleService()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::initCalendarService(UErrorCode&)':
-(.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xa9): undefined reference to `icu_76::ICULocaleService::ICULocaleService(icu_76::UnicodeString const&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xe1): undefined reference to `icu_76::ICUResourceBundleFactory::ICUResourceBundleFactory()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xfe): undefined reference to `icu_76::ICUService::registerFactory(icu_76::ICUServiceFactory*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0x12c): undefined reference to `icu_76::LocaleKeyFactory::LocaleKeyFactory(int)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getAvailableLocales(int&)':
-(.text._ZN6icu_768Calendar19getAvailableLocalesERi+0x1): undefined reference to `icu_76::Locale::getAvailableLocales(int&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getLocale(ULocDataLocaleType, UErrorCode&) const':
-(.text._ZNK6icu_768Calendar9getLocaleE18ULocDataLocaleTypeR10UErrorCode+0x34): undefined reference to `icu_76::LocaleBased::getLocale(ULocDataLocaleType, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getLocaleID(ULocDataLocaleType, UErrorCode&) const':
-(.text._ZNK6icu_768Calendar11getLocaleIDE18ULocDataLocaleTypeR10UErrorCode+0x30): undefined reference to `icu_76::LocaleBased::getLocaleID(ULocDataLocaleType, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::~LocaleCacheKey()':
-(.text._ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED2Ev[_ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED5Ev]+0x3b): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::setWeekData(icu_76::Locale const&, char const*, UErrorCode&)':
-(.text._ZN6icu_768Calendar11setWeekDataERKNS_6LocaleEPKcR10UErrorCode+0x31e): undefined reference to `icu_76::LocaleBased::setLocaleIDs(char const*, char const*)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::makeInstance(icu_76::Locale const&, UErrorCode&)':
-(.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0xd2): undefined reference to `icu_76::LocaleUtility::initLocaleFromName(icu_76::UnicodeString const&, icu_76::Locale&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0x112): undefined reference to `icu_76::ICULocaleService::get(icu_76::Locale const&, int, icu_76::Locale*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0x1d4): undefined reference to `icu_76::ICULocaleService::get(icu_76::Locale const&, int, icu_76::Locale*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::createObject(void const*, UErrorCode&) const':
-(.text._ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE12createObjectEPKvR10UErrorCode+0x69): undefined reference to `icu_76::SharedObject::addRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::DefaultCalendarFactory::create(icu_76::ICUServiceKey const&, icu_76::ICUService const*, UErrorCode&) const':
-(.text._ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x31): undefined reference to `typeinfo for icu_76::LocaleKey'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x38): undefined reference to `typeinfo for icu_76::ICUServiceKey'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::BasicCalendarFactory::create(icu_76::ICUServiceKey const&, icu_76::ICUService const*, UErrorCode&) const':
-(.text._ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x33): undefined reference to `typeinfo for icu_76::LocaleKey'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x3a): undefined reference to `typeinfo for icu_76::ICUServiceKey'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::~LocaleCacheKey()':
-(.text._ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED0Ev[_ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED5Ev]+0x36): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `void icu_76::UnifiedCache::getByLocale<icu_76::SharedCalendar>(icu_76::Locale const&, icu_76::SharedCalendar const*&, UErrorCode&)':
-(.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x2e): undefined reference to `icu_76::UnifiedCache::getInstance(UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0xdf): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x123): undefined reference to `icu_76::UnifiedCache::_get(icu_76::CacheKeyBase const&, icu_76::SharedObject const*&, void const*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x141): undefined reference to `icu_76::SharedObject::removeRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x186): undefined reference to `icu_76::SharedObject::removeRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x1a5): undefined reference to `icu_76::SharedObject::addRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x20c): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::createInstance(icu_76::TimeZone*, icu_76::Locale const&, UErrorCode&)':
-(.text._ZN6icu_768Calendar14createInstanceEPNS_8TimeZoneERKNS_6LocaleER10UErrorCode+0x56): undefined reference to `icu_76::SharedObject::removeRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getCalendarTypeFromLocale(icu_76::Locale const&, char*, int, UErrorCode&)':
-(.text._ZN6icu_768Calendar25getCalendarTypeFromLocaleERKNS_6LocaleEPciR10UErrorCode+0x69): undefined reference to `icu_76::SharedObject::removeRef() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7614SharedCalendarE[_ZTIN6icu_7614SharedCalendarE]+0x10): undefined reference to `typeinfo for icu_76::SharedObject'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_768CacheKeyINS_14SharedCalendarEEE[_ZTIN6icu_768CacheKeyINS_14SharedCalendarEEE]+0x10): undefined reference to `typeinfo for icu_76::CacheKeyBase'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7620BasicCalendarFactoryE[_ZTIN6icu_7620BasicCalendarFactoryE]+0x10): undefined reference to `typeinfo for icu_76::LocaleKeyFactory'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7622DefaultCalendarFactoryE[_ZTIN6icu_7622DefaultCalendarFactoryE]+0x10): undefined reference to `typeinfo for icu_76::ICUResourceBundleFactory'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7615CalendarServiceE[_ZTIN6icu_7615CalendarServiceE]+0x10): undefined reference to `typeinfo for icu_76::ICULocaleService'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x20): undefined reference to `icu_76::LocaleKeyFactory::getDynamicClassID() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x38): undefined reference to `icu_76::LocaleKeyFactory::getDisplayName(icu_76::UnicodeString const&, icu_76::Locale const&, icu_76::UnicodeString&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x40): undefined reference to `icu_76::LocaleKeyFactory::handlesKey(icu_76::ICUServiceKey const&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x48): undefined reference to `icu_76::LocaleKeyFactory::handleCreate(icu_76::Locale const&, int, icu_76::ICUService const*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x50): undefined reference to `icu_76::LocaleKeyFactory::getSupportedIDs(UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x20): undefined reference to `icu_76::ICUResourceBundleFactory::getDynamicClassID() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x30): undefined reference to `icu_76::LocaleKeyFactory::updateVisibleIDs(icu_76::Hashtable&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x38): undefined reference to `icu_76::LocaleKeyFactory::getDisplayName(icu_76::UnicodeString const&, icu_76::Locale const&, icu_76::UnicodeString&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x40): undefined reference to `icu_76::LocaleKeyFactory::handlesKey(icu_76::ICUServiceKey const&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x48): undefined reference to `icu_76::ICUResourceBundleFactory::handleCreate(icu_76::Locale const&, int, icu_76::ICUService const*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x50): undefined reference to `icu_76::ICUResourceBundleFactory::getSupportedIDs(UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x20): undefined reference to `icu_76::ICUNotifier::addListener(icu_76::EventListener const*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x28): undefined reference to `icu_76::ICUNotifier::removeListener(icu_76::EventListener const*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x30): undefined reference to `icu_76::ICUNotifier::notifyChanged()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x38): undefined reference to `icu_76::ICUService::acceptsListener(icu_76::EventListener const&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x40): undefined reference to `icu_76::ICUService::notifyListener(icu_76::EventListener&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x48): undefined reference to `icu_76::ICUService::getKey(icu_76::ICUServiceKey&, icu_76::UnicodeString*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x50): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::UnicodeString const&, signed char, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x58): undefined reference to `icu_76::ICUService::registerFactory(icu_76::ICUServiceFactory*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x60): undefined reference to `icu_76::ICUService::unregister(void const*, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x68): undefined reference to `icu_76::ICUService::reset()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x78): undefined reference to `icu_76::ICULocaleService::createKey(icu_76::UnicodeString const*, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x88): undefined reference to `icu_76::ICUService::createSimpleFactory(icu_76::UObject*, icu_76::UnicodeString const&, signed char, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x90): undefined reference to `icu_76::ICUService::reInitializeFactories()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xa0): undefined reference to `icu_76::ICUService::clearCaches()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xa8): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xb0): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, int, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xb8): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, int, int, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xc0): undefined reference to `icu_76::ICULocaleService::getAvailableLocales() const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xc8): undefined reference to `icu_76::ICULocaleService::createKey(icu_76::UnicodeString const*, int, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(timezone.ao): in function `icu_76::TimeZone::parseCustomID(icu_76::UnicodeString const&, int&, int&, int&, int&)':
-(.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x6f): undefined reference to `u_strncasecmp_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0xf3): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x168): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x1cd): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseSingleLocalizedDigit(icu_76::UnicodeString const&, int, int&) const':
-(.text._ZNK6icu_7614TimeZoneFormat25parseSingleLocalizedDigitERKNS_13UnicodeStringEiRi+0x56): undefined reference to `u_charDigitValue_76'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetFieldsWithPattern(icu_76::UnicodeString const&, int, icu_76::UVector*, signed char, int&, int&, int&) const':
-(.text._ZNK6icu_7614TimeZoneFormat28parseOffsetFieldsWithPatternERKNS_13UnicodeStringEiPNS_7UVectorEaRiS6_S6_+0x116): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetLocalizedGMTPattern(icu_76::UnicodeString const&, int, signed char, int&) const':
-(.text._ZNK6icu_7614TimeZoneFormat30parseOffsetLocalizedGMTPatternERKNS_13UnicodeStringEiaRi+0x13e): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat30parseOffsetLocalizedGMTPatternERKNS_13UnicodeStringEiaRi+0x1a9): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetDefaultLocalizedGMT(icu_76::UnicodeString const&, int, int&) const':
-(.text._ZNK6icu_7614TimeZoneFormat30parseOffsetDefaultLocalizedGMTERKNS_13UnicodeStringEiRi+0x65): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetLocalizedGMT(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const':
-(.text._ZNK6icu_7614TimeZoneFormat23parseOffsetLocalizedGMTERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x121): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao):(.text._ZNK6icu_7614TimeZoneFormat23parseOffsetLocalizedGMTERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x1bb): more undefined references to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const' follow
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetISO8601(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const [clone .cold]':
-(.text.unlikely._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x4): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.unlikely._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0xc): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetISO8601(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const':
-(.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0xaf): undefined reference to `vtable for icu_76::ParsePosition'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x120): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x1c4): undefined reference to `vtable for icu_76::ParsePosition'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x207): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parse(UTimeZoneFormatStyle, icu_76::UnicodeString const&, icu_76::ParsePosition&, int, UTimeZoneFormatTimeType*) const [clone .cold]':
-(.text.unlikely._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x2c): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parse(UTimeZoneFormatStyle, icu_76::UnicodeString const&, icu_76::ParsePosition&, int, UTimeZoneFormatTimeType*) const':
-(.text._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x99): undefined reference to `vtable for icu_76::ParsePosition'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x2c6): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::getGenericLocationName(icu_76::UnicodeString const&)':
-(.text._ZN6icu_768TZGNCore22getGenericLocationNameERKNS_13UnicodeStringE+0x1ea): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore22getGenericLocationNameERKNS_13UnicodeStringE+0x342): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::getPartialLocationName(icu_76::UnicodeString const&, icu_76::UnicodeString const&, signed char, icu_76::UnicodeString const&)':
-(.text._ZN6icu_768TZGNCore22getPartialLocationNameERKNS_13UnicodeStringES3_aS3_+0x288): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::initialize(icu_76::Locale const&, UErrorCode&)':
-(.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x172): undefined reference to `icu_76::SimpleFormatter::applyPatternMinMaxArguments(icu_76::UnicodeString const&, int, int, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x18f): undefined reference to `icu_76::SimpleFormatter::applyPatternMinMaxArguments(icu_76::UnicodeString const&, int, int, UErrorCode&)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x1a5): undefined reference to `icu_76::LocaleDisplayNames::createInstance(icu_76::Locale const&, UDialectHandling)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::TZGNCore(icu_76::Locale const&, UErrorCode&) [clone .cold]':
-(.text.unlikely._ZN6icu_768TZGNCoreC2ERKNS_6LocaleER10UErrorCode+0x21): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.unlikely._ZN6icu_768TZGNCoreC2ERKNS_6LocaleER10UErrorCode+0x2d): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::~TZGNCore()':
-(.text._ZN6icu_768TZGNCoreD2Ev+0x48): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCoreD2Ev+0x54): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::formatGenericNonLocationName(icu_76::TimeZone const&, UTimeZoneGenericNameType, double, icu_76::UnicodeString&) const':
-(.text._ZNK6icu_768TZGNCore28formatGenericNonLocationNameERKNS_8TimeZoneE24UTimeZoneGenericNameTypedRNS_13UnicodeStringE+0x692): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tznames_impl.ao): in function `icu_76::TextTrieMap::search(icu_76::CharacterNode*, icu_76::UnicodeString const&, int, int, icu_76::TextTrieMapSearchResultHandler*, UErrorCode&) const':
-(.text._ZNK6icu_7611TextTrieMap6searchEPNS_13CharacterNodeERKNS_13UnicodeStringEiiPNS_30TextTrieMapSearchResultHandlerER10UErrorCode+0x153): undefined reference to `icu_76::UnicodeString::foldCase(unsigned int)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tznames_impl.ao): in function `icu_76::TextTrieMap::putImpl(icu_76::UnicodeString const&, void*, UErrorCode&)':
-(.text._ZN6icu_7611TextTrieMap7putImplERKNS_13UnicodeStringEPvR10UErrorCode+0x135): undefined reference to `icu_76::UnicodeString::foldCase(unsigned int)'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::parseObject(icu_76::UnicodeString const&, icu_76::Formattable&, UErrorCode&) const [clone .cold]':
-(.text.unlikely._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x4): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::parseObject(icu_76::UnicodeString const&, icu_76::Formattable&, UErrorCode&) const':
-(.text._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x25): undefined reference to `vtable for icu_76::ParsePosition'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x57): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::getLocale(ULocDataLocaleType, UErrorCode&) const':
-(.text._ZNK6icu_766Format9getLocaleE18ULocDataLocaleTypeR10UErrorCode+0x31): undefined reference to `icu_76::LocaleBased::getLocale(ULocDataLocaleType, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::getLocaleID(ULocDataLocaleType, UErrorCode&) const':
-(.text._ZNK6icu_766Format11getLocaleIDE18ULocDataLocaleTypeR10UErrorCode+0x2d): undefined reference to `icu_76::LocaleBased::getLocaleID(ULocDataLocaleType, UErrorCode&) const'
-/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::setLocaleIDs(char const*, char const*)':
-(.text._ZN6icu_766Format12setLocaleIDsEPKcS2_+0x2d): undefined reference to `icu_76::LocaleBased::setLocaleIDs(char const*, char const*)'
-collect2: error: ld returned 1 exit status
-
-Link: https://github.com/libical/libical/pull/930
----
- CMakeLists.txt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index aad02e1e..7dcf516c 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -211,7 +211,7 @@ if(NOT DEFINED ENV{ICU_ROOT} AND APPLE)
-   #Use the homebrew version. MacOS provided ICU doesn't provide development files
-   set(ICU_ROOT "/usr/local/opt/icu4c")
- endif()
--find_package(ICU COMPONENTS uc i18n data)
-+find_package(ICU COMPONENTS i18n uc data)
- set_package_properties(ICU PROPERTIES
-   TYPE RECOMMENDED
-   PURPOSE "For RSCALE (RFC7529) support"
--- 
-2.49.0
-

From facc8845a479693e47647f5e02e1620343bea6e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 3 Jun 2026 10:45:42 -0700
Subject: [PATCH 512/831] libjpeg_turbo: 3.1.4 -> 3.1.4.1

Diff: https://github.com/libjpeg-turbo/libjpeg-turbo/compare/3.1.4...3.1.4.1

Changelog: https://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/3.1.4.1
---
 pkgs/by-name/li/libjpeg_turbo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libjpeg_turbo/package.nix b/pkgs/by-name/li/libjpeg_turbo/package.nix
index 5156d1f87d5c..0181dabd9757 100644
--- a/pkgs/by-name/li/libjpeg_turbo/package.nix
+++ b/pkgs/by-name/li/libjpeg_turbo/package.nix
@@ -32,13 +32,13 @@ assert !(enableJpeg7 && enableJpeg8); # pick only one or none, not both
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libjpeg-turbo";
-  version = "3.1.4";
+  version = "3.1.4.1";
 
   src = fetchFromGitHub {
     owner = "libjpeg-turbo";
     repo = "libjpeg-turbo";
     tag = finalAttrs.version;
-    hash = "sha256-mxmJejgUqS6OC0U0gHsHHe74X0MTVBY5OCbqxIyWa3Q=";
+    hash = "sha256-jBajigX4/j4jG11prTPeGkTVRrRzheFL/LxgnPufzb4=";
   };
 
   patches =

From b4fe75ea95b626f164d4be0bde21b9ede60be20a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 3 Jun 2026 19:03:07 +0000
Subject: [PATCH 513/831] ucc: 1.7.0 -> 1.8.0

---
 pkgs/by-name/uc/ucc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/uc/ucc/package.nix b/pkgs/by-name/uc/ucc/package.nix
index ae59eabb2cf3..016b2111d234 100644
--- a/pkgs/by-name/uc/ucc/package.nix
+++ b/pkgs/by-name/uc/ucc/package.nix
@@ -40,13 +40,13 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   pname = "ucc";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "openucx";
     repo = "ucc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YGvagagGcG6Jiy5VppnfdZ03Sb5+5dYU6NV+RS/KnHY=";
+    hash = "sha256-rH/bG0pYO4VKfrnkXLXy/67hjaz6i3R0YoYdsGBqPsU=";
   };
 
   outputs = [

From 3cea6f05bd8acb21e4d0c135f69c8c8a669d195d Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 3 Jun 2026 21:26:39 +0100
Subject: [PATCH 514/831] hwdata: 0.407 -> 0.408

Changes: https://github.com/vcrhonek/hwdata/compare/v0.407...v0.408
---
 pkgs/by-name/hw/hwdata/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index 9624dc7a05c6..0fc7c9022a62 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.407";
+  version = "0.408";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JrEUmXH1/fua6EJjHHwny19QS0HvYGRPelKF0UroDhc=";
+    hash = "sha256-fgKOvVGAdB3uBFuKfGPFfF9wQEdLtnlMdQrLNIr3teo=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)

From 33961684091fb623efc13c0fb1a889b8aeb79eac Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 23:41:50 +0200
Subject: [PATCH 515/831] apparmor-parser: fix for apparmor 5.0

---
 pkgs/by-name/ap/apparmor-parser/package.nix | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix
index 47927ab6477b..0191929c5efe 100644
--- a/pkgs/by-name/ap/apparmor-parser/package.nix
+++ b/pkgs/by-name/ap/apparmor-parser/package.nix
@@ -6,6 +6,7 @@
   bison,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   buildPackages,
+  zstd,
 
   # apparmor deps
   libapparmor,
@@ -23,15 +24,23 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs .
+
+    substituteInPlace init/rc.apparmor.functions \
+      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" \
+      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
+    sed -i init/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
     cd parser
 
     substituteInPlace Makefile \
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" # FIXME
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
-    sed -i rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
+    # strict format check causes yacc auto-generated code to fail.
+    # This is known, see https://gitlab.com/apparmor/apparmor/-/merge_requests/2039
+    # removing the compile-time check here downgrades the issue and allows compilation to succeed
+    substituteInPlace parser.h \
+      --replace-fail 'extern void yyerror(const char *msg, ...) __attribute__((noreturn, format(printf, 1, 2)));' \
+        'extern void yyerror(const char *msg, ...);'
   '';
 
   nativeBuildInputs = [
@@ -42,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libapparmor
+    zstd
     runtimeShellPackage
   ];
 

From a6b392bab03e99a052ff914e582163fdbeb85360 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 3 Jun 2026 23:43:03 +0200
Subject: [PATCH 516/831] apparmor-profiles: fix test for apparmor 5.0

---
 pkgs/by-name/ap/apparmor-profiles/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/ap/apparmor-profiles/package.nix b/pkgs/by-name/ap/apparmor-profiles/package.nix
index db3c21009b4c..7ecb3ba5cb3c 100644
--- a/pkgs/by-name/ap/apparmor-profiles/package.nix
+++ b/pkgs/by-name/ap/apparmor-profiles/package.nix
@@ -1,7 +1,9 @@
 {
+  lib,
   stdenv,
   which,
   callPackage,
+  python3,
 
   # apparmor deps
   libapparmor,
@@ -28,9 +30,16 @@ stdenv.mkDerivation {
     apparmor-utils
   ];
 
+  checkInputs = [
+    python3
+  ];
+
   preCheck = ''
     export USE_SYSTEM=1
     export LOGPROF="aa-logprof --configdir ${callPackage ./test_config.nix { }} --no-check-mountpoint"
+    patchShebangs ../parser/tst
+    substituteInPlace ../parser/tst/test_profile.py \
+      --replace-fail '../parser/apparmor_parser' '${lib.getExe apparmor-parser}'
   '';
 
   doCheck = true;

From 3b5d44bff532312e311282d9768c5204fc8d601a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 4 Jun 2026 01:51:51 +0200
Subject: [PATCH 517/831] python3Packages.django_5: 5.2.14 -> 5.2.15

https://docs.djangoproject.com/en/5.2/releases/5.2.15/
https://www.djangoproject.com/weblog/2026/jun/03/security-releases/

Fixes:
CVE-2026-6873, CVE-2026-7666, CVE-2026-8404, CVE-2026-35193,
CVE-2026-48587
---
 pkgs/development/python-modules/django/5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 3a7274793a2b..273b61da19c9 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.2.14";
+  version = "5.2.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django";
     repo = "django";
     tag = version;
-    hash = "sha256-gb/4WL2VLoqRucpXuKyPsMSwKZ6gaxy5JA7QTeeazjk=";
+    hash = "sha256-K9yFHr3IkVNMqoeumESszVlju2fW2r8hS8z6M2OdVpE=";
   };
 
   patches = [

From 75a1c47a4ecd29ee975f6606131ad9169e281d4c Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Sun, 31 May 2026 13:32:51 +0100
Subject: [PATCH 518/831] tests.{qt5,qt6}.wrapQtAppsHook: add coverage

Test that wrapQtAppsHook:
- normalizes qtWrapperArgs to a bash array
- preserves user-supplied wrapper arguments
- appends the expected Qt wrapper arguments
- produces wrappers with the expected runtime behaviour
---
 .../libraries/qt-5/5.15/default.nix           |   5 +
 pkgs/development/libraries/qt-6/default.nix   |   5 +
 .../qt-6/tests/wrap-qt-apps-hook.nix          | 162 ++++++++++++++++++
 pkgs/test/default.nix                         |  10 ++
 4 files changed, 182 insertions(+)
 create mode 100644 pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix

diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index 6302d6ab5b31..735afc3c5146 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -10,6 +10,7 @@
   generateSplicesForMkScope,
   lib,
   stdenv,
+  callPackages,
   gcc14Stdenv,
   fetchurl,
   fetchgit,
@@ -297,6 +298,7 @@ let
 
       wrapQtAppsHook = callPackage (
         {
+          wrapQtAppsHook,
           makeBinaryWrapper,
           qtbase,
           qtwayland,
@@ -308,6 +310,9 @@ let
             makeBinaryWrapper
           ]
           ++ lib.optional stdenv.hostPlatform.isLinux qtwayland.dev;
+          passthru.tests = callPackages ../../qt-6/tests/wrap-qt-apps-hook.nix {
+            inherit qtbase wrapQtAppsHook;
+          };
           meta.license = lib.licenses.mit;
         } ../hooks/wrap-qt-apps-hook.sh
       ) { };
diff --git a/pkgs/development/libraries/qt-6/default.nix b/pkgs/development/libraries/qt-6/default.nix
index dc7233f11a8c..b8a7afb5496c 100644
--- a/pkgs/development/libraries/qt-6/default.nix
+++ b/pkgs/development/libraries/qt-6/default.nix
@@ -2,6 +2,7 @@
   newScope,
   lib,
   stdenv,
+  callPackages,
   generateSplicesForMkScope,
   makeScopeWithSplicing',
   fetchurl,
@@ -124,6 +125,7 @@ let
 
       wrapQtAppsHook = callPackage (
         {
+          wrapQtAppsHook,
           makeBinaryWrapper,
           qtwayland,
           qtbase,
@@ -134,6 +136,9 @@ let
           depsTargetTargetPropagated = [
             (onlyPluginsAndQml qtbase)
           ];
+          passthru.tests = callPackages ./tests/wrap-qt-apps-hook.nix {
+            inherit qtbase wrapQtAppsHook;
+          };
           meta.license = lib.licenses.mit;
         } ./hooks/wrap-qt-apps-hook.sh
       ) { };
diff --git a/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix b/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
new file mode 100644
index 000000000000..e43ff3b6e3ac
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
@@ -0,0 +1,162 @@
+{
+  lib,
+  qtbase,
+  runCommandLocal,
+  stdenv,
+  wrapQtAppsHook,
+}:
+let
+  testProgram = stdenv.mkDerivation {
+    pname = "qt-wrapper-test-program";
+    version = "0.0.1";
+    __structuredAttrs = true;
+
+    dontUnpack = true;
+
+    src = /* c */ ''
+      #include <stdio.h>
+      #include <stdlib.h>
+      #include <string.h>
+
+      int main(void) {
+          const char *wrapperTest = getenv("WRAPPER_TEST");
+          if (!wrapperTest || strcmp(wrapperTest, "expected") != 0) {
+              fprintf(stderr,
+                      "expected WRAPPER_TEST=expected, got=%s\n",
+                      wrapperTest);
+              return 1;
+          }
+
+          const char *plugin_path = getenv("QT_PLUGIN_PATH");
+          if (!plugin_path) {
+              fprintf(stderr, "QT_PLUGIN_PATH not set\n");
+              return 1;
+          }
+
+          if (!strstr(plugin_path,
+                      "${qtbase}/${qtbase.qtPluginPrefix}")) {
+              fprintf(stderr,
+                      "QT_PLUGIN_PATH missing Qt plugin dir:\n%s\n",
+                      plugin_path);
+              return 1;
+          }
+
+          return 0;
+      }
+    '';
+
+    buildPhase = ''
+      "$CC" -x c - -o test <<<"$src"
+    '';
+
+    installPhase = ''
+      mkdir -p $out/bin
+      install -m755 test $out/bin/test
+    '';
+
+    meta.mainProgram = "test";
+  };
+
+  # Test that wrapQtAppsHook produces the expected qtWrapperArgs bash array
+  checkWrapperArgsArray =
+    {
+      name,
+      qtWrapperArgs,
+    }:
+    runCommandLocal "${name}-check-qtWrapperArgs"
+      {
+        inherit qtWrapperArgs;
+        buildInputs = [ qtbase ];
+        nativeBuildInputs = [ wrapQtAppsHook ];
+      }
+      ''
+        ${lib.toShellVars {
+          # The resulting array should start with the exact user-defined args:
+          userDefinedArgs = qtWrapperArgs;
+
+          # The hook's setup should also add internal flags, including:
+          internalArgs = [
+            "QT_PLUGIN_PATH"
+            "${qtbase}/${qtbase.qtPluginPrefix}"
+          ];
+        }}
+
+        # The hook should have run its setup already, converting qtWrapperArgs
+        # to an array and appending internal flags.
+        type=$(declare -p qtWrapperArgs)
+        [[ "$type" == "declare -"*a* ]] || {
+          echo "Expected qtWrapperArgs to be an array, found: ''${type%%=*}" >&2
+          exit 1
+        }
+
+        # The start of the array should equal the user-defined args
+        for i in "''${!userDefinedArgs[@]}"; do
+          actual="''${qtWrapperArgs[$i]}"
+          expected="''${userDefinedArgs[$i]}"
+          [ "$expected" = "$actual" ] || {
+            echo "qtWrapperArgs[$i]: expected '$expected', found '$actual'" >&2
+            exit 1
+          }
+        done
+
+        # Internal args should be appended to the array
+        internalSlice=("''${qtWrapperArgs[@]:''${#userDefinedArgs[@]}}")
+        for expected in "''${internalArgs[@]}"; do
+          found=
+          for actual in "''${internalSlice[@]}"; do
+            if [ "$expected" = "$actual" ]; then
+              found=1
+              break
+            fi
+          done
+
+          [ -n "$found" ] || {
+            echo "Internal arg '$expected' not found in internal qtWrapperArgs" >&2
+            exit 1
+          }
+        done
+
+        # The hook should've defined the wrapQtAppsHook function
+        [ "$(type -t wrapQtAppsHook)" = function ] || {
+          echo "wrapQtAppsHook is not declared as a function" >&2
+          exit 1
+        }
+
+        touch "$out"
+      '';
+in
+
+{
+
+  simple = checkWrapperArgsArray {
+    name = "simple";
+    qtWrapperArgs = [
+      "--chdir"
+      "/foo"
+    ];
+  };
+
+  # Integration test: assert program is wrapped with the expected environment
+  runtime =
+    runCommandLocal "simple-wrapper-runtime"
+      {
+        qtWrapperArgs = [
+          "--set"
+          "WRAPPER_TEST"
+          "expected"
+        ];
+
+        buildInputs = [ qtbase ];
+        nativeBuildInputs = [ wrapQtAppsHook ];
+      }
+      ''
+        # Install the test program
+        mkdir -p "$out/bin"
+        cp ${lib.getExe testProgram} "$out/bin/test"
+
+        # Wrap and run the test
+        wrapQtAppsHook
+        "$out/bin/test"
+      '';
+
+}
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 63e8e2b32aae..d02f45fb4884 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -254,6 +254,16 @@ in
     ) pkgs.arrayUtilities
   );
 
+  # Accumulate all passthru.tests from qt5 into a single attribute set.
+  qt5 = recurseIntoAttrs {
+    wrapQtAppsHook = recurseIntoAttrs pkgs.qt5.wrapQtAppsHook.passthru.tests;
+  };
+
+  # Accumulate all passthru.tests from qt6 into a single attribute set.
+  qt6 = recurseIntoAttrs {
+    wrapQtAppsHook = recurseIntoAttrs pkgs.qt6.wrapQtAppsHook.passthru.tests;
+  };
+
   srcOnly = callPackage ../build-support/src-only/tests.nix { };
 
   systemd = callPackage ./systemd { };

From cd5e77db802275de6b21c6eccde59f1f4b88d4f4 Mon Sep 17 00:00:00 2001
From: Matt Sturgeon <matt@sturgeon.me.uk>
Date: Sun, 31 May 2026 10:40:59 +0100
Subject: [PATCH 519/831] wrapQtAppsHook: support structuredAttrs

With `__structuredAttrs = true`, `qtWrapperArgs` is provided as an
array; without it, it is provided as a string.

Use stdenv's `concatTo` helper to normalize `qtWrapperArgs` to a bash
array, regardless of its representation.

Adjust the hook's tests to cover both __structuredAttrs true and false.
---
 .../libraries/qt-5/hooks/wrap-qt-apps-hook.sh    |  7 +++++--
 .../libraries/qt-6/hooks/wrap-qt-apps-hook.sh    |  7 +++++--
 .../libraries/qt-6/tests/wrap-qt-apps-hook.nix   | 16 ++++++++++++++--
 3 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index 6f7cdac0c941..0bbdeea1796a 100644
--- a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -3,8 +3,11 @@ __nix_wrapQtAppsHook=1
 # wrap only once per output
 declare -a qtWrapperDoneForOuputs
 
-# Inherit arguments given in mkDerivation
-qtWrapperArgs=( ${qtWrapperArgs-} )
+# Normalize qtWrapperArgs to an array
+declare -a _qtWrapperArgsTmp
+concatTo _qtWrapperArgsTmp qtWrapperArgs
+qtWrapperArgs=("${_qtWrapperArgsTmp[@]}")
+unset _qtWrapperArgsTmp
 
 qtHostPathSeen=()
 
diff --git a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
index 18056b9ddf3b..248d00b3dda2 100644
--- a/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
+++ b/pkgs/development/libraries/qt-6/hooks/wrap-qt-apps-hook.sh
@@ -3,8 +3,11 @@ if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
     # wrap only once per output
     declare -a qtWrapperDoneForOuputs
 
-    # Inherit arguments given in mkDerivation
-    qtWrapperArgs=(${qtWrapperArgs-})
+    # Normalize qtWrapperArgs to an array
+    declare -a _qtWrapperArgsTmp
+    concatTo _qtWrapperArgsTmp qtWrapperArgs
+    qtWrapperArgs=("${_qtWrapperArgsTmp[@]}")
+    unset _qtWrapperArgsTmp
 
     qtHostPathSeen=()
 
diff --git a/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix b/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
index e43ff3b6e3ac..e9010031e879 100644
--- a/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
+++ b/pkgs/development/libraries/qt-6/tests/wrap-qt-apps-hook.nix
@@ -68,6 +68,7 @@ let
         inherit qtWrapperArgs;
         buildInputs = [ qtbase ];
         nativeBuildInputs = [ wrapQtAppsHook ];
+        __structuredAttrs = true;
       }
       ''
         ${lib.toShellVars {
@@ -126,7 +127,7 @@ let
       '';
 in
 
-{
+lib.fix (self: {
 
   simple = checkWrapperArgsArray {
     name = "simple";
@@ -136,6 +137,11 @@ in
     ];
   };
 
+  simple-no-structuredAttrs = self.simple.overrideAttrs (prevAttrs: {
+    name = prevAttrs.name + "-no-structuredAttrs";
+    __structuredAttrs = false;
+  });
+
   # Integration test: assert program is wrapped with the expected environment
   runtime =
     runCommandLocal "simple-wrapper-runtime"
@@ -148,6 +154,7 @@ in
 
         buildInputs = [ qtbase ];
         nativeBuildInputs = [ wrapQtAppsHook ];
+        __structuredAttrs = true;
       }
       ''
         # Install the test program
@@ -159,4 +166,9 @@ in
         "$out/bin/test"
       '';
 
-}
+  runtime-no-structuredAttrs = self.runtime.overrideAttrs (prevAttrs: {
+    name = prevAttrs.name + "-no-structuredAttrs";
+    __structuredAttrs = false;
+  });
+
+})

From 00afd89038299abbf2c32c34b46299087e94e9a9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 4 Jun 2026 03:32:33 +0200
Subject: [PATCH 520/831] python3Packages.sphinx-autodoc-typehints: 3.10.2 ->
 3.10.5

https://github.com/tox-dev/sphinx-autodoc-typehints/releases/tag/3.10.5
---
 .../python-modules/sphinx-autodoc-typehints/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
index fcfc2e4b9893..a084e1a54962 100644
--- a/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
+++ b/pkgs/development/python-modules/sphinx-autodoc-typehints/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sphinx-autodoc-typehints";
-  version = "3.10.2";
+  version = "3.10.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "sphinx-autodoc-typehints";
     tag = finalAttrs.version;
-    hash = "sha256-ZdUKD8qUWjndhkqnUVk9NoSFgH/Fl2yG7LKHUB4T9CA=";
+    hash = "sha256-ClRfCv3UvUdnSnm5XuyrWj8oFQMSAPb3ZCDokAWI4cE=";
   };
 
   build-system = [

From e1696ec3f65797711183e94344b9dc273a8ab929 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 4 Jun 2026 15:25:22 +0700
Subject: [PATCH 521/831] python3Packages.asgiref: 3.11.0 -> 3.11.1

Release: https://github.com/django/asgiref/releases/tag/3.11.1
Diff: https://github.com/django/asgiref/compare/3.11.0...3.11.1
---
 pkgs/development/python-modules/asgiref/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
index c0740de29df9..516fb48f8b5f 100644
--- a/pkgs/development/python-modules/asgiref/default.nix
+++ b/pkgs/development/python-modules/asgiref/default.nix
@@ -10,7 +10,7 @@
 }:
 
 buildPythonPackage (finalAttrs: {
-  version = "3.11.0";
+  version = "3.11.1";
   pname = "asgiref";
   pyproject = true;
 
@@ -18,7 +18,7 @@ buildPythonPackage (finalAttrs: {
     owner = "django";
     repo = "asgiref";
     tag = finalAttrs.version;
-    hash = "sha256-2ZaUIWGF5cQVNj95b7WiKGsn2wYsoJmJ/CfPhIEZdjc=";
+    hash = "sha256-Mhnaowgv5a+O2hN0ZSdtdhCBQx8HoKSwtRC3gHodgKY=";
   };
 
   build-system = [ setuptools ];

From 1d5b338a702df84b5bca635b589a23ef88cbe4ae Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 4 Jun 2026 14:32:05 +0200
Subject: [PATCH 522/831] coqPackages_8_20.coq-elpi: fix build

coqPackages_8_20.stalmarck-tactic: fix build
---
 pkgs/applications/science/logic/coq/default.nix    | 14 ++++++++++++++
 pkgs/by-name/du/dune/package.nix                   |  1 +
 pkgs/development/coq-modules/coq-elpi/default.nix  |  3 ++-
 pkgs/development/coq-modules/stalmarck/default.nix |  3 ++-
 pkgs/top-level/coq-packages.nix                    |  1 +
 5 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/logic/coq/default.nix b/pkgs/applications/science/logic/coq/default.nix
index a5f7e9e861aa..cee47f70a062 100644
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -105,11 +105,25 @@ let
     substituteInPlace plugins/micromega/sos.ml --replace "; csdp" "; ${csdp}/bin/csdp"
     substituteInPlace plugins/micromega/coq_micromega.ml --replace "System.is_in_system_path \"csdp\"" "true"
   '';
+  dune =
+    if lib.versions.isEq coq-version "8.20" then
+      args.dune.override { version = "3.21.1"; }
+    else
+      args.dune;
   ocamlPackages =
     if customOCamlPackages != null then
       customOCamlPackages
     else
       lib.switch coq-version [
+        {
+          case = lib.versions.isEq "8.20";
+          out = ocamlPackages_4_14.overrideScope (
+            self: super: {
+              inherit dune;
+              dune_3 = dune;
+            }
+          );
+        }
         {
           case = lib.versions.range "8.16" "9.1";
           out = ocamlPackages_4_14;
diff --git a/pkgs/by-name/du/dune/package.nix b/pkgs/by-name/du/dune/package.nix
index e4aa233bf37b..0dfaf0a82ca8 100644
--- a/pkgs/by-name/du/dune/package.nix
+++ b/pkgs/by-name/du/dune/package.nix
@@ -22,6 +22,7 @@ stdenv.mkDerivation {
     hash =
       {
         "3.22.2" = "sha256-wsz4vGsXr6R8RQKXNXSWMDqnyGgOMpt52Yxo41AToRg=";
+        "3.21.1" = "sha256-hPeoLG2ApxJPOEfppInoDPvq+3vtNXOsAShu9W/QjZQ=";
         "2.9.3" = "sha256:1ml8bxym8sdfz25bx947al7cvsi2zg5lcv7x9w6xb01cmdryqr9y";
       }
       ."${version}";
diff --git a/pkgs/development/coq-modules/coq-elpi/default.nix b/pkgs/development/coq-modules/coq-elpi/default.nix
index b0134851418b..0f8f15d72388 100644
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@@ -2,6 +2,7 @@
   lib,
   mkCoqDerivation,
   which,
+  dune,
   coq,
   stdlib,
   version ? null,
@@ -33,7 +34,7 @@ let
   propagatedBuildInputs_wo_elpi = [
     coq.ocamlPackages.findlib
   ];
-  derivation = mkCoqDerivation {
+  derivation = mkCoqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
     pname = "elpi";
     repo = "coq-elpi";
     owner = "LPCIC";
diff --git a/pkgs/development/coq-modules/stalmarck/default.nix b/pkgs/development/coq-modules/stalmarck/default.nix
index e493321d8a0a..369fea9639e3 100644
--- a/pkgs/development/coq-modules/stalmarck/default.nix
+++ b/pkgs/development/coq-modules/stalmarck/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   mkCoqDerivation,
+  dune,
   coq,
   stdlib,
   version ? null,
@@ -38,7 +39,7 @@ let
         else
           "A two-level approach to prove tautologies using Stålmarck's algorithm in Coq.";
     in
-    mkCoqDerivation {
+    mkCoqDerivation.override { dune = dune.override { version = "3.21.1"; }; } {
       inherit
         version
         pname
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index b2cd7f2ada19..a93fb26666c9 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -17,6 +17,7 @@
   fetchpatch,
   makeWrapper,
   coq2html,
+  dune,
 }@args:
 let
   lib = import ../build-support/coq/extra-lib.nix { inherit (args) lib; };

From d59aeb80e50481c69e9535b6421c84a4a398531f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 4 Jun 2026 17:38:16 +0200
Subject: [PATCH 523/831] perl: backport security fixes

Perl ships with some CPAN modules vendored as "dual-life", this commit
inject updated versions certain modules directly from CPAN rather than
applying patches from upstream, as they can be tricky to maintain.

It also includes a patch for CVE-2026-8376 which affects 32-bit
platforms.

- perl: CVE-2026-8376
  https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c

- HTTP-Tiny 0.094: CVE-2026-7010
  https://metacpan.org/release/HAARG/HTTP-Tiny-0.094/changes

- Compress-Raw-Zlib 2.222: CVE-2026-3381, CVE-2026-4176
  https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.222/changes

- Compress-Raw-Bzip2 2.218
  https://metacpan.org/release/PMQS/Compress-Raw-Bzip2-2.218/changes

- IO-Compress 2.220: CVE-2026-48959, CVE-2026-48961, CVE-2026-48962
  https://metacpan.org/release/PMQS/IO-Compress-2.220/changes

- Archive-Tar 3.12: CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
  https://metacpan.org/release/BINGOS/Archive-Tar-3.12/changes

Assisted-by: Codex (OpenAI)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../interpreters/perl/CVE-2026-8376.patch     | 20 ++++++
 .../interpreters/perl/interpreter.nix         | 65 +++++++++++++++++--
 2 files changed, 81 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/interpreters/perl/CVE-2026-8376.patch

diff --git a/pkgs/development/interpreters/perl/CVE-2026-8376.patch b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
new file mode 100644
index 000000000000..c8ad72298178
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
@@ -0,0 +1,20 @@
+Targeted patch for CVE-2026-8376, based on 5e7f119eb2bb1181be908701f22bf7068e722f1c but avoids changes to t/re/pat_psycho.t as they do not apply cleanly.
+
+diff --git a/regcomp_study.c b/regcomp_study.c
+index b513454a4258..1602663f4b26 100644
+--- a/regcomp_study.c
++++ b/regcomp_study.c
+@@ -2784,6 +2784,13 @@ Perl_study_chunk(pTHX_
+                                                (U8 *) SvEND(data->last_found))
+                                 - (U8*)s;
+                         l -= old;
++
++                        if (l > 0 &&
++                            (mincount >= SSize_t_MAX / (SSize_t)l
++                             || old > SSize_t_MAX - mincount * (SSize_t)l)) {
++                            FAIL("Regexp out of space");
++                        }
++
+                         /* Get the added string: */
+                         last_str = newSVpvn_utf8(s  + old, l, UTF);
+                         last_chrs = UTF ? utf8_length((U8*)(s + old),
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index fce8e1c9e0f0..cdb03912b517 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -36,6 +36,8 @@ let
   commonPatches = [
     # Do not look in /usr etc. for dependencies.
     ./no-sys-dirs.patch
+
+    ./CVE-2026-8376.patch
   ]
 
   # Fix build on Solaris on x86_64
@@ -79,6 +81,61 @@ let
   # Some more details: https://arsv.github.io/perl-cross/modules.html
   ++ lib.optional crossCompiling ./cross.patch;
 
+  # Inject fixed CPAN releases for bundled dual-life distributions until the
+  # next perl maintenance release includes them.
+  vendoredPerlDistributions = [
+    {
+      # CVE-2026-7010
+      path = "cpan/HTTP-Tiny";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/H/HA/HAARG/HTTP-Tiny-0.094.tar.gz";
+        hash = "sha256-poQemfwbVdFd6VlHzL17dnvsxRxxAhl/qPBE333cB0M=";
+      };
+    }
+    {
+      # CVE-2026-3381, CVE-2026-4176
+      path = "cpan/Compress-Raw-Zlib";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.222.tar.gz";
+        hash = "sha256-Hf19URplVifIGBXTDTurwo+luIRV/wP4sECZ3LUShrg=";
+      };
+    }
+    {
+      # Runtime dependency of IO-Compress 2.220.
+      path = "cpan/Compress-Raw-Bzip2";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.218.tar.gz";
+        hash = "sha256-iRU+ai69pSNJSTsHT6S3VJ/x+QU952E8GKXgXFtBX6g=";
+      };
+    }
+    {
+      # CVE-2026-48962, CVE-2026-48961, CVE-2026-48959
+      path = "cpan/IO-Compress";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
+        hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
+      };
+    }
+    {
+      # CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
+      path = "cpan/Archive-Tar";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz";
+        hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw=";
+      };
+    }
+  ];
+
+  replaceVendoredPerlDistributions = lib.concatMapStringsSep "\n" (d: ''
+    rm -rf ${d.path}
+    mkdir -p ${d.path}
+
+    tar --strip-components=1 -C ${d.path} -xf ${d.src}
+
+    # Remove executable bits to make t/porting/exec-bit.t happy.
+    find ${d.path} -type f -exec chmod a-x {} +
+  '') vendoredPerlDistributions;
+
   libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
   libcInc = lib.getDev libc;
   libcLib = lib.getLib libc;
@@ -136,10 +193,10 @@ stdenv.mkDerivation (
               --replace "/bin/pwd" "$(type -P pwd)"
           ''
       )
-      +
-      # Perl's build system uses the src variable, and its value may end up in
-      # the output in some cases (when cross-compiling)
-      ''
+      + replaceVendoredPerlDistributions
+      + ''
+        # Perl's build system uses the src variable, and its value may end up in
+        # the output in some cases (when cross-compiling).
         unset src
       '';
 

From a42608a7a8c0d84c9ef80ab8acb05507052e6bbb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 4 Jun 2026 09:47:51 -0700
Subject: [PATCH 524/831] krb5: patch CVE-2026-40355 and CVE-2026-40356

---
 .../CVE-2026-40355-and-CVE-2026-40356.patch   | 61 +++++++++++++++++++
 pkgs/by-name/kr/krb5/package.nix              |  6 +-
 2 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch

diff --git a/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch b/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch
new file mode 100644
index 000000000000..fe37f894fdc4
--- /dev/null
+++ b/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch
@@ -0,0 +1,61 @@
+From acea6182e46fff3d1d64a3172cdff307b07ca441 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 8 Apr 2026 17:57:59 -0400
+Subject: [PATCH] Fix two NegoEx parsing vulnerabilities
+
+In parse_nego_message(), check the result of the second call to
+vector_base() before dereferencing it.  In parse_message(), check for
+a short header_len to prevent an integer underflow when calculating
+the remaining message length.
+
+Reported by Cem Onat Karagun.
+
+CVE-2026-40355:
+
+In MIT krb5 release 1.18 and later, if an application calls
+gss_accept_sec_context() on a system with a NegoEx mechanism
+registered in /etc/gss/mech, an unauthenticated remote attacker can
+trigger a null pointer dereference, causing the process to terminate.
+
+CVE-2026-40356:
+
+In MIT krb5 release 1.18 and later, if an application calls
+gss_accept_sec_context() on a system with a NegoEx mechanism
+registered in /etc/gss/mech, an unauthenticated remote attacker can
+trigger a read overrun of up to 52 bytes, possibly causing the process
+to terminate.  Exfiltration of the bytes read does not appear
+possible.
+
+(cherry picked from commit 2e75f0d9362fb979f5fc92829431a590a130929f)
+
+ticket: 9205
+version_fixed: 1.22.3
+---
+ lib/gssapi/spnego/negoex_util.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/gssapi/spnego/negoex_util.c b/src/lib/gssapi/spnego/negoex_util.c
+index edc5462e844..a65238e5730 100644
+--- a/lib/gssapi/spnego/negoex_util.c
++++ b/lib/gssapi/spnego/negoex_util.c
+@@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in,
+     offset = k5_input_get_uint32_le(in);
+     count = k5_input_get_uint16_le(in);
+     p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len);
++    if (p == NULL) {
++        *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
++        return GSS_S_DEFECTIVE_TOKEN;
++    }
+     for (i = 0; i < count; i++) {
+         extension_type = load_32_le(p + i * EXTENSION_LENGTH);
+         if (extension_type & EXTENSION_FLAG_CRITICAL) {
+@@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in,
+     msg_len = k5_input_get_uint32_le(in);
+     conv_id = k5_input_get_bytes(in, GUID_LENGTH);
+ 
+-    if (in->status || msg_len > token_remaining || header_len > msg_len) {
++    if (in->status || msg_len > token_remaining ||
++        header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) {
+         *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
+         return GSS_S_DEFECTIVE_TOKEN;
+     }
diff --git a/pkgs/by-name/kr/krb5/package.nix b/pkgs/by-name/kr/krb5/package.nix
index 3c402ff11721..c4e35061d41a 100644
--- a/pkgs/by-name/kr/krb5/package.nix
+++ b/pkgs/by-name/kr/krb5/package.nix
@@ -43,7 +43,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-MkP/vI6k1Kwi3cfdKh3FTFeHTEBki2D/lwCXY1VOrxM=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isFreeBSD [
+  patches = [
+    # https://github.com/krb5/krb5/pull/1506
+    ./CVE-2026-40355-and-CVE-2026-40356.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
     (fetchpatch {
       name = "fix-missing-ENODATA.patch";
       url = "https://cgit.freebsd.org/ports/plain/security/krb5-122/files/patch-lib_krad_packet.c?id=0501f716c4aff7880fde56e42d641ef504593b7d";

From 41a37cc08306ebf7b9036d364f9e4266ec3600b3 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Thu, 4 Jun 2026 22:08:37 +0200
Subject: [PATCH 525/831] apparmor-parser: pick upstream patch for yacc
 format-security issues

---
 pkgs/by-name/ap/apparmor-parser/package.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ap/apparmor-parser/package.nix b/pkgs/by-name/ap/apparmor-parser/package.nix
index 0191929c5efe..de39713f0c10 100644
--- a/pkgs/by-name/ap/apparmor-parser/package.nix
+++ b/pkgs/by-name/ap/apparmor-parser/package.nix
@@ -7,6 +7,7 @@
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   buildPackages,
   zstd,
+  fetchpatch,
 
   # apparmor deps
   libapparmor,
@@ -34,15 +35,17 @@ stdenv.mkDerivation (finalAttrs: {
 
     substituteInPlace Makefile \
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-
-    # strict format check causes yacc auto-generated code to fail.
-    # This is known, see https://gitlab.com/apparmor/apparmor/-/merge_requests/2039
-    # removing the compile-time check here downgrades the issue and allows compilation to succeed
-    substituteInPlace parser.h \
-      --replace-fail 'extern void yyerror(const char *msg, ...) __attribute__((noreturn, format(printf, 1, 2)));' \
-        'extern void yyerror(const char *msg, ...);'
   '';
 
+  patches = [
+    (fetchpatch {
+      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
+      # Patches generated yacc parser code to compile with format-security
+      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
+      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
+    })
+  ];
+
   nativeBuildInputs = [
     bison
     flex

From 1248ec4209746baabbda8bea23f4333f5aef8f1c Mon Sep 17 00:00:00 2001
From: Aaron Andersen <aaron@fosslib.net>
Date: Thu, 4 Jun 2026 21:23:45 -0400
Subject: [PATCH 526/831] seatd: replace systemd dependency with systemdLibs

---
 pkgs/by-name/se/seatd/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/seatd/package.nix b/pkgs/by-name/se/seatd/package.nix
index 7c11389a81c5..759ac9650f53 100644
--- a/pkgs/by-name/se/seatd/package.nix
+++ b/pkgs/by-name/se/seatd/package.nix
@@ -6,8 +6,8 @@
   pkg-config,
   scdoc,
   stdenv,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   nixosTests,
 }:
 
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     scdoc
   ];
 
-  buildInputs = lib.optionals systemdSupport [ systemd ];
+  buildInputs = lib.optionals systemdSupport [ systemdLibs ];
 
   mesonFlags = [
     "-Dlibseat-logind=${if systemdSupport then "systemd" else "disabled"}"

From 439b608eaad9ebf2865ac28173b4b1a8b10e7a97 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 4 Jun 2026 19:41:36 +0700
Subject: [PATCH 527/831] python3Packages.appnope: migrate to pyproject

---
 pkgs/development/python-modules/appnope/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/appnope/default.nix b/pkgs/development/python-modules/appnope/default.nix
index 55a66aaf8271..3bf73257df54 100644
--- a/pkgs/development/python-modules/appnope/default.nix
+++ b/pkgs/development/python-modules/appnope/default.nix
@@ -2,13 +2,14 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "appnope";
   version = "0.1.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "minrk";
@@ -17,6 +18,8 @@ buildPythonPackage rec {
     hash = "sha256-We7sZKVbQFIMdZpS+VMdi0RH1O/qtFNrfJNg/98tO5A=";
   };
 
+  build-system = [ setuptools ];
+
   checkInputs = [ pytestCheckHook ];
 
   meta = {

From ff068130907f799841650773ab49b0ed07a40c75 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 4 Jun 2026 19:47:12 +0700
Subject: [PATCH 528/831] python3Packages.appnope: modernize

---
 pkgs/development/python-modules/appnope/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/appnope/default.nix b/pkgs/development/python-modules/appnope/default.nix
index 3bf73257df54..3a621522f28b 100644
--- a/pkgs/development/python-modules/appnope/default.nix
+++ b/pkgs/development/python-modules/appnope/default.nix
@@ -6,7 +6,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "appnope";
   version = "0.1.4";
   pyproject = true;
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "minrk";
     repo = "appnope";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-We7sZKVbQFIMdZpS+VMdi0RH1O/qtFNrfJNg/98tO5A=";
   };
 
@@ -22,6 +22,8 @@ buildPythonPackage rec {
 
   checkInputs = [ pytestCheckHook ];
 
+  pythonImportsCheck = [ "appnope" ];
+
   meta = {
     description = "Disable App Nap on macOS";
     homepage = "https://github.com/minrk/appnope";
@@ -29,4 +31,4 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [ OPNA2608 ];
     # Not Darwin-specific because dummy fallback may be used cross-platform
   };
-}
+})

From bf40241078d01a2c76bcfdc04fbc534574c0d908 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Thu, 4 Jun 2026 19:51:05 +0700
Subject: [PATCH 529/831] python3Packages.appnope: add meta.changelog

---
 pkgs/development/python-modules/appnope/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/appnope/default.nix b/pkgs/development/python-modules/appnope/default.nix
index 3a621522f28b..12e720eb3618 100644
--- a/pkgs/development/python-modules/appnope/default.nix
+++ b/pkgs/development/python-modules/appnope/default.nix
@@ -27,6 +27,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Disable App Nap on macOS";
     homepage = "https://github.com/minrk/appnope";
+    changelog = "https://github.com/minrk/appnope/releases/tag/${finalAttrs.version}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ OPNA2608 ];
     # Not Darwin-specific because dummy fallback may be used cross-platform

From 54439a1843c029099bcb8a82ca0afc089148e9e7 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Fri, 5 Jun 2026 06:41:48 +0300
Subject: [PATCH 530/831] procps: enable `__structuredAttrs` & `strictDeps`

---
 pkgs/os-specific/linux/procps-ng/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index ecd877096f93..b12df1dce429 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [ "usrbin_execdir=$(out)/bin" ] ++ lib.optionals watchOnly [ "src/watch" ];
 
   enableParallelBuilding = true;
+  strictDeps = true;
+  __structuredAttrs = true;
 
   # Too red; 8bit support for fixing https://github.com/NixOS/nixpkgs/issues/275220
   configureFlags = [

From d4e5c45837e5dedccf65e60f9955e5661a9af9fb Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Fri, 5 Jun 2026 06:43:42 +0300
Subject: [PATCH 531/831] procps: add `doc`, `man`, `dev` outputs

---
 pkgs/os-specific/linux/procps-ng/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index b12df1dce429..ff53296d9aba 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -31,6 +31,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Z76m+8OkKlNaAjDJ6JHl3ftNnTlCLUZWWimQ0azhUhY=";
   };
 
+  outputs = [
+    "out"
+    "man"
+    "dev"
+  ]
+  ++ lib.optionals (!watchOnly) [
+    "doc"
+  ];
+
   buildInputs = [ ncurses ] ++ lib.optionals withSystemd [ systemdLibs ];
   nativeBuildInputs = [
     pkg-config

From 316db7c96c1096ae2bf0a40bdec1fc630e1498a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Fri, 5 Jun 2026 12:52:54 +0200
Subject: [PATCH 532/831] libpng: 1.6.56 -> 1.6.58

Fixes: CVE-2026-34757 and CVE-2026-40930 (#528286)
---
 pkgs/by-name/li/libpng/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/li/libpng/package.nix b/pkgs/by-name/li/libpng/package.nix
index d533f3ed56bb..7d52bcffb378 100644
--- a/pkgs/by-name/li/libpng/package.nix
+++ b/pkgs/by-name/li/libpng/package.nix
@@ -11,10 +11,10 @@
 assert zlib != null;
 
 let
-  patchVersion = "1.6.56";
+  patchVersion = "1.6.58";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    hash = "sha256-nOMtSidjoqxfJYcmui9J6QETJ8HujDCGKjLQ8wiJ++g=";
+    hash = "sha256-7ufeoi7VAoaAF5cchsY8TtHmCF3guuv9zD0zIvAPPrA=";
   };
   whenPatched = lib.optionalString apngSupport;
 
@@ -24,11 +24,11 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "libpng" + whenPatched "-apng";
-  version = "1.6.56";
+  version = "1.6.58";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${finalAttrs.version}.tar.xz";
-    hash = "sha256-99i/FgG3gE9YOiVKs0OmVJymzyfSVcMCxHry2dNqbxg=";
+    hash = "sha256-KOtAP1Hw90BSSRMs7P6C6lwO+X8bMsWmWCiBSuDTR3U=";
   };
   postPatch =
     whenPatched "gunzip < ${patch_src} | patch -Np1"

From e049e243cb58d7e4430aec87f7b5ccb66a12e66b Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Fri, 5 Jun 2026 08:45:42 -0400
Subject: [PATCH 533/831] groff: set meta.mainProgram

---
 pkgs/by-name/gr/groff/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/gr/groff/package.nix b/pkgs/by-name/gr/groff/package.nix
index a824d9a82f02..260dda44e791 100644
--- a/pkgs/by-name/gr/groff/package.nix
+++ b/pkgs/by-name/gr/groff/package.nix
@@ -193,6 +193,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ pSub ];
+    mainProgram = "groff";
 
     longDescription = ''
       groff is the GNU implementation of troff, a document formatting

From a3cd26c1e597242b9748b2c9826259d0bb258fa5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 5 Jun 2026 12:08:29 -0700
Subject: [PATCH 534/831] bluez: support libical 4.0

---
 pkgs/by-name/bl/bluez/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/bl/bluez/package.nix b/pkgs/by-name/bl/bluez/package.nix
index 20a9bcce09da..81ec00b045ca 100644
--- a/pkgs/by-name/bl/bluez/package.nix
+++ b/pkgs/by-name/bl/bluez/package.nix
@@ -44,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=21e13976f2e375d701b8b7032ba5c1b2e56c305f";
       hash = "sha256-JrdmYiC+U0KeMP8oVg12Z8CvkMEKWBVgiiUACx0E7dY=";
     })
+    (fetchpatch2 {
+      name = "support-libical-4.0.patch";
+      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=e60d07255327db3fc4e3a28d7fcc792cd42c34d0";
+      hash = "sha256-1uw+5nTjh+t1/L++fRNIlQWblwDwTJifH0EvAn3dym8=";
+    })
     ./lreadline.patch
   ];
 

From 42ccf4cdaf07008fd84ddcf385b104558d526d7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 5 Jun 2026 13:14:40 -0700
Subject: [PATCH 535/831] Revert "libical: 3.0.20 -> 4.0.2"

This reverts commit aca9a4c78cacffd210b8e55ba9f47ae3fe372ac5 because it
broke too many reverse dependencies.
---
 pkgs/by-name/li/libical/package.nix           |  26 ++-
 .../li/libical/respect-env-tzdir.patch        |  29 +++
 pkgs/by-name/li/libical/static.patch          | 205 ++++++++++++++++++
 3 files changed, 250 insertions(+), 10 deletions(-)
 create mode 100644 pkgs/by-name/li/libical/respect-env-tzdir.patch
 create mode 100644 pkgs/by-name/li/libical/static.patch

diff --git a/pkgs/by-name/li/libical/package.nix b/pkgs/by-name/li/libical/package.nix
index e0366ede8ad7..63b3fae8a7ec 100644
--- a/pkgs/by-name/li/libical/package.nix
+++ b/pkgs/by-name/li/libical/package.nix
@@ -16,7 +16,6 @@
   fixDarwinDylibNames,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
-    && !stdenv.hostPlatform.isStatic
     && stdenv.hostPlatform.emulatorAvailable buildPackages,
   buildPackages,
   gobject-introspection,
@@ -25,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libical";
-  version = "4.0.2";
+  version = "3.0.20";
 
   outputs = [
     "out"
@@ -35,8 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libical";
     repo = "libical";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-xrPG3FBUY5OCEHBqcNN4Rj4c4j7kLXUsC0hXRRh76Vg=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-KIMqZ6QAh+fTcKEYrcLlxgip91CLAwL9rwjUdKzBsQk=";
   };
 
   strictDeps = true;
@@ -80,17 +79,24 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DLIBICAL_GLIB_BUILD_DOCS=False"
+    "-DENABLE_GTK_DOC=False"
     "-DLIBICAL_BUILD_EXAMPLES=False"
-    "-DLIBICAL_JAVA_BINDINGS=False"
-    "-DLIBICAL_GOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
-    "-DLIBICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
-    "-DLIBICAL_STATIC=${if stdenv.hostPlatform.isStatic then "True" else "False"}"
+    "-DGOBJECT_INTROSPECTION=${if withIntrospection then "True" else "False"}"
+    "-DICAL_GLIB_VAPI=${if withIntrospection then "True" else "False"}"
+    "-DSTATIC_ONLY=${if stdenv.hostPlatform.isStatic then "True" else "False"}"
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "-DIMPORT_ICAL_GLIB_SRC_GENERATOR=${lib.getDev pkgsBuildBuild.libical}/lib/cmake/LibIcal/IcalGlibSrcGenerator.cmake"
   ];
 
+  patches = [
+    # Will appear in 3.1.0
+    # https://github.com/libical/libical/issues/350
+    ./respect-env-tzdir.patch
+
+    ./static.patch
+  ];
+
   # Using install check so we do not have to manually set GI_TYPELIB_PATH
   # Musl does not support TZDIR.
   doInstallCheck = !stdenv.hostPlatform.isMusl;
@@ -118,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/libical/libical";
     description = "Open Source implementation of the iCalendar protocols";
-    changelog = "https://github.com/libical/libical/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/libical/libical/raw/v${finalAttrs.version}/ReleaseNotes.txt";
     license = lib.licenses.mpl20;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/li/libical/respect-env-tzdir.patch b/pkgs/by-name/li/libical/respect-env-tzdir.patch
new file mode 100644
index 000000000000..59d23e490e5a
--- /dev/null
+++ b/pkgs/by-name/li/libical/respect-env-tzdir.patch
@@ -0,0 +1,29 @@
+--- a/src/libical/icaltz-util.c
++++ b/src/libical/icaltz-util.c
+@@ -94,9 +94,9 @@
+ static const char *zdir = NULL;
+ 
+ static const char *search_paths[] = {
++    "/etc/zoneinfo",
+     "/usr/share/zoneinfo",
+     "/usr/lib/zoneinfo",
+-    "/etc/zoneinfo",
+     "/usr/share/lib/zoneinfo"
+ };
+ 
+@@ -178,6 +178,15 @@
+     const char *fname = ZONES_TAB_SYSTEM_FILENAME;
+     size_t i, num_search_paths;
+ 
++   const char *env_tzdir = getenv ("TZDIR");
++   if (env_tzdir) {
++       sprintf (file_path, "%s/%s", env_tzdir, fname);
++       if (!access (file_path, F_OK|R_OK)) {
++           zdir = env_tzdir;
++           return;
++       }
++   }
++
+     num_search_paths = sizeof(search_paths) / sizeof(search_paths[0]);
+     for (i = 0; i < num_search_paths; i++) {
+         snprintf(file_path, MAXPATHLEN, "%s/%s", search_paths[i], fname);
diff --git a/pkgs/by-name/li/libical/static.patch b/pkgs/by-name/li/libical/static.patch
new file mode 100644
index 000000000000..23678ecd50a6
--- /dev/null
+++ b/pkgs/by-name/li/libical/static.patch
@@ -0,0 +1,205 @@
+From 38fe473fb2c90960a64ddda5c4305d958d460e05 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Thu, 3 Jul 2025 19:52:23 +0200
+Subject: [PATCH] Link ICU components in the right order
+
+When static linking, a library that refers to symbols in another
+library has to come before the latter library in the linker command
+line.
+
+Before this change, I get linker errors like the following.  With this
+change, no error.
+
+FAILED: src/test/icalrecurtest
+: && /nix/store/m8ggqv2dfrw6raz49ipnnab98cljx1k2-x86_64-unknown-linux-musl-gcc-wrapper-14.3.0/bin/x86_64-unknown-linux-musl-g++ -O2       -fvisibility=hidden       -Weffc++ -Wno-deprecated -Wall -Wextra -Woverloaded-virtual -Winit-self -Wunused       -Wno-div-by-zero -Wundef -Wpointer-arith -Wtype-limits -Wwrite-strings -Wreturn-type -Wunused-but-set-variable -Wlogical-op -Wsizeof-pointer-memaccess -Wreorder -Wformat-security -Wredundant-decls -Wunreachable-code -Wvarargs -D_XOPEN_SOURCE=500 -D_DEFAULT_SOURCE -D_GNU_SOURCE -Wall -Wextra -Wformat -Wformat=2 -Wconversion -Wsign-conversion -Wtrampolines -Wimplicit-fallthrough -Wbidi-chars=any -Wformat-security -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong -fcf-protection=full -fno-delete-null-pointer-checks -fno-strict-overflow -fno-strict-aliasing -O3 -DNDEBUG -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,relro -Wl,--as-needed -Wl,--no-copy-dt-needed-entries -Wl,-z,nodlopen -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,relro -Wl,--as-needed -Wl,--no-copy-dt-needed-entries src/test/CMakeFiles/icalrecurtest.dir/icalrecur_test.c.o -o src/test/icalrecurtest  lib/libical.a  lib/libicalss.a  lib/libicalvcal.a  lib/libical.a  /nix>
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_getAvailable_76':
+(.text.ucal_getAvailable_76+0x1): undefined reference to `uloc_getAvailable_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_countAvailable_76':
+(.text.ucal_countAvailable_76+0x1): undefined reference to `uloc_countAvailable_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao): in function `ucal_getKeywordValuesForLocale_76':
+(.text.ucal_getKeywordValuesForLocale_76+0xec): undefined reference to `ulist_createEmptyList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x132): undefined reference to `ulist_resetList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x260): undefined reference to `ulist_addItemEndList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x2e2): undefined reference to `ulist_containsString_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x2f6): undefined reference to `ulist_addItemEndList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x304): undefined reference to `ulist_deleteList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.ucal_getKeywordValuesForLocale_76+0x333): undefined reference to `ulist_deleteList_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x10): undefined reference to `ulist_close_keyword_values_iterator_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x18): undefined reference to `ulist_count_keyword_values_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x28): undefined reference to `ulist_next_keyword_value_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(ucal.ao):(.data.rel.ro._ZL20defaultKeywordValues+0x30): undefined reference to `ulist_reset_keyword_values_iterator_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::SharedCalendar::~SharedCalendar()':
+(.text._ZN6icu_7614SharedCalendarD2Ev+0x32): undefined reference to `icu_76::SharedObject::~SharedObject()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::BasicCalendarFactory::~BasicCalendarFactory()':
+(.text._ZN6icu_7620BasicCalendarFactoryD2Ev+0xf): undefined reference to `icu_76::LocaleKeyFactory::~LocaleKeyFactory()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::DefaultCalendarFactory::~DefaultCalendarFactory()':
+(.text._ZN6icu_7622DefaultCalendarFactoryD2Ev+0xf): undefined reference to `icu_76::ICUResourceBundleFactory::~ICUResourceBundleFactory()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::CalendarService::~CalendarService()':
+(.text._ZN6icu_7615CalendarServiceD2Ev+0xf): undefined reference to `icu_76::ICULocaleService::~ICULocaleService()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::clone() const':
+(.text._ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE5cloneEv[_ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE5cloneEv]+0x65): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::CalendarService::isDefault() const':
+(.text._ZNK6icu_7615CalendarService9isDefaultEv[_ZNK6icu_7615CalendarService9isDefaultEv]+0x5): undefined reference to `icu_76::ICUService::countFactories() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::initCalendarService(UErrorCode&) [clone .cold]':
+(.text.unlikely._ZN6icu_76L19initCalendarServiceER10UErrorCode+0x16): undefined reference to `icu_76::ICULocaleService::~ICULocaleService()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::initCalendarService(UErrorCode&)':
+(.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xa9): undefined reference to `icu_76::ICULocaleService::ICULocaleService(icu_76::UnicodeString const&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xe1): undefined reference to `icu_76::ICUResourceBundleFactory::ICUResourceBundleFactory()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0xfe): undefined reference to `icu_76::ICUService::registerFactory(icu_76::ICUServiceFactory*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_76L19initCalendarServiceER10UErrorCode+0x12c): undefined reference to `icu_76::LocaleKeyFactory::LocaleKeyFactory(int)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getAvailableLocales(int&)':
+(.text._ZN6icu_768Calendar19getAvailableLocalesERi+0x1): undefined reference to `icu_76::Locale::getAvailableLocales(int&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getLocale(ULocDataLocaleType, UErrorCode&) const':
+(.text._ZNK6icu_768Calendar9getLocaleE18ULocDataLocaleTypeR10UErrorCode+0x34): undefined reference to `icu_76::LocaleBased::getLocale(ULocDataLocaleType, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getLocaleID(ULocDataLocaleType, UErrorCode&) const':
+(.text._ZNK6icu_768Calendar11getLocaleIDE18ULocDataLocaleTypeR10UErrorCode+0x30): undefined reference to `icu_76::LocaleBased::getLocaleID(ULocDataLocaleType, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::~LocaleCacheKey()':
+(.text._ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED2Ev[_ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED5Ev]+0x3b): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::setWeekData(icu_76::Locale const&, char const*, UErrorCode&)':
+(.text._ZN6icu_768Calendar11setWeekDataERKNS_6LocaleEPKcR10UErrorCode+0x31e): undefined reference to `icu_76::LocaleBased::setLocaleIDs(char const*, char const*)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::makeInstance(icu_76::Locale const&, UErrorCode&)':
+(.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0xd2): undefined reference to `icu_76::LocaleUtility::initLocaleFromName(icu_76::UnicodeString const&, icu_76::Locale&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0x112): undefined reference to `icu_76::ICULocaleService::get(icu_76::Locale const&, int, icu_76::Locale*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768Calendar12makeInstanceERKNS_6LocaleER10UErrorCode+0x1d4): undefined reference to `icu_76::ICULocaleService::get(icu_76::Locale const&, int, icu_76::Locale*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::createObject(void const*, UErrorCode&) const':
+(.text._ZNK6icu_7614LocaleCacheKeyINS_14SharedCalendarEE12createObjectEPKvR10UErrorCode+0x69): undefined reference to `icu_76::SharedObject::addRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::DefaultCalendarFactory::create(icu_76::ICUServiceKey const&, icu_76::ICUService const*, UErrorCode&) const':
+(.text._ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x31): undefined reference to `typeinfo for icu_76::LocaleKey'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7622DefaultCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x38): undefined reference to `typeinfo for icu_76::ICUServiceKey'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::BasicCalendarFactory::create(icu_76::ICUServiceKey const&, icu_76::ICUService const*, UErrorCode&) const':
+(.text._ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x33): undefined reference to `typeinfo for icu_76::LocaleKey'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode[_ZNK6icu_7620BasicCalendarFactory6createERKNS_13ICUServiceKeyEPKNS_10ICUServiceER10UErrorCode]+0x3a): undefined reference to `typeinfo for icu_76::ICUServiceKey'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::LocaleCacheKey<icu_76::SharedCalendar>::~LocaleCacheKey()':
+(.text._ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED0Ev[_ZN6icu_7614LocaleCacheKeyINS_14SharedCalendarEED5Ev]+0x36): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `void icu_76::UnifiedCache::getByLocale<icu_76::SharedCalendar>(icu_76::Locale const&, icu_76::SharedCalendar const*&, UErrorCode&)':
+(.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x2e): undefined reference to `icu_76::UnifiedCache::getInstance(UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0xdf): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x123): undefined reference to `icu_76::UnifiedCache::_get(icu_76::CacheKeyBase const&, icu_76::SharedObject const*&, void const*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x141): undefined reference to `icu_76::SharedObject::removeRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x186): undefined reference to `icu_76::SharedObject::removeRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x1a5): undefined reference to `icu_76::SharedObject::addRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode[_ZN6icu_7612UnifiedCache11getByLocaleINS_14SharedCalendarEEEvRKNS_6LocaleERPKT_R10UErrorCode]+0x20c): undefined reference to `icu_76::CacheKeyBase::~CacheKeyBase()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::createInstance(icu_76::TimeZone*, icu_76::Locale const&, UErrorCode&)':
+(.text._ZN6icu_768Calendar14createInstanceEPNS_8TimeZoneERKNS_6LocaleER10UErrorCode+0x56): undefined reference to `icu_76::SharedObject::removeRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao): in function `icu_76::Calendar::getCalendarTypeFromLocale(icu_76::Locale const&, char*, int, UErrorCode&)':
+(.text._ZN6icu_768Calendar25getCalendarTypeFromLocaleERKNS_6LocaleEPciR10UErrorCode+0x69): undefined reference to `icu_76::SharedObject::removeRef() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7614SharedCalendarE[_ZTIN6icu_7614SharedCalendarE]+0x10): undefined reference to `typeinfo for icu_76::SharedObject'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_768CacheKeyINS_14SharedCalendarEEE[_ZTIN6icu_768CacheKeyINS_14SharedCalendarEEE]+0x10): undefined reference to `typeinfo for icu_76::CacheKeyBase'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7620BasicCalendarFactoryE[_ZTIN6icu_7620BasicCalendarFactoryE]+0x10): undefined reference to `typeinfo for icu_76::LocaleKeyFactory'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7622DefaultCalendarFactoryE[_ZTIN6icu_7622DefaultCalendarFactoryE]+0x10): undefined reference to `typeinfo for icu_76::ICUResourceBundleFactory'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTIN6icu_7615CalendarServiceE[_ZTIN6icu_7615CalendarServiceE]+0x10): undefined reference to `typeinfo for icu_76::ICULocaleService'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x20): undefined reference to `icu_76::LocaleKeyFactory::getDynamicClassID() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x38): undefined reference to `icu_76::LocaleKeyFactory::getDisplayName(icu_76::UnicodeString const&, icu_76::Locale const&, icu_76::UnicodeString&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x40): undefined reference to `icu_76::LocaleKeyFactory::handlesKey(icu_76::ICUServiceKey const&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x48): undefined reference to `icu_76::LocaleKeyFactory::handleCreate(icu_76::Locale const&, int, icu_76::ICUService const*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7620BasicCalendarFactoryE[_ZTVN6icu_7620BasicCalendarFactoryE]+0x50): undefined reference to `icu_76::LocaleKeyFactory::getSupportedIDs(UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x20): undefined reference to `icu_76::ICUResourceBundleFactory::getDynamicClassID() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x30): undefined reference to `icu_76::LocaleKeyFactory::updateVisibleIDs(icu_76::Hashtable&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x38): undefined reference to `icu_76::LocaleKeyFactory::getDisplayName(icu_76::UnicodeString const&, icu_76::Locale const&, icu_76::UnicodeString&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x40): undefined reference to `icu_76::LocaleKeyFactory::handlesKey(icu_76::ICUServiceKey const&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x48): undefined reference to `icu_76::ICUResourceBundleFactory::handleCreate(icu_76::Locale const&, int, icu_76::ICUService const*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7622DefaultCalendarFactoryE[_ZTVN6icu_7622DefaultCalendarFactoryE]+0x50): undefined reference to `icu_76::ICUResourceBundleFactory::getSupportedIDs(UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x20): undefined reference to `icu_76::ICUNotifier::addListener(icu_76::EventListener const*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x28): undefined reference to `icu_76::ICUNotifier::removeListener(icu_76::EventListener const*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x30): undefined reference to `icu_76::ICUNotifier::notifyChanged()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x38): undefined reference to `icu_76::ICUService::acceptsListener(icu_76::EventListener const&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x40): undefined reference to `icu_76::ICUService::notifyListener(icu_76::EventListener&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x48): undefined reference to `icu_76::ICUService::getKey(icu_76::ICUServiceKey&, icu_76::UnicodeString*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x50): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::UnicodeString const&, signed char, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x58): undefined reference to `icu_76::ICUService::registerFactory(icu_76::ICUServiceFactory*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x60): undefined reference to `icu_76::ICUService::unregister(void const*, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x68): undefined reference to `icu_76::ICUService::reset()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x78): undefined reference to `icu_76::ICULocaleService::createKey(icu_76::UnicodeString const*, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x88): undefined reference to `icu_76::ICUService::createSimpleFactory(icu_76::UObject*, icu_76::UnicodeString const&, signed char, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0x90): undefined reference to `icu_76::ICUService::reInitializeFactories()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xa0): undefined reference to `icu_76::ICUService::clearCaches()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xa8): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xb0): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, int, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xb8): undefined reference to `icu_76::ICULocaleService::registerInstance(icu_76::UObject*, icu_76::Locale const&, int, int, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xc0): undefined reference to `icu_76::ICULocaleService::getAvailableLocales() const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(calendar.ao):(.data.rel.ro._ZTVN6icu_7615CalendarServiceE[_ZTVN6icu_7615CalendarServiceE]+0xc8): undefined reference to `icu_76::ICULocaleService::createKey(icu_76::UnicodeString const*, int, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(timezone.ao): in function `icu_76::TimeZone::parseCustomID(icu_76::UnicodeString const&, int&, int&, int&, int&)':
+(.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x6f): undefined reference to `u_strncasecmp_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0xf3): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x168): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TimeZone13parseCustomIDERKNS_13UnicodeStringERiS4_S4_S4_+0x1cd): undefined reference to `icu_76::ICU_Utility::parseNumber(icu_76::UnicodeString const&, int&, signed char)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseSingleLocalizedDigit(icu_76::UnicodeString const&, int, int&) const':
+(.text._ZNK6icu_7614TimeZoneFormat25parseSingleLocalizedDigitERKNS_13UnicodeStringEiRi+0x56): undefined reference to `u_charDigitValue_76'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetFieldsWithPattern(icu_76::UnicodeString const&, int, icu_76::UVector*, signed char, int&, int&, int&) const':
+(.text._ZNK6icu_7614TimeZoneFormat28parseOffsetFieldsWithPatternERKNS_13UnicodeStringEiPNS_7UVectorEaRiS6_S6_+0x116): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetLocalizedGMTPattern(icu_76::UnicodeString const&, int, signed char, int&) const':
+(.text._ZNK6icu_7614TimeZoneFormat30parseOffsetLocalizedGMTPatternERKNS_13UnicodeStringEiaRi+0x13e): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat30parseOffsetLocalizedGMTPatternERKNS_13UnicodeStringEiaRi+0x1a9): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetDefaultLocalizedGMT(icu_76::UnicodeString const&, int, int&) const':
+(.text._ZNK6icu_7614TimeZoneFormat30parseOffsetDefaultLocalizedGMTERKNS_13UnicodeStringEiRi+0x65): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetLocalizedGMT(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const':
+(.text._ZNK6icu_7614TimeZoneFormat23parseOffsetLocalizedGMTERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x121): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao):(.text._ZNK6icu_7614TimeZoneFormat23parseOffsetLocalizedGMTERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x1bb): more undefined references to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const' follow
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetISO8601(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const [clone .cold]':
+(.text.unlikely._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x4): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.unlikely._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0xc): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parseOffsetISO8601(icu_76::UnicodeString const&, icu_76::ParsePosition&, signed char, signed char*) const':
+(.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0xaf): undefined reference to `vtable for icu_76::ParsePosition'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x120): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x1c4): undefined reference to `vtable for icu_76::ParsePosition'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat18parseOffsetISO8601ERKNS_13UnicodeStringERNS_13ParsePositionEaPa+0x207): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parse(UTimeZoneFormatStyle, icu_76::UnicodeString const&, icu_76::ParsePosition&, int, UTimeZoneFormatTimeType*) const [clone .cold]':
+(.text.unlikely._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x2c): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzfmt.ao): in function `icu_76::TimeZoneFormat::parse(UTimeZoneFormatStyle, icu_76::UnicodeString const&, icu_76::ParsePosition&, int, UTimeZoneFormatTimeType*) const':
+(.text._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x99): undefined reference to `vtable for icu_76::ParsePosition'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_7614TimeZoneFormat5parseE20UTimeZoneFormatStyleRKNS_13UnicodeStringERNS_13ParsePositionEiP23UTimeZoneFormatTimeType+0x2c6): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::getGenericLocationName(icu_76::UnicodeString const&)':
+(.text._ZN6icu_768TZGNCore22getGenericLocationNameERKNS_13UnicodeStringE+0x1ea): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore22getGenericLocationNameERKNS_13UnicodeStringE+0x342): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::getPartialLocationName(icu_76::UnicodeString const&, icu_76::UnicodeString const&, signed char, icu_76::UnicodeString const&)':
+(.text._ZN6icu_768TZGNCore22getPartialLocationNameERKNS_13UnicodeStringES3_aS3_+0x288): undefined reference to `icu_76::SimpleFormatter::format(icu_76::UnicodeString const&, icu_76::UnicodeString const&, icu_76::UnicodeString&, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::initialize(icu_76::Locale const&, UErrorCode&)':
+(.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x172): undefined reference to `icu_76::SimpleFormatter::applyPatternMinMaxArguments(icu_76::UnicodeString const&, int, int, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x18f): undefined reference to `icu_76::SimpleFormatter::applyPatternMinMaxArguments(icu_76::UnicodeString const&, int, int, UErrorCode&)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCore10initializeERKNS_6LocaleER10UErrorCode+0x1a5): undefined reference to `icu_76::LocaleDisplayNames::createInstance(icu_76::Locale const&, UDialectHandling)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::TZGNCore(icu_76::Locale const&, UErrorCode&) [clone .cold]':
+(.text.unlikely._ZN6icu_768TZGNCoreC2ERKNS_6LocaleER10UErrorCode+0x21): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text.unlikely._ZN6icu_768TZGNCoreC2ERKNS_6LocaleER10UErrorCode+0x2d): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::~TZGNCore()':
+(.text._ZN6icu_768TZGNCoreD2Ev+0x48): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZN6icu_768TZGNCoreD2Ev+0x54): undefined reference to `icu_76::SimpleFormatter::~SimpleFormatter()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tzgnames.ao): in function `icu_76::TZGNCore::formatGenericNonLocationName(icu_76::TimeZone const&, UTimeZoneGenericNameType, double, icu_76::UnicodeString&) const':
+(.text._ZNK6icu_768TZGNCore28formatGenericNonLocationNameERKNS_8TimeZoneE24UTimeZoneGenericNameTypedRNS_13UnicodeStringE+0x692): undefined reference to `icu_76::UnicodeString::doCaseCompare(int, int, char16_t const*, int, int, unsigned int) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tznames_impl.ao): in function `icu_76::TextTrieMap::search(icu_76::CharacterNode*, icu_76::UnicodeString const&, int, int, icu_76::TextTrieMapSearchResultHandler*, UErrorCode&) const':
+(.text._ZNK6icu_7611TextTrieMap6searchEPNS_13CharacterNodeERKNS_13UnicodeStringEiiPNS_30TextTrieMapSearchResultHandlerER10UErrorCode+0x153): undefined reference to `icu_76::UnicodeString::foldCase(unsigned int)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(tznames_impl.ao): in function `icu_76::TextTrieMap::putImpl(icu_76::UnicodeString const&, void*, UErrorCode&)':
+(.text._ZN6icu_7611TextTrieMap7putImplERKNS_13UnicodeStringEPvR10UErrorCode+0x135): undefined reference to `icu_76::UnicodeString::foldCase(unsigned int)'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::parseObject(icu_76::UnicodeString const&, icu_76::Formattable&, UErrorCode&) const [clone .cold]':
+(.text.unlikely._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x4): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::parseObject(icu_76::UnicodeString const&, icu_76::Formattable&, UErrorCode&) const':
+(.text._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x25): undefined reference to `vtable for icu_76::ParsePosition'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: (.text._ZNK6icu_766Format11parseObjectERKNS_13UnicodeStringERNS_11FormattableER10UErrorCode+0x57): undefined reference to `icu_76::ParsePosition::~ParsePosition()'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::getLocale(ULocDataLocaleType, UErrorCode&) const':
+(.text._ZNK6icu_766Format9getLocaleE18ULocDataLocaleTypeR10UErrorCode+0x31): undefined reference to `icu_76::LocaleBased::getLocale(ULocDataLocaleType, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::getLocaleID(ULocDataLocaleType, UErrorCode&) const':
+(.text._ZNK6icu_766Format11getLocaleIDE18ULocDataLocaleTypeR10UErrorCode+0x2d): undefined reference to `icu_76::LocaleBased::getLocaleID(ULocDataLocaleType, UErrorCode&) const'
+/nix/store/s417mccczz3vscmsb5g9h7x040gvinfy-x86_64-unknown-linux-musl-binutils-2.44/bin/x86_64-unknown-linux-musl-ld: /nix/store/iiw1j4i5p4hlf78qd9cgwi3d4l9z4n63-icu4c-static-x86_64-unknown-linux-musl-76.1/lib/libicui18n.a(format.ao): in function `icu_76::Format::setLocaleIDs(char const*, char const*)':
+(.text._ZN6icu_766Format12setLocaleIDsEPKcS2_+0x2d): undefined reference to `icu_76::LocaleBased::setLocaleIDs(char const*, char const*)'
+collect2: error: ld returned 1 exit status
+
+Link: https://github.com/libical/libical/pull/930
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index aad02e1e..7dcf516c 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -211,7 +211,7 @@ if(NOT DEFINED ENV{ICU_ROOT} AND APPLE)
+   #Use the homebrew version. MacOS provided ICU doesn't provide development files
+   set(ICU_ROOT "/usr/local/opt/icu4c")
+ endif()
+-find_package(ICU COMPONENTS uc i18n data)
++find_package(ICU COMPONENTS i18n uc data)
+ set_package_properties(ICU PROPERTIES
+   TYPE RECOMMENDED
+   PURPOSE "For RSCALE (RFC7529) support"
+-- 
+2.49.0
+

From 5c20ed83ddf3e00269fad3e98bd1ab38264bdeb1 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 01:05:26 +0300
Subject: [PATCH 536/831] stdenv: linux: centralise
 updateAutotoolsGnuConfigScriptsHook in stageFun
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hook was added six times — once in each of stages 1, xgcc, 2, 3, 4
(and again at the final stdenv) — to teach configure scripts about
non-x86_64 architectures. Wire it once inside stageFun instead, guarded
by `prevStage ? updateAutotoolsGnuConfigScriptsHook` so the dummy stage
(whose prevStage is the raw stub) is unaffected.

The final stdenv (built outside stageFun) keeps its explicit entry.

Eval-verified: stdenv.drvPath is unchanged from master
(q2xn5647kadsgpz40xcmjssa0pmdmiwi-stdenv-linux.drv).
---
 pkgs/stdenv/linux/default.nix | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index feb7f90a147f..c95675239cbe 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -181,7 +181,13 @@ let
         buildPlatform = localSystem;
         hostPlatform = localSystem;
         targetPlatform = localSystem;
-        inherit extraNativeBuildInputs;
+        # Every real (post-dummy) stage needs this hook so configure scripts
+        # can recognise architectures (LoongArch, RISC-V, etc.).
+        extraNativeBuildInputs =
+          extraNativeBuildInputs
+          ++ lib.optional (
+            prevStage ? updateAutotoolsGnuConfigScriptsHook
+          ) prevStage.updateAutotoolsGnuConfigScriptsHook;
         inherit (stage0) initialPath;
         preHook = ''
           # Don't patch #!/interpreter because it leads to retained
@@ -311,9 +317,6 @@ in
           };
         });
       };
-
-      # `gettext` comes with obsolete config.sub/config.guess that don't recognize LoongArch64.
-      extraNativeBuildInputs = [ prevStage.updateAutotoolsGnuConfigScriptsHook ];
     }
   )
 
@@ -427,9 +430,6 @@ in
               '';
             });
       };
-
-      # `gettext` comes with obsolete config.sub/config.guess that don't recognize LoongArch64.
-      extraNativeBuildInputs = [ prevStage.updateAutotoolsGnuConfigScriptsHook ];
     }
   )
 
@@ -531,10 +531,6 @@ in
         );
 
       };
-
-      # `gettext` comes with obsolete config.sub/config.guess that don't recognize LoongArch64.
-      # `libtool` comes with obsolete config.sub/config.guess that don't recognize Risc-V.
-      extraNativeBuildInputs = [ prevStage.updateAutotoolsGnuConfigScriptsHook ];
     }
   )
 
@@ -605,8 +601,6 @@ in
         };
       extraNativeBuildInputs = [
         prevStage.patchelf
-        # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
-        prevStage.updateAutotoolsGnuConfigScriptsHook
       ];
     }
   )
@@ -671,8 +665,6 @@ in
       extraNativeBuildInputs = [
         prevStage.patchelf
         prevStage.xz
-        # Many tarballs come with obsolete config.sub/config.guess that don't recognize aarch64.
-        prevStage.updateAutotoolsGnuConfigScriptsHook
       ];
     }
   )

From 0a27772068b2658b0dc7911375c1e42cc6bc301d Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 01:38:17 +0300
Subject: [PATCH 537/831] stdenv: linux: drop dead enableGold=false override
 from stage1

The override at `super.binutils-unwrapped.override { enableGold = false; }`
defined a stage1 `binutils-unwrapped` derivation that was never used:
xgcc-stage and stage2 both build their own fresh `super.binutils-unwrapped`
without inheriting from stage1, so the gold-disabled rebuild never appeared
in the build graph (verified via `nix-store --query --requisites`).

Verified by drv-hash equality: stdenv.drvPath is unchanged
(q2xn5647kadsgpz40xcmjssa0pmdmiwi-stdenv-linux.drv).
---
 pkgs/stdenv/linux/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index c95675239cbe..511248c81957 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -283,11 +283,7 @@ in
     stageFun prevStage {
       name = "bootstrap-stage1";
 
-      # Rebuild binutils to use from stage2 onwards.
       overrides = self: super: {
-        binutils-unwrapped = super.binutils-unwrapped.override {
-          enableGold = false;
-        };
         inherit (prevStage)
           ccWrapperStdenv
           gcc-unwrapped

From 053f02f232a7ca7cb23ca75335a07808c2a95ff9 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 01:38:37 +0300
Subject: [PATCH 538/831] stdenv: linux: drop dead dejagnu.doCheck=false
 override from stage2

dejagnu is never demand-built in the bootstrap closure (verified via
`nix-store --query --requisites | grep dejagnu` returning empty on
master). The override existed but the resulting derivation was never
referenced by anything stage2+ actually builds.

Verified by drv-hash equality: stdenv.drvPath is unchanged
(q2xn5647kadsgpz40xcmjssa0pmdmiwi-stdenv-linux.drv).
---
 pkgs/stdenv/linux/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 511248c81957..d0b55753569d 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -458,9 +458,6 @@ in
           texinfo
           which
           ;
-        dejagnu = super.dejagnu.overrideAttrs (a: {
-          doCheck = false;
-        });
 
         # Avoids infinite recursion, as this is in the build-time dependencies of libc.
         libiconv = self.libcIconv prevStage.libc;

From 4df33765698ad9b6ff28e2eb958f3971e23d1065 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 06:59:50 +0300
Subject: [PATCH 539/831] stdenv: linux: inherit nukeReferences through
 xgcc/stage2/stage3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nukeReferences was rebuilt at every stage where it appeared (xgcc, stage2,
stage3 — 3 redundant builds beyond stage1's initial build). It is used only
at build time (to scrub references from libidn2/libunistring at stage2),
never appears in the final stdenv's runtime closure, and its outputs are
not propagated into other final-closure derivations.

Adding it to the inherit list at xgcc, stage2, and stage3 collapses the
chain to a single stage1 build. Stage4 still produces its own nukeReferences
through the regular package set; that one is unused by the final stdenv.

Build-only dependency, so this is safe with respect to the
`disallowedRequisites` check on the final stdenv-linux.
---
 pkgs/stdenv/linux/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index d0b55753569d..61b4a996b03e 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -343,6 +343,7 @@ in
           gnum4
           perl
           patchelf
+          nukeReferences
           ;
         ${localSystem.libc} = prevStage.${localSystem.libc};
         gmp = super.gmp.override { cxx = false; };
@@ -457,6 +458,7 @@ in
           bison
           texinfo
           which
+          nukeReferences
           ;
 
         # Avoids infinite recursion, as this is in the build-time dependencies of libc.
@@ -565,6 +567,7 @@ in
             libidn2
             libunistring
             libxcrypt
+            nukeReferences
             ;
           # We build a special copy of libgmp which doesn't use libstdc++, because
           # xgcc++'s libstdc++ references the bootstrap-files (which is what

From f40b936a8643c4f9b7a178e2fc231c45579fd630 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 07:00:07 +0300
Subject: [PATCH 540/831] stdenv: linux: inherit autoconf269 at stage2/stage3

autoconf269 was being rebuilt at stages 2 and 3. It is used only as a
native build input (to regenerate `configure` scripts in autotools-using
packages); its outputs never appear in the final stdenv's runtime closure.

Inheriting it from prevStage at stage2 and stage3 collapses 2 -> 1 build.

Build-only dependency, safe with respect to the `disallowedRequisites`
check on the final stdenv-linux.
---
 pkgs/stdenv/linux/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 61b4a996b03e..e9116d03be92 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -459,6 +459,7 @@ in
           texinfo
           which
           nukeReferences
+          autoconf269
           ;
 
         # Avoids infinite recursion, as this is in the build-time dependencies of libc.
@@ -568,6 +569,7 @@ in
             libunistring
             libxcrypt
             nukeReferences
+            autoconf269
             ;
           # We build a special copy of libgmp which doesn't use libstdc++, because
           # xgcc++'s libstdc++ references the bootstrap-files (which is what

From dcda21b1556f0b3618dc8f7bd196eaab1fd5089c Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 07:00:22 +0300
Subject: [PATCH 541/831] stdenv: linux: inherit python3Minimal at
 stage3/stage4

python3Minimal was being rebuilt at stages 3 and 4. It is used only as a
native build input (e.g. meson, glib build helpers); its outputs do not
appear in the final stdenv's runtime closure.

Inheriting from prevStage at stage3 and stage4 collapses 2 -> 1 build.

Build-only dependency, safe with respect to the `disallowedRequisites`
check on the final stdenv-linux.
---
 pkgs/stdenv/linux/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index e9116d03be92..80802992360d 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -570,6 +570,7 @@ in
             libxcrypt
             nukeReferences
             autoconf269
+            python3Minimal
             ;
           # We build a special copy of libgmp which doesn't use libstdc++, because
           # xgcc++'s libstdc++ references the bootstrap-files (which is what
@@ -634,6 +635,7 @@ in
           linuxHeaders
           libidn2
           libunistring
+          python3Minimal
           ;
         ${localSystem.libc} = prevStage.${localSystem.libc};
         # Since this is the first fresh build of binutils since stage2, our own runtimeShell will be used.

From 1d37095ba040f5f6a0cad5b4f9356a55824d394a Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Thu, 14 May 2026 08:38:09 +0300
Subject: [PATCH 542/831] stdenv: linux: inherit libxcrypt at xgcc/stage2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

libxcrypt was built twice (xgcc and stage2). Adding it to the inherit list
at xgcc and stage2 chains it through: stage1 produces the single build,
xgcc/stage2/stage3 inherit. Total bootstrap-stage builds: 2 -> 1.

libxcrypt is build-time-only — it is needed at build time by tools that
support libcrypt-style password hashing, but its `out` is not in the final
stdenv runtime closure (glibc no longer depends on libxcrypt at runtime;
applications that need it link directly).

Safe with respect to the `disallowedRequisites` check on the final
stdenv-linux.
---
 pkgs/stdenv/linux/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 80802992360d..34fdac07cff5 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -344,6 +344,7 @@ in
           perl
           patchelf
           nukeReferences
+          libxcrypt
           ;
         ${localSystem.libc} = prevStage.${localSystem.libc};
         gmp = super.gmp.override { cxx = false; };
@@ -460,6 +461,7 @@ in
           which
           nukeReferences
           autoconf269
+          libxcrypt
           ;
 
         # Avoids infinite recursion, as this is in the build-time dependencies of libc.

From a630049d801392ad6e30bf7280b5e73d998fcb45 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 6 Jun 2026 03:40:44 +0000
Subject: [PATCH 543/831] fontconfig: 2.17.1 -> 2.18.1

---
 pkgs/development/libraries/fontconfig/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index dee1e197dd6e..9e4c1fb36057 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fontconfig";
-  version = "2.17.1";
+  version = "2.18.1";
 
   outputs = [
     "bin"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   # ref: https://github.com/NixOS/nixpkgs/pull/401037#discussion_r2055430206
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/api/v4/projects/890/packages/generic/fontconfig/${finalAttrs.version}/fontconfig-${finalAttrs.version}.tar.xz";
-    hash = "sha256-n1yuk/T//B+8Ba6ZzfxwjNYN/WYS/8BRKCcCXAJvpUE=";
+    hash = "sha256-IwDz2/pyU7OkT0/uzbyN+kXd5dws+3H86vMfOUy0EDE=";
   };
 
   nativeBuildInputs = [

From a06fb593b6facc51ec4348cfb4f105536e319739 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Fri, 5 Jun 2026 22:16:08 -0400
Subject: [PATCH 544/831] freetype: add patches for four vulnerabilities from
 project zero

- https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1419 /
  https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1420
- https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1421
- https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1423
- https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1425
---
 pkgs/by-name/fr/freetype/package.nix | 48 ++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/pkgs/by-name/fr/freetype/package.nix b/pkgs/by-name/fr/freetype/package.nix
index 1eb213ab71f1..2f5f6ccef0a8 100644
--- a/pkgs/by-name/fr/freetype/package.nix
+++ b/pkgs/by-name/fr/freetype/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   buildPackages,
   pkgsHostHost,
   pkg-config,
@@ -69,6 +70,53 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./enable-table-validation.patch
+
+    # https://project-zero.issues.chromium.org/issues/505355061
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1419
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1420
+    (fetchpatch {
+      name = "truetype-shz-limit-heap-buffer-overflow-part1.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/1803559c4ee407d0bcbf2a67dbe96690cee869d2.patch";
+      hash = "sha256-zxtJ2pJz8pNofgYrJ6c8/eZqRvxTotanF2IdU9ckpM4=";
+    })
+    (fetchpatch {
+      name = "truetype-shz-limit-heap-buffer-overflow-part2.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/7d600a022e1d813e85a8c94ffd395f6135872267.patch";
+      hash = "sha256-aHE11C9Cr23D2lqNmTVUDA5E07xxUm+AcYdWJG9zLFs=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/505357209
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1421
+    (fetchpatch {
+      name = "truetype-iup-integer-overflow.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/7974be74d8b5a2fbf99aa88f0461d1f80af51cee.patch";
+      hash = "sha256-b5Px0ALsnC5K1+601YioAjCLkLVXNnvTIZ1aQtCeNoQ=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/506902245
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1423
+    # https://gitlab.freedesktop.org/freetype/freetype/-/merge_requests/428
+    (fetchpatch {
+      name = "truetype-variation-handling-signednes-mismatch.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/0d45c7f1911bc6db0bf072eea0c8cdccd77bc6b3.patch";
+      hash = "sha256-bw/9O86sZQa+vwdgx2MTqxWi6vjMcRTyC42ba9CaZ3I=";
+    })
+
+    # prerequisite for the below to apply, since this changes formatting of
+    # affected code.
+    (fetchpatch {
+      name = "ftobjs-formatting.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/590b77014bd920d0bdf64c039fddbce89a288b83.patch";
+      hash = "sha256-govOzLBzQMAjSKABVFryDnSn2by2f/W9BgGG3o+qSuE=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/507321912
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1425
+    (fetchpatch {
+      name = "sub-byte-bitmaps-heap-buffer-over-read.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/cbe12767ea73d1006edc75fcd61c0b0d2a88f34e.patch";
+      hash = "sha256-jMeqY9uX7Ryfdd8icGDT4kEKl6aGRWafSN8GzOhGW7g=";
+    })
   ]
   ++ lib.optional useEncumberedCode ./enable-subpixel-rendering.patch;
 

From c81db54284de3ff7df95e57514171af285aeba1a Mon Sep 17 00:00:00 2001
From: Ricardo Correia <someplaceguy@wizy.org>
Date: Sat, 6 Jun 2026 13:37:40 +0000
Subject: [PATCH 545/831] minimal-bootstrap.gnumake-musl: fix build

GNU Make's release tarball contains pregenerated Autotools files and
depends on archive mtimes to keep them newer than their inputs.

The Mes-built gnutar used by gnumake-musl does not preserve those mtimes.
That can make configure.ac and m4 files appear newer than aclocal.m4 or
Makefile.in, causing make to try to run aclocal/automake during the
minimal bootstrap build.

Use gnutar-musl here, which is already documented as preserving mtimes for
pregenerated files.

Assisted-by: OpenAI Codex (GPT-5.5)
---
 pkgs/os-specific/linux/minimal-bootstrap/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index dae72f79852a..d52c50d80e5d 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -184,6 +184,9 @@ lib.makeScope
           tinycc = tinycc-musl;
           gawk = gawk-mes;
           gnumakeBoot = gnumake;
+          # GNU Make's release tarball relies on preserved mtimes for
+          # pregenerated Autotools files.
+          gnutar = gnutar-musl;
         };
 
         gnumake-static = callPackage ./gnumake/static.nix {

From af9f83d9f225ad51b4aeefe509f6ceb645b9f593 Mon Sep 17 00:00:00 2001
From: nick-linux8 <nick.stationengineer@proton.me>
Date: Sun, 7 Jun 2026 01:09:26 -0400
Subject: [PATCH 546/831] alsa-{lib,utils,ucm-conf}: adopt packages

---
 pkgs/by-name/al/alsa-lib/package.nix      | 4 +++-
 pkgs/by-name/al/alsa-ucm-conf/package.nix | 1 +
 pkgs/by-name/al/alsa-utils/package.nix    | 4 +++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alsa-lib/package.nix b/pkgs/by-name/al/alsa-lib/package.nix
index 4304bf4ef467..4c02e2a8d7eb 100644
--- a/pkgs/by-name/al/alsa-lib/package.nix
+++ b/pkgs/by-name/al/alsa-lib/package.nix
@@ -60,6 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
       "alsa-topology"
     ];
     platforms = with lib.platforms; linux ++ freebsd;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
   };
 })
diff --git a/pkgs/by-name/al/alsa-ucm-conf/package.nix b/pkgs/by-name/al/alsa-ucm-conf/package.nix
index 176fb0e2086c..eace84e7b18f 100644
--- a/pkgs/by-name/al/alsa-ucm-conf/package.nix
+++ b/pkgs/by-name/al/alsa-ucm-conf/package.nix
@@ -58,6 +58,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       roastiek
       mvs
+      nick-linux
     ];
 
     platforms = lib.platforms.linux ++ lib.platforms.freebsd;
diff --git a/pkgs/by-name/al/alsa-utils/package.nix b/pkgs/by-name/al/alsa-utils/package.nix
index e293ed8d10e7..4476b715cdcf 100644
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -98,6 +98,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
   };
 })

From 373f683e561aa9d1c80e59ff6330735739df4fcb Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sun, 7 Jun 2026 02:15:25 -0600
Subject: [PATCH 547/831] python3Packages.requests-toolbelt: switch to
 pyproject

---
 .../python-modules/requests-toolbelt/default.nix   | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/requests-toolbelt/default.nix b/pkgs/development/python-modules/requests-toolbelt/default.nix
index f9e79d5955c3..59354d41092b 100644
--- a/pkgs/development/python-modules/requests-toolbelt/default.nix
+++ b/pkgs/development/python-modules/requests-toolbelt/default.nix
@@ -6,20 +6,22 @@
   pyopenssl,
   pytestCheckHook,
   requests,
+  setuptools,
   trustme,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "requests-toolbelt";
   version = "1.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-doGgo9BHAStb3A7jfX+PB+vnarCMrsz8OSHOI8iNW8Y=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+  dependencies = [ requests ];
 
   nativeCheckInputs = [
     betamax
@@ -43,8 +45,8 @@ buildPythonPackage rec {
   meta = {
     description = "Toolbelt of useful classes and functions to be used with requests";
     homepage = "http://toolbelt.rtfd.org";
-    changelog = "https://github.com/requests/toolbelt/blob/${version}/HISTORY.rst";
+    changelog = "https://github.com/requests/toolbelt/blob/${finalAttrs.version}/HISTORY.rst";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ matthiasbeyer ];
   };
-}
+})

From 10978e39f8ed8df22c8097fe16c4d95d77838c10 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:33 +0200
Subject: [PATCH 548/831] grpc: 1.80.0 -> 1.81.0

---
 pkgs/by-name/gr/grpc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/grpc/package.nix b/pkgs/by-name/gr/grpc/package.nix
index fd682d3b0516..84e80bfc5b7d 100644
--- a/pkgs/by-name/gr/grpc/package.nix
+++ b/pkgs/by-name/gr/grpc/package.nix
@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation (finalAttrs: {
   pname = "grpc";
-  version = "1.80.0"; # N.B: if you change this, please update:
+  version = "1.81.0"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "grpc";
     repo = "grpc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/dpTRG5JcZY2VAsqOYNIpFW7ouSy/eC2STulP7qdSYg=";
+    hash = "sha256-o1wfHrgD2VE6HcPPEWQPQZXrMh+8+GNoUjbCQoRlIWg=";
     fetchSubmodules = true;
   };
 

From 6b60525b2184c5e5c3a2896dc5f5ff9128d63326 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:37 +0200
Subject: [PATCH 549/831] python3Packages.grpcio: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 880782e6c683..7b786ec380ba 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -18,12 +18,12 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KayhXt0GiMIroB18wBywANcrIDP0o8cqgaGbVv0UMlc=";
+    hash = "sha256-pazX79Ox/ptOsLyqoVB+7WigrQZ4tlTD97Rk35up3KU=";
   };
 
   postPatch = ''

From ac6c2aecd82f33322997c1229fae09c47aec653a Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:39 +0200
Subject: [PATCH 550/831] python3Packages.grpcio-channelz: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-channelz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index 028c63669ca3..634811c727e9 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_channelz";
     inherit version;
-    hash = "sha256-fs6As480ti6Q5uHFqghYXwwPE8GpyI6vdNioZxw6n6E=";
+    hash = "sha256-V6Gr5QURNJv9iafEJtHbaRmOLJzUcbr2wNVgbDTbmt8=";
   };
 
   build-system = [ setuptools ];

From 3881bdb4619328cde88fcd1a87245eaf946c6344 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:42 +0200
Subject: [PATCH 551/831] python3Packages.grpcio-health-checking: 1.80.0 ->
 1.81.0

---
 .../python-modules/grpcio-health-checking/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index 2db14472125a..3d65fef2e464 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.80.0";
+  version = "1.81.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_health_checking";
     inherit version;
-    hash = "sha256-LMXwi8i4FrhlWrb1nHFFAGO6IHZtMeIaST6RLjVgyLE=";
+    hash = "sha256-CfMWdPGs3PIUvE5kDru77xZbB3of1kg0eVGW1Sv9zjk=";
   };
 
   propagatedBuildInputs = [

From 5ae2c501e9590672dd714d700828b94a8339332e Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:44 +0200
Subject: [PATCH 552/831] python3Packages.grpcio-reflection: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-reflection/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 914cffe15618..87e145bb3513 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_reflection";
     inherit version;
-    hash = "sha256-6cdqq8QyQnmUW3C8dqPUG8T5OWv/zxz8EBGlccLFYiE=";
+    hash = "sha256-UZHbeqbKsbaYGwh5+kT9zdQ7pkTwMBxAuXb4E+tO/wY=";
   };
 
   build-system = [ setuptools ];

From ad1a906f4eb4058616dcc4be20481c35066f2ada Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:47 +0200
Subject: [PATCH 553/831] python3Packages.grpcio-status: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-status/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index a4ebf1aaf5a2..03c03473d5ad 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.80.0";
+  version = "1.81.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_status";
     inherit version;
-    hash = "sha256-33OAKkyJo+qIqir/lx6Ib8zOFivC5lEUCLPWehRDgc0=";
+    hash = "sha256-tv6XiM/dHw9jwFKKHgv9tB6P8Fg+kg0tjoiIWYwBu2k=";
   };
 
   postPatch = ''

From c0254a8c03861d8875a71a59274071a90c39e278 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:49 +0200
Subject: [PATCH 554/831] python3Packages.grpcio-testing: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-testing/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 812e24eaf438..b3f68350d32f 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_testing";
     inherit version;
-    hash = "sha256-+1rVfED/36l3MEPfo46MN3Oa+ONHHxZwoh54BRzRmv0=";
+    hash = "sha256-MjcL3/wM0Jq63pKP2ID5Gb8HCv5dASot4UEkJ7LcGSE=";
   };
 
   postPatch = ''

From 1949fdb81e69d77f0bfbfce33692dda39f5771f0 Mon Sep 17 00:00:00 2001
From: scraptux <git@thomasjasny.de>
Date: Sun, 7 Jun 2026 11:17:53 +0200
Subject: [PATCH 555/831] python3Packages.grpcio-tools: 1.80.0 -> 1.81.0

---
 pkgs/development/python-modules/grpcio-tools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index d079a2447a3f..bf74b27fcea2 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -13,13 +13,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.80.0";
+  version = "1.81.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_tools";
     inherit version;
-    hash = "sha256-JgUrGcbODc9S0QJElq6j4r36hkFZ8G3HuXsi0EGpSyY=";
+    hash = "sha256-BzPXc+yoy0YfTyobecZMEj25ZhvkGwgYS4FJeyuZHMs=";
   };
 
   postPatch = ''

From 53c65555da322ff0ea39d13278c5a4eff02c06e9 Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Sun, 7 Jun 2026 13:51:11 +0300
Subject: [PATCH 556/831] ocl-icd: 2.3.4 -> 2.3.5

This adds support for opencl 3.1.
---
 pkgs/by-name/oc/ocl-icd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/oc/ocl-icd/package.nix b/pkgs/by-name/oc/ocl-icd/package.nix
index 1b6fad3afa82..f5440bf9270b 100644
--- a/pkgs/by-name/oc/ocl-icd/package.nix
+++ b/pkgs/by-name/oc/ocl-icd/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocl-icd";
-  version = "2.3.4";
+  version = "2.3.5";
 
   src = fetchFromGitHub {
     owner = "OCL-dev";
     repo = "ocl-icd";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-7q5+33oWMA/PQOz6awC+LOBVTKeXNluHxDNAq8bJPYU=";
+    sha256 = "sha256-J7j68KlcwdlwtBo171xZd5iLWeo1suYm43G1JiFs2AE=";
   };
 
   nativeBuildInputs = [

From 80edf6a63022180fcf57ad25c4255dfefda2f65c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 09:25:39 -0700
Subject: [PATCH 557/831] libde265: 1.1.0 -> 1.1.1

Diff: https://github.com/strukturag/libde265/compare/v1.1.0...v1.1.1

Changelog: https://github.com/strukturag/libde265/releases/tag/v1.1.1
---
 pkgs/by-name/li/libde265/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libde265/package.nix b/pkgs/by-name/li/libde265/package.nix
index 80293886a1e1..771b9e336634 100644
--- a/pkgs/by-name/li/libde265/package.nix
+++ b/pkgs/by-name/li/libde265/package.nix
@@ -15,14 +15,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.1.0";
+  version = "1.1.1";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QhBi23HttVdIJCueSeKj3ZKwqX1iFcuAX7GmnMRCyN8=";
+    hash = "sha256-ZHfPC86oylqt2bwWMJRWVjdMEEmX6UOKR7XkR0HPyok=";
   };
 
   nativeBuildInputs = [

From 33f6a6e239d813d65e627086d78bd9579823d708 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 10:30:58 -0700
Subject: [PATCH 558/831] libmemcached: 1.0.18 -> 1.1.4

We switch the upstream to https://github.com/awesomized/libmemcached as
did e.g. Alpine Linux and Arch Linux.

Diff: https://github.com/awesomized/libmemcached/compare/1.0.18...1.1.4

Changelog: https://github.com/awesomized/libmemcached/blob/1.1.4/ChangeLog-1.1.md
---
 pkgs/by-name/li/libmemcached/musl-fixes.patch | 58 -------------------
 pkgs/by-name/li/libmemcached/package.nix      | 42 +++++++-------
 2 files changed, 21 insertions(+), 79 deletions(-)
 delete mode 100644 pkgs/by-name/li/libmemcached/musl-fixes.patch

diff --git a/pkgs/by-name/li/libmemcached/musl-fixes.patch b/pkgs/by-name/li/libmemcached/musl-fixes.patch
deleted file mode 100644
index eb2a6bc980eb..000000000000
--- a/pkgs/by-name/li/libmemcached/musl-fixes.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-diff --git a/libhashkit/fnv_64.cc b/libhashkit/fnv_64.cc
-index 68e4dd0..64656b7 100644
---- a/libhashkit/fnv_64.cc
-+++ b/libhashkit/fnv_64.cc
-@@ -37,8 +37,9 @@
- 
- 
- #include <libhashkit/common.h>
-+#include <limits.h>
- 
--#if __WORDSIZE == 64 && defined(HAVE_FNV64_HASH)
-+#if (LONG_BITS == 64) && defined(HAVE_FNV64_HASH)
- 
- /* FNV hash'es lifted from Dustin Sallings work */
- static uint64_t FNV_64_INIT= 0xcbf29ce484222325;
-diff --git a/libhashkit/has.cc b/libhashkit/has.cc
-index 843e32e..4153e5e 100644
---- a/libhashkit/has.cc
-+++ b/libhashkit/has.cc
-@@ -37,6 +37,7 @@
- 
- 
- #include <libhashkit/common.h>
-+#include <limits.h>
- 
- bool libhashkit_has_algorithm(const hashkit_hash_algorithm_t algo)
- {
-@@ -44,7 +45,7 @@ bool libhashkit_has_algorithm(const hashkit_hash_algorithm_t algo)
-   {
-   case HASHKIT_HASH_FNV1_64:
-   case HASHKIT_HASH_FNV1A_64:
--#if __WORDSIZE == 64 && defined(HAVE_FNV64_HASH)
-+#if (LONG_BITS == 64) && defined(HAVE_FNV64_HASH)
-     return true;
- #else
-     return false;
-diff --git a/libtest/cmdline.cc b/libtest/cmdline.cc
-index 29a22de..161c646 100644
---- a/libtest/cmdline.cc
-+++ b/libtest/cmdline.cc
-@@ -61,7 +61,7 @@ using namespace libtest;
- #include <algorithm>
- #include <stdexcept>
- 
--#ifndef __USE_GNU
-+#ifndef _GNU_SOURCE
- static char **environ= NULL;
- #endif
- 
-@@ -201,7 +201,7 @@ Application::error_t Application::run(const char *args[])
- 
-   fatal_assert(posix_spawnattr_setsigmask(&spawnattr, &mask) == 0);
- 
--#if defined(POSIX_SPAWN_USEVFORK) || defined(__linux__)
-+#if defined(POSIX_SPAWN_USEVFORK) || defined(__GLIBC__)
-   // Use USEVFORK on linux
-   flags |= POSIX_SPAWN_USEVFORK;
- #endif
diff --git a/pkgs/by-name/li/libmemcached/package.nix b/pkgs/by-name/li/libmemcached/package.nix
index dfcd86d022de..e28220062207 100644
--- a/pkgs/by-name/li/libmemcached/package.nix
+++ b/pkgs/by-name/li/libmemcached/package.nix
@@ -1,41 +1,41 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchpatch,
+  fetchFromGitHub,
+  bison,
+  cmake,
+  flex,
   cyrus_sasl,
   libevent,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmemcached";
-  version = "1.0.18";
+  version = "1.1.4";
 
-  src = fetchurl {
-    url = "https://launchpad.net/libmemcached/${lib.versions.majorMinor finalAttrs.version}/${finalAttrs.version}/+download/libmemcached-${finalAttrs.version}.tar.gz";
-    sha256 = "10jzi14j32lpq0if0p9vygcl2c1352hwbywzvr9qzq7x6aq0nb72";
+  src = fetchFromGitHub {
+    owner = "awesomized";
+    repo = "libmemcached";
+    tag = finalAttrs.version;
+    hash = "sha256-jEw6L2/139oo4sGprl9Xp0DTarxAK1bEF2ak2kHWSAs=";
   };
 
-  # Fix linking against libpthread (patch from Fedora)
-  # https://bugzilla.redhat.com/show_bug.cgi?id=1037707
-  # https://bugs.launchpad.net/libmemcached/+bug/1281907
-  # Fix building on macOS (patch from Homebrew)
-  # https://bugs.launchpad.net/libmemcached/+bug/1245562
-  patches =
-    lib.optional stdenv.hostPlatform.isLinux ./libmemcached-fix-linking-with-libpthread.patch
-    ++ lib.optional stdenv.hostPlatform.isDarwin (fetchpatch {
-      url = "https://raw.githubusercontent.com/Homebrew/homebrew/bfd4a0a4626b61c2511fdf573bcbbc6bbe86340e/Library/Formula/libmemcached.rb";
-      sha256 = "1gjf3vd7hiyzxjvlg2zfc3y2j0lyr6nhbws4xb5dmin3csyp8qb8";
-    })
-    ++ lib.optional stdenv.hostPlatform.isMusl ./musl-fixes.patch;
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+  ];
+
+  cmakeFlags = [
+    "-DENABLE_SASL=ON"
+  ];
 
   buildInputs = [ libevent ];
   propagatedBuildInputs = [ cyrus_sasl ];
 
-  env.NIX_CFLAGS_COMPILE = "-fpermissive";
-
   meta = {
-    homepage = "https://libmemcached.org";
+    homepage = "https://github.com/awesomized/libmemcached";
+    changelog = "https://github.com/awesomized/libmemcached/blob/${finalAttrs.src.tag}/ChangeLog-${lib.versions.majorMinor finalAttrs.version}.md";
     description = "Open source C/C++ client library and tools for the memcached server";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;

From 0c743500cbc0bd3ec743c42b80370c7e5b3da857 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 10:59:24 -0700
Subject: [PATCH 559/831] phpExtensions.memcached: drop superfluous configure
 flag

---
 pkgs/development/php-packages/memcached/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/memcached/default.nix b/pkgs/development/php-packages/memcached/default.nix
index fdbda0292e59..f2c5125dd677 100644
--- a/pkgs/development/php-packages/memcached/default.nix
+++ b/pkgs/development/php-packages/memcached/default.nix
@@ -24,12 +24,12 @@ buildPecl rec {
 
   configureFlags = [
     "--with-zlib-dir=${zlib.dev}"
-    "--with-libmemcached-dir=${libmemcached}"
   ];
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     cyrus_sasl
+    libmemcached
     zlib
   ];
 

From 4114a35469875a3ade9771da6458aebf131354c9 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:41:55 +0300
Subject: [PATCH 560/831] minimal-bootstrap: split aggregate tests

Split minimal-bootstrap.test into bootstrap-chain, static-tools, and compiler aggregate tests. This keeps the full aggregate while allowing static-tool edits to be verified without rebuilding unrelated compiler checks.

Assisted-by: codex with gpt-5.5-high
---
 .../linux/minimal-bootstrap/default.nix       | 77 ++++++++++++-------
 1 file changed, 49 insertions(+), 28 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index dae72f79852a..a6189bddb3ff 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -366,61 +366,82 @@ lib.makeScope
           writeTextFile
           writeText
           ;
-        test = kaem.runCommand "minimal-bootstrap-test" { } (
-          ''
+
+        tests = {
+          bootstrap-chain = kaem.runCommand "minimal-bootstrap-bootstrap-chain-test" { } ''
             echo ${bash.tests.get-version}
-            echo ${bash-static.tests.get-version}
             echo ${bash_2_05.tests.get-version}
             echo ${binutils.tests.get-version}
-            echo ${binutils-static.tests.get-version}
             echo ${bison.tests.get-version}
             echo ${bzip2.tests.get-version}
-            echo ${bzip2-static.tests.get-version}
             echo ${coreutils-musl.tests.get-version}
-            echo ${coreutils-static.tests.get-version}
             echo ${diffutils.tests.get-version}
-            echo ${diffutils-static.tests.get-version}
             echo ${findutils.tests.get-version}
-            echo ${findutils-static.tests.get-version}
             echo ${gawk.tests.get-version}
             echo ${gawk-mes.tests.get-version}
-            echo ${gawk-static.tests.get-version}
-            echo ${gcc46.tests.get-version}
-            echo ${gcc46-cxx.tests.hello-world}
-            echo ${gcc10.tests.hello-world}
-            echo ${gcc-latest.tests.hello-world}
             echo ${gnugrep.tests.get-version}
-            echo ${gnugrep-static.tests.get-version}
             echo ${gnum4.tests.get-version}
             echo ${gnumake-musl.tests.get-version}
-            echo ${gnumake-static.tests.get-version}
-            echo ${gnupatch-static.tests.get-version}
             echo ${gnused.tests.get-version}
             echo ${gnused-mes.tests.get-version}
-            echo ${gnused-static.tests.get-version}
             echo ${gnutar.tests.get-version}
             echo ${gnutar-latest.tests.get-version}
             echo ${gnutar-musl.tests.get-version}
-            echo ${gnutar-static.tests.get-version}
             echo ${gzip.tests.get-version}
-            echo ${gzip-static.tests.get-version}
             echo ${heirloom.tests.get-version}
             echo ${mes.compiler.tests.get-version}
             echo ${musl.tests.hello-world}
-            echo ${patchelf-static.tests.get-version}
             echo ${python.tests.get-version}
             echo ${tinycc-mes.compiler.tests.chain}
             echo ${tinycc-musl.compiler.tests.hello-world}
             echo ${xz.tests.get-version}
-          ''
-          + (lib.strings.optionalString (hostPlatform.libc == "glibc") ''
-            echo ${gcc-glibc.tests.hello-world}
-            echo ${glibc.tests.hello-world}
-          '')
-          + ''
             mkdir ''${out}
-          ''
-        );
+          '';
+
+          static-tools = kaem.runCommand "minimal-bootstrap-static-tools-test" { } ''
+            echo ${bash-static.tests.get-version}
+            echo ${binutils-static.tests.get-version}
+            echo ${bzip2-static.tests.get-version}
+            echo ${coreutils-static.tests.get-version}
+            echo ${diffutils-static.tests.get-version}
+            echo ${findutils-static.tests.get-version}
+            echo ${gawk-static.tests.get-version}
+            echo ${gnugrep-static.tests.get-version}
+            echo ${gnumake-static.tests.get-version}
+            echo ${gnupatch-static.tests.get-version}
+            echo ${gnused-static.tests.get-version}
+            echo ${gnutar-static.tests.get-version}
+            echo ${gzip-static.tests.get-version}
+            echo ${patchelf-static.tests.get-version}
+            echo ${xz-static.tests.get-version}
+            mkdir ''${out}
+          '';
+
+          compiler = kaem.runCommand "minimal-bootstrap-compiler-test" { } (
+            ''
+              echo ${gcc46.tests.get-version}
+              echo ${gcc46-cxx.tests.hello-world}
+              echo ${gcc10.tests.hello-world}
+              echo ${gcc-latest.tests.hello-world}
+            ''
+            + (lib.strings.optionalString (hostPlatform.libc == "glibc") ''
+              echo ${gcc-glibc.tests.hello-world}
+              echo ${glibc.tests.hello-world}
+            '')
+            + ''
+              mkdir ''${out}
+            ''
+          );
+
+          full = kaem.runCommand "minimal-bootstrap-test" { } ''
+            echo ${tests.bootstrap-chain}
+            echo ${tests.static-tools}
+            echo ${tests.compiler}
+            mkdir ''${out}
+          '';
+        };
+
+        test = tests.full;
       }
       // (lib.optionalAttrs (hostPlatform.libc == "glibc")) {
         gcc-glibc = callPackage ./gcc/glibc.nix {

From a540814c6f5df4b0d484a26eb7c00fc70ac02509 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:41:25 +0300
Subject: [PATCH 561/831] minimal-bootstrap: drop patchelf compiler reference

Static patchelf does not need build-compiler paths in debug or source metadata. Add deterministic compiler flags and disallow references to the bootstrap compiler.

Size impact against upstream/staging:

- patchelf-static closure: 167.634 MiB -> 1.237 MiB (-166.397 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
index 7bf32df8ecb9..d14ca2df1d49 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
@@ -43,6 +43,8 @@ bash.runCommand "${pname}-${version}"
       gzip
     ];
 
+    disallowedReferences = [ gcc ];
+
     passthru.tests.get-version =
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
@@ -70,7 +72,7 @@ bash.runCommand "${pname}-${version}"
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
       CC=musl-gcc \
-      CXXFLAGS=-static
+      CXXFLAGS="-static -g0 -O2 -DNDEBUG -ffile-prefix-map=${gcc}=. -fmacro-prefix-map=${gcc}=."
 
     # Build
     make -j $NIX_BUILD_CORES

From 4b9eb9aca1bd14880cfa93c02195eef04a901936 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 13:46:05 -0700
Subject: [PATCH 562/831] libmemcached: run tests

---
 pkgs/by-name/li/libmemcached/package.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkgs/by-name/li/libmemcached/package.nix b/pkgs/by-name/li/libmemcached/package.nix
index e28220062207..bb3b5a90e3d2 100644
--- a/pkgs/by-name/li/libmemcached/package.nix
+++ b/pkgs/by-name/li/libmemcached/package.nix
@@ -7,6 +7,8 @@
   flex,
   cyrus_sasl,
   libevent,
+  ctestCheckHook,
+  memcached,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -27,12 +29,25 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
     "-DENABLE_SASL=ON"
   ];
 
   buildInputs = [ libevent ];
   propagatedBuildInputs = [ cyrus_sasl ];
 
+  doCheck = true;
+
+  nativeCheckInputs = [
+    ctestCheckHook
+    memcached
+  ];
+
+  disabledTests = [
+    "bin/memcapable"
+    "memcached_regression_lp583031"
+  ];
+
   meta = {
     homepage = "https://github.com/awesomized/libmemcached";
     changelog = "https://github.com/awesomized/libmemcached/blob/${finalAttrs.src.tag}/ChangeLog-${lib.versions.majorMinor finalAttrs.version}.md";

From 9f3e988fbf681238c067972db498dd5f2581f075 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:05 +0300
Subject: [PATCH 563/831] minimal-bootstrap: make xz-static actually static

Force the xz build through a static libtool link, disallow the musl runtime reference, and remove unused installed libraries, headers, docs, and auxiliary decoder tools.

Size impact against upstream/staging:

- xz-static closure: 26.517 MiB -> 0.277 MiB (-26.239 MiB)

Assisted-by: codex with gpt-5.5-high
---
 .../linux/minimal-bootstrap/xz/static.nix         | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
index d7eec96dff2a..c663c4cf04f8 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/xz/static.nix
@@ -39,10 +39,12 @@ bash.runCommand "${pname}-${version}"
       gzip
     ];
 
+    disallowedReferences = [ musl ];
+
     passthru.tests.get-version =
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
-        ${lib.getExe result} --version
+        ${result}/bin/xz --version
         mkdir $out
       '';
 
@@ -65,8 +67,8 @@ bash.runCommand "${pname}-${version}"
 
     # Configure
     export CC=musl-gcc
-    export CFLAGS=-static
-    export CXXFLAGS=-static
+    export CFLAGS="-g0 -O2 -DNDEBUG"
+    export CXXFLAGS="$CFLAGS"
     export LDFLAGS=-static
     bash ./configure \
       --prefix=$out \
@@ -78,11 +80,16 @@ bash.runCommand "${pname}-${version}"
       --disable-nls \
       --disable-shared \
       --disable-scripts \
+      --disable-doc \
+      --disable-xzdec \
+      --disable-lzmadec \
+      --disable-lzmainfo \
       --disable-assembler
 
     # Build
-    make -j $NIX_BUILD_CORES
+    make -j $NIX_BUILD_CORES LDFLAGS=-all-static
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/include $out/lib $out/share
   ''

From 338f91240fc29826aa672597e2d7e312155f1369 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:41:35 +0300
Subject: [PATCH 564/831] minimal-bootstrap: trim bash-static output

Disable NLS and remove installed documentation from the static bash used in stage0. The bootstrap path keeps bash and the sh symlink only.

Size impact against upstream/staging:

- bash-static closure: 9.643 MiB -> 1.333 MiB (-8.310 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
index 742379b94603..31ec4ebc5836 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bash/static.nix
@@ -63,6 +63,7 @@ bash.runCommand "${pname}-${version}"
       --host=${hostPlatform.config} \
       --without-bash-malloc \
       --disable-dependency-tracking \
+      --disable-nls \
       --enable-static-link \
       CC=musl-gcc
 
@@ -72,5 +73,6 @@ bash.runCommand "${pname}-${version}"
     # Install
     make -j $NIX_BUILD_CORES install-strip
     rm $out/bin/bashbug
+    rm -rf $out/share
     ln -s $out/bin/bash $out/bin/sh
   ''

From ffe5913f5677ae84c08f95d886592375af323172 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:41:43 +0300
Subject: [PATCH 565/831] minimal-bootstrap: trim binutils-static output

Drop unused installed libraries and headers, avoid building unused gprof/libctf components, and replace duplicate target-prefixed tools with symlinks while keeping the conventional paths available.

Size impact against upstream/staging:

- binutils-static closure: 42.482 MiB -> 21.093 MiB (-21.389 MiB)

Assisted-by: codex with gpt-5.5-high
---
 .../minimal-bootstrap/binutils/static.nix     | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index 90e2eb8126ea..6461f6523c0b 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -46,6 +46,8 @@ let
     "--enable-deterministic-archives"
     # depends on bison
     "--disable-gprofng"
+    # unused downstream
+    "--disable-gprof"
 
     # Turn on --enable-new-dtags by default to make the linker set
     # RUNPATH instead of RPATH on binaries.  This is important because
@@ -57,6 +59,8 @@ let
     # path to force users to declare their use of these libraries.
     "--with-lib-path=:"
     "--disable-gold"
+    # unused in the bootstrap path and removed from the output
+    "--disable-libctf"
     "--disable-plugins"
   ];
 in
@@ -83,6 +87,7 @@ bash.runCommand "${pname}-${version}"
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
         ${result}/bin/ld --version
+        ${result}/${hostPlatform.config}/bin/ld --version
         mkdir $out
       '';
   }
@@ -106,5 +111,17 @@ bash.runCommand "${pname}-${version}"
 
     # gprof/addr2line/elfedit + man pages are unused downstream.
     rm -f $out/bin/gprof $out/bin/addr2line $out/bin/elfedit
-    rm -rf $out/share/info $out/share/man
+    rm -rf $out/include $out/lib $out/share
+
+    # The target-prefixed tools duplicate the unprefixed tools byte-for-byte.
+    # Keep the conventional target-prefixed paths, but make them symlinks.
+    targetBin=$out/${hostPlatform.config}/bin
+    if [ -d "$targetBin" ]; then
+      for tool in ar as ld ld.bfd nm objcopy objdump ranlib readelf strip; do
+        if [ -e "$targetBin/$tool" ] && cmp -s "$out/bin/$tool" "$targetBin/$tool"; then
+          rm "$targetBin/$tool"
+          ln -s ../../bin/$tool "$targetBin/$tool"
+        fi
+      done
+    fi
   ''

From b200ae73ec2e3435b569cae82a5af7c4be6ba0e5 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:13 +0300
Subject: [PATCH 566/831] minimal-bootstrap: trim gawk-static output

Disable optional gawk features not used by the bootstrap path and prune installed helper files, headers, libraries, documentation, locale data, and awk library scripts. The smoke test now covers a simple awk program, not only --version.

Size impact against upstream/staging:

- gawk-static closure: 6.001 MiB -> 1.549 MiB (-4.453 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
index 2abe73c2aa0c..c6175308d59d 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
@@ -48,6 +48,7 @@ bash.runCommand "${pname}-${version}"
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
         ${result}/bin/awk --version
+        ${result}/bin/awk 'BEGIN { if (2 + 2 != 4) exit 1 }'
         mkdir $out
       '';
   }
@@ -62,6 +63,10 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-extensions \
+      --disable-mpfr \
+      --disable-nls \
+      --disable-pma \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -71,4 +76,6 @@ bash.runCommand "${pname}-${version}"
     # Install
     make -j $NIX_BUILD_CORES install-strip
     rm $out/bin/gawkbug
+    rm -rf $out/etc $out/include $out/lib $out/libexec
+    rm -rf $out/share
   ''

From 3a2649965b33b5d8ad71c24ccefe0bfa229d7fc7 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:22 +0300
Subject: [PATCH 567/831] minimal-bootstrap: trim findutils-static output

Disable NLS and keep only the bootstrap-relevant find and xargs tools. Drop locate, updatedb, frcode, documentation, locale data, and the var directory.

Size impact against upstream/staging:

- findutils-static closure: 2.830 MiB -> 0.592 MiB (-2.237 MiB)

Assisted-by: codex with gpt-5.5-high
---
 .../linux/minimal-bootstrap/findutils/static.nix           | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
index aa68c36eb73b..c6b1c6e2ba0c 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
@@ -47,6 +47,7 @@ bash.runCommand "${pname}-${version}"
       result:
       bash.runCommand "${pname}-get-version-${version}" { } ''
         ${result}/bin/find --version
+        ${result}/bin/xargs --version
         mkdir $out
       '';
 
@@ -69,6 +70,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -77,5 +79,8 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
-    rm $out/bin/updatedb
+
+    # Keep only the bootstrap-relevant find/xargs tools.
+    rm -f $out/bin/locate $out/bin/updatedb
+    rm -rf $out/libexec $out/share $out/var
   ''

From 61300f0b34bd7c16f2bf87fa6c2bdffa1a97c71d Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:33 +0300
Subject: [PATCH 568/831] minimal-bootstrap: trim gnumake-static output

Disable NLS and remove installed headers and documentation. The bootstrap path only needs the static make binary.

Size impact against upstream/staging:

- gnumake-static closure: 0.963 MiB -> 0.325 MiB (-0.638 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
index 1a7da3f1aff3..d24f0e6d12ce 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/static.nix
@@ -79,6 +79,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS="-static -std=gnu17"
 
@@ -87,4 +88,7 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+
+    # Remove files not needed to execute make in the bootstrap chain.
+    rm -rf $out/include $out/share
   ''

From cf5986d6ce1563ee59016e9341e4387a03e2e34b Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:42 +0300
Subject: [PATCH 569/831] minimal-bootstrap: trim diffutils-static output

Disable NLS and remove installed documentation from the static diffutils output. The bootstrap path keeps the diff, cmp, diff3, and sdiff binaries.

Size impact against upstream/staging:

- diffutils-static closure: 0.896 MiB -> 0.661 MiB (-0.235 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
index 063d1f0a4100..f46805411c61 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/static.nix
@@ -69,6 +69,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static \
       ac_cv_path_PR_PROGRAM=pr
@@ -78,4 +79,7 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+
+    # Remove documentation not needed in the bootstrap chain.
+    rm -rf $out/share
   ''

From 978f2e3f80c8190238780d4f27af71cc781e6b98 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:42:50 +0300
Subject: [PATCH 570/831] minimal-bootstrap: trim gnugrep-static output

Disable NLS and remove installed documentation after keeping only the grep binary. The existing egrep and fgrep pruning remains in place.

Size impact against upstream/staging:

- gnugrep-static closure: 0.546 MiB -> 0.381 MiB (-0.165 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
index 69f8dadd22ab..6083a70b2410 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
@@ -70,6 +70,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -79,4 +80,7 @@ bash.runCommand "${pname}-${version}"
     # Install
     make -j $NIX_BUILD_CORES install-strip
     rm $out/bin/{egrep,fgrep}
+
+    # Remove documentation not needed in the bootstrap chain.
+    rm -rf $out/share
   ''

From 0bc798232d8c05a61fde41cbd392a724796a6bfe Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:43:00 +0300
Subject: [PATCH 571/831] minimal-bootstrap: trim bzip2-static output

Install the single bzip2 binary with bunzip2 and bzcat symlinks instead of duplicate binaries, and skip unused recovery tools, headers, libraries, scripts, and man pages. The smoke test covers compression plus both decompression entry points.

Size impact against upstream/staging:

- bzip2-static closure: 0.665 MiB -> 0.159 MiB (-0.505 MiB)

Assisted-by: codex with gpt-5.5-high
---
 .../linux/minimal-bootstrap/bzip2/static.nix  | 37 ++++++++++++++-----
 .../linux/minimal-bootstrap/default.nix       |  1 +
 2 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
index fcdb8131957e..540f86112aa4 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bzip2/static.nix
@@ -33,12 +33,28 @@ bash.runCommand "${pname}-${version}"
       gzip
     ];
 
-    passthru.tests.get-version =
-      result:
-      bash.runCommand "${pname}-get-version-${version}" { } ''
-        ${result}/bin/bzip2 --help
-        mkdir $out
-      '';
+    passthru.tests = {
+      get-version =
+        result:
+        bash.runCommand "${pname}-get-version-${version}" { } ''
+          ${result}/bin/bzip2 --help
+          mkdir $out
+        '';
+
+      compress =
+        result:
+        bash.runCommand "${pname}-compress-${version}" { } ''
+          printf 'bootstrap\n' > input
+          ${result}/bin/bzip2 -k input
+          ${result}/bin/bunzip2 -c input.bz2 > bunzip2-output
+          read -r bunzip2Output < bunzip2-output
+          test "$bunzip2Output" = bootstrap
+          ${result}/bin/bzcat input.bz2 > bzcat-output
+          read -r bzcatOutput < bzcat-output
+          test "$bzcatOutput" = bootstrap
+          mkdir $out
+        '';
+    };
 
     meta = {
       description = "High-quality data compression program";
@@ -58,12 +74,15 @@ bash.runCommand "${pname}-${version}"
       -j $NIX_BUILD_CORES \
       CC=musl-gcc \
       CFLAGS=-static \
-      bzip2 bzip2recover
+      bzip2
 
     # Install
-    make install -j $NIX_BUILD_CORES PREFIX=$out
+    mkdir -p $out/bin
+    cp bzip2 $out/bin/bzip2
+    ln -s bzip2 $out/bin/bunzip2
+    ln -s bzip2 $out/bin/bzcat
 
     # Strip
     # Ignore failures, because strip may fail on non-elf files.
-    find $out/{bin,lib} -type f -exec strip --strip-debug {} + || true
+    strip --strip-debug $out/bin/bzip2 || true
   ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index a6189bddb3ff..40a2f9b5cac7 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -402,6 +402,7 @@ lib.makeScope
             echo ${bash-static.tests.get-version}
             echo ${binutils-static.tests.get-version}
             echo ${bzip2-static.tests.get-version}
+            echo ${bzip2-static.tests.compress}
             echo ${coreutils-static.tests.get-version}
             echo ${diffutils-static.tests.get-version}
             echo ${findutils-static.tests.get-version}

From e6c8f21c055266f969ab42d57f823de49abf9010 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Fri, 22 May 2026 05:43:09 +0300
Subject: [PATCH 572/831] minimal-bootstrap: trim gnutar-static output

Disable NLS and remove installed documentation plus the remote tape helper. The stage0 bootstrap path only needs the static tar binary.

Size impact against upstream/staging:

- gnutar-static closure: 3.772 MiB -> 0.826 MiB (-2.946 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
index 3add87dc6f3a..07eba0ef2fe4 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/static.nix
@@ -62,6 +62,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -70,4 +71,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/libexec $out/share
   ''

From 022df297033c8b5f01e918d116e2083a2a2f4233 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 7 Jun 2026 23:41:05 +0300
Subject: [PATCH 573/831] minimal-bootstrap: trim gzip-static output

Remove installed info and man pages. The stage0 bootstrap path only needs the static gzip binary.

Size impact against upstream/staging:

- gzip-static closure: 0.249 MiB -> 0.175 MiB (-0.073 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
index 5697ce229934..f449fdcd3609 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gzip/static.nix
@@ -77,4 +77,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES bin_SCRIPTS= install-strip
+    rm -rf $out/share
   ''

From 2c001ac5ad4e9f04908c8720c01dbf397266b793 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 7 Jun 2026 23:41:16 +0300
Subject: [PATCH 574/831] minimal-bootstrap: trim gnused-static output

Disable NLS and remove installed documentation. The stage0 bootstrap path only needs the static sed binary.

Size impact against upstream/staging:

- gnused-static closure: 0.480 MiB -> 0.276 MiB (-0.204 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
index f086c21747ff..8ebb1791e55c 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
@@ -62,6 +62,7 @@ bash.runCommand "${pname}-${version}"
       --build=${buildPlatform.config} \
       --host=${hostPlatform.config} \
       --disable-dependency-tracking \
+      --disable-nls \
       CC=musl-gcc \
       CFLAGS=-static
 
@@ -70,4 +71,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/share
   ''

From 4bd6d06b87eabe898940b6c7b7c7128e6b455819 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 7 Jun 2026 23:41:31 +0300
Subject: [PATCH 575/831] minimal-bootstrap: trim gnupatch-static output

Remove the installed man page. The stage0 bootstrap path only needs the static patch binary.

Size impact against upstream/staging:

- gnupatch-static closure: 0.273 MiB -> 0.241 MiB (-0.032 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
index 7cf5c0d1e786..ee25341e0b3b 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/static.nix
@@ -78,4 +78,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/share
   ''

From d250f7fa96c7278fdbe24a2d221d4a06211e8048 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sun, 7 Jun 2026 23:41:38 +0300
Subject: [PATCH 576/831] minimal-bootstrap: trim patchelf-static output

Remove installed shell completion, documentation, and man page. The stage0 bootstrap path only needs the static patchelf binary.

Size impact after the compiler-reference cleanup:

- patchelf-static closure: 1.237 MiB -> 1.225 MiB (-0.012 MiB)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
index d14ca2df1d49..1bec275f7b2a 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
@@ -79,4 +79,5 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
+    rm -rf $out/share
   ''

From ca76ad5f3d2a3dd2bace6e5f45e82298eb8e2920 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 14:15:18 -0700
Subject: [PATCH 577/831] libnice: add meta.changelog

---
 pkgs/by-name/li/libnice/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 99b58d0dc778..93c4e7de9df1 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -75,6 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = false;
 
   meta = {
+    changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS";
     description = "GLib ICE implementation";
     longDescription = ''
       Libnice is an implementation of the IETF's Interactice Connectivity

From 386925859c7f6e0abb6d2c0c1f0116e1b904acec Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Mon, 8 Jun 2026 00:19:19 +0300
Subject: [PATCH 578/831] minimal-bootstrap: trim coreutils-static output

Remove the empty share directory left behind after pruning installed coreutils documentation. The stage0 bootstrap path only needs the single static coreutils binary and symlink entry points.

Size impact against the previous trimmed output:

- coreutils-static closure: 2,250,112 B -> 2,249,944 B (-168 B)

Assisted-by: codex with gpt-5.5-high
---
 pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
index 22eca3a3c873..2291a5dedba3 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
@@ -80,5 +80,5 @@ bash.runCommand "${pname}-${version}"
     make -j $NIX_BUILD_CORES install-strip
 
     # Remove documentation not needed in the bootstrap chain.
-    rm -rf $out/share/info $out/share/man
+    rm -rf $out/share
   ''

From a86e904e5a6c23b94a16dda04a016ef7a3acccb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 7 Jun 2026 14:24:01 -0700
Subject: [PATCH 579/831] libpaper: 1.1.29 -> 2.2.8

Diff: https://github.com/rrthomas/libpaper/compare/v1.1.29...v2.2.8
---
 pkgs/by-name/li/libpaper/package.nix | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libpaper/package.nix b/pkgs/by-name/li/libpaper/package.nix
index d15318f30b06..71c6f5326aeb 100644
--- a/pkgs/by-name/li/libpaper/package.nix
+++ b/pkgs/by-name/li/libpaper/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.1.29";
+  version = "2.2.8";
   pname = "libpaper";
 
   src = fetchurl {
-    url = "mirror://debian/pool/main/libp/libpaper/libpaper_${finalAttrs.version}.tar.gz";
-    hash = "sha256-JjMOIemjEkZY1RX9hQsM3lRv9C2JsllqUmTF8Wd/BUc=";
+    url = "https://github.com/rrthomas/libpaper/releases/download/v${finalAttrs.version}/libpaper-${finalAttrs.version}.tar.gz";
+    hash = "sha256-HjMFcWkBkYdOykFex2iJ3RG6uYh6IwLWo2Zc0IHE13s=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -36,9 +36,15 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
+    changelog = "https://github.com/rrthomas/libpaper/releases/tag/v${finalAttrs.version}";
     description = "Library for handling paper characteristics";
-    homepage = "http://packages.debian.org/unstable/source/libpaper";
-    license = lib.licenses.gpl2;
+    homepage = "https://github.com/rrthomas/libpaper";
+    license = with lib.licenses; [
+      gpl2Only
+      gpl3Plus
+      mit
+      publicDomain
+    ];
     platforms = lib.platforms.unix;
   };
 })

From 3d3f33094c92102067a996c83216bed3b5c11764 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 8 Jun 2026 00:45:11 +0000
Subject: [PATCH 580/831] wayland-protocols: 1.48 -> 1.49

---
 pkgs/development/libraries/wayland/protocols.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/wayland/protocols.nix b/pkgs/development/libraries/wayland/protocols.nix
index 8a14819a2805..3aeaf002b5dd 100644
--- a/pkgs/development/libraries/wayland/protocols.nix
+++ b/pkgs/development/libraries/wayland/protocols.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayland-protocols";
-  version = "1.48";
+  version = "1.49";
 
   doCheck =
     stdenv.hostPlatform == stdenv.buildPlatform
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/${finalAttrs.pname}/-/releases/${finalAttrs.version}/downloads/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-OYA2rA62SEmC3b3n/4aEjXUyMfnN7q6YPwa1KUZiWqE=";
+    hash = "sha256-7EyPdJQtbf96zotM5HZPDvn/YYqTXZdOp37e4q0kCxQ=";
   };
 
   postPatch = lib.optionalString finalAttrs.finalPackage.doCheck ''

From ff0334da83c1a0e1ecb3864fcb84dd24dbcaecc5 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Mon, 8 Jun 2026 16:42:44 +0200
Subject: [PATCH 581/831] rsync: 3.4.3 -> 3.4.4

https://github.com/RsyncProject/rsync/releases/tag/v3.4.4
---
 pkgs/by-name/rs/rsync/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index c8137c8cf3c3..a6d869ad44da 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsync";
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchurl {
     # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
     url = "mirror://samba/rsync/src/rsync-${finalAttrs.version}.tar.gz";
-    hash = "sha256-xy5jyjAhy8gLqG7DAQJ3P0xWMfvEkrUudzs5WPgqU9M=";
+    hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY=";
   };
 
   preBuild = ''

From 2bb71590023462a801b3f3a6dab783b2556acbed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 8 Jun 2026 08:54:54 -0700
Subject: [PATCH 582/831] python3Packages.aiohttp: 3.14.0 -> 3.14.1

Diff: https://github.com/aio-libs/aiohttp/compare/v3.14.0...v3.14.1

Changelog: https://docs.aiohttp.org/en/v3.14.1/changes.html
---
 pkgs/development/python-modules/aiohttp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohttp/default.nix b/pkgs/development/python-modules/aiohttp/default.nix
index 06844833573d..bd20ca8fc845 100644
--- a/pkgs/development/python-modules/aiohttp/default.nix
+++ b/pkgs/development/python-modules/aiohttp/default.nix
@@ -51,14 +51,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiohttp";
-  version = "3.14.0";
+  version = "3.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RRXdDDkQlL7erfYgs4+gSy6GMlVUG7PrDLTQBYJJ1To=";
+    hash = "sha256-OJSLv/NfVrKESZqNr51FJUzLRz7wLMRdGoNjKC5EhlI=";
   };
 
   postPatch = ''

From 25cb117512e908090514b9a06b57a5d4900b3026 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 8 Jun 2026 08:57:14 -0700
Subject: [PATCH 583/831] python3Packages.pytest-aiohttp: 1.1.0 -> 1.1.1

Diff: https://github.com/aio-libs/pytest-aiohttp/compare/v1.1.0...v1.1.1

Changelog: https://github.com/aio-libs/pytest-aiohttp/blob/refs/tags/v1.1.1/CHANGES.rst
---
 pkgs/development/python-modules/pytest-aiohttp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-aiohttp/default.nix b/pkgs/development/python-modules/pytest-aiohttp/default.nix
index ba963a0b67b7..dbe4e0674c5a 100644
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-aiohttp";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   __darwinAllowLocalNetworking = true;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "aio-libs";
     repo = "pytest-aiohttp";
     tag = "v${version}";
-    hash = "sha256-5xUY3SVaoZzCZE/qfAP4R49HbtBMYj5jMN5viLEzEkM=";
+    hash = "sha256-SYMwVmcgPLOasW6TQGqqNO+sbp8zQQtDHb3IyAVO6KI=";
   };
 
   build-system = [

From 94c6cc8ea1eeccbd47b1de266b781c7bdd2df433 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Mon, 8 Jun 2026 11:37:32 -0700
Subject: [PATCH 584/831] replaceVarsWith: properly set pname, version

Link: https://github.com/NixOS/nixpkgs/issues/485742

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/build-support/replace-vars/replace-vars-with.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/replace-vars/replace-vars-with.nix b/pkgs/build-support/replace-vars/replace-vars-with.nix
index abbb9a1cc1a0..60e48f841a19 100644
--- a/pkgs/build-support/replace-vars/replace-vars-with.nix
+++ b/pkgs/build-support/replace-vars/replace-vars-with.nix
@@ -122,7 +122,8 @@ in
 
 stdenvNoCC.mkDerivation (
   {
-    name = baseNameOf src;
+    pname = optionalAttrs.pname or optionalAttrs.name or (baseNameOf src);
+    version = "26.11pre-git";
   }
   // optionalAttrs
   // forcedAttrs

From f3fc4042f5058ab5766b7fb65046bebe26f13b76 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Wed, 20 May 2026 15:41:22 -0400
Subject: [PATCH 585/831] cargo-auditable: 0.7.2 -> 0.7.5

---
 pkgs/by-name/ca/cargo-auditable/builder.nix | 2 ++
 pkgs/by-name/ca/cargo-auditable/package.nix | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-auditable/builder.nix b/pkgs/by-name/ca/cargo-auditable/builder.nix
index 348ff29ef61a..0fa045556116 100644
--- a/pkgs/by-name/ca/cargo-auditable/builder.nix
+++ b/pkgs/by-name/ca/cargo-auditable/builder.nix
@@ -21,6 +21,8 @@ lib.extendMkDerivation {
     {
       inherit auditable pname;
 
+      __structuredAttrs = true;
+
       src = fetchFromGitHub {
         owner = "rust-secure-code";
         repo = "cargo-auditable";
diff --git a/pkgs/by-name/ca/cargo-auditable/package.nix b/pkgs/by-name/ca/cargo-auditable/package.nix
index b74e0abbd515..371169459144 100644
--- a/pkgs/by-name/ca/cargo-auditable/package.nix
+++ b/pkgs/by-name/ca/cargo-auditable/package.nix
@@ -18,9 +18,9 @@ let
     auditable-bootstrap = bootstrap;
   };
 
-  version = "0.7.2";
-  hash = "sha256-hR6PjTOps8JSM7UbfGlCoZmmwtWExVqYwh4lxDiFWdc=";
-  cargoHash = "sha256-JEfnUJ9J6Xak3AOCwQCnu+v+3Wl3QbXX20qVFWB6040=";
+  version = "0.7.5";
+  hash = "sha256-0VONJCv/msLcGenItWMLJ7DH79RTD6vsU9gX/nphh1g=";
+  cargoHash = "sha256-/iAYib+xDQSJ8B559/V7b994ErSUGsPSDx64jFF5B6I=";
 
   # cargo-auditable cannot be built with cargo-auditable until cargo-auditable is built
   bootstrap = auditableBuilder {

From 5cd317d2dab4c51471a8603f55ad3728eea811e1 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Mon, 8 Jun 2026 16:42:07 -0400
Subject: [PATCH 586/831] cargo-auditable: add nix-update-script

---
 pkgs/by-name/ca/cargo-auditable/builder.nix | 5 ++++-
 pkgs/by-name/ca/cargo-auditable/package.nix | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ca/cargo-auditable/builder.nix b/pkgs/by-name/ca/cargo-auditable/builder.nix
index 0fa045556116..da652a61fcad 100644
--- a/pkgs/by-name/ca/cargo-auditable/builder.nix
+++ b/pkgs/by-name/ca/cargo-auditable/builder.nix
@@ -16,6 +16,7 @@ lib.extendMkDerivation {
       auditable ? true,
       hash ? "",
       cargoHash ? "",
+      passthru ? { },
       ...
     }:
     {
@@ -47,7 +48,9 @@ lib.extendMkDerivation {
         installManPage cargo-auditable/cargo-auditable.1
       '';
 
-      passthru.bootstrap = auditable-bootstrap;
+      passthru = passthru // {
+        bootstrap = auditable-bootstrap;
+      };
 
       meta = {
         description = "Tool to make production Rust binaries auditable";
diff --git a/pkgs/by-name/ca/cargo-auditable/package.nix b/pkgs/by-name/ca/cargo-auditable/package.nix
index 371169459144..064df430d374 100644
--- a/pkgs/by-name/ca/cargo-auditable/package.nix
+++ b/pkgs/by-name/ca/cargo-auditable/package.nix
@@ -2,6 +2,7 @@
   buildPackages,
   callPackage,
   makeRustPlatform,
+  nix-update-script,
 }:
 let
   # Need to use the build platform rustc and Cargo so that
@@ -32,4 +33,5 @@ in
 auditableBuilder {
   inherit version hash cargoHash;
   auditable = true;
+  passthru.updateScript = nix-update-script { };
 }

From edca5f9152e3806b66bbce2bc93ff5dd41ece6b9 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 8 Jun 2026 22:32:15 +0100
Subject: [PATCH 587/831] sdl2-compat: 2.32.68 -> 2.32.70

Changes: https://github.com/libsdl-org/sdl2-compat/releases/tag/release-2.32.70
---
 pkgs/by-name/sd/sdl2-compat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix
index 5b6376cd9538..b1143ff1a0fc 100644
--- a/pkgs/by-name/sd/sdl2-compat/package.nix
+++ b/pkgs/by-name/sd/sdl2-compat/package.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl2-compat";
-  version = "2.32.68";
+  version = "2.32.70";
 
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "sdl2-compat";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-66AHlsl53q9efRqZOzI4JiUbaGByrSMoQFj3K7udTsQ=";
+    hash = "sha256-IKfcF03I+kCewjdEcw7ANd6sCZvjNksIhBfJan9SSUY=";
   };
 
   nativeBuildInputs = [

From c1d0c1eaa6e38af35b25325f625e1e7acf807f4d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 00:57:07 +0000
Subject: [PATCH 588/831] hwloc: 2.13.0 -> 2.14.0

---
 pkgs/by-name/hw/hwloc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwloc/package.nix b/pkgs/by-name/hw/hwloc/package.nix
index c49a9c9b78ad..5ad26d3e89a3 100644
--- a/pkgs/by-name/hw/hwloc/package.nix
+++ b/pkgs/by-name/hw/hwloc/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwloc";
-  version = "2.13.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "open-mpi";
     repo = "hwloc";
     tag = "hwloc-${finalAttrs.version}";
-    hash = "sha256-W/WiLj4lqJZMGRhH+PXuSJS6mtW+fir4xmDTH9mcOtE=";
+    hash = "sha256-lbh8tkKeUcHta7/q9TuHQhccyWjkBgrC5fVifFJqQyY=";
   };
 
   configureFlags = [

From 02c36547a4e27c0474de8f6bd32397092f62e69a Mon Sep 17 00:00:00 2001
From: OttNorml <2350859+ottnorml@users.noreply.github.com>
Date: Tue, 9 Jun 2026 05:37:24 +0200
Subject: [PATCH 589/831] prek: 0.3.13 -> 0.4.4

Diff: https://github.com/j178/prek/compare/v0.3.13...v0.4.4

Changelog: https://github.com/j178/prek/blob/v0.4.4/CHANGELOG.md
---
 pkgs/by-name/pr/prek/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index 4f4920e06410..7d791d9cd57e 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.3.13";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OPH1H571jw0b8EsyzRcVdG54sQ7KeOclmnHCeVGteRI=";
+    hash = "sha256-PAEmRQ5Vro83fkegOWsdY59U7WAQxBPSEalzxZV6K4o=";
   };
 
-  cargoHash = "sha256-lvB09qOvVXmSdhR1TRJQ3rvYyn6cFSOGpogJZDajPuQ=";
+  cargoHash = "sha256-EmlR6Lmt5XR0uS/y3FqY5yGNeVBSdtLtEGH9jZLcP2o=";
 
   nativeBuildInputs = [
     installShellFiles

From e64ef4b13710934154312e52349f882a82a2002e Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 8 Jun 2026 16:12:55 +0200
Subject: [PATCH 590/831] wrapGAppsHook: make more bash variables local

---
 .../setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh             | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index ea3e81bfdf27..92b7a5eee3e7 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -51,6 +51,8 @@ wrapGAppsHook() {
     wrapGAppsHookHasRunForOutput["$output"]=1
 
     if [[ -z "${dontWrapGApps:-}" ]]; then
+        local targetDirsThatExist targetDirsRealPath targetDirs targetDir
+
         targetDirsThatExist=()
         targetDirsRealPath=()
 
@@ -71,6 +73,7 @@ wrapGAppsHook() {
         # wrap links to binaries that point outside targetDirs
         # Note: links to binaries within targetDirs do not need
         #       to be wrapped as the binaries have already been wrapped
+        local linkPathReal targetPath
         if [[ ${#targetDirsThatExist[@]} -ne 0 ]]; then
             find "${targetDirsThatExist[@]}" -type l -xtype f -executable -print0 |
                 while IFS= read -r -d '' linkPath; do

From 0a9601a870530381284330b108b2b9123473de6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 9 Jun 2026 11:10:34 -0700
Subject: [PATCH 591/831] python3Packages.pytest-aiohttp: use finalAttrs

---
 .../development/python-modules/pytest-aiohttp/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-aiohttp/default.nix b/pkgs/development/python-modules/pytest-aiohttp/default.nix
index dbe4e0674c5a..0952681a5135 100644
--- a/pkgs/development/python-modules/pytest-aiohttp/default.nix
+++ b/pkgs/development/python-modules/pytest-aiohttp/default.nix
@@ -10,7 +10,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pytest-aiohttp";
   version = "1.1.1";
   pyproject = true;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "pytest-aiohttp";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-SYMwVmcgPLOasW6TQGqqNO+sbp8zQQtDHb3IyAVO6KI=";
   };
 
@@ -45,9 +45,9 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/aio-libs/pytest-aiohttp/";
-    changelog = "https://github.com/aio-libs/pytest-aiohttp/blob/${src.rev}/CHANGES.rst";
+    changelog = "https://github.com/aio-libs/pytest-aiohttp/blob/${finalAttrs.src.tag}/CHANGES.rst";
     description = "Pytest plugin for aiohttp support";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

From 37928491dffcfcb7c6a9668a82de2b01edf871d0 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 26 May 2026 06:26:21 +0100
Subject: [PATCH 592/831] librsvg: 2.62.1 -> 2.62.3

Changes:
- https://gitlab.gnome.org/GNOME/librsvg/-/tags/2.62.2
- https://gitlab.gnome.org/GNOME/librsvg/-/tags/2.62.3

Co-authored-by: dotlambda <github@dotlambda.de>
---
 pkgs/by-name/li/librsvg/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/librsvg/package.nix b/pkgs/by-name/li/librsvg/package.nix
index 333015e1927c..297c1a0eae32 100644
--- a/pkgs/by-name/li/librsvg/package.nix
+++ b/pkgs/by-name/li/librsvg/package.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.62.1";
+  version = "2.62.3";
 
   outputs = [
     "out"
@@ -62,13 +62,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tByoQgYkL93YJqK/djSNfN9SwQUMv6BguGboGiUhRcM=";
+    hash = "sha256-frRJsnIqdoAhNW9m3+4yAsIptU7U5qcM5AwJDpf/FvI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-Px7H2Z4ShCCuZNskuKj427lE9dvIc6xRo8R1S4fK+ZQ=";
+    hash = "sha256-9ubfIl9R2BdcAWn7i050KBbb4cMdlakvrKdnjpZCQjA=";
     dontConfigure = true;
   };
 

From 2a6942aa98776405d1f99a554efe711c7b001968 Mon Sep 17 00:00:00 2001
From: Anton Tetov Johansson <anton@tetov.se>
Date: Tue, 9 Jun 2026 14:16:11 +0200
Subject: [PATCH 593/831] less: 702 -> 704

---
 pkgs/by-name/le/less/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/le/less/package.nix b/pkgs/by-name/le/less/package.nix
index bc017a199195..00823f701cde 100644
--- a/pkgs/by-name/le/less/package.nix
+++ b/pkgs/by-name/le/less/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "less";
-  version = "702";
+  version = "704";
 
   # `less` is provided by the following sources:
   # - meta.homepage
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   # homepage, and only those not marked as beta.
   src = fetchurl {
     url = "https://www.greenwoodsoftware.com/less/less-${finalAttrs.version}.tar.gz";
-    hash = "sha256-JCpkwA8C2W+O4gjPY4rhcotyfH9f34Kn1PTK4y+whOI=";
+    hash = "sha256-IKCworslJfpTx+7pvrhUtMnPFy6rsgmvcCB0NUe/6fs=";
   };
 
   buildInputs = [

From 8ee977fe7fb6aee0d47c0aeb20f6af09cf15d357 Mon Sep 17 00:00:00 2001
From: Leona Maroni <dev@leona.is>
Date: Wed, 10 Jun 2026 09:21:32 +0200
Subject: [PATCH 594/831] rsync: fix test failure on darwin

---
 pkgs/by-name/rs/rsync/package.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index a6d869ad44da..2a6cdd676a9f 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
 
   updateAutotoolsGnuConfigScriptsHook,
   perl,
@@ -36,6 +37,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY=";
   };
 
+  patches = [
+    # Fixes test failure on darwin
+    (fetchpatch {
+      url = "https://github.com/RsyncProject/rsync/commit/e1c5f0e93a75dd45f32f3b92ba221ef158ac2e5f.patch";
+      hash = "sha256-pg65K9BCTq/WvS5icK6KT28ARccFKedp2445wLYdRsE=";
+      excludes = [
+        ".github/workflows/cygwin-build.yml"
+      ];
+    })
+  ];
+
   preBuild = ''
     patchShebangs ./runtests.py
   '';

From 774054e73cca482dba984a78ac7e488f5f57db73 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Wed, 10 Jun 2026 16:52:00 +0200
Subject: [PATCH 595/831] python3Packages.pygobject3: 3.56.2 -> 3.56.3

changelog: https://gitlab.gnome.org/GNOME/pygobject/-/raw/3.56.3/NEWS

diff: https://gitlab.gnome.org/GNOME/pygobject/-/compare/3.56.2...3.56.3
---
 pkgs/development/python-modules/pygobject/3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index b912d6b04bb8..c728dbbbd82c 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.56.2";
+  version = "3.56.3";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/pygobject/${lib.versions.majorMinor version}/pygobject-${version}.tar.gz";
-    hash = "sha256-uBYJiWlUQIHenuztuUrWrFnHfk1XH+cFHxi+vOwHQxM=";
+    hash = "sha256-EnYOSg49BLbrleBveifjYsgm1WfqYTNzqSwAO2xw0tY=";
   };
 
   depsBuildBuild = [ pkg-config ];

From 5750c4a1f5379f5d462e0c661079d0f9ebf3c6f5 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Wed, 3 Jun 2026 10:28:27 +0200
Subject: [PATCH 596/831] =?UTF-8?q?dune:=203.22.2=20=E2=86=92=203.23.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/du/dune/package.nix                           | 3 ++-
 .../ocaml-modules/dune-configurator/default.nix            | 5 ++++-
 pkgs/development/ocaml-modules/stdune/default.nix          | 7 ++++++-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/du/dune/package.nix b/pkgs/by-name/du/dune/package.nix
index 0dfaf0a82ca8..0f50adc7b00f 100644
--- a/pkgs/by-name/du/dune/package.nix
+++ b/pkgs/by-name/du/dune/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   buildPackages,
-  version ? "3.22.2",
+  version ? "3.23.1",
 }:
 let
   # needed for pkgsStatic
@@ -21,6 +21,7 @@ stdenv.mkDerivation {
       "https://github.com/ocaml/dune/releases/download/${version}/dune-${sfx}${version}.tbz";
     hash =
       {
+        "3.23.1" = "sha256-k7TnFX9rqP62HPxfhgCO/SxZA3unigF9krSr8wYyNI8=";
         "3.22.2" = "sha256-wsz4vGsXr6R8RQKXNXSWMDqnyGgOMpt52Yxo41AToRg=";
         "3.21.1" = "sha256-hPeoLG2ApxJPOEfppInoDPvq+3vtNXOsAShu9W/QjZQ=";
         "2.9.3" = "sha256:1ml8bxym8sdfz25bx947al7cvsi2zg5lcv7x9w6xb01cmdryqr9y";
diff --git a/pkgs/development/ocaml-modules/dune-configurator/default.nix b/pkgs/development/ocaml-modules/dune-configurator/default.nix
index d17a866141b9..2ede486e1a14 100644
--- a/pkgs/development/ocaml-modules/dune-configurator/default.nix
+++ b/pkgs/development/ocaml-modules/dune-configurator/default.nix
@@ -1,14 +1,17 @@
 {
   lib,
   buildDunePackage,
+  ocaml,
   dune,
   csexp,
+  version ? if lib.versionAtLeast ocaml.version "4.13" then dune.version else "3.22.2",
 }:
 
 buildDunePackage {
   pname = "dune-configurator";
+  inherit version;
 
-  inherit (dune) src version;
+  inherit (dune.override { inherit version; }) src;
 
   dontAddPrefix = true;
 
diff --git a/pkgs/development/ocaml-modules/stdune/default.nix b/pkgs/development/ocaml-modules/stdune/default.nix
index 04b3fc3d1267..f4d61e9241f9 100644
--- a/pkgs/development/ocaml-modules/stdune/default.nix
+++ b/pkgs/development/ocaml-modules/stdune/default.nix
@@ -1,5 +1,7 @@
 {
+  lib,
   buildDunePackage,
+  ocaml,
   dune,
   dyn,
   ordering,
@@ -7,11 +9,14 @@
   csexp,
   fs-io,
   top-closure,
+  version ? if lib.versionAtLeast ocaml.version "4.13" then dune.version else "3.22.2",
 }:
 
 buildDunePackage {
   pname = "stdune";
-  inherit (dune) version src;
+  inherit version;
+
+  inherit (dune.override { inherit version; }) src;
 
   dontAddPrefix = true;
 

From 1691b9e047c61f725377168894abe3af20a7fdc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 10 Jun 2026 12:45:56 -0700
Subject: [PATCH 597/831] python3Packages.httpx: only unset $SSL_CERT_FILE if
 path doesn't exist

---
 pkgs/development/python-modules/httpx/setup-hook.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/httpx/setup-hook.sh b/pkgs/development/python-modules/httpx/setup-hook.sh
index 7e9ced07b69c..fe567877ef1a 100644
--- a/pkgs/development/python-modules/httpx/setup-hook.sh
+++ b/pkgs/development/python-modules/httpx/setup-hook.sh
@@ -1,5 +1,7 @@
 httpxSslCertFileUnset() {
+  if [ ! -e "${SSL_CERT_FILE-}" ]; then
     unset SSL_CERT_FILE
+  fi
 }
 
 postHooks+=(httpxSslCertFileUnset)

From 4071736d8c5b8fe22079531ee0339710fb975fa6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 10 Jun 2026 12:53:16 -0700
Subject: [PATCH 598/831] python3Packages.pyreqwest: remove httpx workaround

---
 pkgs/development/python-modules/pyreqwest/default.nix | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pyreqwest/default.nix b/pkgs/development/python-modules/pyreqwest/default.nix
index 10b189757108..3d6fe0e9c825 100644
--- a/pkgs/development/python-modules/pyreqwest/default.nix
+++ b/pkgs/development/python-modules/pyreqwest/default.nix
@@ -43,6 +43,7 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "pyreqwest" ];
 
   nativeCheckInputs = [
+    cacert
     dirty-equals
     docker
     granian
@@ -57,12 +58,6 @@ buildPythonPackage (finalAttrs: {
     yarl
   ];
 
-  preCheck = ''
-    # Without this tests fails with
-    #     unexpected error: No CA certificates were loaded from the system
-    export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
-  '';
-
   disabledTestPaths = [
     # requires a running Docker daemon
     "tests/test_examples.py"

From 902d6dd64bd7361ff57530c3fb4bb8db1f30b2be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 10 Jun 2026 13:18:41 -0700
Subject: [PATCH 599/831] python3Packages.prowlpy: remove httpx workaround

---
 pkgs/development/python-modules/prowlpy/default.nix | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/prowlpy/default.nix b/pkgs/development/python-modules/prowlpy/default.nix
index f69da1bc04c0..a6368e345efe 100644
--- a/pkgs/development/python-modules/prowlpy/default.nix
+++ b/pkgs/development/python-modules/prowlpy/default.nix
@@ -43,6 +43,7 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "prowlpy" ];
 
   nativeCheckInputs = [
+    cacert
     pytest-asyncio
     pytest-cov-stub
     pytestCheckHook
@@ -50,12 +51,6 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
-  preCheck = ''
-    # Without this pyreqwest fails with
-    #     unexpected error: No CA certificates were loaded from the system
-    export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
-  '';
-
   # tests fail without this
   pytestFlags = [ "-v" ];
 

From 811bd13927b21ba798a7648966c530a31738c83e Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Tue, 9 Jun 2026 19:28:19 +0300
Subject: [PATCH 600/831] diffutils: move to by-name

Also drop diffutils from the `inherit (prevStage)` overrides in
pkgs/stdenv/linux/default.nix. Once the package lives in pkgs/by-name,
that pin gives the top-level `diffutils` attribute a source location
even though it is defined via `_internalCallByNamePackageFile`, which
nixpkgs-vet rejects (NPV-102). Dropping the pin lets the by-name
auto-definition stand on its own, at the cost of no longer reusing the
bootstrap-stage build (a stdenv-class rebuild, hence staging).

Co-authored-by: Philip Taron <philip.taron@gmail.com>
Assisted-by: Claude Code (claude-opus-4-8)
---
 .../gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch          | 0
 pkgs/{tools/text => by-name/di}/diffutils/musl-llvm.patch       | 0
 .../diffutils/default.nix => by-name/di/diffutils/package.nix}  | 0
 pkgs/stdenv/linux/default.nix                                   | 1 -
 pkgs/top-level/all-packages.nix                                 | 2 --
 5 files changed, 3 deletions(-)
 rename pkgs/{tools/text => by-name/di}/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch (100%)
 rename pkgs/{tools/text => by-name/di}/diffutils/musl-llvm.patch (100%)
 rename pkgs/{tools/text/diffutils/default.nix => by-name/di/diffutils/package.nix} (100%)

diff --git a/pkgs/tools/text/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch b/pkgs/by-name/di/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
similarity index 100%
rename from pkgs/tools/text/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
rename to pkgs/by-name/di/diffutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
diff --git a/pkgs/tools/text/diffutils/musl-llvm.patch b/pkgs/by-name/di/diffutils/musl-llvm.patch
similarity index 100%
rename from pkgs/tools/text/diffutils/musl-llvm.patch
rename to pkgs/by-name/di/diffutils/musl-llvm.patch
diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/by-name/di/diffutils/package.nix
similarity index 100%
rename from pkgs/tools/text/diffutils/default.nix
rename to pkgs/by-name/di/diffutils/package.nix
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 5c19d616c960..c9b64c3086e8 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -832,7 +832,6 @@ in
               xz
               bashNonInteractive
               coreutils
-              diffutils
               findutils
               gawk
               gnused
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 138c354620c2..ee64420ed000 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2072,8 +2072,6 @@ with pkgs;
     enableBloat = false;
   };
 
-  diffutils = callPackage ../tools/text/diffutils { };
-
   inherit (import ../build-support/dlang/dub-support.nix { inherit lib callPackage; })
     dub-to-nix
     importDubLock

From d76fd9e7e88c3f5e4bb74c0f2d1f79edb5903cf6 Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Wed, 10 Jun 2026 21:37:03 -0400
Subject: [PATCH 601/831] file: 5.47 -> 5.48

The patches that were required for v5.47 are now part of the v5.48
release.

Changelog: <https://github.com/file/file/compare/FILE5_47...FILE5_48>
---
 ...-Don-t-flush-when-trying-to-set-nega.patch |  57 --
 ...Revert-previous-and-always-set-offse.patch |  26 -
 .../tools/misc/file/0003-Add-LE-BE-GUID.patch | 631 ------------------
 ...parsing-guids-in-big-endian-machines.patch |  82 ---
 pkgs/tools/misc/file/default.nix              |  38 +-
 5 files changed, 2 insertions(+), 832 deletions(-)
 delete mode 100644 pkgs/tools/misc/file/0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
 delete mode 100644 pkgs/tools/misc/file/0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
 delete mode 100644 pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
 delete mode 100644 pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch

diff --git a/pkgs/tools/misc/file/0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch b/pkgs/tools/misc/file/0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
deleted file mode 100644
index 77ad10f252c7..000000000000
--- a/pkgs/tools/misc/file/0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 12b76648185104ce9118d8b5fa57aa34a77ad084 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Wed, 15 Apr 2026 20:00:20 +0000
-Subject: [PATCH] PR/745: streamout: Don't flush when trying to set negative
- offsets     on pipes, just continue, fixes 'cat file.zip | file -'
-
----
- ChangeLog       |  2 ++
- src/softmagic.c | 22 ++++++++++++++++------
- 2 files changed, 18 insertions(+), 6 deletions(-)
-
-diff --git a/src/softmagic.c b/src/softmagic.c
-index 7cf7c798..a5e758eb 100644
---- a/src/softmagic.c
-+++ b/src/softmagic.c
-@@ -245,14 +245,19 @@ match(struct magic_set *ms, struct magic *magic, file_regex_t **magic_rxcomp,
- flush:
- 			/* Skip sub-tests */
- 			while (magindex < nmagic - 1 &&
--			    magic[magindex + 1].cont_level != 0)
-+			    magic[magindex + 1].cont_level != 0) {
- 				magindex++;
-+			}
- 			cont_level = 0;
- 			continue; /* Skip to next top-level test*/
- 		}
- 
--		if (msetoffset(ms, m, &bb, b, offset, cont_level) == -1)
--			goto flush;
-+		if (msetoffset(ms, m, &bb, b, offset, cont_level) == -1) {
-+			if (b->elen == FILE_BADSIZE)
-+				continue;
-+			else
-+				goto flush;
-+		}
- 		ms->line = m->lineno;
- 
- 		/* if main entry matches, print it... */
-@@ -347,8 +352,13 @@ flush:
- 				 */
- 				cont_level = m->cont_level;
- 			}
--			if (msetoffset(ms, m, &bb, b, offset, cont_level) == -1)
--				goto flush;
-+			if (msetoffset(ms, m, &bb, b, offset, cont_level)
-+			    == -1) {
-+				if (b->elen == FILE_BADSIZE)
-+					continue;
-+				else
-+					goto flush;
-+			}
- 			if (m->flag & OFFADD) {
- 				if (cont_level == 0) {
- 					if ((ms->flags & MAGIC_DEBUG) != 0)
--- 
-2.53.0
-
diff --git a/pkgs/tools/misc/file/0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch b/pkgs/tools/misc/file/0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
deleted file mode 100644
index ff405c446597..000000000000
--- a/pkgs/tools/misc/file/0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From c54605718190ad8fe9c25cb475f1f32ca7cd54f7 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Sun, 12 Apr 2026 22:15:14 +0000
-Subject: [PATCH] PR/725: inliniac: Revert previous and always set offset.
-
----
- src/softmagic.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/src/softmagic.c b/src/softmagic.c
-index 9aaf8b3e..7cf7c798 100644
---- a/src/softmagic.c
-+++ b/src/softmagic.c
-@@ -1577,8 +1577,7 @@ normal:
- 			ms->offset = offset;
- 			ms->eoffset = 0;
- 		} else {
--			if (b->fd != -1)
--				ms->offset = ms->eoffset + offset;
-+			ms->offset = ms->eoffset + offset;
- 		}
- 	}
- 	if ((ms->flags & MAGIC_DEBUG) != 0) {
--- 
-2.51.2
-
diff --git a/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch b/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
deleted file mode 100644
index 69e52586b5f6..000000000000
--- a/pkgs/tools/misc/file/0003-Add-LE-BE-GUID.patch
+++ /dev/null
@@ -1,631 +0,0 @@
-From 797a275514c80303accbd821df9692b04f6020e6 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Sun, 19 Apr 2026 19:56:49 +0000
-Subject: [PATCH] Add LE/BE GUID
-
-(OPNA2608: removed hunks that change file modification dates, as they
-make it more difficult to apply the patch)
-
-(OPNA2608: merge typo fix 2866af2e51beb40afe35d2ff5e765991ac459237)
-
----
- doc/magic.man    |   8 ++--
- src/Makefile.am  |   3 +-
- src/apprentice.c | 121 ++++++++++-------------------------------------
- src/file.h       |  31 ++++++------
- src/funcs.c      |  30 +++++++++---
- src/print.c      |  11 +++--
- src/softmagic.c  |  18 ++++++-
- src/swap.c       | 101 +++++++++++++++++++++++++++++++++++++++
- src/swap.h       |  48 +++++++++++++++++++
- 9 files changed, 247 insertions(+), 124 deletions(-)
- create mode 100644 src/swap.c
- create mode 100644 src/swap.h
-
-diff --git a/doc/magic.man b/doc/magic.man
-index aa9f8da247..bad8111b28 100644
---- a/doc/magic.man
-+++ b/doc/magic.man
-@@ -373,7 +373,9 @@ The DER types are:
- .Dv rel-oid-iri .
- These types can be followed by an optional numeric size, which indicates
- the field width in bytes.
--.It Dv guid
-+.It Dv guid ,
-+.It Dv leguid ,
-+.It Dv beguid 
- A Globally Unique Identifier, parsed and printed as
- XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.
- Its format is a string.
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 64c0414367..10cf6fcb23 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -10,7 +10,8 @@ AM_CFLAGS = $(CFLAG_VISIBILITY) @WARNINGS@
- libmagic_la_SOURCES = buffer.c magic.c apprentice.c softmagic.c ascmagic.c \
- 	encoding.c compress.c is_csv.c is_json.c is_simh.c is_tar.c readelf.c \
- 	print.c fsmagic.c funcs.c file.h readelf.h tar.h apptype.c der.c der.h \
--	file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h
-+	file_opts.h elfclass.h mygetopt.h cdf.c cdf_time.c readcdf.c cdf.h \
-+	swap.c swap.h
- libmagic_la_LDFLAGS = -no-undefined -version-info 1:0:0
- if MINGW
- MINGWLIBS = -lgnurx -lshlwapi
-diff --git a/src/apprentice.c b/src/apprentice.c
-index a6ab9e7c30..b67897b45a 100644
---- a/src/apprentice.c
-+++ b/src/apprentice.c
-@@ -32,6 +32,7 @@
- #endif	/* lint */
- 
- #include "magic.h"
-+#include "swap.h"
- #include <stdlib.h>
- #ifdef HAVE_UNISTD_H
- #include <unistd.h>
-@@ -50,12 +51,6 @@ FILE_RCSID("@(#)$File: apprentice.c,v 1.373 2026/04/17 14:58:57 christos Exp $")
- #endif
- #include <dirent.h>
- #include <limits.h>
--#ifdef HAVE_BYTESWAP_H
--#include <byteswap.h>
--#endif
--#ifdef HAVE_SYS_BSWAP_H
--#include <sys/bswap.h>
--#endif
- 
- 
- #define	EATAB {while (*l && isascii(CAST(unsigned char, *l)) && \
-@@ -131,20 +126,6 @@ file_private void mlist_free(struct mlist *);
- file_private void byteswap(struct magic *, uint32_t);
- file_private void bs1(struct magic *);
- 
--#if defined(HAVE_BYTESWAP_H)
--#define swap2(x)	bswap_16(x)
--#define swap4(x)	bswap_32(x)
--#define swap8(x)	bswap_64(x)
--#elif defined(HAVE_SYS_BSWAP_H)
--#define swap2(x)	bswap16(x)
--#define swap4(x)	bswap32(x)
--#define swap8(x)	bswap64(x)
--#else
--file_private uint16_t swap2(uint16_t);
--file_private uint32_t swap4(uint32_t);
--file_private uint64_t swap8(uint64_t);
--#endif
--
- file_private char *mkdbname(struct magic_set *, const char *, int);
- file_private struct magic_map *apprentice_buf(struct magic_set *, struct magic *,
-     size_t);
-@@ -285,6 +266,8 @@ static const struct type_tbl_s type_tbl[] = {
- 	{ XX("clear"),		FILE_CLEAR,		FILE_FMT_NONE },
- 	{ XX("der"),		FILE_DER,		FILE_FMT_STR },
- 	{ XX("guid"),		FILE_GUID,		FILE_FMT_STR },
-+	{ XX("leguid"),		FILE_LEGUID,		FILE_FMT_STR },
-+	{ XX("beguid"),		FILE_BEGUID,		FILE_FMT_STR },
- 	{ XX("offset"),		FILE_OFFSET,		FILE_FMT_QUAD },
- 	{ XX("bevarint"),	FILE_BEVARINT,		FILE_FMT_STR },
- 	{ XX("levarint"),	FILE_LEVARINT,		FILE_FMT_STR },
-@@ -926,6 +909,8 @@ typesize(int type)
- 	case FILE_LEVARINT:
- 		return 8;
- 
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 	case FILE_GUID:
- 		return 16;
- 
-@@ -989,6 +974,8 @@ apprentice_magic_strength_1(const struct magic *m)
- 	case FILE_BEVARINT:
- 	case FILE_LEVARINT:
- 	case FILE_GUID:
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 	case FILE_BEID3:
- 	case FILE_LEID3:
- 	case FILE_OFFSET:
-@@ -1251,6 +1238,8 @@ set_test_type(struct magic *mstart, struct magic *m)
- 	case FILE_LEVARINT:
- 	case FILE_DER:
- 	case FILE_GUID:
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 	case FILE_OFFSET:
- 	case FILE_MSDOSDATE:
- 	case FILE_BEMSDOSDATE:
-@@ -1733,6 +1722,8 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
- 		case FILE_CLEAR:
- 		case FILE_DER:
- 		case FILE_GUID:
-+		case FILE_LEGUID:
-+		case FILE_BEGUID:
- 		case FILE_OCTAL:
- 			break;
- 		default:
-@@ -2943,6 +2934,8 @@ getvalue(struct magic_set *ms, struct magic *m, const char **p, int action)
- 		if (errno == 0)
- 			*p = ep;
- 		return 0;
-+	case FILE_BEGUID:
-+	case FILE_LEGUID:
- 	case FILE_GUID:
- 		if (file_parse_guid(*p, m->value.guid) == -1) {
- 			file_magwarn(ms, "Error parsing guid `%s'", *p);
-@@ -3418,7 +3411,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
- 
- 	ptr = CAST(uint32_t *, map->p);
- 	if (*ptr != MAGICNO) {
--		if (swap4(*ptr) != MAGICNO) {
-+		if (file_swap4(*ptr) != MAGICNO) {
- 			file_error(ms, 0, "bad magic in `%s'", dbname);
- 			return -1;
- 		}
-@@ -3426,7 +3419,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
- 	} else
- 		needsbyteswap = 0;
- 	if (needsbyteswap)
--		version = swap4(ptr[1]);
-+		version = file_swap4(ptr[1]);
- 	else
- 		version = ptr[1];
- 	if (version != VERSIONNO) {
-@@ -3439,7 +3432,7 @@ check_buffer(struct magic_set *ms, struct magic_map *map, const char *dbname)
- 	nentries = 0;
- 	for (i = 0; i < MAGIC_SETS; i++) {
- 		if (needsbyteswap)
--			map->nmagic[i] = swap4(ptr[i + 2]);
-+			map->nmagic[i] = file_swap4(ptr[i + 2]);
- 		else
- 			map->nmagic[i] = ptr[i + 2];
- 		if (map->nmagic[i] > entries) {
-@@ -3577,69 +3570,6 @@ byteswap(struct magic *magic, uint32_t nmagic)
- 		bs1(&magic[i]);
- }
- 
--#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
--/*
-- * swap a short
-- */
--file_private uint16_t
--swap2(uint16_t sv)
--{
--	uint16_t rv;
--	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
--	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
--	d[0] = s[1];
--	d[1] = s[0];
--	return rv;
--}
--
--/*
-- * swap an int
-- */
--file_private uint32_t
--swap4(uint32_t sv)
--{
--	uint32_t rv;
--	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
--	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
--	d[0] = s[3];
--	d[1] = s[2];
--	d[2] = s[1];
--	d[3] = s[0];
--	return rv;
--}
--
--/*
-- * swap a quad
-- */
--file_private uint64_t
--swap8(uint64_t sv)
--{
--	uint64_t rv;
--	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
--	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
--# if 0
--	d[0] = s[3];
--	d[1] = s[2];
--	d[2] = s[1];
--	d[3] = s[0];
--	d[4] = s[7];
--	d[5] = s[6];
--	d[6] = s[5];
--	d[7] = s[4];
--# else
--	d[0] = s[7];
--	d[1] = s[6];
--	d[2] = s[5];
--	d[3] = s[4];
--	d[4] = s[3];
--	d[5] = s[2];
--	d[6] = s[1];
--	d[7] = s[0];
--# endif
--	return rv;
--}
--#endif
--
- file_protected uintmax_t 
- file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
- {
-@@ -3676,16 +3606,16 @@ file_varint2uintmax_t(const unsigned char *us, int t, size_t *l)
- file_private void
- bs1(struct magic *m)
- {
--	m->flag = swap2(m->flag);
--	m->offset = swap4(CAST(uint32_t, m->offset));
--	m->in_offset = swap4(CAST(uint32_t, m->in_offset));
--	m->lineno = swap4(CAST(uint32_t, m->lineno));
-+	m->flag = file_swap2(m->flag);
-+	m->offset = file_swap4(CAST(uint32_t, m->offset));
-+	m->in_offset = file_swap4(CAST(uint32_t, m->in_offset));
-+	m->lineno = file_swap4(CAST(uint32_t, m->lineno));
- 	if (IS_STRING(m->type)) {
--		m->str_range = swap4(m->str_range);
--		m->str_flags = swap4(m->str_flags);
-+		m->str_range = file_swap4(m->str_range);
-+		m->str_flags = file_swap4(m->str_flags);
- 	} else {
--		m->value.q = swap8(m->value.q);
--		m->num_mask = swap8(m->num_mask);
-+		m->value.q = file_swap8(m->value.q);
-+		m->num_mask = file_swap8(m->num_mask);
- 	}
- }
- 
-@@ -3708,6 +3638,7 @@ file_pstring_length_size(struct magic_set *ms, const struct magic *m)
- 		return FILE_BADSIZE;
- 	}
- }
-+
- file_protected size_t
- file_pstring_get_length(struct magic_set *ms, const struct magic *m,
-     const char *ss)
-diff --git a/src/file.h b/src/file.h
-index 258b776976..25e365351d 100644
---- a/src/file.h
-+++ b/src/file.h
-@@ -179,7 +179,7 @@
- #define MAXstring 128		/* max len of "string" types */
- 
- #define MAGICNO		0xF11E041C
--#define VERSIONNO	20
-+#define VERSIONNO	21
- #define FILE_MAGICSIZE	432
- 
- #define FILE_GUID_SIZE	sizeof("XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX")
-@@ -292,17 +292,19 @@ struct magic {
- #define				FILE_CLEAR		47
- #define				FILE_DER		48
- #define				FILE_GUID		49
--#define				FILE_OFFSET		50
--#define				FILE_BEVARINT		51
--#define				FILE_LEVARINT		52
--#define				FILE_MSDOSDATE		53
--#define				FILE_LEMSDOSDATE	54
--#define				FILE_BEMSDOSDATE	55
--#define				FILE_MSDOSTIME		56
--#define				FILE_LEMSDOSTIME	57
--#define				FILE_BEMSDOSTIME	58
--#define				FILE_OCTAL		59
--#define				FILE_NAMES_SIZE		60 /* size of array to contain all names */
-+#define				FILE_LEGUID		50
-+#define				FILE_BEGUID		51
-+#define				FILE_OFFSET		52
-+#define				FILE_BEVARINT		53
-+#define				FILE_LEVARINT		54
-+#define				FILE_MSDOSDATE		55
-+#define				FILE_LEMSDOSDATE	56
-+#define				FILE_BEMSDOSDATE	57
-+#define				FILE_MSDOSTIME		58
-+#define				FILE_LEMSDOSTIME	59
-+#define				FILE_BEMSDOSTIME	60
-+#define				FILE_OCTAL		61
-+#define				FILE_NAMES_SIZE		62 /* size of array to contain all names */
- 
- #define IS_STRING(t) \
- 	((t) == FILE_STRING || \
-@@ -558,7 +560,8 @@ file_protected int file_separator(struct magic_set *);
- file_protected char *file_copystr(char *, size_t, size_t, const char *);
- file_protected int file_checkfmt(char *, size_t, const char *);
- file_protected size_t file_printedlen(const struct magic_set *);
--file_protected int file_print_guid(char *, size_t, const uint64_t *);
-+file_protected int file_print_leguid(char *, size_t, const uint64_t *);
-+file_protected int file_print_beguid(char *, size_t, const uint64_t *);
- file_protected int file_parse_guid(const char *, uint64_t *);
- file_protected int file_replace(struct magic_set *, const char *, const char *);
- file_protected int file_printf(struct magic_set *, const char *, ...)
-diff --git a/src/funcs.c b/src/funcs.c
-index dd80198f36..e5782bf2e8 100644
---- a/src/funcs.c
-+++ b/src/funcs.c
-@@ -27,6 +27,7 @@
- #endif	/* lint */
- 
- #include "magic.h"
-+#include "swap.h"
- #include <assert.h>
- #include <stdarg.h>
- #include <stdlib.h>
-@@ -934,12 +935,9 @@ file_parse_guid(const char *s, uint64_t *guid)
- 	return 0;
- }
- 
--file_protected int
--file_print_guid(char *str, size_t len, const uint64_t *guid)
-+file_private int
-+file_print_guid(char *str, size_t len, const struct guid *g)
- {
--	const struct guid *g = CAST(const struct guid *,
--	    CAST(const void *, guid));
--
- #ifndef WIN32
- 	return snprintf(str, len, "%.8X-%.4hX-%.4hX-%.2hhX%.2hhX-"
- 	    "%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX%.2hhX",
-@@ -955,6 +953,26 @@ file_print_guid(char *str, size_t len, const uint64_t *guid)
- #endif
- }
- 
-+file_protected int
-+file_print_leguid(char *str, size_t len, const uint64_t *guid)
-+{
-+	const struct guid *g = CAST(const struct guid *,
-+	    CAST(const void *, guid));
-+	return file_print_guid(str, len, g);
-+}
-+
-+file_protected int
-+file_print_beguid(char *str, size_t len, const uint64_t *guid)
-+{
-+	const struct guid *g = CAST(const struct guid *,
-+	    CAST(const void *, guid));
-+	struct guid gg = *g;
-+	gg.data1 = file_swap4(gg.data1);
-+	gg.data2 = file_swap2(gg.data2);
-+	gg.data3 = file_swap2(gg.data3);
-+	return file_print_guid(str, len, &gg);
-+}
-+
- file_protected int
- file_pipe_closexec(int *fds)
- {
-diff --git a/src/print.c b/src/print.c
-index 0740fd67e2..ac0802f309 100644
---- a/src/print.c
-+++ b/src/print.c
-@@ -227,12 +227,17 @@ file_mdump(struct magic *m)
- 		case FILE_DER:
- 			(void) fprintf(stderr, "'%s'", m->value.s);
- 			break;
-+		case FILE_LEGUID:
- 		case FILE_GUID:
--			(void) file_print_guid(tbuf, sizeof(tbuf),
-+			(void) file_print_leguid(tbuf, sizeof(tbuf),
-+			    m->value.guid);
-+			(void) fprintf(stderr, "%s", tbuf);
-+			break;
-+		case FILE_BEGUID:
-+			(void) file_print_beguid(tbuf, sizeof(tbuf),
- 			    m->value.guid);
- 			(void) fprintf(stderr, "%s", tbuf);
- 			break;
--
- 		default:
- 			(void) fprintf(stderr, "*bad type %d*", m->type);
- 			break;
-diff --git a/src/softmagic.c b/src/softmagic.c
-index 370be0a54d..2f04b5ce6c 100644
---- a/src/softmagic.c
-+++ b/src/softmagic.c
-@@ -812,7 +812,13 @@ mprint(struct magic_set *ms, struct magic *m)
- 			return -1;
- 		break;
- 	case FILE_GUID:
--		(void) file_print_guid(buf, sizeof(buf), ms->ms_value.guid);
-+	case FILE_LEGUID:
-+		(void) file_print_leguid(buf, sizeof(buf), ms->ms_value.guid);
-+		if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
-+			return -1;
-+		break;
-+	case FILE_BEGUID:
-+		(void) file_print_beguid(buf, sizeof(buf), ms->ms_value.guid);
- 		if (file_printf(ms, F(ms, desc, "%s"), buf) == -1)
- 			return -1;
- 		break;
-@@ -972,6 +978,8 @@ moffset(struct magic_set *ms, struct magic *m, size_t nbytes,
- 		}
- 		break;
- 
-+	case FILE_BEGUID:
-+	case FILE_LEGUID:
- 	case FILE_GUID:
- 		o = CAST(int32_t, (ms->offset + 2 * sizeof(uint64_t)));
- 		break;
-@@ -1333,6 +1341,8 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
- 	case FILE_USE:
- 	case FILE_DER:
- 	case FILE_GUID:
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 		return 1;
- 	default:
- 		file_magerror(ms, "invalid type %d in mconvert()", m->type);
-@@ -1903,6 +1913,8 @@ mget(struct magic_set *ms, struct magic *m, const struct buffer *b,
- 			return 0;
- 		break;
- 
-+	case FILE_LEGUID:
-+	case FILE_BEGUID:
- 	case FILE_GUID:
- 		if (OFFSET_OOB(nbytes, offset, 16))
- 			return 0;
-@@ -2416,6 +2428,8 @@ magiccheck(struct magic_set *ms, struct magic *m, file_regex_t **m_cache)
- 			return 0;
- 		}
- 		return matched;
-+	case FILE_BEGUID:
-+	case FILE_LEGUID:
- 	case FILE_GUID:
- 		l = 0;
- 		v = memcmp(m->value.guid, p->guid, sizeof(p->guid));
-diff --git a/src/swap.c b/src/swap.c
-new file mode 100644
-index 0000000000..f20e354237
---- /dev/null
-+++ b/src/swap.c
-@@ -0,0 +1,101 @@
-+/*
-+ * Copyright (c) Ian F. Darwin 1986-1995.
-+ * Software written by Ian F. Darwin and others;
-+ * maintained 1995-present by Christos Zoulas and others.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice immediately at the beginning of the file, without modification,
-+ *    this list of conditions, and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
-+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+/*
-+ * apprentice - make one pass through /etc/magic, learning its secrets.
-+ */
-+
-+#include "file.h"
-+
-+#ifndef	lint
-+FILE_RCSID("@(#)$File: swap.c,v 1.1 2026/04/19 19:56:49 christos Exp $")
-+#endif	/* lint */
-+
-+#include "swap.h"
-+
-+#if !defined(HAVE_BYTESWAP_H) && !defined(HAVE_SYS_BSWAP_H)
-+/*
-+ * swap a short
-+ */
-+file_protected uint16_t
-+file_swap2(uint16_t sv)
-+{
-+	uint16_t rv;
-+	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
-+	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
-+	d[0] = s[1];
-+	d[1] = s[0];
-+	return rv;
-+}
-+
-+/*
-+ * swap an int
-+ */
-+file_protected uint32_t
-+file_swap4(uint32_t sv)
-+{
-+	uint32_t rv;
-+	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
-+	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
-+	d[0] = s[3];
-+	d[1] = s[2];
-+	d[2] = s[1];
-+	d[3] = s[0];
-+	return rv;
-+}
-+
-+/*
-+ * swap a quad
-+ */
-+file_protected uint64_t
-+file_swap8(uint64_t sv)
-+{
-+	uint64_t rv;
-+	uint8_t *s = RCAST(uint8_t *, RCAST(void *, &sv));
-+	uint8_t *d = RCAST(uint8_t *, RCAST(void *, &rv));
-+# if 0
-+	d[0] = s[3];
-+	d[1] = s[2];
-+	d[2] = s[1];
-+	d[3] = s[0];
-+	d[4] = s[7];
-+	d[5] = s[6];
-+	d[6] = s[5];
-+	d[7] = s[4];
-+# else
-+	d[0] = s[7];
-+	d[1] = s[6];
-+	d[2] = s[5];
-+	d[3] = s[4];
-+	d[4] = s[3];
-+	d[5] = s[2];
-+	d[6] = s[1];
-+	d[7] = s[0];
-+# endif
-+	return rv;
-+}
-+#endif
-diff --git a/src/swap.h b/src/swap.h
-new file mode 100644
-index 0000000000..9fc6428d7d
---- /dev/null
-+++ b/src/swap.h
-@@ -0,0 +1,48 @@
-+/*
-+ * Copyright (c) Ian F. Darwin 1986-1995.
-+ * Software written by Ian F. Darwin and others;
-+ * maintained 1995-present by Christos Zoulas and others.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice immediately at the beginning of the file, without modification,
-+ *    this list of conditions, and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
-+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+
-+#ifdef HAVE_BYTESWAP_H
-+#include <byteswap.h>
-+#endif
-+#ifdef HAVE_SYS_BSWAP_H
-+#include <sys/bswap.h>
-+#endif
-+
-+#if defined(HAVE_BYTESWAP_H)
-+#define file_swap2(x)	bswap_16(x)
-+#define file_swap4(x)	bswap_32(x)
-+#define file_swap8(x)	bswap_64(x)
-+#elif defined(HAVE_SYS_BSWAP_H)
-+#define file_swap2(x)	bswap16(x)
-+#define file_swap4(x)	bswap32(x)
-+#define file_swap8(x)	bswap64(x)
-+#else
-+file_protected uint16_t file_swap2(uint16_t);
-+file_protected uint32_t file_swap4(uint32_t);
-+file_protected uint64_t file_swap8(uint64_t);
-+#endif
diff --git a/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch b/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch
deleted file mode 100644
index ede424aaba7c..000000000000
--- a/pkgs/tools/misc/file/0004-Handle-parsing-guids-in-big-endian-machines.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 7a2b2a4b6e0f9de8682e6098c514155f2198cc8e Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Sun, 17 May 2026 17:10:25 +0000
-Subject: [PATCH] Handle parsing guids in big endian machines (Christoph Biedl)
-
-(OPNA2608: removed hunks that change file modification dates, as they
-make it more difficult to apply the patch)
-
----
- src/compress.c |  7 +++----
- src/file.h     |  3 ++-
- src/funcs.c    | 21 ++++++++++++++++++++-
- 3 files changed, 25 insertions(+), 6 deletions(-)
-
-diff --git a/src/compress.c b/src/compress.c
-index 76b7aad18..7f1d584d0 100644
---- a/src/compress.c
-+++ b/src/compress.c
-@@ -125,12 +125,11 @@ static const char *zlib_args[] = { "python", "-c", zlibcode, NULL };
- static int
- zlibcmp(const unsigned char *buf)
- {
--	unsigned short x = 1;
--	unsigned char *s = CAST(unsigned char *, CAST(void *, &x));
-+	unsigned short x;
- 
- 	if ((buf[0] & 0xf) != 8 || (buf[0] & 0x80) != 0)
- 		return 0;
--	if (s[0] != 1)	/* endianness test */
-+	if (file_bigendian())	/* endianness test */
- 		x = buf[0] | (buf[1] << 8);
- 	else
- 		x = buf[1] | (buf[0] << 8);
-diff --git a/src/file.h b/src/file.h
-index 497de9b91..6a39801e4 100644
---- a/src/file.h
-+++ b/src/file.h
-@@ -597,6 +597,7 @@ file_protected uint64_t file_signextend(struct magic_set *, struct magic *,
- file_protected uintmax_t file_varint2uintmax_t(const unsigned char *, int,
-     size_t *);
- 
-+file_protected int file_bigendian(void);
- file_protected void file_badread(struct magic_set *);
- file_protected void file_badseek(struct magic_set *);
- file_protected void file_oomem(struct magic_set *, size_t);
-diff --git a/src/funcs.c b/src/funcs.c
-index 8698f3312..0f2e6942b 100644
---- a/src/funcs.c
-+++ b/src/funcs.c
-@@ -52,6 +52,18 @@ FILE_RCSID("@(#)$File: funcs.c,v 1.151 2026/05/16 15:21:40 christos Exp $")
- #define SIZE_MAX	((size_t)~0)
- #endif
- 
-+file_protected int
-+file_bigendian(void)
-+{
-+	union {
-+		unsigned short x;
-+		unsigned char s[sizeof(unsigned short)];
-+	} u;
-+
-+	u.x = 1;
-+	return u.s[0] != 1;
-+}
-+
- file_protected char *
- file_copystr(char *buf, size_t blen, size_t width, const char *str)
- {
-@@ -931,6 +943,13 @@ file_parse_guid(const char *s, uint64_t *guid)
- 	    !getxvalue(&g->data4[6], s + 8, 2) ||
- 	    !getxvalue(&g->data4[7], s + 10, 2))
- 		return -1;
-+
-+	if (file_bigendian()) {
-+		g->data1 = file_swap4(g->data1);
-+		g->data2 = file_swap2(g->data2);
-+		g->data3 = file_swap2(g->data3);
-+
-+	}
- 	return 0;
- }
- 
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 4bd56f4dcfb3..da9968755584 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -3,8 +3,6 @@
   stdenv,
   fetchurl,
   buildPackages,
-  autoconf,
-  automake,
   zlib,
   libgnurx,
   updateAutotoolsGnuConfigScriptsHook,
@@ -18,14 +16,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "file";
-  version = "5.47";
+  version = "5.48";
 
   src = fetchurl {
     urls = [
       "https://astron.com/pub/file/file-${finalAttrs.version}.tar.gz"
       "https://distfiles.macports.org/file/file-${finalAttrs.version}.tar.gz"
     ];
-    hash = "sha256-RWcv7BZctMwTWKLXa11X0ih23Ll6sWlCesOFy+HVWXo=";
+    hash = "sha256-7RRlaIOyOjZLQFfAVZXZMlLam8Rz0wEGUZUZ0NoUEoM=";
   };
 
   outputs = [
@@ -34,46 +32,14 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
-  patches = [
-    # Fixes `cat archive.zip | file -` just showing a generic "data" type. See:
-    # - https://bugs.astron.com/view.php?id=764
-    # - https://github.com/file/file/commit/12b76648185104ce9118d8b5fa57aa34a77ad084
-    # Vendored patch because using fetchpatch is impossible for a package in
-    # this part of the bootstrap chain.
-    ./0001-PR-745-streamout-Don-t-flush-when-trying-to-set-nega.patch
-    # Fixes breakage of python3Packages.python-magic and xdg-utils
-    ./0002-PR-725-inliniac-Revert-previous-and-always-set-offse.patch
-
-    # Splits byteswapping functions into a separate file & reuses them across the codebase
-    # (needed for GUID parsing fix below)
-    # https://github.com/file/file/commit/797a275514c80303accbd821df9692b04f6020e6
-    # https://github.com/file/file/commit/2866af2e51beb40afe35d2ff5e765991ac459237
-    ./0003-Add-LE-BE-GUID.patch
-
-    # Fixes GUID parsing on big-endian
-    # https://github.com/file/file/commit/7a2b2a4b6e0f9de8682e6098c514155f2198cc8e
-    ./0004-Handle-parsing-guids-in-big-endian-machines.patch
-  ];
-
   strictDeps = true;
   enableParallelBuilding = true;
 
   nativeBuildInputs = [
-    # 0003-Add-LE-BE-GUID.patch touches automake file, need to regenerate files
-    # autoreconfHook would cause inf rec (hook -> libtool -> file -> hook), adding the individual components we need
-    autoconf
-    automake
-
     updateAutotoolsGnuConfigScriptsHook
   ];
   buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW libgnurx;
 
-  # 0003-Add-LE-BE-GUID.patch touches automake file, need to regenerate files
-  # autoreconfHook would cause inf rec (hook -> libtool -> file -> hook), manually calling autoreconf
-  preConfigure = ''
-    autoreconf
-  '';
-
   # https://bugs.astron.com/view.php?id=382
   doCheck = !stdenv.buildPlatform.isMusl;
 

From 972ffeccf531af0017aff7b20b5a88d28611ef47 Mon Sep 17 00:00:00 2001
From: n0099 <git@n0099.com>
Date: Wed, 10 Jun 2026 05:39:29 +0000
Subject: [PATCH 602/831] libtpms: fix building with `-march=x86-64-v4`

fix #528643
https://github.com/stefanberger/libtpms/pull/588
---
 pkgs/by-name/li/libtpms/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/li/libtpms/package.nix b/pkgs/by-name/li/libtpms/package.nix
index caecbaaaacc9..bd26f5b5639d 100644
--- a/pkgs/by-name/li/libtpms/package.nix
+++ b/pkgs/by-name/li/libtpms/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   pkg-config,
   autoreconfHook,
   openssl,
@@ -19,6 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-wCipOOr3LnLq1NqDtxw6hq0VTyniDwp18vBxyET/WGM=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/stefanberger/libtpms/pull/588.patch?full_index=1";
+      hash = "sha256-MVHy0sdg8ywKzu9M4ueRjH786uXQK8al21k8f+mAdR0=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config

From 55199b0bb1cc0e1959002da688529970b9619e62 Mon Sep 17 00:00:00 2001
From: lukas-sgx <lukas.soigneux@epitech.eu>
Date: Thu, 11 Jun 2026 08:02:25 +0200
Subject: [PATCH 603/831] hwdata: 0.406 -> 0.408

---
 pkgs/by-name/hw/hwdata/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index 0678443277a9..0fc7c9022a62 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.406";
+  version = "0.408";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6GXXkDzunbtea+MmmWV2gpHgCgdGi75U+TV9H/6Emtk=";
+    hash = "sha256-fgKOvVGAdB3uBFuKfGPFfF9wQEdLtnlMdQrLNIr3teo=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)

From f7876e60c7afdab2f50f2686c94e2ec507861cce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Jun 2026 06:53:15 +0000
Subject: [PATCH 604/831] lilv: 0.26.4 -> 0.28.0

---
 pkgs/by-name/li/lilv/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/lilv/package.nix b/pkgs/by-name/li/lilv/package.nix
index acc3ff565858..ebdff4c26be8 100644
--- a/pkgs/by-name/li/lilv/package.nix
+++ b/pkgs/by-name/li/lilv/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lilv";
-  version = "0.26.4";
+  version = "0.28.0";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.drobilla.net/lilv-${version}.tar.xz";
-    hash = "sha256-HItfy3hxgXPmfXblGtQj9RE6n/aEY/JWYZWuRjlgieM=";
+    hash = "sha256-jctwrbXPByM1EVprCR9BE3EL3HOrqtqj+enB5VlXsUk=";
   };
 
   nativeBuildInputs = [

From 7ee32846927cf8f453b06cfaedd7dde105233bfd Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Thu, 11 Jun 2026 11:40:31 +0200
Subject: [PATCH 605/831] imagemagick: 7.1.2-24 -> 7.1.2-25

changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md

diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-24...7.1.2-25
---
 pkgs/by-name/im/imagemagick/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index 88faea3ca8c0..12c419172032 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -88,13 +88,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-24";
+  version = "7.1.2-25";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-oSH0dsQ3cuFNYJIIr6LHbv82FbFxxcmkjQ5csTNsYCA=";
+    hash = "sha256-7z1oIKXZcumsESLrFRvU6z0M8JVsogG7yDWwF62jPwo=";
   };
 
   outputs = [

From ce0ee926172806aab3b159638fcd311546a2ca60 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 11 Jun 2026 13:01:27 +0200
Subject: [PATCH 606/831] Revert "replaceVarsWith: properly set pname, version"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Breaks stdenv, e.g. python3Minimal, where the build fails with

> find: ‘nuke-refs’: No such file or directory
---
 pkgs/build-support/replace-vars/replace-vars-with.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/build-support/replace-vars/replace-vars-with.nix b/pkgs/build-support/replace-vars/replace-vars-with.nix
index 60e48f841a19..abbb9a1cc1a0 100644
--- a/pkgs/build-support/replace-vars/replace-vars-with.nix
+++ b/pkgs/build-support/replace-vars/replace-vars-with.nix
@@ -122,8 +122,7 @@ in
 
 stdenvNoCC.mkDerivation (
   {
-    pname = optionalAttrs.pname or optionalAttrs.name or (baseNameOf src);
-    version = "26.11pre-git";
+    name = baseNameOf src;
   }
   // optionalAttrs
   // forcedAttrs

From 2c67d1303cc3b0d3afe90549d169c1ded72d5e2d Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 10 Jun 2026 23:35:07 +0200
Subject: [PATCH 607/831] python314: 3.14.5 -> 3.14.6

https://docs.python.org/release/3.14.6/whatsnew/changelog.html
---
 pkgs/development/interpreters/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 1efc8c14f0ae..5c7e4eafb3cd 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
         sourceVersion = {
           major = "3";
           minor = "14";
-          patch = "5";
+          patch = "6";
           suffix = "";
         };
-        hash = "sha256-fjJZe5nl2aOavtNd5Gk/oWnfPlhQ1MM0M3/9ahmjbbY=";
+        hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM=";
       };
     };
 

From 584d8c9e355d66259bc5d6627e8d8d034bee8897 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 10 Jun 2026 23:36:32 +0200
Subject: [PATCH 608/831] python313: 3.13.13 -> 3.13.14

https://docs.python.org/release/3.13.13/whatsnew/changelog.html

Fixes: CVE-2026-4224, CVE-2026-3644, CVE-2026-2297
---
 pkgs/development/interpreters/python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 5c7e4eafb3cd..f1dcae961908 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -59,10 +59,10 @@
       sourceVersion = {
         major = "3";
         minor = "13";
-        patch = "13";
+        patch = "14";
         suffix = "";
       };
-      hash = "sha256-Krkf9AF4PMymT3XRDIgulXvf1g4r9acvhCF5Nym3inE=";
+      hash = "sha256-Y55DJDxiCjCPloIT354A8vj2IzL3rbqnp+65eDBXxpA=";
       inherit passthruFun;
     };
 

From b6f477e6e78c740ed2f26e7a24b0430e2708fd63 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 10 Jun 2026 19:14:48 +0200
Subject: [PATCH 609/831] gbenchmark: fix eval and build on musl

glibcLocales is only non-null when stdenv.hostPlatform.isLinux &&
stdenv.hostPlatform.isGnu, so when it was added it broke eval of this
package on musl.  Fix the platform checks to be more accurate, and
backport an upstream fix for more accurate platform checks on their
side, to get building on musl again.

Fixes: f6da9198396a ("gbenchmark: 1.9.4 -> 1.9.5")
---
 pkgs/by-name/gb/gbenchmark/package.nix | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index 9d21e2c8a84b..a35f4781dba1 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   ninja,
   gtest,
@@ -20,6 +21,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Mm4pG7zMB00iof32CxreoNBFnduPZTMp3reHMCIAFPQ=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "portability.patch";
+      url = "https://github.com/google/benchmark/commit/b5ba9bab85d80f29a161dd634b7d234cf3722f90.patch";
+      hash = "sha256-/X01AWXK0eJ59F8oSREZ7V5Cpw1y35n9uFB1mCvMOus=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja
@@ -27,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
-  nativeCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ glibcLocales ];
+  nativeCheckInputs = lib.optionals (glibcLocales != null) [ glibcLocales ];
 
   cmakeFlags = [
     (lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false)
@@ -45,10 +54,12 @@ stdenv.mkDerivation (finalAttrs: {
     # with Xcode, but we just work around it by silencing the warning.
     NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++17-attribute-extensions";
   }
-  // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+  // lib.optionalAttrs stdenv.hostPlatform.isGnu {
     # For test:locale_impermeability_test
     LANG = "en_US.UTF-8";
     LC_ALL = "en_US.UTF-8";
+  }
+  // lib.optionalAttrs (glibcLocales != null) {
     LOCALE_ARCHIVE = "${glibcLocales}/lib/locale/locale-archive";
   };
 

From d1215feef7546678557856166b0601dd9e7d2ad3 Mon Sep 17 00:00:00 2001
From: Arthur Gautier <arthur.gautier@arista.com>
Date: Thu, 11 Jun 2026 10:04:11 -0700
Subject: [PATCH 610/831] libtpms: bump commit id from PR to the one that
 merged master

---
 pkgs/by-name/li/libtpms/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libtpms/package.nix b/pkgs/by-name/li/libtpms/package.nix
index bd26f5b5639d..d0b6a1f2e0a2 100644
--- a/pkgs/by-name/li/libtpms/package.nix
+++ b/pkgs/by-name/li/libtpms/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     (fetchpatch2 {
-      url = "https://github.com/stefanberger/libtpms/pull/588.patch?full_index=1";
+      url = "https://github.com/stefanberger/libtpms/commit/2d9b00c4e42677cd0a9b67344f4d873ddc409a21.patch?full_index=1";
       hash = "sha256-MVHy0sdg8ywKzu9M4ueRjH786uXQK8al21k8f+mAdR0=";
     })
   ];

From 6e58884bf2f556471a83ac74eef646371d86cedb Mon Sep 17 00:00:00 2001
From: Nathan Henrie <nate@n8henrie.com>
Date: Thu, 11 Jun 2026 17:27:05 -0600
Subject: [PATCH 611/831] qt6.qtbase: fix darwin permissions for statically
 linked plugins

Assisted-by: Claude (Fable)

Fixes https://github.com/NixOS/nixpkgs/issues/530884
---
 .../libraries/qt-6/modules/qtbase/default.nix      | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index fa3ae210d281..bc27472bba7a 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -275,6 +275,13 @@ stdenv.mkDerivation {
         --replace-quiet /usr/libexec/PlistBuddy '${lib.getExe' xcbuild "PlistBuddy"}'
     done
 
+    # Unlike Apple's PlistBuddy, xcbuild's only accepts capitalized commands,
+    # so the usage-description probe in permissions.prf always fails and the
+    # darwin permission plugins (Bluetooth, camera, ...) are silently never
+    # linked into qmake-built apps.
+    substituteInPlace mkspecs/features/permissions.prf \
+      --replace-fail "-c 'print " "-c 'Print "
+
     substituteInPlace mkspecs/common/macx.conf \
       --replace-fail 'CONFIG += ' 'CONFIG += no_default_rpath '
   '';
@@ -332,7 +339,12 @@ stdenv.mkDerivation {
   postFixup = ''
     moveToOutput      "mkspecs/modules" "$dev"
     fixQtModulePaths  "$dev/mkspecs/modules"
-    fixQtBuiltinPaths "$out" '*.pr?'
+    # fixQtBuiltinPaths reads qtPluginPrefix/qtQmlPrefix from the environment,
+    # but the setup hook only exports them for downstream packages; without
+    # them e.g. $$[QT_INSTALL_PLUGINS] in qt.prf is rewritten to "$out/"
+    # instead of "$out/${qtPluginPrefix}", breaking static plugin linking.
+    qtPluginPrefix=${qtPluginPrefix} qtQmlPrefix=${qtQmlPrefix} \
+      fixQtBuiltinPaths "$out" '*.pr?'
 
     # @out@ would be automagically replaced inside makeSetupHook by the output of that derivation,
     # but we need it to be the output of this derivation.

From 3b6967c20926a7c6423ebd9875a6cd18a7f254d5 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 7 Jun 2026 20:34:11 -0400
Subject: [PATCH 612/831] libressl: fix Darwin build

https://hydra.nixos.org/build/331199232
---
 pkgs/by-name/li/libressl/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 4ccc79407ba7..4bf139efc381 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -61,6 +61,10 @@ let
 
       doCheck = !(stdenv.hostPlatform.isPower64 || stdenv.hostPlatform.isRiscV);
       preCheck = ''
+        export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
+        export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
+      ''
+      + lib.optionalString stdenv.hostPlatform.isElf ''
         # Bail if any shared object has executable stack enabled. This can
         # happen when an object produced from an assmbly file in libcrypto is
         # missing a .note.GNU-stack section. An executable stack is dangerous
@@ -76,9 +80,6 @@ let
           }
           END { exit res }
         '
-
-        export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
-        export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
       '';
       postCheck = ''
         export ${ldLibPathEnvName}=$PREVIOUS_${ldLibPathEnvName}

From ed6faeb409235bf6b3b85082fbd00fe658593ca1 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Fri, 12 Jun 2026 09:02:45 +0200
Subject: [PATCH 613/831] openssl_3_6: 3.6.2 -> 3.6.3

Update to fix multiple CVEs.

See: https://github.com/openssl/openssl/releases/tag/openssl-3.6.3

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/development/libraries/openssl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 7762b0283a02..8a9699572d64 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -507,8 +507,8 @@ in
   };
 
   openssl_3_6 = common {
-    version = "3.6.2";
-    hash = "sha256-qvUaH+BkOE+BHa6utOxNznNA7IvYkwJ+7mdq8x6DoE8=";
+    version = "3.6.3";
+    hash = "sha256-JDqGZJz28j7rai/yRW4J5dd92QGKVNPZawxr3Wumx/E=";
 
     patches = [
       # Support for NIX_SSL_CERT_FILE, motivation:

From d0c441bcc6940d1eeef5d8e9b6cc39802916ce28 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 11 Jun 2026 18:37:24 +0200
Subject: [PATCH 614/831] minijail: 2025.07.02 -> 2026.05.18

Fixes build with Linux 6.19 headers.
---
 pkgs/by-name/mi/minijail/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/minijail/package.nix b/pkgs/by-name/mi/minijail/package.nix
index c2a72c604cd7..a00a16045076 100644
--- a/pkgs/by-name/mi/minijail/package.nix
+++ b/pkgs/by-name/mi/minijail/package.nix
@@ -8,12 +8,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "minijail";
-  version = "2025.07.02";
+  version = "2026.05.18";
 
   src = fetchFromGitiles {
     url = "https://chromium.googlesource.com/chromiumos/platform/minijail";
     tag = "linux-v${finalAttrs.version}";
-    hash = "sha256-GRnr2O6ZpWtRDGJ6Am0XPT426Xh7wxTJsoEqyTUECYY=";
+    hash = "sha256-15TQnTFIx2DSdAQZPCVhBPs8a+V6YV3IrA1LqfMWcRQ=";
   };
 
   buildInputs = [ libcap ];

From 097d5c78f5886ab6323892f516503b6b036eb777 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 10:34:10 +0300
Subject: [PATCH 615/831] freetype: simplify src's fetchurl

---
 pkgs/by-name/fr/freetype/package.nix | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/fr/freetype/package.nix b/pkgs/by-name/fr/freetype/package.nix
index 1eb213ab71f1..1bcb6b83642c 100644
--- a/pkgs/by-name/fr/freetype/package.nix
+++ b/pkgs/by-name/fr/freetype/package.nix
@@ -41,14 +41,10 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
   version = "2.14.3";
 
-  src =
-    let
-      inherit (finalAttrs) pname version;
-    in
-    fetchurl {
-      url = "mirror://savannah/freetype/freetype-${version}.tar.xz";
-      sha256 = "sha256-NrxPHMQTM1No7mVsQq/KZcWjmH6HaMwozxG6d154Wl8=";
-    };
+  src = fetchurl {
+    url = "mirror://savannah/freetype/freetype-${finalAttrs.version}.tar.xz";
+    hash = "sha256-NrxPHMQTM1No7mVsQq/KZcWjmH6HaMwozxG6d154Wl8=";
+  };
 
   propagatedBuildInputs = [
     zlib

From c6bebdf2efefdd9ce086de61d352fc674f3933a3 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 10:03:51 +0300
Subject: [PATCH 616/831] python3Packages.matplotlib: add doronbehar to
 maintainers

---
 pkgs/development/python-modules/matplotlib/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 2311afef7a39..969219e1b5e7 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -206,6 +206,7 @@ buildPythonPackage rec {
     ];
     maintainers = with lib.maintainers; [
       veprbl
+      doronbehar
     ];
   };
 }

From cb9baef75053d218e66640fd140e9b40644e5b93 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 10:22:20 +0300
Subject: [PATCH 617/831] python3Packages.matplotlib: use finalAttrs pattern

---
 pkgs/development/python-modules/matplotlib/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 969219e1b5e7..3d49760d3cd8 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -75,13 +75,13 @@ let
   interactive = enableTk || enableGtk3 || enableQt;
 in
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   version = "3.10.9";
   pname = "matplotlib";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-/WZQjoxod9mOWGZUtgigRW241+ilRuseJgDv2VcwI1g=";
   };
 
@@ -199,7 +199,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python plotting library, making publication quality plots";
     homepage = "https://matplotlib.org/";
-    changelog = "https://github.com/matplotlib/matplotlib/releases/tag/v${version}";
+    changelog = "https://github.com/matplotlib/matplotlib/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       psfl
       bsd0
@@ -209,4 +209,4 @@ buildPythonPackage rec {
       doronbehar
     ];
   };
-}
+})

From c4a9aae5c70072807d7a9baee32dbbcab4ebea4b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 12 Jun 2026 10:03:26 +0300
Subject: [PATCH 618/831] python3Packages.matplotlib: 3.10.9 -> 3.11.0

Changelog: https://github.com/matplotlib/matplotlib/releases/tag/v3.11.0

Disable withOutdatedFreetype passthru test, comment explains why.
---
 .../python-modules/matplotlib/default.nix     | 33 ++++++-------------
 1 file changed, 10 insertions(+), 23 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 3d49760d3cd8..eed032805c76 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -19,13 +19,8 @@
   # native libraries
   ffmpeg-headless,
   freetype,
-  # By default, almost all tests fail due to the fact we use our version of
-  # freetype. We still use this argument to define the overridden
-  # derivation `matplotlib.passthru.tests.withoutOutdatedFreetype` - which
-  # builds matplotlib with the freetype version they default to, with which all
-  # tests should pass.
-  doCheck ? false,
   qhull,
+  libraqm,
 
   # propagates
   contourpy,
@@ -76,13 +71,13 @@ let
 in
 
 buildPythonPackage (finalAttrs: {
-  version = "3.10.9";
+  version = "3.11.0";
   pname = "matplotlib";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-/WZQjoxod9mOWGZUtgigRW241+ilRuseJgDv2VcwI1g=";
+    hash = "sha256-aMDHvgGzDcyjY4k09/WR33NAEjXL2/DRqxxx59t/i1c=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";
@@ -99,10 +94,6 @@ buildPythonPackage (finalAttrs: {
         --replace-fail "/usr/bin/env python3" "/usr/bin/env pypy3"
     ''
     + ''
-      substituteInPlace pyproject.toml \
-        --replace-fail "meson-python>=0.13.1,<0.17.0" meson-python \
-        --replace-fail "setuptools_scm>=7,<10" setuptools_scm
-
       patchShebangs tools
     ''
     + lib.optionalString (stdenv.hostPlatform.isLinux && interactive) ''
@@ -118,6 +109,7 @@ buildPythonPackage (finalAttrs: {
     ffmpeg-headless
     freetype
     qhull
+    libraqm
   ]
   ++ lib.optionals enableGtk3 [
     cairo
@@ -159,6 +151,7 @@ buildPythonPackage (finalAttrs: {
   mesonFlags = lib.mapAttrsToList lib.mesonBool {
     system-freetype = true;
     system-qhull = true;
+    system-libraqm = true;
     # Otherwise GNU's `ar` binary fails to put symbols from libagg into the
     # matplotlib shared objects. See:
     # -https://github.com/matplotlib/matplotlib/issues/28260#issuecomment-2146243663
@@ -168,20 +161,14 @@ buildPythonPackage (finalAttrs: {
 
   passthru.tests = {
     inherit sage;
-    withOutdatedFreetype = matplotlib.override {
-      doCheck = true;
-      freetype = freetype.overrideAttrs (_: {
-        src = fetchurl {
-          url = "mirror://savannah/freetype/freetype-old/freetype-2.6.1.tar.gz";
-          hash = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
-        };
-        patches = [ ];
-      });
-    };
   };
 
   pythonImportsCheck = [ "matplotlib" ];
-  inherit doCheck;
+  # Running the tests requires a specific freetype version, so pixel-to-pixel
+  # comparisons will pass. Since matplotlib depends directly & indirectly on
+  # freetype, this would be too expensive to even test this (correctly) in
+  # `passthru.tests`.
+  doCheck = false;
   nativeCheckInputs = [ pytestCheckHook ];
   preCheck = ''
     # https://matplotlib.org/devdocs/devel/testing.html#obtain-the-reference-images

From 8bb465825d98ce00008d3411ea21c4bffa5d1060 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 12 Jun 2026 11:00:16 -0700
Subject: [PATCH 619/831] python3Packages.pikepdf: 10.7.1 -> 10.8.0

Diff: https://github.com/pikepdf/pikepdf/compare/v10.7.1...v10.8.0

Changelog: https://github.com/pikepdf/pikepdf/blob/v10.8.0/docs/releasenotes/version10.md
---
 pkgs/development/python-modules/pikepdf/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 4173d1cc9eda..ef7b972ce3e8 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.7.1";
+  version = "10.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-qXpGopfiIG9dimJjHZlbHhXrtliSbgj2tWGQhbQwP5Q=";
+    hash = "sha256-ih5QC6VVl7dGvamp3FRzahnpEDjdO8gGFNVX19Bu8LE=";
   };
 
   patches = [

From c9b84bea7611c54cf57768833a3b6a28775144e5 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 01:45:49 +0300
Subject: [PATCH 620/831] libfaketime: `strictDeps` & `enableParallelBuilding`

`nix store make-content-addressed` gives the same output
before and after this change.

The speedup from `enableParallelBuilding` is only
39s -> 36s on my machine, but why not?
---
 pkgs/by-name/li/libfaketime/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index d66ac6704ecb..cf5c047850da 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   __structuredAttrs = true;
+  structDeps = true;
+  enableParallelBuilding = true;
 
   meta = {
     description = "Report faked system time to programs without having to change the system-wide time";

From e2464bbe5958ac199df0e823dcf232cc8272151e Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 02:01:14 +0300
Subject: [PATCH 621/831] libfaketime: use `CFLAGS` instead of
 `NIX_CFLAGS_COMPILE`

pkgsLLVM.libfaketime wouldn't link both before or after this change,
but pkgsCross.loongarch64-linux.libfaketime would and gave the same output
after `nix store make-content-addressed` before and after this change.
---
 pkgs/by-name/li/libfaketime/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index cf5c047850da..ecdb04678b32 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     PREFIX = placeholder "out";
     LIBDIRNAME = "/lib";
-    NIX_CFLAGS_COMPILE = toString (
+    CFLAGS = toString (
       lib.optionals stdenv.cc.isClang [
         "-Wno-error=cast-function-type"
         "-Wno-error=format-truncation"

From e1b1a2cdccc95db57900409002a08e5bee979a6e Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 01:43:48 +0300
Subject: [PATCH 622/831] libfaketime: split `doc` & `man` outputs

output size changes:
- out: 232K -> 180K
- man: 0 -> 4K
- doc: 0 -> 48K
---
 pkgs/by-name/li/libfaketime/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index ecdb04678b32..36874a53f40c 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -26,6 +26,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = hashes.${finalAttrs.version};
   };
 
+  outputs = [
+    "out"
+    "doc"
+    "man"
+  ];
+
   patches = [
     ./nix-store-date.patch
   ]

From cbf6b65968a11896b3a8c8b108bf9ed5bf6deba0 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 02:16:08 +0300
Subject: [PATCH 623/831] acl: use `finalAttrs`

This does not change the eval
---
 pkgs/development/libraries/acl/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index 9bba05fd90bf..477e69555871 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -11,12 +11,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "acl";
   version = "2.3.2";
 
   src = fetchurl {
-    url = "mirror://savannah/acl/acl-${version}.tar.gz";
+    url = "mirror://savannah/acl/acl-${finalAttrs.version}.tar.gz";
     hash = "sha256-XyvbrWKXB6p9hcYj+ZSqih0t7FWnPeUgW6wL9gWKL3w=";
   };
 
@@ -41,6 +41,6 @@ stdenv.mkDerivation rec {
     description = "Library and tools for manipulating access control lists";
     license = lib.licenses.gpl2Plus;
     teams = [ lib.teams.security-review ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "acl_project" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "acl_project" finalAttrs.version;
   };
-}
+})

From 7661bd9f8cee33b387bbb9f18cba6aeeea76a847 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Sat, 13 Jun 2026 02:16:08 +0300
Subject: [PATCH 624/831] acl: `strictDeps`, `__structuredAttrs`,
 `enableParallelBuilding`

This does not change the output (modulo path)
---
 pkgs/development/libraries/acl/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index 477e69555871..3397e6e27a14 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -28,6 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
   ];
 
+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ gettext ];
   buildInputs = [ attr ];
 

From 23eb9d22438eb163f258eaae9f2f9a32f7659eba Mon Sep 17 00:00:00 2001
From: Aleksi Hannula <ahannula4+nixgit@gmail.com>
Date: Sat, 13 Jun 2026 11:26:40 +0300
Subject: [PATCH 625/831] gccgo: fix build from
 minimal-bootstrap.gnugrep-static

gccgo is built by overriding gcc from stdenv stage3. At this stage of
stdenv, when minimal-bootstrap is used as the bootstrap seed, the grep
package is actually gnugrep-static from minimal-bootstrap. This package
was accidentally missing egrep and fgrep.

Now, the gcc configure system is capable of detecting that grep -E
works as an egrep substitute. Still, a few makefiles were using egrep
directly rather than grep -E. This ultimately broke the gccgo build in
a subtle way.
---
 pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
index 6083a70b2410..18e71d833461 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/static.nix
@@ -79,7 +79,6 @@ bash.runCommand "${pname}-${version}"
 
     # Install
     make -j $NIX_BUILD_CORES install-strip
-    rm $out/bin/{egrep,fgrep}
 
     # Remove documentation not needed in the bootstrap chain.
     rm -rf $out/share

From 8260f81399d5956ecf53b4718c6f247770fbb167 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sat, 13 Jun 2026 11:37:13 +0200
Subject: [PATCH 626/831] postgresql: remove pkgsStatic support

This breaks again and again - and upstream is not really going to
support it anyway. It never fully worked - and the important thing is to
be able to build `pkgsStatic.libpq` anyway, which works independently of
the server package.
---
 pkgs/servers/sql/postgresql/generic.nix | 113 ++++++++----------------
 1 file changed, 37 insertions(+), 76 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 5b4b355c80f4..f9f2da13af04 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -56,33 +56,19 @@ let
       bonjourSupport ? false,
 
       # Curl
-      curlSupport ?
-        lib.versionAtLeast version "18"
-        && lib.meta.availableOn stdenv.hostPlatform curl
-        # Building statically fails with:
-        # configure: error: library 'curl' does not provide curl_multi_init
-        # https://www.postgresql.org/message-id/487dacec-6d8d-46c0-a36f-d5b8c81a56f1%40technowledgy.de
-        && !stdenv.hostPlatform.isStatic,
+      curlSupport ? lib.versionAtLeast version "18" && lib.meta.availableOn stdenv.hostPlatform curl,
       curl,
 
       # GSSAPI
-      gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic,
+      gssSupport ? with stdenv.hostPlatform; !isWindows,
       libkrb5,
 
       # icu
-      # Building with icu in pkgsStatic gives tons of "undefined reference" errors like this:
-      #   /nix/store/452lkaak37d3mzzn3p9ak7aa3wzhdqaj-icu4c-74.2-x86_64-unknown-linux-musl/lib/libicuuc.a(chariter.ao):
-      #    (.data.rel.ro._ZTIN6icu_7417CharacterIteratorE[_ZTIN6icu_7417CharacterIteratorE]+0x0):
-      #    undefined reference to `vtable for __cxxabiv1::__si_class_type_info'
-      icuSupport ? !stdenv.hostPlatform.isStatic,
+      icuSupport ? true,
       icu,
 
       # JIT
-      jitSupport ?
-        stdenv.hostPlatform.canExecute stdenv.buildPlatform
-        # Building with JIT in pkgsStatic fails like this:
-        #   fatal error: 'stdio.h' file not found
-        && !stdenv.hostPlatform.isStatic,
+      jitSupport ? stdenv.hostPlatform.canExecute stdenv.buildPlatform,
       llvmPackages,
       nukeReferences,
       overrideCC,
@@ -100,21 +86,12 @@ let
       numactl,
 
       # PAM
-      pamSupport ?
-        lib.meta.availableOn stdenv.hostPlatform linux-pam
-        # Building with linux-pam in pkgsStatic gives a few "undefined reference" errors like this:
-        #   /nix/store/3s55icpsbc36sgn7sa8q3qq4z6al6rlr-linux-pam-static-x86_64-unknown-linux-musl-1.6.1/lib/libpam.a(pam_audit.o):
-        #     in function `pam_modutil_audit_write':(.text+0x571):
-        #     undefined reference to `audit_close'
-        && !stdenv.hostPlatform.isStatic,
+      pamSupport ? lib.meta.availableOn stdenv.hostPlatform linux-pam,
       linux-pam,
 
       # PL/Perl
       perlSupport ?
         lib.meta.availableOn stdenv.hostPlatform perl
-        # Building with perl in pkgsStatic gives this error:
-        #   configure: error: cannot build PL/Perl because libperl is not a shared library
-        && !stdenv.hostPlatform.isStatic
         # configure tries to call the perl executable for the version
         && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
       perl,
@@ -122,9 +99,6 @@ let
       # PL/Python
       pythonSupport ?
         lib.meta.availableOn stdenv.hostPlatform python3
-        # Building with python in pkgsStatic gives this error:
-        #  checking how to link an embedded Python application... configure: error: could not find shared library for Python
-        && !stdenv.hostPlatform.isStatic
         # configure tries to call the python executable
         && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
       python3,
@@ -132,8 +106,6 @@ let
       # PL/Tcl
       tclSupport ?
         lib.meta.availableOn stdenv.hostPlatform tcl
-        # tcl is broken in pkgsStatic
-        && !stdenv.hostPlatform.isStatic
         # configure fails with:
         #   configure: error: file 'tclConfig.sh' is required for Tcl
         && stdenv.buildPlatform.canExecute stdenv.hostPlatform,
@@ -434,19 +406,6 @@ let
       + lib.optionalString (atLeast "18") ''
         substituteInPlace src/test/regress/parallel_schedule \
           --replace-fail numa ""
-      ''
-      # This check was introduced upstream to prevent calls to "exit" inside libpq.
-      # However, this doesn't work reliably with static linking, see this and following:
-      # https://postgr.es/m/flat/20210703001639.GB2374652%40rfd.leadboat.com#52584ca4bd3cb9dac376f3158c419f97
-      # Thus, disable the check entirely, as it would currently fail with this:
-      # > libpq.so.5.17:                  U atexit
-      # > libpq.so.5.17:                  U pthread_exit
-      # > libpq must not be calling any function which invokes exit
-      # Don't mind the fact that this checks libpq.**so** in pkgsStatic - that's correct, since PostgreSQL
-      # still needs a shared library internally.
-      + lib.optionalString (atLeast "15" && stdenv'.hostPlatform.isStatic) ''
-        substituteInPlace src/interfaces/libpq/Makefile \
-          --replace-fail "echo 'libpq must not be calling any function which invokes exit'; exit 1;" "echo;"
       '';
 
       postInstall = ''
@@ -472,8 +431,7 @@ let
         # because there is a realistic use-case for extensions to locate the /lib directory to
         # load other shared modules.
         remove-references-to -t "$dev" -t "$doc" -t "$man" "$out/bin/postgres"
-      ''
-      + lib.optionalString (!stdenv'.hostPlatform.isStatic) ''
+
         if [ -z "''${dontDisableStatic:-}" ]; then
           # Remove static libraries in case dynamic are available.
           for i in $lib/lib/*.a; do
@@ -484,8 +442,7 @@ let
             fi
           done
         fi
-      ''
-      + ''
+
         # The remaining static libraries are libpgcommon.a, libpgport.a and related.
         # Those are only used when building e.g. extensions, so go to $dev.
         moveToOutput "lib/*.a" "$dev"
@@ -530,18 +487,16 @@ let
       # Also see <nixpkgs>/doc/stdenv/platform-notes.chapter.md
       doCheck = false;
       doInstallCheck =
-        !(stdenv'.hostPlatform.isStatic)
-        &&
-          # Tests currently can't be run on darwin, because of a Nix bug:
-          # https://github.com/NixOS/nix/issues/12548
-          # https://git.lix.systems/lix-project/lix/issues/691
-          # The error appears as this in the initdb logs:
-          #   FATAL:  could not create shared memory segment: Cannot allocate memory
-          # Don't let yourself be fooled when trying to remove this condition: Running
-          # the tests works fine most of the time. But once the tests (or any package using
-          # postgresqlTestHook) fails on the same machine for a few times, enough IPC objects
-          # will be stuck around, and any future builds with the tests enabled *will* fail.
-          !(stdenv'.hostPlatform.isDarwin)
+        # Tests currently can't be run on darwin, because of a Nix bug:
+        # https://github.com/NixOS/nix/issues/12548
+        # https://git.lix.systems/lix-project/lix/issues/691
+        # The error appears as this in the initdb logs:
+        #   FATAL:  could not create shared memory segment: Cannot allocate memory
+        # Don't let yourself be fooled when trying to remove this condition: Running
+        # the tests works fine most of the time. But once the tests (or any package using
+        # postgresqlTestHook) fails on the same machine for a few times, enough IPC objects
+        # will be stuck around, and any future builds with the tests enabled *will* fail.
+        !(stdenv'.hostPlatform.isDarwin)
         &&
           # Regression tests currently fail in pkgsMusl because of a difference in EXPLAIN output.
           !(stdenv'.hostPlatform.isMusl)
@@ -624,20 +579,26 @@ let
         ];
         platforms = lib.platforms.unix;
 
-        # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
-        # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
-        # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
-        # host-platform.
-        #
-        # I managed to get a cross-build with JIT support working with
-        # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
-        # resulting LLVM IR isn't platform-independent this doesn't give you much.
-        # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
-        # a query, postgres would coredump with `Illegal instruction`.
-        #
-        # Note: This is "host canExecute build" on purpose, since this is about the LLVM that is called
-        # to do JIT at **runtime**.
-        broken = jitSupport && !stdenv.hostPlatform.canExecute stdenv.buildPlatform;
+        broken =
+          # JIT support doesn't work with cross-compilation. It is attempted to build LLVM-bytecode
+          # (`%.bc` is the corresponding `make(1)`-rule) for each sub-directory in `backend/` for
+          # the JIT apparently, but with a $(CLANG) that can produce binaries for the build, not the
+          # host-platform.
+          #
+          # I managed to get a cross-build with JIT support working with
+          # `depsBuildBuild = [ llvmPackages.clang ] ++ buildInputs`, but considering that the
+          # resulting LLVM IR isn't platform-independent this doesn't give you much.
+          # In fact, I tried to test the result in a VM-test, but as soon as JIT was used to optimize
+          # a query, postgres would coredump with `Illegal instruction`.
+          #
+          # Note: This is "host canExecute build" on purpose, since this is about the LLVM that is called
+          # to do JIT at **runtime**.
+          (jitSupport && !stdenv.hostPlatform.canExecute stdenv.buildPlatform)
+          # While PostgreSQL claims to support static builds, it does not do so in a way that
+          # would work properly and consistently in pkgsStatic. The server heavily depends on
+          # the ability to load shared modules at runtime, but dlopen() is stubbed out in static
+          # musl builds. The important part is, that the separate libpq package builds in pkgsStatic.
+          || stdenv.hostPlatform.isStatic;
       };
     });
 

From efeb755073b9b5f58a34d9a3b609d9f178c9affb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 13 Jun 2026 20:11:35 +0200
Subject: [PATCH 627/831] ci/owners: remove natsukium from remaining python
 ownership

---
 ci/OWNERS | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ci/OWNERS b/ci/OWNERS
index e08961b38210..e5d896e39688 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -192,10 +192,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/by-name/an/android*                     @NixOS/android
 
 # Python-related code and docs
-/doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
-/pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
-/pkgs/development/interpreters/python         @mweinelt @natsukium
+/doc/languages-frameworks/python.section.md   @mweinelt
+/maintainers/scripts/update-python-libraries  @mweinelt
+/pkgs/by-name/up/update-python-libraries      @mweinelt
+/pkgs/development/interpreters/python         @mweinelt
 
 # CUDA
 /pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers

From f8981908fa0149134072cb0ede100e51358841be Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 13 Jun 2026 20:23:37 +0000
Subject: [PATCH 628/831] protobuf: 35.0 -> 35.1

Diff: https://github.com/protocolbuffers/protobuf/compare/v35.0...v35.1

Changelog:
https://github.com/protocolbuffers/protobuf/releases/tag/v35.1
---
 pkgs/development/libraries/protobuf/35.nix     | 4 ++--
 pkgs/development/python-modules/protobuf/7.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/protobuf/35.nix b/pkgs/development/libraries/protobuf/35.nix
index 0dba884f1ecf..c1addeb59840 100644
--- a/pkgs/development/libraries/protobuf/35.nix
+++ b/pkgs/development/libraries/protobuf/35.nix
@@ -2,8 +2,8 @@
 
 callPackage ./generic.nix (
   {
-    version = "35.0";
-    hash = "sha256-J0NA19W44CzgSjKv3A+1An6vDRTDjaWMhDzQGEOtrCk=";
+    version = "35.1";
+    hash = "sha256-nif9xjd+3ASR2pvvSXkzTEWoKi2oKLzV9gMQ3EevBVk=";
   }
   // args
 )
diff --git a/pkgs/development/python-modules/protobuf/7.nix b/pkgs/development/python-modules/protobuf/7.nix
index 3cb696c0110a..c0465363a84f 100644
--- a/pkgs/development/python-modules/protobuf/7.nix
+++ b/pkgs/development/python-modules/protobuf/7.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "protobuf";
-  version = "7.35.0";
+  version = "7.35.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-ou/YRgX0HlWfGIGwkStECZ0KKsm/RrNHSCPxD7OTsOY=";
+    hash = "sha256-zhFaJv4MOaLCmXPZFNMn5RamRVRkSJ/jzR5RobNU+Bo=";
   };
 
   build-system = [ setuptools ];

From 1dc665b0af91e936f86e659adf87317638974581 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 13 Jun 2026 20:25:14 +0000
Subject: [PATCH 629/831] python3Packages.protobuf: enable __structuredAttrs

---
 pkgs/development/python-modules/protobuf/7.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/protobuf/7.nix b/pkgs/development/python-modules/protobuf/7.nix
index c0465363a84f..203c3b9c118a 100644
--- a/pkgs/development/python-modules/protobuf/7.nix
+++ b/pkgs/development/python-modules/protobuf/7.nix
@@ -11,6 +11,7 @@ buildPythonPackage (finalAttrs: {
   pname = "protobuf";
   version = "7.35.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;

From e351b6fa2fa118886cd235823243ecc63a5204f3 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 13 Jun 2026 20:26:19 +0000
Subject: [PATCH 630/831] python3Packages.protobuf6: enable __structuredAttrs

---
 pkgs/development/python-modules/protobuf/6.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/protobuf/6.nix b/pkgs/development/python-modules/protobuf/6.nix
index 6c96954b0df7..8259f224f131 100644
--- a/pkgs/development/python-modules/protobuf/6.nix
+++ b/pkgs/development/python-modules/protobuf/6.nix
@@ -11,6 +11,7 @@ buildPythonPackage (finalAttrs: {
   pname = "protobuf";
   version = "6.33.6";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;

From 418b4595bbeea7930296197d57702f57b43e830b Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 13 Jun 2026 20:25:55 +0000
Subject: [PATCH 631/831] python3Packages.protobuf5: enable __structuredAttrs

---
 pkgs/development/python-modules/protobuf/5.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/protobuf/5.nix b/pkgs/development/python-modules/protobuf/5.nix
index 5e44c82d463f..dcfbf72e415c 100644
--- a/pkgs/development/python-modules/protobuf/5.nix
+++ b/pkgs/development/python-modules/protobuf/5.nix
@@ -10,6 +10,7 @@ buildPythonPackage rec {
   pname = "protobuf";
   version = "5.29.6";
   pyproject = true;
+  __structuredAttrs = true;
   # nixpkgs-update: no auto update
 
   src = fetchPypi {

From 756f27df972ea5db54acc73ec09f90b1a531f390 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Sat, 13 Jun 2026 16:55:05 -0700
Subject: [PATCH 632/831] aws-c-http: 0.10.4 -> 0.11.0

Diff: https://github.com/awslabs/aws-c-http/compare/v0.10.4...v0.11.0
---
 pkgs/by-name/aw/aws-c-http/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/aw/aws-c-http/package.nix b/pkgs/by-name/aw/aws-c-http/package.nix
index 01b333b01b35..9f0fd8c16f04 100644
--- a/pkgs/by-name/aw/aws-c-http/package.nix
+++ b/pkgs/by-name/aw/aws-c-http/package.nix
@@ -14,13 +14,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-http";
   # nixpkgs-update: no auto update
-  version = "0.10.4";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t9PoxOjgV9qLris+C18SaEwXodBGcgK591LZl0dajxU=";
+    hash = "sha256-SCdZfGIIHU6f0OArygZm0yY0wE6Hdx/JWvHZcK1DQOw=";
   };
 
   nativeBuildInputs = [

From 6db252617590ff61fd852e956ca4829081f7d93c Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Sat, 13 Jun 2026 16:56:19 -0700
Subject: [PATCH 633/831] aws-c-io: 0.22.0 -> 0.27.2

Diff: https://github.com/awslabs/aws-c-io/compare/v0.22.0...v0.27.2
---
 pkgs/by-name/aw/aws-c-io/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/aw/aws-c-io/package.nix b/pkgs/by-name/aw/aws-c-io/package.nix
index 590195761664..960d79c9a43d 100644
--- a/pkgs/by-name/aw/aws-c-io/package.nix
+++ b/pkgs/by-name/aw/aws-c-io/package.nix
@@ -12,13 +12,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-io";
   # nixpkgs-update: no auto update
-  version = "0.22.0";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-io";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-NOEjXk4s/FV4CdmyXOr4Oh2y+pFNrUMP/Sy+X+fVQc4=";
+    hash = "sha256-0vzuSvJ/4you0YYnizjctKP5AcLm5sJieDOSCHwm1HM=";
   };
 
   nativeBuildInputs = [ cmake ];

From c0ec12aeaec4ce63f60ff9606d286d006c821695 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 13 Jun 2026 17:53:35 -0700
Subject: [PATCH 634/831] krb5: patch CVE-2026-11850

---
 pkgs/by-name/kr/krb5/CVE-2026-11850.patch | 33 +++++++++++++++++++++++
 pkgs/by-name/kr/krb5/package.nix          |  2 ++
 2 files changed, 35 insertions(+)
 create mode 100644 pkgs/by-name/kr/krb5/CVE-2026-11850.patch

diff --git a/pkgs/by-name/kr/krb5/CVE-2026-11850.patch b/pkgs/by-name/kr/krb5/CVE-2026-11850.patch
new file mode 100644
index 000000000000..3c7dde29df3f
--- /dev/null
+++ b/pkgs/by-name/kr/krb5/CVE-2026-11850.patch
@@ -0,0 +1,33 @@
+From 2a5fd83d4436583f2ddc0e193269a4d800ee45c4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sebasti=C3=A1n=20Alba?= <sebasjosue84@gmail.com>
+Date: Wed, 8 Apr 2026 18:32:25 -0400
+Subject: [PATCH] Prevent read overrun in libkdb_ldap
+
+In berval2tl_data(), reject inputs of length less than 2 to prevent an
+integer underflow and subsequent read overrun.  (The security impact
+is negligible as the attacker would have to control the KDB LDAP
+server.)
+
+[ghudson@mit.edu: wrote commit message]
+
+ticket: 9206 (new)
+tags: pullup
+target_version: 1.22-next
+---
+ plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+index 418d253d17..9aa68bacd7 100644
+--- a/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
++++ b/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+@@ -80,6 +80,9 @@ getstringtime(krb5_timestamp);
+ krb5_error_code
+ berval2tl_data(struct berval *in, krb5_tl_data **out)
+ {
++    if (in->bv_len < 2)
++        return EINVAL;
++
+     *out = (krb5_tl_data *) malloc (sizeof (krb5_tl_data));
+     if (*out == NULL)
+         return ENOMEM;
diff --git a/pkgs/by-name/kr/krb5/package.nix b/pkgs/by-name/kr/krb5/package.nix
index c4e35061d41a..4e97e9867190 100644
--- a/pkgs/by-name/kr/krb5/package.nix
+++ b/pkgs/by-name/kr/krb5/package.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
+    # https://github.com/krb5/krb5/pull/1505
+    ./CVE-2026-11850.patch
     # https://github.com/krb5/krb5/pull/1506
     ./CVE-2026-40355-and-CVE-2026-40356.patch
   ]

From 5f8fa250d5012bca29143c89c30a296e8002b7bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 14 Jun 2026 03:54:36 +0200
Subject: [PATCH 635/831] python314Packages.aws-sam-translator: 1.106.0 ->
 1.110.0

---
 .../aws-sam-translator/default.nix            | 32 ++++---------------
 1 file changed, 6 insertions(+), 26 deletions(-)

diff --git a/pkgs/development/python-modules/aws-sam-translator/default.nix b/pkgs/development/python-modules/aws-sam-translator/default.nix
index 33ced09ce46b..42a22dedbbaf 100644
--- a/pkgs/development/python-modules/aws-sam-translator/default.nix
+++ b/pkgs/development/python-modules/aws-sam-translator/default.nix
@@ -10,25 +10,22 @@
   pytest-rerunfailures,
   pytest-xdist,
   pytestCheckHook,
-  pythonAtLeast,
   pyyaml,
+  requests,
   setuptools,
   typing-extensions,
 }:
 
 buildPythonPackage rec {
   pname = "aws-sam-translator";
-  version = "1.106.0";
+  version = "1.110.0";
   pyproject = true;
 
-  # https://github.com/aws/serverless-application-model/issues/3831
-  disabled = pythonAtLeast "3.14";
-
   src = fetchFromGitHub {
     owner = "aws";
     repo = "serverless-application-model";
     tag = "v${version}";
-    hash = "sha256-9KrBoa50lgZcqe/wzt05TsuUYbjRuQXgXTVHjDKBmr4=";
+    hash = "sha256-Zn+6cDyDZSsV9V+zAA8BOPs4aKl0j3dF92/azGYG+OI=";
   };
 
   postPatch = ''
@@ -36,6 +33,8 @@ buildPythonPackage rec {
     rm pytest.ini
   '';
 
+  pythonRelaxDeps = [ "pydantic" ];
+
   build-system = [ setuptools ];
 
   dependencies = [
@@ -52,6 +51,7 @@ buildPythonPackage rec {
     pytest-xdist
     pytestCheckHook
     pyyaml
+    requests
   ];
 
   preCheck = ''
@@ -66,26 +66,6 @@ buildPythonPackage rec {
     "slow"
   ];
 
-  disabledTests = [
-    # urllib3 2.0 compat
-    "test_plugin_accepts_different_sar_client"
-    "test_plugin_accepts_flags"
-    "test_plugin_accepts_parameters"
-    "test_plugin_default_values"
-    "test_plugin_invalid_configuration_raises_exception"
-    "test_plugin_must_setup_correct_name"
-    "test_must_process_applications"
-    "test_must_process_applications_validate"
-    "test_process_invalid_applications"
-    "test_process_invalid_applications_validate"
-    "test_resolve_intrinsics"
-    "test_sar_service_calls"
-    "test_sar_success_one_app"
-    "test_sar_throttling_doesnt_stop_processing"
-    "test_sleep_between_sar_checks"
-    "test_unexpected_sar_error_stops_processing"
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   pythonImportsCheck = [ "samtranslator" ];

From 042fe921f5eb501460a87295349036a09edab9cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 14 Jun 2026 04:02:10 +0200
Subject: [PATCH 636/831] python314Packages.chalice: allow on 3.14

This was already possible since the 1.33.0 update.
https://redirect.github.com/aws/chalice/commit/bf4dce655ad97784ea09fb19484465fcf08c847d
---
 pkgs/development/python-modules/chalice/default.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/development/python-modules/chalice/default.nix b/pkgs/development/python-modules/chalice/default.nix
index dab8b5c075fb..c6aa4b4035a2 100644
--- a/pkgs/development/python-modules/chalice/default.nix
+++ b/pkgs/development/python-modules/chalice/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonAtLeast,
 
   # build-system
   setuptools,
@@ -28,8 +27,6 @@ buildPythonPackage (finalAttrs: {
   version = "1.33.0";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.14";
-
   src = fetchFromGitHub {
     owner = "aws";
     repo = "chalice";
@@ -78,7 +75,6 @@ buildPythonPackage (finalAttrs: {
     "test_can_import_env_vars"
     "test_stack_trace_printed_on_error"
     # Don't build
-    "test_can_generate_pipeline_for_all"
     "test_build_wheel"
     # Tests require dist
     "test_setup_tar_gz_hyphens_in_name"

From c1b74a6831fe46c9a52e3265e7c328c5f61e9d5f Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Sun, 14 Jun 2026 05:45:41 +0000
Subject: [PATCH 637/831] gnupatch: enable strictDeps

part of <https://github.com/NixOS/nixpkgs/issues/178468>.

the output is bit-for-bit identical before and after this change
(tested both x86_64-linux `pkgs.gnupatch` and `pkgsMusl.gnupatch`).
---
 pkgs/tools/text/gnupatch/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index 99a801c4cc8e..68ebbedfbc23 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = stdenv.hostPlatform.libc != "musl";
   nativeCheckInputs = [ ed ];
 
+  strictDeps = true;
+
   meta = {
     description = "GNU Patch, a program to apply differences to files";
     mainProgram = "patch";

From f9f5c0662091ee07de5e6ba20aae4a36ef2718b5 Mon Sep 17 00:00:00 2001
From: Alexis Hildebrandt <afh@surryhill.net>
Date: Sat, 6 Jun 2026 12:07:59 +0200
Subject: [PATCH 638/831] fretboard: fix darwin build

---
 pkgs/by-name/fr/fretboard/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/fr/fretboard/package.nix b/pkgs/by-name/fr/fretboard/package.nix
index 115e311419e8..a1c0e3a6707a 100644
--- a/pkgs/by-name/fr/fretboard/package.nix
+++ b/pkgs/by-name/fr/fretboard/package.nix
@@ -69,6 +69,5 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "fretboard";
     teams = [ lib.teams.gnome-circle ];
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })

From 7f54ad693754c31d75e3e93d5f181a6f76dc98a1 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Mon, 15 Jun 2026 02:42:40 +0300
Subject: [PATCH 639/831] gnutar: `__structuredAttrs` &
 `enableParallelBuilding`

---
 pkgs/by-name/gn/gnutar/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/gn/gnutar/package.nix b/pkgs/by-name/gn/gnutar/package.nix
index 51344245c45f..acf5f3233aeb 100644
--- a/pkgs/by-name/gn/gnutar/package.nix
+++ b/pkgs/by-name/gn/gnutar/package.nix
@@ -40,7 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
     "info"
   ];
 
+  __structuredAttrs = true;
   strictDeps = true;
+  enableParallelBuilding = true;
 
   nativeBuildInputs = [ autoreconfHook ] ++ lib.optional stdenv.hostPlatform.isCygwin gettext;
 

From f9823a9e198ac27fc99e6f0aadd531d6c759a4ce Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 15 Jun 2026 16:47:25 +0300
Subject: [PATCH 640/831] python3Packages.matplotlib: fix setuptools_scm
 constraint

Should have been kept in #530985
---
 pkgs/development/python-modules/matplotlib/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index eed032805c76..2f11fd9a0d65 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -94,6 +94,9 @@ buildPythonPackage (finalAttrs: {
         --replace-fail "/usr/bin/env python3" "/usr/bin/env pypy3"
     ''
     + ''
+      substituteInPlace pyproject.toml \
+        --replace-fail "setuptools_scm>=7,<10" setuptools_scm
+
       patchShebangs tools
     ''
     + lib.optionalString (stdenv.hostPlatform.isLinux && interactive) ''

From eb5dafe5479e70ac0195fdeabf57da842d2603bf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 00:28:40 +0200
Subject: [PATCH 641/831] python3Packages.httpcore2: 2.3.0 -> 2.4.0

https://github.com/pydantic/httpx2/blob/v2.4.0/src/httpcore2/CHANGELOG.md
---
 pkgs/development/python-modules/httpcore2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/httpcore2/default.nix b/pkgs/development/python-modules/httpcore2/default.nix
index cfbbf8113342..eddeeb5178fd 100644
--- a/pkgs/development/python-modules/httpcore2/default.nix
+++ b/pkgs/development/python-modules/httpcore2/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "httpcore2";
-  version = "2.3.0";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "httpx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cW6meHx6VBMz5r/lXCKKK7Sq4e2nk+n1A5YTNtR2kB4=";
+    hash = "sha256-T5As4cdZRHkWszzaDZX8G8Z35TkaBsB/oy92FtOhuBY=";
   };
 
   postPatch = ''

From 71bf5cc8cb35b23e1bc393533a5177898fabbfbd Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 11:59:22 +0200
Subject: [PATCH 642/831] python3Packages.idna: 3.15 -> 3.18

https://github.com/kjd/idna/releases/tag/v3.18
---
 pkgs/development/python-modules/idna/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index c6c917852319..7278212bf772 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "idna";
-  version = "3.15";
+  version = "3.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kjd";
     repo = "idna";
     tag = "v${version}";
-    hash = "sha256-z3Nd834inihGzquCAmejUQvRcM0Yn/VmMcWQP3oh4ak=";
+    hash = "sha256-9nLy/9PNuLSQJsf4Jes0uN695+LGjz2LXlfiZxxvGV4=";
   };
 
   build-system = [ flit-core ];

From 15ad0c06216db71aa97ba1ec1732711c7cad3a89 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 14:47:21 +0200
Subject: [PATCH 643/831] python3Packages.httpx2: 2.3.0 -> 2.4.0

https://github.com/pydantic/httpx2/blob/v2.4.0/src/httpx2/CHANGELOG.md
---
 pkgs/development/python-modules/httpx2/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/httpx2/default.nix b/pkgs/development/python-modules/httpx2/default.nix
index 9e73b584f276..f27315046788 100644
--- a/pkgs/development/python-modules/httpx2/default.nix
+++ b/pkgs/development/python-modules/httpx2/default.nix
@@ -29,7 +29,6 @@
   # tests
   chardet,
   pytestCheckHook,
-  pytest-httpbin,
   pytest-trio,
   trustme,
   uvicorn,
@@ -40,14 +39,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "httpx2";
-  version = "2.3.0";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "httpx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cW6meHx6VBMz5r/lXCKKK7Sq4e2nk+n1A5YTNtR2kB4=";
+    hash = "sha256-T5As4cdZRHkWszzaDZX8G8Z35TkaBsB/oy92FtOhuBY=";
   };
 
   postPatch = ''

From 28e20e77fc5109649ddd16d7ad5aa459dba93186 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:24:45 +0200
Subject: [PATCH 644/831] python3Packages.valkey: fix valkey 9.1 compat

---
 pkgs/development/python-modules/valkey/default.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/valkey/default.nix b/pkgs/development/python-modules/valkey/default.nix
index 5674542e9016..dcccacb7d569 100644
--- a/pkgs/development/python-modules/valkey/default.nix
+++ b/pkgs/development/python-modules/valkey/default.nix
@@ -40,11 +40,20 @@ buildPythonPackage rec {
   };
 
   patches = [
+    # valkey 9.0 compat
     (fetchpatch {
-      # valkey 9.0 compat
       url = "https://github.com/valkey-io/valkey-py/commit/c01505e547f614f278b882a016557b6ed652bb9f.patch";
       hash = "sha256-rvA65inIioqdc+QV4KaaUv1I/TMZUq0TWaFJcJiy8NU=";
     })
+    # valkey 9.1 compat
+    (fetchpatch {
+      url = "https://github.com/valkey-io/valkey-py/commit/df5c44903dc8e2dda733e5576324ba0ff8c4c6a0.patch";
+      hash = "sha256-0wsWuaOYWBgf6BjlJuciZYRbugYfchTU2khQX7rtRJg=";
+    })
+    (fetchpatch {
+      url = "https://github.com/valkey-io/valkey-py/commit/046c7fb9e8260c2d69d05141b1519903c4e40efe.patch";
+      hash = "sha256-/yN1y0hbmBR6o6ab4h0qkn/qhU6jASOIeqWhxUi5w/I=";
+    })
   ];
 
   build-system = [ setuptools ];

From 2b080788e2178808fbb42674fbef8daae9aedebe Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:33:57 +0200
Subject: [PATCH 645/831] python3Packages.matplotlib: relax setuptools-scm
 constraint

Per their upstream comment this is fine for downstream distributors, as
it only breaks editable installs for them.
---
 pkgs/development/python-modules/matplotlib/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index eed032805c76..20a63ca43387 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -95,6 +95,9 @@ buildPythonPackage (finalAttrs: {
     ''
     + ''
       patchShebangs tools
+
+      substituteInPlace pyproject.toml \
+        --replace-fail "setuptools_scm>=7,<10" "setuptools_scm"
     ''
     + lib.optionalString (stdenv.hostPlatform.isLinux && interactive) ''
       # fix paths to libraries in dlopen calls (headless detection)

From fc4407ec5ecd31d13c855ff181f1dbff2c272729 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:38:14 +0200
Subject: [PATCH 646/831] python3Packages.meson-python: 0.19.0 -> 0.20.0

https://github.com/mesonbuild/meson-python/blob/0.20.0/CHANGELOG.rst
---
 pkgs/development/python-modules/meson-python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 35e9e0c350b4..28f726541f1a 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "meson-python";
-  version = "0.19.0";
+  version = "0.20.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "meson_python";
-    hash = "sha256-mVnRmKpptX/P01SjRRjG95W3gac+0GVvTQFmAWDMJVM=";
+    hash = "sha256-bZcmrmzTfiLyEMdLNkswGApowgRC6X/wnzxWakFK9zg=";
   };
 
   build-system = [

From 186c27eb2fc154df133bd5502977291c14d23271 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:54:08 +0200
Subject: [PATCH 647/831] python3Packages.pdm-backend: 2.4.8 -> 2.4.9

https://github.com/pdm-project/pdm-backend/releases/tag/2.4.9
---
 pkgs/development/python-modules/pdm-backend/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pdm-backend/default.nix b/pkgs/development/python-modules/pdm-backend/default.nix
index 4170d421d632..e4bf513d4f55 100644
--- a/pkgs/development/python-modules/pdm-backend/default.nix
+++ b/pkgs/development/python-modules/pdm-backend/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pdm-backend";
-  version = "2.4.8";
+  version = "2.4.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdm-project";
     repo = "pdm-backend";
     tag = version;
-    hash = "sha256-zh+JP1sX+ra3Z6oVgxOabwMmD/bQjokdb0MelZ0k1KQ=";
+    hash = "sha256-082ZSfRUGUV8DX+vuJeOd+HOuAfnKfZPZ3Lyhx6TRlE=";
   };
 
   env.PDM_BUILD_SCM_VERSION = version;

From 81f9403c1e1adae1e175fa72f6701deb7d40feca Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:48:32 +0200
Subject: [PATCH 648/831] python3Packages.pytest-run-parallel: 0.8.2 -> 0.9.1

https://github.com/Quansight-Labs/pytest-run-parallel/releases/tag/v0.9.1
---
 .../python-modules/pytest-run-parallel/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-run-parallel/default.nix b/pkgs/development/python-modules/pytest-run-parallel/default.nix
index 7f7dfe9cad19..2ab2cd05f651 100644
--- a/pkgs/development/python-modules/pytest-run-parallel/default.nix
+++ b/pkgs/development/python-modules/pytest-run-parallel/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytest-run-parallel";
-  version = "0.8.2";
+  version = "0.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Quansight-Labs";
     repo = "pytest-run-parallel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/EoIemQvQFgo9Ic+ZcQJk7fC8S+OHOHaHODrsivarhY=";
+    hash = "sha256-8ndm/CKtWieNF3mx7Ni7nPO4psam3TAM9NJzdiiSpPQ=";
   };
 
   build-system = [ setuptools ];

From 81edfa0080b857e81a8d09ab18381df58aec4eb0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 15:49:19 +0200
Subject: [PATCH 649/831] python3Packages.pytest-describe: 3.1.0 -> 3.2.0

https://github.com/pytest-dev/pytest-describe/releases/tag/3.2.0
---
 pkgs/development/python-modules/pytest-describe/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-describe/default.nix b/pkgs/development/python-modules/pytest-describe/default.nix
index 3c88f2f6f66b..fcbfbd3f4be0 100644
--- a/pkgs/development/python-modules/pytest-describe/default.nix
+++ b/pkgs/development/python-modules/pytest-describe/default.nix
@@ -15,7 +15,7 @@
 
 let
   pname = "pytest-describe";
-  version = "3.1.0";
+  version = "3.2.0";
 in
 buildPythonPackage {
   inherit pname version;
@@ -25,7 +25,7 @@ buildPythonPackage {
     owner = "pytest-dev";
     repo = "pytest-describe";
     tag = version;
-    hash = "sha256-ygrZwd1cO9arekdzqn5Axjz4i9Q0QKFA/OS6QSIvP9Y=";
+    hash = "sha256-nvTINE3QtV2pCKD/aixYDSO2ryW1uYDv55FLOMP7Vlc=";
   };
 
   postPatch = ''

From 19d19509aa7c338fcdeee3435dc04c3c07cfebdf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 16:35:55 +0200
Subject: [PATCH 650/831] python3Packaegs.aioresponses: fix aiohttp 3.14 compat

---
 .../aioresponses/aiohttp-3.14-compat.patch    | 79 +++++++++++++++++++
 .../python-modules/aioresponses/default.nix   |  6 ++
 2 files changed, 85 insertions(+)
 create mode 100644 pkgs/development/python-modules/aioresponses/aiohttp-3.14-compat.patch

diff --git a/pkgs/development/python-modules/aioresponses/aiohttp-3.14-compat.patch b/pkgs/development/python-modules/aioresponses/aiohttp-3.14-compat.patch
new file mode 100644
index 000000000000..a60736062614
--- /dev/null
+++ b/pkgs/development/python-modules/aioresponses/aiohttp-3.14-compat.patch
@@ -0,0 +1,79 @@
+From 1a48e1f898035e3bedc981f06520842c55977706 Mon Sep 17 00:00:00 2001
+From: kleine-safie <k-guilherme@safie.jp>
+Date: Wed, 10 Jun 2026 11:05:30 +0900
+Subject: [PATCH] support for pause_reading
+
+---
+ aioresponses/compat.py     |  5 +++++
+ aioresponses/core.py       |  2 ++
+ tests/test_aioresponses.py | 11 ++++++++++-
+ tox.ini                    | 11 ++++++-----
+ 4 files changed, 23 insertions(+), 6 deletions(-)
+
+diff --git a/aioresponses/compat.py b/aioresponses/compat.py
+index 83fd47a..e95ecb2 100644
+--- a/aioresponses/compat.py
++++ b/aioresponses/compat.py
+@@ -2,6 +2,7 @@
+ import asyncio  # noqa: F401
+ from re import Pattern
+ from typing import Dict, Optional, Union  # noqa
++from unittest.mock import Mock
+ from urllib.parse import parse_qsl, urlencode
+ 
+ from aiohttp import __version__ as aiohttp_version, StreamReader
+@@ -17,6 +18,10 @@ def stream_reader_factory(  # noqa
+     loop: 'Optional[asyncio.AbstractEventLoop]' = None
+ ) -> StreamReader:
+     protocol = ResponseHandler(loop=loop)
++    # Satisfies BaseProtocol's flow control hooks that
++    # fire when a large payload exceeds the StreamReader limit.
++    protocol._parser = Mock()
++    protocol._parser.feed_data.return_value = ([], False, b'')
+     return StreamReader(protocol, limit=2 ** 16, loop=loop)
+ 
+ 
+diff --git a/aioresponses/core.py b/aioresponses/core.py
+index a904cf9..52640f3 100644
+--- a/aioresponses/core.py
++++ b/aioresponses/core.py
+@@ -182,6 +182,8 @@ def _build_response(self, url: 'Union[URL, str]',
+             headers=CIMultiDictProxy(self._prepare_request_headers(request_headers)),
+             real_url=url
+         )
++        if 'stream_writer' in inspect.signature(response_class).parameters:
++            kwargs['stream_writer'] = Mock(output_size=0)
+         kwargs['writer'] = None
+         kwargs['continue100'] = None
+         kwargs['timer'] = TimerNoop()
+diff --git a/tests/test_aioresponses.py b/tests/test_aioresponses.py
+index 68bec3f..45c0d87 100644
+--- a/tests/test_aioresponses.py
++++ b/tests/test_aioresponses.py
+@@ -4,9 +4,10 @@
+ from asyncio import CancelledError, TimeoutError
+ from random import uniform
+ from typing import Coroutine, Generator, Union
+-from unittest.mock import patch
++from unittest.mock import MagicMock, patch
+ 
+ from aiohttp import hdrs
++from aiohttp.base_protocol import BaseProtocol
+ from aiohttp import http
+ from aiohttp.client import ClientSession
+ from aiohttp.client_reqrep import ClientResponse
+@@ -312,6 +313,14 @@ async def test_streaming(self, m):
+         content = await resp.content.read()
+         self.assertEqual(content, b'Test')
+ 
++    @aioresponses()
++    async def test_streaming_large_body(self, m):
++        body = b'x' * (1024 * 1024)
++        m.get(self.url, body=body)
++        resp = await self.session.get(self.url)
++        content = await resp.content.read()
++        self.assertEqual(content, body)
++
+     @aioresponses()
+     async def test_streaming_up_to(self, m):
+         m.get(self.url, body='Test')
diff --git a/pkgs/development/python-modules/aioresponses/default.nix b/pkgs/development/python-modules/aioresponses/default.nix
index e3ec08c122ce..395f7387aef7 100644
--- a/pkgs/development/python-modules/aioresponses/default.nix
+++ b/pkgs/development/python-modules/aioresponses/default.nix
@@ -25,6 +25,12 @@ buildPythonPackage rec {
     hash = "sha256-uGHN/l3FjzuK+sewppc9XXsstgjdD2JT0WuO6Or23xE=";
   };
 
+  patches = [
+    # https://github.com/pnuckowski/aioresponses/issues/289
+    # https://github.com/pnuckowski/aioresponses/pull/292
+    ./aiohttp-3.14-compat.patch
+  ];
+
   postPatch = ''
     # https://github.com/pnuckowski/aioresponses/pull/278
     substituteInPlace aioresponses/core.py \

From eea62504755a60a7bed09378d3175a19c5b9ffbf Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 17:45:35 +0200
Subject: [PATCH 651/831] python3Packages.sqlalchemy: 2.0.50 -> 2.0.51

https://github.com/sqlalchemy/sqlalchemy/releases/tag/rel_2_0_51
---
 pkgs/development/python-modules/sqlalchemy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sqlalchemy/default.nix b/pkgs/development/python-modules/sqlalchemy/default.nix
index 1e57fb444030..ea8d784e831f 100644
--- a/pkgs/development/python-modules/sqlalchemy/default.nix
+++ b/pkgs/development/python-modules/sqlalchemy/default.nix
@@ -43,14 +43,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sqlalchemy";
-  version = "2.0.50";
+  version = "2.0.51";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sqlalchemy";
     repo = "sqlalchemy";
     tag = "rel_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-pZgkQa+qXuXSSlBXba5qByXFqegaIB/XGgp7Q2Bsz9U=";
+    hash = "sha256-2t3NhfLiu/rLI2yvFPK9uQXGyzqNUj7ImDRx0EasdsI=";
   };
 
   postPatch = ''

From e858e80fb18c50f8cb8eaf750bbc2a2075207103 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 9 Jun 2026 10:05:48 +0200
Subject: [PATCH 652/831] wrapGAppsHook: only wrap $outBin by default

---
 doc/languages-frameworks/gnome.section.md     |  2 +-
 .../wrap-gapps-hook/wrap-gapps-hook.sh        | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/doc/languages-frameworks/gnome.section.md b/doc/languages-frameworks/gnome.section.md
index ecfda62b5700..7e9130218ca6 100644
--- a/doc/languages-frameworks/gnome.section.md
+++ b/doc/languages-frameworks/gnome.section.md
@@ -105,7 +105,7 @@ Given the requirements above, the package expression would become messy quickly:
 }
 ```
 
-Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables.
+Fortunately, we have a [family of hooks]{#ssec-gnome-hooks-wrapgappshook} that automate this. They work in conjunction with other setup hooks that populate environment variables, and will then wrap all executables in `bin` and `libexec` directories using said variables. If a package has multiple outputs, these hooks will work on `outputBin` by default, or on the outputs listed in `wrapGAppsInOutputs` if set.
 
 - [`wrapGAppsHook3`]{#ssec-gnome-hooks-wrapgappshook3} for GTK 3 apps. For convenience, it also adds `dconf.lib` for a GIO module implementing a GSettings backend using `dconf`, `gtk3` for GSettings schemas, and `librsvg` for GdkPixbuf loader to the closure.
 - [`wrapGAppsHook4`]{#ssec-gnome-hooks-wrapgappshook4} for GTK 4 apps. Same as `wrapGAppsHook3` but replaces `gtk3` with `gtk4`.
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index 92b7a5eee3e7..ef2c02dff02e 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -42,13 +42,32 @@ wrapGApp() {
     wrapProgram "$program" "${gappsWrapperArgs[@]}" "$@"
 }
 
+_wrapGAppsHookMayRunForOutput() {
+    local -r output="$1"
+    if [[ -v wrapGAppsInOutputs ]]; then
+        local allowedOutput
+        # Support both structuredAttrs on and off
+        local -a allowedOutputs
+        concatTo allowedOutputs wrapGAppsInOutputs
+        for allowedOutput in "${allowedOutputs[@]}"; do
+            [ "$allowedOutput" = "$output" ] && return 0
+        done
+    else
+        [ "$outputBin" = "$output" ] && return 0
+    fi
+    return 1
+ }
+
 declare -gA wrapGAppsHookHasRunForOutput
 
 # Note: $gappsWrapperArgs still gets defined even if ${dontWrapGApps-} is set.
+# $output is brought into scope via fixupPhase() in pkgs/stdenv/generic/setup.sh
 wrapGAppsHook() {
     # guard against running multiple times for the same output (e.g. due to propagation)
     [ "${wrapGAppsHookHasRunForOutput["$output"]:-}" = 1 ] && return 0
     wrapGAppsHookHasRunForOutput["$output"]=1
+    # guard against running for outputs we don't want to run it for
+    _wrapGAppsHookMayRunForOutput "$output" || return 0
 
     if [[ -z "${dontWrapGApps:-}" ]]; then
         local targetDirsThatExist targetDirsRealPath targetDirs targetDir

From 5767290bcd2e2c8d955006718324f26b8f688be5 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Tue, 9 Jun 2026 10:06:33 +0200
Subject: [PATCH 653/831] wrapGAppsHook: add tests for multiple outputs

---
 .../setup-hooks/wrap-gapps-hook/default.nix   | 189 +++++++++++++++++-
 1 file changed, 188 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
index 73c2782cfe07..7212578e7405 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/default.nix
@@ -76,7 +76,136 @@ makeSetupHook {
           ];
         };
 
-        # The wrapper for executable files should add path to dconf GIO module.
+        # Simple derivation containing a program and a daemon, but split over multiple outputs.
+        basic-multiple-outputs = stdenv.mkDerivation {
+          name = "basic-multiple-outputs";
+
+          src = sample-project;
+
+          outputs = [
+            "out"
+            "lib"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            # Wrapper will want to append this to XDG_DATA_DIRS, but should not cause a cyclic dependency;
+            # i.e. only "out" will be wrapped.
+            mkdir -p $out/share
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using a non-default output
+        # Executables in "bin" should be handled correctly automatically
+        basic-bin-output = stdenv.mkDerivation {
+          name = "basic-bin-output";
+
+          src = sample-project;
+
+          outputs = [
+            "bin"
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $bin
+            mv $out/bin $bin
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using a non-default output
+        basic-other-outputs = stdenv.mkDerivation {
+          name = "basic-other-outputs";
+
+          src = sample-project;
+
+          outputs = [
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          wrapGAppsInOutputs = [
+            "dev"
+            "lib"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $dev
+            mv $out/bin $dev
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using non-default outputs
+        # that are explicitly referenced via wrapGAppsInOutputs
+        basic-other-outputs-structuredattrs = stdenv.mkDerivation {
+          name = "basic-other-outputs-structuredAttrs";
+
+          __structuredAttrs = true;
+
+          src = sample-project;
+
+          outputs = [
+            "dev"
+            "lib"
+            "out"
+          ];
+
+          strictDeps = true;
+          nativeBuildInputs = [ wrapGAppsHook3 ];
+
+          installFlags = [
+            "bin-foo"
+            "libexec-bar"
+          ];
+
+          wrapGAppsInOutputs = [
+            "dev"
+            "lib"
+          ];
+
+          postInstall = ''
+            mkdir -p $lib
+            mv $out/libexec $lib
+            mkdir -p $dev
+            mv $out/bin $dev
+          '';
+        };
+
+        # Simple derivation containing a program and a daemon, but using non-default outputs
+        # that are explicitly referenced via wrapGAppsInOutputs, while structuredAttrs are enabled
+        # so that it is a proper array.
         basic-contains-dconf =
           let
             tested = basic;
@@ -92,6 +221,64 @@ makeSetupHook {
             ''
           );
 
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-multiple-outputs-contains-dconf =
+          let
+            tested = basic-multiple-outputs;
+          in
+          testLib.runTest "basic-multiple-outputs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-bin-output-contains-dconf =
+          let
+            tested = basic-bin-output;
+          in
+          testLib.runTest "basic-bin-output-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-other-outputs-contains-dconf =
+          let
+            tested = basic-other-outputs;
+          in
+          testLib.runTest "basic-other-outputs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.dev}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.lib}/libexec/bar" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
+        # The wrapper for executable files should add path to dconf GIO module.
+        basic-other-outputs-contains-dconf-structuredattrs =
+          let
+            tested = basic-other-outputs-structuredattrs;
+          in
+          testLib.runTest "basic-other-outputs-structuredattrs-contains-dconf" (
+            testLib.skip stdenv.hostPlatform.isDarwin ''
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.dev}/bin/foo" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+              ${expectSomeLineContainingYInFileXToMentionZ "${tested.lib}/libexec/bar" "GIO_EXTRA_MODULES"
+                "${dconf.lib}/lib/gio/modules"
+              }
+            ''
+          );
+
         basic-contains-gdk-pixbuf =
           let
             tested = basic;

From 2ba83f987baf09304b58ff81c5c9a377883b41a3 Mon Sep 17 00:00:00 2001
From: SandaruKasa <sandarukasa@ya.ru>
Date: Mon, 15 Jun 2026 04:31:56 +0300
Subject: [PATCH 654/831] libfaketime: structDeps -> strictDeps

typo in c9b84bea7611c54cf57768833a3b6a28775144e5
---
 pkgs/by-name/li/libfaketime/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libfaketime/package.nix b/pkgs/by-name/li/libfaketime/package.nix
index 36874a53f40c..9500cdb60097 100644
--- a/pkgs/by-name/li/libfaketime/package.nix
+++ b/pkgs/by-name/li/libfaketime/package.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   __structuredAttrs = true;
-  structDeps = true;
+  strictDeps = true;
   enableParallelBuilding = true;
 
   meta = {

From 6b2ed1f4cefa3e311d356ec3f99e1782986ebaab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 12 Jun 2026 12:57:40 -0700
Subject: [PATCH 655/831] python3Packages.idna: improve meta.changelog

---
 pkgs/development/python-modules/idna/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index 7278212bf772..dcd4408111e6 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/kjd/idna/";
-    changelog = "https://github.com/kjd/idna/releases/tag/${src.tag}";
+    changelog = "https://github.com/kjd/idna/blob/${src.tag}/HISTORY.md";
     description = "Internationalized Domain Names in Applications (IDNA)";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.dotlambda ];

From 54c816a0e5f59f0aae9931e2596e8721173aae1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 12 Jun 2026 13:02:29 -0700
Subject: [PATCH 656/831] python3Packages.idna: use finalAttrs

---
 pkgs/development/python-modules/idna/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/idna/default.nix b/pkgs/development/python-modules/idna/default.nix
index dcd4408111e6..a8bda9b6f28f 100644
--- a/pkgs/development/python-modules/idna/default.nix
+++ b/pkgs/development/python-modules/idna/default.nix
@@ -6,7 +6,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "idna";
   version = "3.18";
   pyproject = true;
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "kjd";
     repo = "idna";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-9nLy/9PNuLSQJsf4Jes0uN695+LGjz2LXlfiZxxvGV4=";
   };
 
@@ -26,9 +26,9 @@ buildPythonPackage rec {
 
   meta = {
     homepage = "https://github.com/kjd/idna/";
-    changelog = "https://github.com/kjd/idna/blob/${src.tag}/HISTORY.md";
+    changelog = "https://github.com/kjd/idna/blob/${finalAttrs.src.tag}/HISTORY.md";
     description = "Internationalized Domain Names in Applications (IDNA)";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.dotlambda ];
   };
-}
+})

From 3e7b87d61c644490bd228becfe8c700e913e3379 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 15 Jun 2026 18:06:03 +0200
Subject: [PATCH 657/831] cacert: 3.123 -> 3.125

---
 pkgs/by-name/ca/cacert/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index 8dd727f6ded3..df6b082a92bc 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.123";
+  version = "3.125";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-dxMO+RITdyhEVh+9OqMdQTslwqx/V2/qO8O7/375NIk=";
+    hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
   };
 
   unpackPhase = ''

From 1ed75d980adb9547b81e0e2d651eb2b2f1736ef8 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Mon, 15 Jun 2026 02:23:19 -0600
Subject: [PATCH 658/831] linux-pam: 1.7.1 -> 1.7.2

https://github.com/linux-pam/linux-pam/releases/tag/v1.7.2
Diff: https://github.com/linux-pam/linux-pam/compare/v1.7.1...v1.7.2
---
 pkgs/by-name/li/linux-pam/package.nix | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/linux-pam/package.nix b/pkgs/by-name/li/linux-pam/package.nix
index 5e1fdfd4a7ce..0da213b857c0 100644
--- a/pkgs/by-name/li/linux-pam/package.nix
+++ b/pkgs/by-name/li/linux-pam/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPackages,
   fetchFromGitHub,
+  fetchpatch,
   flex,
   db4,
   gettext,
@@ -33,18 +34,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linux-pam";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "linux-pam";
     repo = "linux-pam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kANcwxifQz2tYPSrSBSFiYNTm51Gr10L/zroCqm8ZHQ=";
-
+    hash = "sha256-V3XQqolinh+MqUefMDYJF9zP4fBJTHc7YKN+NEGjx1g=";
   };
 
   __structuredAttrs = true;
 
+  patches = [
+    (fetchpatch {
+      name = "secure-opendir-fix-error-handling.patch";
+      url = "https://github.com/linux-pam/linux-pam/commit/dd62bac17221911106de165607c6925ea54b18d1.patch?full_index=1";
+      hash = "sha256-ddgDYdVfdXfTaMFV1hO3RJX9w1NHmE7yi3PxsHOdpvY=";
+    })
+  ];
+
   # patching unix_chkpwd is required as the nix store entry does not have the necessary bits
   postPatch = ''
     substituteInPlace modules/module-meson.build \
@@ -104,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "nis" false)
     (lib.mesonBool "xtests" false)
     (lib.mesonBool "examples" false)
+    (lib.mesonOption "vendordir" "${placeholder "out"}/etc")
   ]
   # warning: slower execution due to debug makes VM tests fail!
   ++ lib.optional debugMode (lib.mesonBool "pam-debug" true);

From 1444d3fc386cb89bb716f06985984784bb521c45 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Thu, 4 Jun 2026 14:07:25 +0300
Subject: [PATCH 659/831] musescore: remove qt6.qtdeclarative patch

---
 pkgs/by-name/mu/musescore/package.nix | 37 +++++++--------------------
 1 file changed, 9 insertions(+), 28 deletions(-)

diff --git a/pkgs/by-name/mu/musescore/package.nix b/pkgs/by-name/mu/musescore/package.nix
index c974b2e79415..0fe03f6c388e 100644
--- a/pkgs/by-name/mu/musescore/package.nix
+++ b/pkgs/by-name/mu/musescore/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
 
   # nativeBuildInputs
   cmake,
@@ -35,24 +34,6 @@
   nixosTests,
 }:
 
-let
-  qt6' = qt6.overrideScope (
-    self: super: {
-      # Fix for: https://github.com/NixOS/nixpkgs/issues/526825
-      # reported upstream at: https://github.com/musescore/MuseScore/issues/33015
-      qtdeclarative = super.qtdeclarative.overrideAttrs (
-        new: old: {
-          patches = old.patches ++ [
-            (fetchpatch {
-              url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.patch";
-              hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
-            })
-          ];
-        }
-      );
-    }
-  );
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "musescore";
   version = "4.7.3";
@@ -114,8 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    qt6'.qttools
-    qt6'.wrapQtAppsHook
+    qt6.qttools
+    qt6.wrapQtAppsHook
     ninja
     pkg-config
   ]
@@ -128,12 +109,12 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     flac
     freetype
-    qt6'.qt5compat
-    qt6'.qtbase
-    qt6'.qtdeclarative
-    qt6'.qtnetworkauth
-    qt6'.qtscxml
-    qt6'.qtsvg
+    qt6.qt5compat
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtnetworkauth
+    qt6.qtscxml
+    qt6.qtsvg
     lame
     libjack2
     libogg
@@ -150,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
-    qt6'.qtwayland
+    qt6.qtwayland
   ];
 
   # Put the default, `$prefix/lib` directory to look for ffmpeg shared objects,

From ef9a5555f45dfa4a2094bd06a2457934298afd6c Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Tue, 16 Jun 2026 21:01:22 +0100
Subject: [PATCH 660/831] iproute2: 7.0.0 -> 7.1.0

Changes: https://lore.kernel.org/netdev/20260615160636.412a064e@phoenix.local/
---
 pkgs/by-name/ip/iproute2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 9417763e3177..842ffb89bb0d 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-5iiQ97XeY8BaO/Mx3I3rTAFcM2AT80Gk7fRpaXl/L04=";
+    hash = "sha256-/Z+huVgJQXFXyoPdcpV+MmG9vOiWNTy5NvgK8LM6S1w=";
   };
 
   postPatch = ''

From bd5e2f2e4de12ba768c6031e59a54f9929921422 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Mon, 8 Jun 2026 15:39:11 +0200
Subject: [PATCH 661/831] xemu: re-enable structuredAttrs

Depends on https://github.com/NixOS/nixpkgs/pull/526688

The GApps wrapper would try to wrap executables in "debug" instead of "out",
this should be fixed with that PR.
---
 pkgs/by-name/xe/xemu/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/xe/xemu/package.nix b/pkgs/by-name/xe/xemu/package.nix
index b69437e9c3de..b70955b2f10d 100644
--- a/pkgs/by-name/xe/xemu/package.nix
+++ b/pkgs/by-name/xe/xemu/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
       find subprojects -type d -name .git -prune -execdir rm -r {} +
     '';
   };
-  __structuredAttrs = false;
+  __structuredAttrs = true;
   nativeBuildInputs = [
     meson
     cmake

From 36559eb1b96510b7225d59ae0870be654058e2e5 Mon Sep 17 00:00:00 2001
From: Artemis Tosini <artemis.tosini@obsidian.systems>
Date: Fri, 12 Jun 2026 16:01:52 -0400
Subject: [PATCH 662/831] deterministic-uname: add setup hook

Several packages were adding deterministic-uname to `nativeBuildInputs`,
but that is insufficient for its use. Add a setup hook to make its use
more obvious
---
 pkgs/by-name/de/deterministic-uname/package.nix   | 3 +++
 pkgs/by-name/de/deterministic-uname/setup-hook.sh | 8 ++++++++
 2 files changed, 11 insertions(+)
 create mode 100644 pkgs/by-name/de/deterministic-uname/setup-hook.sh

diff --git a/pkgs/by-name/de/deterministic-uname/package.nix b/pkgs/by-name/de/deterministic-uname/package.nix
index 771803f6b9b5..f83c4ef9c0d5 100644
--- a/pkgs/by-name/de/deterministic-uname/package.nix
+++ b/pkgs/by-name/de/deterministic-uname/package.nix
@@ -46,6 +46,9 @@ replaceVarsWith {
     modDirVersion = if modDirVersion != "" then modDirVersion else "unknown";
   };
 
+  # coreutils uname is in initialPath, so ordinarily appears in PATH before packages in nativeBuildInputs.
+  setupHook = ./setup-hook.sh;
+
   meta = {
     description = "Print certain system information (hardcoded with lib/system values)";
     mainProgram = "uname";
diff --git a/pkgs/by-name/de/deterministic-uname/setup-hook.sh b/pkgs/by-name/de/deterministic-uname/setup-hook.sh
new file mode 100644
index 000000000000..c66623749a73
--- /dev/null
+++ b/pkgs/by-name/de/deterministic-uname/setup-hook.sh
@@ -0,0 +1,8 @@
+# PATH is overwritten after package setup hooks are run,
+# so the variable change needs to be delayed until a phase.
+# An entry in prePhases is the earliest possible, useful
+# in case an unpack or patch hook attempts to run uname.
+unamePreHook() {
+  export PATH="@out@/bin:$PATH"
+}
+appendToVar prePhases unamePreHook

From 5b23ab1417428a453e539b5c2135cec6488c16ac Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 17 Jun 2026 04:16:29 +0200
Subject: [PATCH 663/831] libaio: pull src from codeberg

https://lore.kernel.org/distributions/ajH6hjJ9X6PcLET3@thunder.hadrons.org/T/#u
---
 pkgs/by-name/li/libaio/package.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/li/libaio/package.nix b/pkgs/by-name/li/libaio/package.nix
index 35de54c0d9da..d803c65219e9 100644
--- a/pkgs/by-name/li/libaio/package.nix
+++ b/pkgs/by-name/li/libaio/package.nix
@@ -1,16 +1,18 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromCodeberg,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   version = "0.3.113";
   pname = "libaio";
 
-  src = fetchurl {
-    url = "https://pagure.io/libaio/archive/libaio-${finalAttrs.version}/libaio-libaio-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-cWxwWXAyRzROsGa1TsvDyiE08BAzBxkubCt9q1+VKKs=";
+  src = fetchFromCodeberg {
+    owner = "jmoyer";
+    repo = "libaio";
+    tag = "libaio-${finalAttrs.version}";
+    hash = "sha256-8TofYbwsnenv5GuC6FjkUt9rBTULEb5nhknuxr2ckQg=";
   };
 
   postPatch = ''
@@ -33,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Library for asynchronous I/O in Linux";
     homepage = "https://lse.sourceforge.net/io/aio.html";
+    downloadPage = "https://codeberg.org/jmoyer/libaio";
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;
     maintainers = [ ];

From 7049a93a44d73f6e3ac18feb3facd7f7bda29858 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Mon, 15 Jun 2026 21:53:39 +0200
Subject: [PATCH 664/831] gcc15: 15.2.0 -> 15.3.0

---
 .../gcc/patches/15/aarch64-sve-rtx.patch      | 87 -------------------
 .../compilers/gcc/patches/default.nix         |  3 -
 pkgs/development/compilers/gcc/versions.nix   |  4 +-
 3 files changed, 2 insertions(+), 92 deletions(-)
 delete mode 100644 pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch

diff --git a/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch b/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch
deleted file mode 100644
index 257c76d735da..000000000000
--- a/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-Without the change `libhwy-1.3.0` ICEs when built for aarch64-linux as:
-https://github.com/NixOS/nixpkgs/pull/320616#issuecomment-3764400891
-
-Upstream report: http://gcc.gnu.org/PR120718
-Upstream fix: https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00
-Fetched as:
-$ curl -L 'https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00' > aarch64-sve-rtx.patch
-
-From: Richard Sandiford <richard.sandiford@arm.com>
-Date: Thu, 14 Aug 2025 16:56:50 +0000 (+0100)
-Subject: Remove MODE_COMPOSITE_P test from simplify_gen_subreg [PR120718]
-X-Git-Url: https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00
-
-Remove MODE_COMPOSITE_P test from simplify_gen_subreg [PR120718]
-
-simplify_gen_subreg rejected subregs of literal constants if
-MODE_COMPOSITE_P.  This was added by the fix for PR96648 in
-g:c0f772894b6b3cd8ed5c5dd09d0c7917f51cf70f.  Jakub said:
-
-  As for the simplify_gen_subreg change, I think it would be desirable
-  to just avoid creating SUBREGs of constants on all targets and for all
-  constants, if simplify_immed_subreg simplified, fine, otherwise punt,
-  but as we are late in GCC11 development, the patch instead guards this
-  behavior on MODE_COMPOSITE_P (outermode) - i.e. only conversions to
-  powerpc{,64,64le} double double long double - and only for the cases where
-  simplify_immed_subreg was called.
-
-I'm not sure about relaxing the codes further, since subregs might
-be wanted for CONST, SYMBOL_REF and LABEL_REF.  But removing the
-MODE_COMPOSITE_P is needed to fix PR120718, where we get an ICE
-from generating a subreg of a V2SI const_vector.
-
-Unlike the trunk version, this backport does not remove the
-VOIDmode test; see PR121501.
-
-gcc/
-	PR rtl-optimization/120718
-	* simplify-rtx.cc (simplify_context::simplify_gen_subreg):
-	Remove MODE_COMPOSITE_P condition.
-
-gcc/testsuite/
-	PR rtl-optimization/120718
-	* gcc.target/aarch64/sve/acle/general/pr120718.c: New test.
----
-
-diff --git a/gcc/simplify-rtx.cc b/gcc/simplify-rtx.cc
-index 88d31a71c05a..8d4cbf1371a3 100644
---- a/gcc/simplify-rtx.cc
-+++ b/gcc/simplify-rtx.cc
-@@ -8317,14 +8317,11 @@ simplify_context::simplify_gen_subreg (machine_mode outermode, rtx op,
- 
-   if (GET_CODE (op) == SUBREG
-       || GET_CODE (op) == CONCAT
--      || GET_MODE (op) == VOIDmode)
--    return NULL_RTX;
--
--  if (MODE_COMPOSITE_P (outermode)
--      && (CONST_SCALAR_INT_P (op)
--	  || CONST_DOUBLE_AS_FLOAT_P (op)
--	  || CONST_FIXED_P (op)
--	  || GET_CODE (op) == CONST_VECTOR))
-+      || GET_MODE (op) == VOIDmode
-+      || CONST_SCALAR_INT_P (op)
-+      || CONST_DOUBLE_AS_FLOAT_P (op)
-+      || CONST_FIXED_P (op)
-+      || GET_CODE (op) == CONST_VECTOR)
-     return NULL_RTX;
- 
-   if (validate_subreg (outermode, innermode, op, byte))
-diff --git a/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c b/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c
-new file mode 100644
-index 000000000000..9ca0938e36bf
---- /dev/null
-+++ b/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c
-@@ -0,0 +1,12 @@
-+/* { dg-options "-O2" } */
-+
-+#include <arm_sve.h>
-+typedef int __attribute__((vector_size(8))) v2si;
-+typedef struct { int x; int y; } A;
-+void bar(A a);
-+void foo()
-+{
-+    A a;
-+    *(v2si *)&a = (v2si){0, (int)svcntd_pat(SV_ALL)};
-+    bar(a);
-+}
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index cc0b5b47e9b4..06981780da3f 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -112,9 +112,6 @@ optionals noSysDirs (
 # c++tools: Don't check --enable-default-pie.
 # --enable-default-pie breaks bootstrap gcc otherwise, because libiberty.a is not found
 ++ optional (is14 || is15) ./c++tools-dont-check-enable-default-pie.patch
-# http://gcc.gnu.org/PR120718 backport (will be inclkuded in 15.3.0) to
-# fix `highway-1.3.0` ICE on aarch64-linux.
-++ optional is15 ./15/aarch64-sve-rtx.patch
 
 ## 2. Patches relevant on specific platforms ####################################
 
diff --git a/pkgs/development/compilers/gcc/versions.nix b/pkgs/development/compilers/gcc/versions.nix
index ca6b2c91033d..6e49faf18628 100644
--- a/pkgs/development/compilers/gcc/versions.nix
+++ b/pkgs/development/compilers/gcc/versions.nix
@@ -1,7 +1,7 @@
 let
   majorMinorToVersionMap = {
     "16" = "16.1.0";
-    "15" = "15.2.0";
+    "15" = "15.3.0";
     "14" = "14.3.0";
     "13" = "13.4.0";
   };
@@ -15,7 +15,7 @@ let
       # 3 digits: releases (14.2.0)
       # 4 digits: snapshots (14.2.1.20250322)
       "16.1.0" = "sha256-UO+02Uwzl6/zsNYaWr10i03THZ0/Kre+BbFx02pRD3k=";
-      "15.2.0" = "sha256-Q4/ZloJrDIJIWinaA6ctcdbjVBqD7HAt9Ccfb+Al0k4=";
+      "15.3.0" = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
       "14.3.0" = "sha256-4Nx3KXYlYxrI5Q+pL//v6Jmk63AlktpcMu8E4ik6yjo=";
       "13.4.0" = "sha256-nEzm27BAVo/cVFWIrAPFy8lajb8MeqSQFwhDr7WcqPU=";
     }

From a237f34fe760618b117993a49018e4199ae66880 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Wed, 17 Jun 2026 08:23:59 +0200
Subject: [PATCH 665/831] gcc: fix download issue for new release

---
 pkgs/build-support/fetchurl/mirrors.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index f9f5b25557d2..759550a27b4c 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -54,6 +54,8 @@
 
   # GCC
   gcc = [
+    "https://gcc.gnu.org/pub/gcc/"
+    "https://sourceware.org/pub/gcc/"
     "https://mirror.koddos.net/gcc/"
     "https://bigsearcher.com/mirrors/gcc/"
     "ftp://ftp.nluug.nl/mirror/languages/gcc/"

From cf51da6e32eb92b61d5caea177c1325de9a1a99f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 17 Jun 2026 08:02:25 -0700
Subject: [PATCH 666/831] libxkbfile: 1.1.3 -> 1.2.0

---
 pkgs/by-name/li/libxkbfile/package.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libxkbfile/package.nix b/pkgs/by-name/li/libxkbfile/package.nix
index 93cd9028b379..4dd6270b4793 100644
--- a/pkgs/by-name/li/libxkbfile/package.nix
+++ b/pkgs/by-name/li/libxkbfile/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchurl,
+  meson,
+  ninja,
   pkg-config,
   xorgproto,
   libx11,
@@ -10,7 +12,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxkbfile";
-  version = "1.1.3";
+  version = "1.2.0";
 
   outputs = [
     "out"
@@ -19,12 +21,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libxkbfile-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qbY+6pl6u57mqLT7tRWDHIQfRxr4RaCd5EOygAOHS+w=";
+    hash = "sha256-f3GITl+vVvsOgj84SFmc+bWpr85RyQmCuutk9jUjPr8=";
   };
 
   strictDeps = true;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
 
   buildInputs = [
     xorgproto

From 9c39764facdce1cf61dac6d73bbcb09e45a48afa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 17 Jun 2026 07:59:37 -0700
Subject: [PATCH 667/831] libxkbcommon: 1.13.1 -> 1.13.2

Diff: https://github.com/xkbcommon/libxkbcommon/compare/xkbcommon-1.13.1...xkbcommon-1.13.2

Changelog: https://github.com/xkbcommon/libxkbcommon/blob/xkbcommon-1.13.2/NEWS.md
---
 .../li/libxkbcommon_8/disable-x11com.patch    | 23 -------------------
 pkgs/by-name/li/libxkbcommon_8/package.nix    | 17 +++++++-------
 2 files changed, 9 insertions(+), 31 deletions(-)
 delete mode 100644 pkgs/by-name/li/libxkbcommon_8/disable-x11com.patch

diff --git a/pkgs/by-name/li/libxkbcommon_8/disable-x11com.patch b/pkgs/by-name/li/libxkbcommon_8/disable-x11com.patch
deleted file mode 100644
index c0a8b7ac43af..000000000000
--- a/pkgs/by-name/li/libxkbcommon_8/disable-x11com.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-On nixpkgs /tmp/.X11-unix is not compatible with Xvfb requirement and the
-test fails.
---- a/meson.build
-+++ b/meson.build
-@@ -1229,18 +1229,6 @@ if get_option('enable-x11')
-         env: test_env,
-         is_parallel : false,
-     )
--    test(
--        'x11comp',
--        executable(
--            'test-x11comp',
--            'test/x11comp.c',
--            'test/utils-text.c',
--            'test/utils-text.h',
--            dependencies: x11_xvfb_test_dep
--        ),
--        env: test_env,
--        is_parallel : false,
--    )
- endif
- if get_option('enable-xkbregistry')
-     test(
diff --git a/pkgs/by-name/li/libxkbcommon_8/package.nix b/pkgs/by-name/li/libxkbcommon_8/package.nix
index caed48e59c02..7c96341eb86c 100644
--- a/pkgs/by-name/li/libxkbcommon_8/package.nix
+++ b/pkgs/by-name/li/libxkbcommon_8/package.nix
@@ -11,6 +11,8 @@
   libxcb,
   libxml2,
   python3,
+  setxkbmap,
+  xkbcomp,
   libx11,
   # To enable the "interactive-wayland" subcommand of xkbcli. This is the
   # wayland equivalent of `xev` on X11.
@@ -24,20 +26,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxkbcommon";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "xkbcommon";
     repo = "libxkbcommon";
     tag = "xkbcommon-${finalAttrs.version}";
-    hash = "sha256-wUsxsM0xXTg7nbvFMXrrnHherOepj0YI77eferjRgJA=";
+    hash = "sha256-JdS4+HPHDUUOUq5TUX2F5DicHif8wD3cPvMocWhD4S4=";
   };
 
-  patches = [
-    # Disable one Xvfb test as it fails for permission checks.
-    ./disable-x11com.patch
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -64,7 +61,11 @@ stdenv.mkDerivation (finalAttrs: {
     wayland
     wayland-protocols
   ];
-  nativeCheckInputs = [ python3 ];
+  nativeCheckInputs = [
+    python3
+    setxkbmap
+    xkbcomp
+  ];
 
   mesonFlags = [
     "-Dxkb-config-root=${xkeyboard_config}/etc/X11/xkb"

From 3103c5d052abbda54914f9ecd9b55e9d75daebfe Mon Sep 17 00:00:00 2001
From: Nathan Gill <n@ngill.net>
Date: Mon, 15 Jun 2026 22:36:11 +0100
Subject: [PATCH 668/831] cdparanoia-iii: add maintainer `olduser101`

---
 pkgs/by-name/cd/cdparanoia-iii/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/cd/cdparanoia-iii/package.nix b/pkgs/by-name/cd/cdparanoia-iii/package.nix
index 39d5bfb97b32..644e2450431f 100644
--- a/pkgs/by-name/cd/cdparanoia-iii/package.nix
+++ b/pkgs/by-name/cd/cdparanoia-iii/package.nix
@@ -171,6 +171,9 @@ stdenv.mkDerivation (finalAttrs: {
       gpl2Plus
       lgpl21Plus
     ];
+    maintainers = with lib.maintainers; [
+      olduser101
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "cdparanoia";
   };

From 50e805c3dff2bf2ec625179a9e7ebf7f2cd17547 Mon Sep 17 00:00:00 2001
From: Nathan Gill <n@ngill.net>
Date: Mon, 15 Jun 2026 22:39:32 +0100
Subject: [PATCH 669/831] cdparanoia-iii: fix build on darwin

freebsd patches conflict with those applied for darwin, so
disable the freebsd patches on darwin targets.
---
 pkgs/by-name/cd/cdparanoia-iii/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cd/cdparanoia-iii/package.nix b/pkgs/by-name/cd/cdparanoia-iii/package.nix
index 644e2450431f..813adc115078 100644
--- a/pkgs/by-name/cd/cdparanoia-iii/package.nix
+++ b/pkgs/by-name/cd/cdparanoia-iii/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
       })
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
-    ++ [
+    ++ lib.optional (!stdenv.hostPlatform.isDarwin) [
       (fetchpatch {
         url = "https://raw.githubusercontent.com/freebsd/freebsd-ports/42da4cdf2d9161fea8f7cdfc19aefda7707fadf4/audio/cdparanoia/files/patch-interface_low__interface.h";
         hash = "sha256-bXrcRFCbU7/7/N+J8VGKGSxIB1m8XwoAlc/KTnt9wN0=";

From a960983be330dfaff54f72c4fd50b1b47eafbcec Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 17 Jun 2026 12:47:07 -0700
Subject: [PATCH 670/831] gccNGPackages_15: 15.2.0 -> 15.3.0

Assisted-by: Claude Code (claude-opus-4-8)
---
 pkgs/development/compilers/gcc/ng/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gcc/ng/default.nix b/pkgs/development/compilers/gcc/ng/default.nix
index c849367aa1fc..4eb9ca23b9b5 100644
--- a/pkgs/development/compilers/gcc/ng/default.nix
+++ b/pkgs/development/compilers/gcc/ng/default.nix
@@ -14,7 +14,7 @@
 }@packageSetArgs:
 let
   versions = {
-    "15.2.0".officialRelease.sha256 = "sha256-Q4/ZloJrDIJIWinaA6ctcdbjVBqD7HAt9Ccfb+Al0k4=";
+    "15.3.0".officialRelease.sha256 = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
   }
   // gccVersions;
 

From 3d7e51d3f6291dd409a474661ca56025f68ed2f2 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 17 Jun 2026 21:51:16 +0100
Subject: [PATCH 671/831] lttng-ust: 2.15.0 -> 2.15.1

Changes: https://lore.kernel.org/lkml/e5fe9c15-f9b0-4d00-8fa7-3562759b4ca6@efficios.com/
---
 pkgs/by-name/lt/lttng-ust/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lt/lttng-ust/package.nix b/pkgs/by-name/lt/lttng-ust/package.nix
index 164510c209ce..9749f6c938e1 100644
--- a/pkgs/by-name/lt/lttng-ust/package.nix
+++ b/pkgs/by-name/lt/lttng-ust/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lttng-ust";
-  version = "2.15.0";
+  version = "2.15.1";
 
   src = fetchFromGitHub {
     owner = "lttng";
     repo = "lttng-ust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LOZo/sVb9eG39Gg1PBs2FoLHTeOD5us9wW4kUwNo8o0=";
+    hash = "sha256-AWo205IPGKpEyz5RlscHfdfCTV0zOWPHOGk4ImAJbcQ=";
   };
 
   outputs = [

From 70d5331f424b8ac532d312099c9a9246a63455b9 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 18 Jun 2026 06:42:50 +0200
Subject: [PATCH 672/831] nodejs_24: 24.16.0 -> 24.17.0

---
 pkgs/development/web/nodejs/v24.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 914ab1479370..ae766cfeb5db 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "24.16.0";
-  sha256 = "2ff84a6de70b6165290111b0fc656ded1ad207a799816fe720cc7c31232df30f";
+  version = "24.17.0";
+  sha256 = "a7ab562ed2369a29c68b72fa00e3103bcdfe37063dff799c6acc8e404e275fcd";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -56,13 +56,6 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
-
-      # Patch for nghttp2 1.69 support
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/4a32c00fb8dbe55c3bcf9ef43343968c9fe449e6.diff?full_index=1";
-        hash = "sha256-pex8ruwa4b/vWvfGA+nyN3JJP8NOturmwAQe4Rkd6nU=";
-        excludes = [ "tools/nix/*" ];
-      })
     ]
     ++ gypPatches
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [

From c1ea0a5d4706b8e2090bf2776ab07d0bdf822f59 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Thu, 18 Jun 2026 01:51:45 -0700
Subject: [PATCH 673/831] util-linux: 2.42.1 -> 2.42.2

https://www.kernel.org/pub/linux/utils/util-linux/v2.42/v2.42.2-ReleaseNotes

Fix some CVEs in mount(8) and a UAF in libblkid.
---
 pkgs/by-name/ut/util-linux/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index 3c26f7b0d780..f11d004bb0cf 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -43,11 +43,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "util-linux" + lib.optionalString isMinimal "-minimal";
-  version = "2.42.1";
+  version = "2.42.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor finalAttrs.version}/util-linux-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gukVjrEqmwtWnYThaH/tndGP6JzNjvWsNCchinwNf38=";
+    hash = "sha256-A6BdOt+WAu8Sjy2gW4SzIFzmDDUeVzfANw90AAZ5zoo=";
   };
 
   # Note: fetchpatch/fetchpatch2 cause infinite recursion with util-linuxMinimal.

From a0728be44a8b34886b0708c6713f37f787927137 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Thu, 18 Jun 2026 15:08:28 +0200
Subject: [PATCH 674/831] llhttp: 9.4.1 -> 9.4.2

---
 pkgs/by-name/ll/llhttp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ll/llhttp/package.nix b/pkgs/by-name/ll/llhttp/package.nix
index 6f9115c07dc4..4487a4518360 100644
--- a/pkgs/by-name/ll/llhttp/package.nix
+++ b/pkgs/by-name/ll/llhttp/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "llhttp";
-  version = "9.4.1";
+  version = "9.4.2";
 
   src = fetchFromGitHub {
     owner = "nodejs";
     repo = "llhttp";
     tag = "release/v${finalAttrs.version}";
-    hash = "sha256-eQoOsJ3lIIGSIfC4atkbUqCAYzCzs5kzTihYaI4jqz0=";
+    hash = "sha256-LS8HS8CnXJ3X8WlIvtxBLc0h1wLL/HmTqZWHlvBjTEo=";
   };
 
   outputs = [

From 054629adb9e8f2dc44865b8cb1f1cafbdc4b2ae6 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Thu, 18 Jun 2026 16:15:41 +0300
Subject: [PATCH 675/831] pipewire: 1.6.6 -> 1.6.7

Diff: https://gitlab.freedesktop.org/pipewire/pipewire/-/compare/1.6.6...1.6.7

Changelog: https://gitlab.freedesktop.org/pipewire/pipewire/-/releases/1.6.7
---
 pkgs/by-name/pi/pipewire/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index cd01b173b031..c2ec4a841043 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -88,7 +88,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pipewire";
-  version = "1.6.6";
+  version = "1.6.7";
 
   outputs = [
     "out"
@@ -104,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     tag = finalAttrs.version;
-    hash = "sha256-pyZozhJomFT4QkJv/NKkXpbknmVxjv8hCxZV6RcIHmE=";
+    hash = "sha256-DSW9ho+NLikW/stlxvHLhRguMZy/4b7VEcC938ObJmQ=";
   };
 
   patches = [

From 335cd65a8a96d2e8b41b6651de91ec26f6144513 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 18 Jun 2026 09:46:30 -0700
Subject: [PATCH 676/831] lilv: add meta.changelog

---
 pkgs/by-name/li/lilv/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/lilv/package.nix b/pkgs/by-name/li/lilv/package.nix
index ebdff4c26be8..c09fa4a379b8 100644
--- a/pkgs/by-name/li/lilv/package.nix
+++ b/pkgs/by-name/li/lilv/package.nix
@@ -76,6 +76,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "http://drobilla.net/software/lilv";
+    changelog = "https://gitlab.com/lv2/lilv/-/blob/v${version}/NEWS";
     description = "C library to make the use of LV2 plugins";
     license = lib.licenses.mit;
     maintainers = [ ];

From d3215831d267b1ad78132be43294e591a80916e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 18 Jun 2026 14:38:56 -0700
Subject: [PATCH 677/831] python3Packages.clang: rename from libclang

The project name (e.g. on PyPI) is clang. The project called libclang
can be found at https://github.com/sighingnow/libclang instead.
---
 pkgs/by-name/ed/edgetx/package.nix                   |  2 +-
 pkgs/by-name/mu/mupdf/package.nix                    |  2 +-
 .../python-modules/{libclang => clang}/default.nix   |  2 +-
 pkgs/development/python-modules/hawkmoth/default.nix |  8 ++++----
 pkgs/development/python-modules/pymupdf/default.nix  |  4 ++--
 .../python-modules/pywebtransport/default.nix        |  5 ++---
 pkgs/development/python-modules/tensorflow/bin.nix   |  4 ++--
 pkgs/top-level/python-aliases.nix                    |  1 +
 pkgs/top-level/python-packages.nix                   | 12 ++++++++----
 9 files changed, 22 insertions(+), 18 deletions(-)
 rename pkgs/development/python-modules/{libclang => clang}/default.nix (98%)

diff --git a/pkgs/by-name/ed/edgetx/package.nix b/pkgs/by-name/ed/edgetx/package.nix
index 5205b6d8a56c..4d38926996d1 100644
--- a/pkgs/by-name/ed/edgetx/package.nix
+++ b/pkgs/by-name/ed/edgetx/package.nix
@@ -34,7 +34,7 @@ let
       pillow
       lz4
       jinja2
-      libclang
+      clang
     ]
   );
 
diff --git a/pkgs/by-name/mu/mupdf/package.nix b/pkgs/by-name/mu/mupdf/package.nix
index 341a839549ca..b2a097ef2b8f 100644
--- a/pkgs/by-name/mu/mupdf/package.nix
+++ b/pkgs/by-name/mu/mupdf/package.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
   ++ lib.optionals (enableCxx || enablePython) [
     (python3.pythonOnBuildForHost.withPackages (ps: [
       ps.setuptools
-      ps.libclang
+      ps.clang
     ]))
   ]
   ++ lib.optionals enablePython [
diff --git a/pkgs/development/python-modules/libclang/default.nix b/pkgs/development/python-modules/clang/default.nix
similarity index 98%
rename from pkgs/development/python-modules/libclang/default.nix
rename to pkgs/development/python-modules/clang/default.nix
index 4657515963e7..1f6e2103034f 100644
--- a/pkgs/development/python-modules/libclang/default.nix
+++ b/pkgs/development/python-modules/clang/default.nix
@@ -25,7 +25,7 @@ let
   '';
 in
 buildPythonPackage {
-  pname = "libclang";
+  pname = "clang";
   pyproject = true;
 
   inherit (libclang) version src;
diff --git a/pkgs/development/python-modules/hawkmoth/default.nix b/pkgs/development/python-modules/hawkmoth/default.nix
index aedd7da24c45..782d88abbf56 100644
--- a/pkgs/development/python-modules/hawkmoth/default.nix
+++ b/pkgs/development/python-modules/hawkmoth/default.nix
@@ -3,9 +3,9 @@
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
-  libclang,
-  sphinx,
   clang,
+  sphinx,
+  llvmPackages,
   pytestCheckHook,
   strictyaml,
 }:
@@ -25,13 +25,13 @@ buildPythonPackage rec {
   build-system = [ hatchling ];
 
   dependencies = [
-    libclang
+    clang
     sphinx
   ];
   propagatedBuildInputs = [ clang ];
 
   nativeCheckInputs = [
-    clang
+    llvmPackages.clang
     pytestCheckHook
     strictyaml
   ];
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index a087c6442d91..a879125bd8e7 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -7,7 +7,7 @@
   toPythonModule,
 
   # build-system
-  libclang,
+  clang,
   pipcl,
   psutil,
   setuptools,
@@ -75,7 +75,7 @@ buildPythonPackage (finalAttrs: {
   '';
 
   build-system = [
-    libclang
+    clang
     pipcl
     swig
     setuptools
diff --git a/pkgs/development/python-modules/pywebtransport/default.nix b/pkgs/development/python-modules/pywebtransport/default.nix
index c8116561b720..d1e93433fe5e 100644
--- a/pkgs/development/python-modules/pywebtransport/default.nix
+++ b/pkgs/development/python-modules/pywebtransport/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   clang,
   fetchFromGitHub,
-  libclang,
   llvmPackages,
   msgpack,
   pkg-config,
@@ -42,13 +41,13 @@ buildPythonPackage (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    clang
+    llvmPackages.clang
     llvmPackages.libclang.lib
     pkg-config
   ];
 
   env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
-  env.LD_LIBRARY_PATH = "${llvmPackages.libclang.lib}/lib:${lib.getLib libclang}/lib";
+  env.LD_LIBRARY_PATH = "${llvmPackages.libclang.lib}/lib:${lib.getLib clang}/lib";
 
   prePatch = ''
     # maturin can't find the file
diff --git a/pkgs/development/python-modules/tensorflow/bin.nix b/pkgs/development/python-modules/tensorflow/bin.nix
index da07cc04b6ad..4edddcbf0d99 100644
--- a/pkgs/development/python-modules/tensorflow/bin.nix
+++ b/pkgs/development/python-modules/tensorflow/bin.nix
@@ -19,7 +19,7 @@
   google-pasta,
   grpcio,
   h5py,
-  libclang,
+  clang,
   numpy,
   opt-einsum,
   packaging,
@@ -95,7 +95,7 @@ buildPythonPackage (finalAttrs: {
     google-pasta
     grpcio
     h5py
-    libclang
+    clang
     ml-dtypes
     numpy
     opt-einsum
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 39c48cbcf876..c51cd3bf8929 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -321,6 +321,7 @@ mapAliases {
   ledger-agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   ledger_agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
   libarcus = throw "'libarcus' has been removed, as it was unmaintained in nixpkgs"; # Added 2026-05-22
+  libclang = clang; # added 2026-06-18
   libgpiod = gpiod; # added 2026-03-30
   libpyfoscam = throw "libpyfoscam was removed because Home Assistant switched to libpyfoscamcgi"; # added 2025-07-03
   line_profiler = throw "'line_profiler' has been renamed to/replaced by 'line-profiler'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b46df1489f11..539f123d5921 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2793,7 +2793,11 @@ self: super: with self; {
 
   ckcc-protocol = callPackage ../development/python-modules/ckcc-protocol { };
 
-  ckzg = callPackage ../development/python-modules/ckzg { };
+  ckzg = callPackage ../development/python-modules/ckzg {
+    inherit (pkgs) clang;
+  };
+
+  clang = callPackage ../development/python-modules/clang { };
 
   clarabel = callPackage ../development/python-modules/clarabel { };
 
@@ -8828,8 +8832,6 @@ self: super: with self; {
 
   libbs = callPackage ../development/python-modules/libbs { };
 
-  libclang = callPackage ../development/python-modules/libclang { };
-
   libcloud = callPackage ../development/python-modules/libcloud { };
 
   libcomps = lib.pipe pkgs.libcomps [
@@ -14786,7 +14788,9 @@ self: super: with self; {
     callPackage ../development/python-modules/pyobjc-framework-libdispatch
       { };
 
-  pyobjus = callPackage ../development/python-modules/pyobjus { };
+  pyobjus = callPackage ../development/python-modules/pyobjus {
+    inherit (pkgs) clang;
+  };
 
   pyocd = callPackage ../development/python-modules/pyocd { };
 

From 90160343a11674115ca07e06e35adb8dfea863ba Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 19 Jun 2026 06:14:57 +0100
Subject: [PATCH 678/831] fluidsynth: 2.5.4 -> 2.5.5

Changes: https://github.com/FluidSynth/fluidsynth/releases/tag/v2.5.5
---
 pkgs/by-name/fl/fluidsynth/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/fluidsynth/package.nix b/pkgs/by-name/fl/fluidsynth/package.nix
index 3bb34d87c60d..d292b8ac7a60 100644
--- a/pkgs/by-name/fl/fluidsynth/package.nix
+++ b/pkgs/by-name/fl/fluidsynth/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.4";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uL9K2Bc5PA6qm/QVFvEUDyGBst9L/sNP0+HculCWCZk=";
+    hash = "sha256-WEzOYHtPIUkPZu3v4dWcCh3dOJUyG1xRxDuoSXqiGbk=";
     fetchSubmodules = true;
   };
 

From b73c4eaf76f8461f8c12dcbfcfa8039852dafaa2 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Fri, 19 Jun 2026 14:06:46 +0200
Subject: [PATCH 679/831] iproute2: stop substitutung pname

---
 pkgs/by-name/ip/iproute2/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 842ffb89bb0d..2ad8fa7c8a26 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   version = "7.1.0";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
+    url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${version}.tar.xz";
     hash = "sha256-/Z+huVgJQXFXyoPdcpV+MmG9vOiWNTy5NvgK8LM6S1w=";
   };
 

From 821cc48c4f849313896a1d310c0e69a99474ea83 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 19 Jun 2026 16:58:34 +0200
Subject: [PATCH 680/831] jsoncpp: 1.9.7 -> 1.9.8

changelog: https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.8

diff: https://github.com/open-source-parsers/jsoncpp/compare/1.9.7...1.9.8
---
 pkgs/by-name/js/jsoncpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/js/jsoncpp/package.nix b/pkgs/by-name/js/jsoncpp/package.nix
index dc3d94b78260..b5f4373d5bd1 100644
--- a/pkgs/by-name/js/jsoncpp/package.nix
+++ b/pkgs/by-name/js/jsoncpp/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jsoncpp";
-  version = "1.9.7";
+  version = "1.9.8";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "open-source-parsers";
     repo = "jsoncpp";
     rev = finalAttrs.version;
-    sha256 = "sha256-rf8d2UNTVEZhuiyChK2XnUbfGDvsfXnKADhaSp8qBwQ=";
+    sha256 = "sha256-5cH9G4/TVCM5HX6QSk3P4m5+cwuK4x8hP9FohBcmjik=";
   };
 
   /*

From dd01bdc65ee19e5527de0031ac1ec5a152cac837 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 19 Jun 2026 18:56:20 +0200
Subject: [PATCH 681/831] appstream: 1.1.2 -> 1.1.3

---
 pkgs/development/libraries/appstream/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/appstream/default.nix b/pkgs/development/libraries/appstream/default.nix
index 61e1d7792264..095a87c4d853 100644
--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@@ -12,8 +12,9 @@
   cmake,
   gettext,
   xmlto,
-  docbook-xsl-nons,
+  docbook-xsl-ns,
   docbook_xml_dtd_45,
+  libblake3,
   libxslt,
   libstemmer,
   glib,
@@ -42,7 +43,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "appstream";
-  version = "1.1.2";
+  version = "1.1.3";
 
   outputs = [
     "out"
@@ -54,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ximion";
     repo = "appstream";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-tvdWWdL6PthffAZZnNZ3+17/eJdZFx8xFkqm7IvyPWE=";
+    hash = "sha256-z9HmTYOjglki+ID7GPMf3jGLOAkxLqJd4+GsIR3W3u4=";
   };
 
   patches = [
@@ -81,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
     libxslt
     xmlto
-    docbook-xsl-nons
+    docbook-xsl-ns
     docbook_xml_dtd_45
     glib
     itstool
@@ -99,6 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    libblake3
     libstemmer
     glib
     xapian

From 133740a5aa533ea09b916c9981410d2de8896c53 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 17 Jun 2026 12:59:05 +0200
Subject: [PATCH 682/831] libnice: fix build for musl

Backported the FreeBSD fix as well to get the musl one to apply
cleanly.  Dependencies don't all build for FreeBSD but it wasn't hard
to get that to work so I have fixes in the pipeline.

Fixes: 40092a228d3a ("libnice: 0.1.22 -> 0.1.23")
---
 pkgs/by-name/li/libnice/musl.patch  | 178 ++++++++++++++++++++++++++++
 pkgs/by-name/li/libnice/package.nix |  10 ++
 2 files changed, 188 insertions(+)
 create mode 100644 pkgs/by-name/li/libnice/musl.patch

diff --git a/pkgs/by-name/li/libnice/musl.patch b/pkgs/by-name/li/libnice/musl.patch
new file mode 100644
index 000000000000..bf5c2a890bbd
--- /dev/null
+++ b/pkgs/by-name/li/libnice/musl.patch
@@ -0,0 +1,178 @@
+From a7310137cf09e382e2642e39d4ade88942d564c3 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Fri, 19 Jun 2026 17:21:47 +0200
+Subject: [PATCH 1/3] tests: treat Glibc-style sendmmsg as default case
+
+As requested.
+
+Link: https://gitlab.freedesktop.org/libnice/libnice/-/merge_requests/353#note_3526962
+Signed-off-by: Alyssa Ross <hi@alyssa.is>
+---
+ tests/instrument-send.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/tests/instrument-send.c b/tests/instrument-send.c
+index 3f79de87..65576dea 100644
+--- a/tests/instrument-send.c
++++ b/tests/instrument-send.c
+@@ -190,23 +190,23 @@ sendmsg (int sockfd, const struct msghdr *msg, int flags)
+   }
+ }
+ 
+-#ifndef __FreeBSD__
+-int
+-sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+-#else
++#ifdef __FreeBSD__
+ ssize_t
+ sendmmsg (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)
++#else
++int
++sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+ #endif
+ {
+   if (should_inject_ewouldblock ()) {
+     errno = EWOULDBLOCK;
+     return -1;
+   } else {
+-#ifndef __FreeBSD__
+-    int ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)) (
++#ifdef __FreeBSD__
++    ssize_t ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+ #else
+-    ssize_t ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)) (
++    int ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+ #endif
+     if (ret != -1) {
+-- 
+GitLab
+
+
+From 145c542b442f4deb89e1cc8bb92e1ca02456f918 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Mon, 15 Jun 2026 17:54:12 +0200
+Subject: [PATCH 2/3] tests: check sendmmsg prototype in Meson
+
+Checking the actual prototype we have rather than using hardcoded libc
+checks improves portability by being compatible with libcs that aren't
+explictly handled, but use the same prototype as a known libc.  For
+example, uClibc-ng uses the same prototype as FreeBSD, but wouldn't
+have been caught be the __FreeBSD__ check.
+---
+ tests/instrument-send.c |  4 ++--
+ tests/meson.build       | 18 +++++++++++++++++-
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/tests/instrument-send.c b/tests/instrument-send.c
+index 65576dea..9903619a 100644
+--- a/tests/instrument-send.c
++++ b/tests/instrument-send.c
+@@ -190,7 +190,7 @@ sendmsg (int sockfd, const struct msghdr *msg, int flags)
+   }
+ }
+ 
+-#ifdef __FreeBSD__
++#if defined(HAVE_FREEBSD_STYLE_SENDMMSG)
+ ssize_t
+ sendmmsg (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)
+ #else
+@@ -202,7 +202,7 @@ sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+     errno = EWOULDBLOCK;
+     return -1;
+   } else {
+-#ifdef __FreeBSD__
++#if defined(HAVE_FREEBSD_STYLE_SENDMMSG)
+     ssize_t ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+ #else
+diff --git a/tests/meson.build b/tests/meson.build
+index 7a4ce651..29888c29 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -102,9 +102,25 @@ if gst_dep.found() and not static_build
+     ]
+     gst_env = environment()
+     dl_dep = cc.find_library('dl')
++
++    instrument_send_lib_c_args = ['-DG_LOG_DOMAIN="libnice-instrument-send"']
++    if cc.compiles('''
++      #include <sys/socket.h>
++      static int (*f) (int, struct mmsghdr *, unsigned int, int) = &sendmmsg;
++    ''', args: ['-D_GNU_SOURCE', '-Werror=incompatible-pointer-types'], name: 'Glibc-style sendmmsg')
++      # We consider this the default.
++    elif cc.compiles('''
++      #include <sys/socket.h>
++      static ssize_t (*f) (int, struct mmsghdr *, size_t, int) = &sendmmsg;
++    ''', args: ['-D_GNU_SOURCE', '-Werror=incompatible-pointer-types'], name: 'FreeBSD-style sendmmsg')
++      instrument_send_lib_c_args += ['-DHAVE_FREEBSD_STYLE_SENDMMSG']
++    else
++      error('sendmmsg not present or has unknown prototype')
++    endif
++
+     instrument_send_lib = shared_library('instrument-send',
+       'instrument-send.c',
+-      c_args: '-DG_LOG_DOMAIN="libnice-instrument-send"',
++      c_args: instrument_send_lib_c_args,
+       dependencies: [dl_dep, gio_deps],
+     )
+     gst_env.append('LD_PRELOAD', instrument_send_lib.full_path())
+-- 
+GitLab
+
+
+From 4565af6fe9fe01164b072710ad18e537608d3a40 Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Wed, 17 Jun 2026 11:53:11 +0200
+Subject: [PATCH 3/3] tests: support NetBSD/musl-style sendmmsg
+
+Fixes compilation for these platforms.
+---
+ tests/instrument-send.c | 6 ++++++
+ tests/meson.build       | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/tests/instrument-send.c b/tests/instrument-send.c
+index 9903619a..20c02b30 100644
+--- a/tests/instrument-send.c
++++ b/tests/instrument-send.c
+@@ -193,6 +193,9 @@ sendmsg (int sockfd, const struct msghdr *msg, int flags)
+ #if defined(HAVE_FREEBSD_STYLE_SENDMMSG)
+ ssize_t
+ sendmmsg (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)
++#elif defined(HAVE_NETBSD_STYLE_SENDMMSG)
++int
++sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, unsigned int flags)
+ #else
+ int
+ sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+@@ -205,6 +208,9 @@ sendmmsg (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)
+ #if defined(HAVE_FREEBSD_STYLE_SENDMMSG)
+     ssize_t ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, size_t vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
++#elif defined(HAVE_NETBSD_STYLE_SENDMMSG)
++    int ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, unsigned int flags)) (
++        dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+ #else
+     int ret = ((int (*) (int sockfd, struct mmsghdr *msgvec, unsigned int vlen, int flags)) (
+         dlsym (RTLD_NEXT, "sendmmsg"))) (sockfd, msgvec, vlen, flags);
+diff --git a/tests/meson.build b/tests/meson.build
+index 29888c29..3827dc2b 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -114,6 +114,11 @@ if gst_dep.found() and not static_build
+       static ssize_t (*f) (int, struct mmsghdr *, size_t, int) = &sendmmsg;
+     ''', args: ['-D_GNU_SOURCE', '-Werror=incompatible-pointer-types'], name: 'FreeBSD-style sendmmsg')
+       instrument_send_lib_c_args += ['-DHAVE_FREEBSD_STYLE_SENDMMSG']
++    elif cc.compiles('''
++      #include <sys/socket.h>
++      static int (*f) (int, struct mmsghdr *, unsigned int, unsigned int) = &sendmmsg;
++    ''', args: ['-D_GNU_SOURCE', '-Werror=incompatible-pointer-types'], name: 'NetBSD-style sendmmsg')
++      instrument_send_lib_c_args += ['-DHAVE_NETBSD_STYLE_SENDMMSG']
+     else
+       error('sendmmsg not present or has unknown prototype')
+     endif
+-- 
+GitLab
+
diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 93c4e7de9df1..da06d966edbc 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -37,6 +38,15 @@ stdenv.mkDerivation (finalAttrs: {
     # Bumps the gupnp_igd_dep version requested to 1.6
     # https://gitlab.freedesktop.org/libnice/libnice/-/merge_requests/255
     ./gupnp-igd-bump.patch
+
+    (fetchpatch {
+      name = "freebsd.patch";
+      url = "https://gitlab.freedesktop.org/libnice/libnice/-/commit/479f0813a571ff035bf00de679db452a0441125b.patch";
+      hash = "sha256-rr8pAb8TjU85jYWUjsMMKkLxxXVE3B+IjfAyOw9suo0=";
+    })
+
+    # https://gitlab.freedesktop.org/libnice/libnice/-/merge_requests/353
+    ./musl.patch
   ];
 
   nativeBuildInputs = [

From 455a02410fb6cd8e926ba92e31309ef07359959f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 10:13:01 -0700
Subject: [PATCH 683/831] python3Packages.rich-toolkit: 0.17.1 -> 0.20.1

Diff: https://github.com/patrick91/rich-toolkit/compare/0.17.1...0.20.1

Changelog: https://github.com/patrick91/rich-toolkit/blob/0.20.1/CHANGELOG.md
---
 .../python-modules/rich-toolkit/default.nix     | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/rich-toolkit/default.nix b/pkgs/development/python-modules/rich-toolkit/default.nix
index bac82024c583..dfb682351eef 100644
--- a/pkgs/development/python-modules/rich-toolkit/default.nix
+++ b/pkgs/development/python-modules/rich-toolkit/default.nix
@@ -17,18 +17,23 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "rich-toolkit";
-  version = "0.17.1";
+  version = "0.20.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "patrick91";
     repo = "rich-toolkit";
-    tag = version;
-    hash = "sha256-69x760lnMdwrNFUL1g9PBlTRGz34Ur2CHWbJq7PqBmk=";
+    tag = finalAttrs.version;
+    hash = "sha256-XYSksCMCCxO6wzsEEJ6X340iT32hU5n/EikKLZ2m7A0=";
   };
 
+  postPatch = ''
+    # the commit updating the version happens only after tagging
+    sed -i 's/version = ".*"/version = "${finalAttrs.version}"/' pyproject.toml
+  '';
+
   build-system = [ hatchling ];
 
   dependencies = [
@@ -46,10 +51,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "rich_toolkit" ];
 
   meta = {
-    changelog = "https://github.com/patrick91/rich-toolkit/releases/tag/${src.tag}";
+    changelog = "https://github.com/patrick91/rich-toolkit/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     description = "Rich toolkit for building command-line applications";
     homepage = "https://github.com/patrick91/rich-toolkit/";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})

From 41a95eb3f6755878a34335981edf975c455a41db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 10:25:29 -0700
Subject: [PATCH 684/831] python3Packages.flask-cors: 6.0.2 -> 6.0.5

Diff: https://github.com/corydolphin/flask-cors/compare/6.0.2...6.0.5

Changelog: https://github.com/corydolphin/flask-cors/releases/tag/6.0.5
---
 pkgs/development/python-modules/flask-cors/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
index 0f8510073034..986c2f838a2d 100644
--- a/pkgs/development/python-modules/flask-cors/default.nix
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -6,6 +6,7 @@
   werkzeug,
   pytestCheckHook,
   setuptools,
+  setuptools-scm,
 
   # for passthru.tests
   aiobotocore,
@@ -14,18 +15,19 @@
 
 buildPythonPackage rec {
   pname = "flask-cors";
-  version = "6.0.2";
+  version = "6.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "corydolphin";
     repo = "flask-cors";
     tag = version;
-    hash = "sha256-9WlD5Qd0WiBDrVHf5nT1qAK2gtYavlPnY7qFkiAgxws=";
+    hash = "sha256-fngKJm7/7BMcWPPFncTCWw2sL1UJ0t4ICpXr95yNpbg=";
   };
 
   build-system = [
     setuptools
+    setuptools-scm
   ];
 
   dependencies = [
@@ -33,6 +35,8 @@ buildPythonPackage rec {
     werkzeug
   ];
 
+  pythonImportsCheck = [ "flask_cors" ];
+
   nativeCheckInputs = [
     pytestCheckHook
   ];

From 658e3cbf1bdc3abad3ae543918ccc0a0f39016d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 10:31:07 -0700
Subject: [PATCH 685/831] python3Packages.flask-cors: use finalAttrs

---
 pkgs/development/python-modules/flask-cors/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/flask-cors/default.nix b/pkgs/development/python-modules/flask-cors/default.nix
index 986c2f838a2d..16f9c4d18f50 100644
--- a/pkgs/development/python-modules/flask-cors/default.nix
+++ b/pkgs/development/python-modules/flask-cors/default.nix
@@ -13,7 +13,7 @@
   moto,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "flask-cors";
   version = "6.0.5";
   pyproject = true;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "corydolphin";
     repo = "flask-cors";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-fngKJm7/7BMcWPPFncTCWw2sL1UJ0t4ICpXr95yNpbg=";
   };
 
@@ -48,8 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Flask extension adding a decorator for CORS support";
     homepage = "https://github.com/corydolphin/flask-cors";
-    changelog = "https://github.com/corydolphin/flask-cors/releases/tag/${src.tag}";
+    changelog = "https://github.com/corydolphin/flask-cors/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ nickcao ];
   };
-}
+})

From 7a2e21ee2066c92b963159f45f7e8e06b5fbce6d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 11:12:01 -0700
Subject: [PATCH 686/831] lvm2: 2.03.39 -> 2.03.41

Changelog: https://gitlab.com/lvmteam/lvm2/-/blob/v2_03_41/WHATS_NEW
---
 pkgs/os-specific/linux/lvm2/2_03.nix   | 4 ++--
 pkgs/os-specific/linux/lvm2/common.nix | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
index c288d56dcc03..83397f3b492e 100644
--- a/pkgs/os-specific/linux/lvm2/2_03.nix
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.03.39";
-  hash = "sha256-I7yQZ+KP4NN7PMRB8oZbngIs48Ykur4ikYuN2QwDHug=";
+  version = "2.03.41";
+  hash = "sha256-1YARuEXfjsE4FsoT6mw51Ms9A4zS19OHrN9Wga19Zjc=";
 }
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
index 2e4de4038f9a..83b6502405c8 100644
--- a/pkgs/os-specific/linux/lvm2/common.nix
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -231,6 +231,9 @@ stdenv.mkDerivation rec {
   };
 
   meta = {
+    changelog = "https://gitlab.com/lvmteam/lvm2/-/blob/v${
+      lib.replaceString "." "_" version
+    }/WHATS_NEW";
     homepage = "http://sourceware.org/lvm2/";
     description = "Tools to support Logical Volume Management (LVM) on Linux";
     platforms = lib.platforms.linux;

From 3f1f18f34a96880bc6775778b9e5fbbcb3a15549 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 19 Jun 2026 20:22:15 +0200
Subject: [PATCH 687/831] python3Packages.matplotlib: fix build

This had ended up duplicated, and failed the second time.  Bad merge?
---
 pkgs/development/python-modules/matplotlib/default.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index c7fb77d7912e..2f11fd9a0d65 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -98,9 +98,6 @@ buildPythonPackage (finalAttrs: {
         --replace-fail "setuptools_scm>=7,<10" setuptools_scm
 
       patchShebangs tools
-
-      substituteInPlace pyproject.toml \
-        --replace-fail "setuptools_scm>=7,<10" "setuptools_scm"
     ''
     + lib.optionalString (stdenv.hostPlatform.isLinux && interactive) ''
       # fix paths to libraries in dlopen calls (headless detection)

From 5d359cdd4d964fe5388449b13d246e4844dd7529 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 19 Jun 2026 20:24:46 +0200
Subject: [PATCH 688/831] matplotlib: remove unused inputs

Fixes: c4a9aae5c700 ("python3Packages.matplotlib: 3.10.9 -> 3.11.0")
---
 pkgs/development/python-modules/matplotlib/default.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index c7fb77d7912e..9fea9767f130 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -13,8 +13,6 @@
   setuptools-scm,
   pytestCheckHook,
   python,
-  matplotlib,
-  fetchurl,
 
   # native libraries
   ffmpeg-headless,

From 2c176d05ca6242f24dcf7d98fdbda3a928b734fc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 12:03:01 -0700
Subject: [PATCH 689/831] maturin: 1.13.3 -> 1.14.1

Diff: https://github.com/PyO3/maturin/compare/v1.13.3...v1.14.1

Changelog: https://github.com/PyO3/maturin/blob/v1.14.1/Changelog.md
---
 pkgs/by-name/ma/maturin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 2fe364f2bfa3..fae97effb3b9 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "maturin";
-  version = "1.13.3";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xVR/R/aQ6Kvx7w/X9gedjJLzlxz+5nhnwjxsiyKcg0A=";
+    hash = "sha256-sqcNRN8oAZ2AK5gHr3ipb035VOiB+zDA10wTtiaeUBM=";
   };
 
-  cargoHash = "sha256-awdc2SLEfMP4cLG+RvQbeYPn1o9Ft7sqOnRy8iQqjB0=";
+  cargoHash = "sha256-pD8/S7GsFFeAjc8U4fQ9ZTu+o3mKyPagMPKKRI40n4w=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

From eeef7c42f3ba64323534533a657f9479c91176b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 13:23:09 -0700
Subject: [PATCH 690/831] mercurial: 7.1.2 -> 7.2.2

Changelog: https://wiki.mercurial-scm.org/Release7.2
---
 pkgs/by-name/me/mercurial/package.nix | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/me/mercurial/package.nix b/pkgs/by-name/me/mercurial/package.nix
index 3ac5b2529b12..badad6378c51 100644
--- a/pkgs/by-name/me/mercurial/package.nix
+++ b/pkgs/by-name/me/mercurial/package.nix
@@ -40,11 +40,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "7.1.2";
+    version = "7.2.2";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      hash = "sha256-zie5pHZ88upJa1FGi65RL6am6vCJHkn4lh3GlLTcgco=";
+      hash = "sha256-8uyOfu7wUAWRcG03RVXwzrEYgiBo51+jsyvgfdIYT2w=";
     };
 
     pyproject = false;
@@ -56,7 +56,7 @@ let
         rustPlatform.fetchCargoVendor {
           inherit src;
           name = "mercurial-${version}";
-          hash = "sha256-REMgZ1TiVTDbvT8TCd4EeHfYT/xMJfC4E6weLJFT6Rw=";
+          hash = "sha256-OGsHK3Bh47V4n+7HYpVp/jymCz1QY45rkWlAW0Hob7g=";
           sourceRoot = "mercurial-${version}/rust";
         }
       else
@@ -180,12 +180,6 @@ let
                 ""
               }
           done
-
-          # https://bz.mercurial-scm.org/show_bug.cgi?id=6887
-          # Adding setuptools to the python path is not enough for the distutils
-          # module to be found, so we patch usage directly:
-          substituteInPlace tests/hghave.py \
-            --replace-fail "distutils" "setuptools._distutils"
         '';
 
         # This runs Mercurial _a lot_ of times.

From 7a49c1337a521afc89d76115826542e230df8dcd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 19 Jun 2026 22:22:59 +0000
Subject: [PATCH 691/831] ldns: 1.9.0 -> 1.9.2

---
 pkgs/by-name/ld/ldns/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ld/ldns/package.nix b/pkgs/by-name/ld/ldns/package.nix
index 4078cdfd5372..f40ea684be96 100644
--- a/pkgs/by-name/ld/ldns/package.nix
+++ b/pkgs/by-name/ld/ldns/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ldns";
-  version = "1.9.0";
+  version = "1.9.2";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/ldns/ldns-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-q67tKFj76oSk65gz4Z59IzgMwPPZtlSLlivkInb/3LM=";
+    sha256 = "sha256-tST6IZlLboNCAM64wn8bhL2lmC/jVwbwWBlsB525TV0=";
   };
 
   postPatch = ''

From 1c97950f52ad01ae1dc4e8bee8bf80fd9add4999 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 18 Jun 2026 02:32:25 +0200
Subject: [PATCH 692/831] python3Packages.anyio: 4.13.0 -> 4.14.0

https://github.com/agronholm/anyio/blob/4.14.0/docs/versionhistory.rst
---
 pkgs/development/python-modules/anyio/default.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/anyio/default.nix b/pkgs/development/python-modules/anyio/default.nix
index 822bc7b0b484..2337ee8f6c8b 100644
--- a/pkgs/development/python-modules/anyio/default.nix
+++ b/pkgs/development/python-modules/anyio/default.nix
@@ -20,6 +20,7 @@
   hypothesis,
   psutil,
   pytest-mock,
+  pytest-timeout,
   pytest-xdist,
   pytestCheckHook,
   trustme,
@@ -31,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "anyio";
-  version = "4.13.0";
+  version = "4.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "agronholm";
     repo = "anyio";
     tag = version;
-    hash = "sha256-W2uR1VwI9u4QIPmbcYp8jDatEdya97NaJwAABlaRHzM=";
+    hash = "sha256-g+2d/j3ke+RjwIYq0JyFfYxg80QXrura9Dsx7cQyMIQ=";
   };
 
   build-system = [ setuptools-scm ];
@@ -59,6 +60,7 @@ buildPythonPackage rec {
     hypothesis
     psutil
     pytest-mock
+    pytest-timeout
     pytest-xdist
     pytestCheckHook
     trustme
@@ -98,6 +100,9 @@ buildPythonPackage rec {
     "test_run_in_custom_limiter"
     "test_cancel_from_shielded_scope"
     "test_start_task_soon_cancel_later"
+
+    # fails to monkeypatch __file__.__main__
+    "test_entrypoint_main_module"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # PermissionError: [Errno 1] Operation not permitted: '/dev/console'

From 238a80f814c524fc0314df3790f7d9ef369ad950 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 17:39:38 -0700
Subject: [PATCH 693/831] python3Packages.lxml: 6.1.0 -> 6.1.1

Diff: https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1

Changelog: https://github.com/lxml/lxml/blob/lxml-6.1.1/CHANGES.txt
---
 pkgs/development/python-modules/lxml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index d3dd5022478f..5b618d00be02 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "lxml";
-  version = "6.1.0";
+  version = "6.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
     tag = "lxml-${version}";
-    hash = "sha256-crFUn1TmxdHXr3ULDKsRy4Y4PR/itaycsWiSDb+pbeg=";
+    hash = "sha256-SRJaegK4PxgK0rdILVp3J92VnjPmExiD2AuMLoGQIbA=";
   };
 
   build-system = [

From 0114e63fb6dc1f7d74811f1e357d231519f09442 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 19 Jun 2026 17:42:07 -0700
Subject: [PATCH 694/831] python3Packages.lxml: use finalAttrs

---
 pkgs/development/python-modules/lxml/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/lxml/default.nix b/pkgs/development/python-modules/lxml/default.nix
index 5b618d00be02..997fe6504a78 100644
--- a/pkgs/development/python-modules/lxml/default.nix
+++ b/pkgs/development/python-modules/lxml/default.nix
@@ -16,7 +16,7 @@
   xcodebuild,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "lxml";
   version = "6.1.1";
   pyproject = true;
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "lxml";
     repo = "lxml";
-    tag = "lxml-${version}";
+    tag = "lxml-${finalAttrs.version}";
     hash = "sha256-SRJaegK4PxgK0rdILVp3J92VnjPmExiD2AuMLoGQIbA=";
   };
 
@@ -58,10 +58,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/lxml/lxml/blob/lxml-${version}/CHANGES.txt";
+    changelog = "https://github.com/lxml/lxml/blob/${finalAttrs.src.tag}/CHANGES.txt";
     description = "Pythonic binding for the libxml2 and libxslt libraries";
     homepage = "https://lxml.de";
     license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})

From bc52944a1e2cf3c595d74423168b120cc320decb Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 20 Jun 2026 10:08:42 +0100
Subject: [PATCH 695/831] libgbm: 26.0.3 -> 26.1.3

---
 pkgs/development/libraries/mesa/gbm.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mesa/gbm.nix b/pkgs/development/libraries/mesa/gbm.nix
index e4f36f7f1779..6f9b56157253 100644
--- a/pkgs/development/libraries/mesa/gbm.nix
+++ b/pkgs/development/libraries/mesa/gbm.nix
@@ -20,14 +20,14 @@ stdenv.mkDerivation rec {
 
   # We don't use the versions from common.nix, because libgbm is a world rebuild,
   # so the updates need to happen separately on staging.
-  version = "26.0.3";
+  version = "26.1.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-CTOnJKsx9hDtLhDnuJSGc/lBQ2ZcDm3/Iie7awusGho=";
+    hash = "sha256-W2Ud9wmiIuDYMnFj8sK2SGAI1WayMCtdj7/7od/1Ql4=";
   };
 
   mesonAutoFeatures = "disabled";

From 24a18b8315a0f3cc0654c92c51c8da89671ec0bf Mon Sep 17 00:00:00 2001
From: Michael Wang <michael_wzq@icloud.com>
Date: Sat, 20 Jun 2026 19:58:06 +1000
Subject: [PATCH 696/831] libultrahdr: fix i686-linux build and unrestrict
 meta.platforms https://github.com/NixOS/nixpkgs/issues/532626

---
 pkgs/by-name/li/libultrahdr/package.nix       |  41 ++---
 .../remove-platform-and-detection-logic.patch | 142 ++++++++++++++++++
 2 files changed, 156 insertions(+), 27 deletions(-)
 create mode 100644 pkgs/by-name/li/libultrahdr/remove-platform-and-detection-logic.patch

diff --git a/pkgs/by-name/li/libultrahdr/package.nix b/pkgs/by-name/li/libultrahdr/package.nix
index c3ef856b8fbf..f63521ee4742 100644
--- a/pkgs/by-name/li/libultrahdr/package.nix
+++ b/pkgs/by-name/li/libultrahdr/package.nix
@@ -40,6 +40,13 @@ stdenv.mkDerivation (finalAttrs: {
     (replaceVars ./gtest.patch {
       GTEST_INCLUDE_DIRS = "${lib.getDev gtest}/include";
     })
+
+    # Remove platform and architecture detection logic
+    # Also drop arch-specific compile and optimization flags to ensure
+    # packaging friendliness.
+    # Based on https://github.com/google/libultrahdr/pull/383
+    # modified to target 1.4.0 instead of main
+    ./remove-platform-and-detection-logic.patch
   ];
 
   # CMake incorrect absolute include/lib paths: https://github.com/NixOS/nixpkgs/issues/144170
@@ -53,6 +60,12 @@ stdenv.mkDerivation (finalAttrs: {
         'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
   '';
 
+  # use sse2 for floating point math to fix tests
+  env = lib.optionalAttrs stdenv.hostPlatform.isi686 {
+    CFLAGS = "-mfpmath=sse -msse2";
+    CXXFLAGS = "-mfpmath=sse -msse2";
+  };
+
   cmakeFlags = [
     (lib.cmakeBool "UHDR_BUILD_TESTS" true)
     # Build disables install target in cross-compilation mode so
@@ -102,33 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       yzx9
     ];
-    # CMake script rejects non-approved platform targets
-    # https://github.com/google/libultrahdr/pull/383 would get rid of that
-    platforms =
-      let
-        # Values from the "Detect system" section in /CMakeLists.txt
-        # https://github.com/google/libultrahdr/blob/d52a0d13814ca399fc8a07e23de1d2c63f0e8404/CMakeLists.txt#L34
-        oss = [
-          "linux"
-          "windows"
-          "darwin"
-        ];
-        archs = [
-          "i686"
-          "x86_64"
-          "aarch64"
-          "armv7l"
-          "riscv64"
-          "riscv32"
-          "loongarch64"
-        ];
-      in
-      lib.lists.intersectLists lib.platforms.all (
-        lib.lists.crossLists (arch: os: "${arch}-${os}") [
-          archs
-          oss
-        ]
-      );
+    platforms = lib.platforms.all;
     license = with lib.licenses; [
       asl20
     ];
diff --git a/pkgs/by-name/li/libultrahdr/remove-platform-and-detection-logic.patch b/pkgs/by-name/li/libultrahdr/remove-platform-and-detection-logic.patch
new file mode 100644
index 000000000000..5c3521be65a6
--- /dev/null
+++ b/pkgs/by-name/li/libultrahdr/remove-platform-and-detection-logic.patch
@@ -0,0 +1,142 @@
+From e2daed8da97d8857dcec2fd68d2f6f3326170f67 Mon Sep 17 00:00:00 2001
+From: Kleis Auke Wolthuizen <github@kleisauke.nl>
+Date: Wed, 10 Dec 2025 15:01:28 +0100
+Subject: [PATCH] Remove platform and architecture detection logic
+
+Also drop arch-specific compile and optimization flags to ensure
+packaging friendliness.
+---
+ CMakeLists.txt      | 104 +++-----------------------------------------
+ cmake/package.cmake |   3 --
+ 2 files changed, 5 insertions(+), 102 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 51283356..07ed9100 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -25,44 +25,6 @@ project(libuhdr
+         LANGUAGES C CXX
+         DESCRIPTION "Library for encoding and decoding ultrahdr images")
+ 
+-###########################################################
+-# Detect system
+-###########################################################
+-if(${CMAKE_SYSTEM_NAME} MATCHES "Linux")
+-elseif(${CMAKE_SYSTEM_NAME} MATCHES "Emscripten")
+-elseif(${CMAKE_SYSTEM_NAME} MATCHES "Android")
+-elseif(WIN32)
+-elseif(APPLE)
+-else()
+-  message(FATAL_ERROR "Platform ${CMAKE_SYSTEM_NAME} not recognized")
+-endif()
+-
+-if(CMAKE_SYSTEM_PROCESSOR MATCHES "amd64.*|x86_64.*|AMD64.*")
+-  if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+-    set(ARCH "amd64")
+-  else()
+-    set(ARCH "i386")
+-  endif()
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "i686.*|i386.*|x86.*")
+-  set(ARCH "i386")
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(aarch64.*|AARCH64.*|arm64.*|ARM64.*)")
+-  if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+-    set(ARCH "aarch64")
+-  else()
+-    set(ARCH "arm")
+-  endif()
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm.*|ARM.*)")
+-  set(ARCH "arm")
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^riscv64")
+-  set(ARCH "riscv64")
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^riscv32")
+-  set(ARCH "riscv32")
+-elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^loongarch64")
+-  set(ARCH "loong64")
+-else()
+-  message(FATAL_ERROR "Architecture: ${CMAKE_SYSTEM_PROCESSOR} not recognized")
+-endif()
+-
+ ###########################################################
+ # Directories
+ ###########################################################
+@@ -287,45 +228,9 @@ elseif(EMSCRIPTEN)
+                            or try 'cmake -DUHDR_BUILD_DEPS=1'")
+     endif()
+   endif()
+-else()
+-  add_compile_options(-ffunction-sections)
+-  add_compile_options(-fdata-sections)
+-  add_compile_options(-fomit-frame-pointer)
+-  add_compile_options(-ffp-contract=fast)
+-  if(ARCH STREQUAL "i386")
+-    add_compile_options(-m32)
+-    add_compile_options(-march=i386)
+-    add_compile_options(-mtune=generic)
+-  elseif(ARCH STREQUAL "amd64")
+-    add_compile_options(-m64)
+-    add_compile_options(-march=x86-64)
+-    add_compile_options(-mtune=generic)
+-  elseif(ARCH STREQUAL "arm")
+-    add_compile_options(-march=armv7-a)
+-    add_compile_options(-marm)
+-    if(NOT ANDROID_ABI)
+-      add_compile_options(-mfloat-abi=hard)
+-    endif()
+-    add_compile_options(-mfpu=neon-vfpv3)
+-    add_compile_options(-fno-lax-vector-conversions)
+-  elseif(ARCH STREQUAL "aarch64")
+-    add_compile_options(-march=armv8-a)
+-    add_compile_options(-fno-lax-vector-conversions)
+-  elseif(ARCH STREQUAL "riscv64")
+-    add_compile_options(-march=rv64gc)
+-    add_compile_options(-mabi=lp64d)
+-  elseif(ARCH STREQUAL "riscv32")
+-    add_compile_options(-march=rv32gc)
+-    add_compile_options(-mabi=ilp32d)
+-  elseif(ARCH STREQUAL "loong64")
+-    add_compile_options(-march=loongarch64)
+-    add_compile_options(-mabi=lp64d)
+-  endif()
+-
+-  if(UHDR_ENABLE_WERROR)
+-    CheckCompilerOption("-Werror" SUPPORTS_WERROR)
+-    set(UHDR_WERROR_FLAGS "-Werror")
+-  endif()
++elseif(UHDR_ENABLE_WERROR)
++  CheckCompilerOption("-Werror" SUPPORTS_WERROR)
++  set(UHDR_WERROR_FLAGS "-Werror")
+ endif()
+ 
+ ###########################################################
+@@ -585,7 +490,8 @@ set_property(DIRECTORY PROPERTY ADDITIONAL_MAKE_CLEAN_FILES
+ ###########################################################
+ file(GLOB UHDR_CORE_SRCS_LIST "${SOURCE_DIR}/src/*.cpp")
+ if(UHDR_ENABLE_INTRINSICS)
+-  if(ARCH STREQUAL "arm" OR ARCH STREQUAL "aarch64")
++  string(TOLOWER ${CMAKE_SYSTEM_PROCESSOR} CMAKE_SYSTEM_PROCESSOR_LC)
++  if(CMAKE_SYSTEM_PROCESSOR_LC STREQUAL "aarch64" OR CMAKE_SYSTEM_PROCESSOR_LC MATCHES "^arm")
+     file(GLOB UHDR_CORE_NEON_SRCS_LIST "${SOURCE_DIR}/src/dsp/arm/*.cpp")
+     list(APPEND UHDR_CORE_SRCS_LIST ${UHDR_CORE_NEON_SRCS_LIST})
+   endif()
+diff --git a/cmake/package.cmake b/cmake/package.cmake
+index 2e3649aa..5a416c22 100644
+--- a/cmake/package.cmake
++++ b/cmake/package.cmake
+@@ -29,9 +29,7 @@ if("${CMAKE_SYSTEM_NAME}" STREQUAL "")
+   message(FATAL_ERROR "Failed to determine CPACK_SYSTEM_NAME. Is CMAKE_SYSTEM_NAME set?" )
+ endif()
+ string(TOLOWER "${CMAKE_SYSTEM_NAME}" CPACK_SYSTEM_NAME)
+-set(CPACK_PACKAGE_ARCHITECTURE ${ARCH})
+ set(CPACK_PACKAGE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}-${CPACK_SYSTEM_NAME}")
+-set(CPACK_PACKAGE_FILE_NAME "${CPACK_PACKAGE_FILE_NAME}-${CPACK_PACKAGE_ARCHITECTURE}")
+ set(CPACK_RESOURCE_FILE_LICENSE ${CMAKE_SOURCE_DIR}/LICENSE)
+ set(CPACK_PACKAGING_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX})
+ 
+@@ -46,7 +44,6 @@ elseif(UNIX)
+     set(CPACK_DEBIAN_PACKAGE_HOMEPAGE ${CPACK_PACKAGE_HOMEPAGE_URL})
+   elseif(EXISTS "/etc/redhat-release")
+     set(CPACK_GENERATOR "RPM")
+-    set(CPACK_RPM_PACKAGE_ARCHITECTURE ${CPACK_PACKAGE_ARCHITECTURE})
+     set(CPACK_RPM_PACKAGE_RELEASE 1)
+     set(CPACK_RPM_PACKAGE_LICENSE "Apache 2.0")
+     set(CPACK_RPM_PACKAGE_URL ${CPACK_PACKAGE_HOMEPAGE_URL})

From 1bdde03f71cfc428d5ff7324cfb8be06076e2471 Mon Sep 17 00:00:00 2001
From: Michael Wang <michael_wzq@icloud.com>
Date: Sat, 20 Jun 2026 18:40:22 +1000
Subject: [PATCH 697/831] libultrahdr: fix tests on big-endian
 https://github.com/google/libultrahdr/pull/396

---
 pkgs/by-name/li/libultrahdr/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/li/libultrahdr/package.nix b/pkgs/by-name/li/libultrahdr/package.nix
index f63521ee4742..c4328f72fcfb 100644
--- a/pkgs/by-name/li/libultrahdr/package.nix
+++ b/pkgs/by-name/li/libultrahdr/package.nix
@@ -47,6 +47,13 @@ stdenv.mkDerivation (finalAttrs: {
     # Based on https://github.com/google/libultrahdr/pull/383
     # modified to target 1.4.0 instead of main
     ./remove-platform-and-detection-logic.patch
+
+    # fix tests on big-endian
+    # https://github.com/google/libultrahdr/pull/396
+    (fetchpatch {
+      url = "https://github.com/google/libultrahdr/commit/13a058f452d846e43d4691f6885eeeaa8b0ea8d0.patch";
+      hash = "sha256-2ZVvBMz8wQLEThuXdRJbbx5m2ouRZpxVWoH88RLmit4=";
+    })
   ];
 
   # CMake incorrect absolute include/lib paths: https://github.com/NixOS/nixpkgs/issues/144170

From 16c27918569370f5ceeb1ca2512f925a2298e2fb Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:05:55 +0200
Subject: [PATCH 698/831] poppler: 25.10.0 -> 26.06.0

changelog: changelog: https://poppler.freedesktop.org/releases.html

diff: diff: https://gitlab.freedesktop.org/poppler/poppler/-/compare/poppler-25.10.0...poppler-26.06.0
---
 .../development/libraries/poppler/default.nix | 26 +++++++++++--------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index 686d4a3715e3..0b1b6a76df2f 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -55,13 +55,13 @@ let
     domain = "gitlab.freedesktop.org";
     owner = "poppler";
     repo = "test";
-    rev = "9d5011815a14c157ba25bb160187842fb81579a5";
-    hash = "sha256-sA5f235IJpzzzHqpwHM3zCZC2Yh0ztA6PZa84j/6tfY=";
+    rev = "f0068e9c530017ad811d1f28b95f9b7f59264e37";
+    hash = "sha256-Xf8duSh0r1o09b5BKB7mBvzrMfXYlzTuTOuK2ZCeItc=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "poppler-${suffix}";
-  version = "25.10.0"; # beware: updates often break cups-filters build, check scribus too!
+  version = "26.06.0"; # beware: updates often break cups-filters build, check scribus too!
 
   outputs = [
     "out"
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://poppler.freedesktop.org/poppler-${finalAttrs.version}.tar.xz";
-    hash = "sha256-a16btk2rsVeHoU2xZ1KRx6+vk4dDjMk6T7f2rsTub+A=";
+    hash = "sha256-TLTlo9yMte7HUciiPIuhn2H5be3AzQfSruawyOLPa6Q=";
   };
 
   nativeBuildInputs = [
@@ -129,18 +129,22 @@ stdenv.mkDerivation (finalAttrs: {
     (mkFlag qt5Support "QT5")
     (mkFlag qt6Support "QT6")
     (mkFlag gpgmeSupport "GPGME")
-  ]
-  ++ lib.optionals finalAttrs.finalPackage.doCheck [
-    "-DTESTDATADIR=${testData}"
   ];
   disallowedReferences = lib.optional finalAttrs.finalPackage.doCheck testData;
 
   dontWrapQtApps = true;
 
-  # Workaround #54606
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
-  '';
+  preConfigure =
+    lib.optionalString finalAttrs.finalPackage.doCheck ''
+      # The test data directory needs to be writable during the test phase.
+      mkdir -p $TMPDIR/testdata
+      cp -r --no-preserve=mode ${testData}/* $TMPDIR/testdata
+      cmakeFlagsArray+=(-DTESTDATADIR=$TMPDIR/testdata)
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # Workaround #54606
+      sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
+    '';
 
   # Work around gpgme trying to write to $HOME during qt5 and qt6 tests:
   preCheck = lib.optionalString gpgmeSupport ''

From 75f331ec360b55cb4793836ff1ded77b58fcd98c Mon Sep 17 00:00:00 2001
From: glevy <glevy@crans.org>
Date: Fri, 8 May 2026 09:29:06 +0000
Subject: [PATCH 699/831] python3Packages.joserfc: 1.6.1 -> 1.6.9

Changelog : https://github.com/authlib/joserfc/compare/1.6.1...1.6.9
---
 pkgs/development/python-modules/joserfc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/joserfc/default.nix b/pkgs/development/python-modules/joserfc/default.nix
index 16fd842083c6..89874d9e571e 100644
--- a/pkgs/development/python-modules/joserfc/default.nix
+++ b/pkgs/development/python-modules/joserfc/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "joserfc";
-  version = "1.6.1";
+  version = "1.6.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "authlib";
     repo = "joserfc";
     tag = version;
-    hash = "sha256-druh7ybcQBjTxUFMVLUwknw/aa/fyrUdS4ftS/ftYeA=";
+    hash = "sha256-Ge1r34GVmpJ9h5GtRkPd0mkV7HuLf7D31ikuPAnpkuY=";
   };
 
   build-system = [ setuptools ];

From ed76de3e2ad32f63857414d9e8f2318774e2833a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sat, 20 Jun 2026 00:42:53 +0000
Subject: [PATCH 700/831] libjxl, jpegli: Fix file conflicts when installed
 together. Fixes #533459

Done by moving the benchmarks and library files to separate outputs
so one can reference only `.bin` in `systemPackages`,
avoiding the overlapping names:

    bin/benchmark_xl
    lib/libjxl_cms.so
    lib/libjxl_threads.so
    lib/libjxl_extras_codec.a

For jpegli, a `dev` output also needed to be added to remove a cyclic
reference (from `out` to `bin`):
With a `bin` output newly present, the nixpkgs `multiple-outputs` hook
emits `nix-support/propagated-build-inputs` (which lists the `bin` output)
as development metadata. Without a `dev` output this lands in `out`,
creating an `out -> bin -> out` reference cycle (`bin` links the runtime
libs in `out`).
Example of what was in `bin`'s `nix-support/propagated-build-inputs`:

    /nix/store/99f61f783cd29k1gmr7hrxjnb4v584jn-jpegli-0-unstable-2026-04-30-bin /nix/store/320lmb4fnd2x5alv9hlpdlgz73aj8f26-jpegli-0-unstable-2026-04-30

Creating `dev` moves `nix-support` there, breaking the cycle
and matching the `libjxl` output layout.

Assisted-By: Claude Opus 4.8 in Zoo Code
---
 pkgs/by-name/jp/jpegli/package.nix |  9 +++++++++
 pkgs/by-name/li/libjxl/package.nix | 30 ++++++++++++++++++------------
 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/jp/jpegli/package.nix b/pkgs/by-name/jp/jpegli/package.nix
index 68ed1766c073..86bf75f0c426 100644
--- a/pkgs/by-name/jp/jpegli/package.nix
+++ b/pkgs/by-name/jp/jpegli/package.nix
@@ -31,7 +31,10 @@ stdenv.mkDerivation {
 
   outputs = [
     "out"
+    "bin"
+    "dev"
     "man"
+    "benchmark"
   ];
 
   strictDeps = true;
@@ -70,6 +73,12 @@ stdenv.mkDerivation {
     (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
   ];
 
+  # Move `benchmark_xl` into a separate output to avoid a file collision
+  # with the `benchmark_xl` binary provided by `libjxl`.
+  postInstall = ''
+    moveToOutput "bin/benchmark_xl" "$benchmark"
+  '';
+
   doCheck = true;
 
   passthru = {
diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index ce50b109a961..93fceb3f3095 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -35,7 +35,9 @@ stdenv.mkDerivation rec {
 
   outputs = [
     "out"
+    "bin"
     "dev"
+    "benchmark"
   ];
 
   src = fetchFromGitHub {
@@ -150,18 +152,22 @@ stdenv.mkDerivation rec {
       --replace 'sh$' 'sh( -e$|$)'
   '';
 
-  postInstall =
-    lib.optionalString enablePlugins ''
-      GDK_PIXBUF_MODULEDIR="$out/${gdk-pixbuf.moduleDir}" \
-      GDK_PIXBUF_MODULE_FILE="$out/${loadersPath}" \
-        gdk-pixbuf-query-loaders --update-cache
-    ''
-    # Cross-compiled gdk-pixbuf doesn't support thumbnailers
-    + lib.optionalString (enablePlugins && stdenv.hostPlatform == stdenv.buildPlatform) ''
-      mkdir -p "$out/bin"
-      makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-jxl" \
-        --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
-    '';
+  # Move `benchmark_xl` into a separate output to avoid a file collision
+  # with the `benchmark_xl` binary provided by `jpegli`.
+  postInstall = ''
+    moveToOutput "bin/benchmark_xl" "$benchmark"
+  ''
+  + lib.optionalString enablePlugins ''
+    GDK_PIXBUF_MODULEDIR="$out/${gdk-pixbuf.moduleDir}" \
+    GDK_PIXBUF_MODULE_FILE="$out/${loadersPath}" \
+      gdk-pixbuf-query-loaders --update-cache
+  ''
+  # Cross-compiled gdk-pixbuf doesn't support thumbnailers
+  + lib.optionalString (enablePlugins && stdenv.hostPlatform == stdenv.buildPlatform) ''
+    mkdir -p "$out/bin"
+    makeWrapper ${gdk-pixbuf}/bin/gdk-pixbuf-thumbnailer "$out/libexec/gdk-pixbuf-thumbnailer-jxl" \
+      --set GDK_PIXBUF_MODULE_FILE "$out/${loadersPath}"
+  '';
 
   env = lib.optionalAttrs stdenv.hostPlatform.isAarch32 {
     CXXFLAGS = "-mfp16-format=ieee";

From ecae36f1728d97f9a17cb10ea1cc1fabfb8276fe Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Sun, 21 Jun 2026 00:41:07 +0200
Subject: [PATCH 701/831] jq: 1.8.1 -> 1.8.2

Changelogs: https://github.com/jqlang/jq/releases/tag/jq-1.8.2
Should be backported (22 CVEs)
---
 pkgs/by-name/jq/jq/CVE-2026-32316.patch | 49 --------------
 pkgs/by-name/jq/jq/CVE-2026-33947.patch | 66 -------------------
 pkgs/by-name/jq/jq/CVE-2026-33948.patch | 45 -------------
 pkgs/by-name/jq/jq/CVE-2026-39979.patch | 27 --------
 pkgs/by-name/jq/jq/CVE-2026-40164.patch | 87 -------------------------
 pkgs/by-name/jq/jq/musl.patch           | 31 ---------
 pkgs/by-name/jq/jq/package.nix          | 14 +---
 7 files changed, 3 insertions(+), 316 deletions(-)
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-32316.patch
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-33947.patch
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-33948.patch
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-39979.patch
 delete mode 100644 pkgs/by-name/jq/jq/CVE-2026-40164.patch
 delete mode 100644 pkgs/by-name/jq/jq/musl.patch

diff --git a/pkgs/by-name/jq/jq/CVE-2026-32316.patch b/pkgs/by-name/jq/jq/CVE-2026-32316.patch
deleted file mode 100644
index 29d08c9adcd7..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-32316.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From e47e56d226519635768e6aab2f38f0ab037c09e5 Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Thu, 12 Mar 2026 20:28:43 +0900
-Subject: [PATCH] Fix heap buffer overflow in `jvp_string_append` and
- `jvp_string_copy_replace_bad`
-
-In `jvp_string_append`, the allocation size `(currlen + len) * 2` could
-overflow `uint32_t` when `currlen + len` exceeds `INT_MAX`, causing a small
-allocation followed by a large `memcpy`.
-
-In `jvp_string_copy_replace_bad`, the output buffer size calculation
-`length * 3 + 1` could overflow `uint32_t`, again resulting in a small
-allocation followed by a large write.
-
-Add overflow checks to both functions to return an error for strings
-that would exceed `INT_MAX` in length. Fixes CVE-2026-32316.
----
- src/jv.c | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
-diff --git a/src/jv.c b/src/jv.c
-index 722a539391..2a62b48419 100644
---- a/src/jv.c
-+++ b/src/jv.c
-@@ -1114,7 +1114,12 @@ static jv jvp_string_copy_replace_bad(const char* data, uint32_t length) {
-   const char* end = data + length;
-   const char* i = data;
- 
--  uint32_t maxlength = length * 3 + 1; // worst case: all bad bytes, each becomes a 3-byte U+FFFD
-+  // worst case: all bad bytes, each becomes a 3-byte U+FFFD
-+  uint64_t maxlength = (uint64_t)length * 3 + 1;
-+  if (maxlength >= INT_MAX) {
-+    return jv_invalid_with_msg(jv_string("String too long"));
-+  }
-+
-   jvp_string* s = jvp_string_alloc(maxlength);
-   char* out = s->data;
-   int c = 0;
-@@ -1174,6 +1179,10 @@ static uint32_t jvp_string_remaining_space(jvp_string* s) {
- static jv jvp_string_append(jv string, const char* data, uint32_t len) {
-   jvp_string* s = jvp_string_ptr(string);
-   uint32_t currlen = jvp_string_length(s);
-+  if ((uint64_t)currlen + len >= INT_MAX) {
-+    jv_free(string);
-+    return jv_invalid_with_msg(jv_string("String too long"));
-+  }
- 
-   if (jvp_refcnt_unshared(string.u.ptr) &&
-       jvp_string_remaining_space(s) >= len) {
diff --git a/pkgs/by-name/jq/jq/CVE-2026-33947.patch b/pkgs/by-name/jq/jq/CVE-2026-33947.patch
deleted file mode 100644
index 9f31fd82b057..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-33947.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From fb59f1491058d58bdc3e8dd28f1773d1ac690a1f Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Mon, 13 Apr 2026 11:23:40 +0900
-Subject: [PATCH] Limit path depth to prevent stack overflow
-
-Deeply nested path arrays can cause unbounded recursion in
-`jv_setpath`, `jv_getpath`, and `jv_delpaths`, leading to
-stack overflow. Add a depth limit of 10000 to match the
-existing `tojson` depth limit. This fixes CVE-2026-33947.
----
- src/jv_aux.c  | 21 +++++++++++++++++++++
- 2 files changed, 46 insertions(+)
-
-diff --git a/src/jv_aux.c b/src/jv_aux.c
-index 018f380b10..fd5ff96684 100644
---- a/src/jv_aux.c
-+++ b/src/jv_aux.c
-@@ -365,6 +365,10 @@ static jv jv_dels(jv t, jv keys) {
-   return t;
- }
- 
-+#ifndef MAX_PATH_DEPTH
-+#define MAX_PATH_DEPTH (10000)
-+#endif
-+
- jv jv_setpath(jv root, jv path, jv value) {
-   if (jv_get_kind(path) != JV_KIND_ARRAY) {
-     jv_free(value);
-@@ -372,6 +376,12 @@ jv jv_setpath(jv root, jv path, jv value) {
-     jv_free(path);
-     return jv_invalid_with_msg(jv_string("Path must be specified as an array"));
-   }
-+  if (jv_array_length(jv_copy(path)) > MAX_PATH_DEPTH) {
-+    jv_free(value);
-+    jv_free(root);
-+    jv_free(path);
-+    return jv_invalid_with_msg(jv_string("Path too deep"));
-+  }
-   if (!jv_is_valid(root)){
-     jv_free(value);
-     jv_free(path);
-@@ -424,6 +434,11 @@ jv jv_getpath(jv root, jv path) {
-     jv_free(path);
-     return jv_invalid_with_msg(jv_string("Path must be specified as an array"));
-   }
-+  if (jv_array_length(jv_copy(path)) > MAX_PATH_DEPTH) {
-+    jv_free(root);
-+    jv_free(path);
-+    return jv_invalid_with_msg(jv_string("Path too deep"));
-+  }
-   if (!jv_is_valid(root)) {
-     jv_free(path);
-     return root;
-@@ -502,6 +517,12 @@ jv jv_delpaths(jv object, jv paths) {
-       jv_free(elem);
-       return err;
-     }
-+    if (jv_array_length(jv_copy(elem)) > MAX_PATH_DEPTH) {
-+      jv_free(object);
-+      jv_free(paths);
-+      jv_free(elem);
-+      return jv_invalid_with_msg(jv_string("Path too deep"));
-+    }
-     jv_free(elem);
-   }
-   if (jv_array_length(jv_copy(paths)) == 0) {
diff --git a/pkgs/by-name/jq/jq/CVE-2026-33948.patch b/pkgs/by-name/jq/jq/CVE-2026-33948.patch
deleted file mode 100644
index 5b6497e1469d..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-33948.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Mon, 13 Apr 2026 08:46:11 +0900
-Subject: [PATCH] Fix NUL truncation in the JSON parser
-
-This fixes CVE-2026-33948.
----
- src/util.c   | 8 +-------
- tests/shtest | 6 ++++++
- 2 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/src/util.c b/src/util.c
-index fdfdb96d88..80d65fc808 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -312,13 +312,7 @@ static int jq_util_input_read_more(jq_util_input_state *state) {
-       if (p != NULL)
-         state->current_line++;
- 
--      if (p == NULL && state->parser != NULL) {
--        /*
--         * There should be no NULs in JSON texts (but JSON text
--         * sequences are another story).
--         */
--        state->buf_valid_len = strlen(state->buf);
--      } else if (p == NULL && feof(state->current_input)) {
-+      if (p == NULL && feof(state->current_input)) {
-         size_t i;
- 
-         /*
-diff --git a/tests/shtest b/tests/shtest
-index cb88745277..370f7b7c69 100755
---- a/tests/shtest
-+++ b/tests/shtest
-@@ -880,4 +880,10 @@ $JQ -nf $d/prog.jq 2> $d/out && {
- }
- diff $d/out $d/expected
- 
-+# CVE-2026-33948: No NUL truncation in the JSON parser
-+if printf '{}\x00{}' | $JQ >/dev/null 2> /dev/null; then
-+  printf 'Error expected but jq exited successfully\n' 1>&2
-+  exit 1
-+fi
-+
- exit 0
diff --git a/pkgs/by-name/jq/jq/CVE-2026-39979.patch b/pkgs/by-name/jq/jq/CVE-2026-39979.patch
deleted file mode 100644
index cc0c3d17f77f..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-39979.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 2f09060afab23fe9390cce7cb860b10416e1bf5f Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Mon, 13 Apr 2026 11:04:52 +0900
-Subject: [PATCH] Fix out-of-bounds read in jv_parse_sized()
-
-This fixes CVE-2026-39979.
-
-Co-authored-by: Mattias Wadman <mattias.wadman@gmail.com>
----
- src/jv_parse.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/jv_parse.c b/src/jv_parse.c
-index aa2054cc09..56847b5eaa 100644
---- a/src/jv_parse.c
-+++ b/src/jv_parse.c
-@@ -893,8 +893,9 @@ jv jv_parse_sized_custom_flags(const char* string, int length, int flags) {
- 
-   if (!jv_is_valid(value) && jv_invalid_has_msg(jv_copy(value))) {
-     jv msg = jv_invalid_get_msg(value);
--    value = jv_invalid_with_msg(jv_string_fmt("%s (while parsing '%s')",
-+    value = jv_invalid_with_msg(jv_string_fmt("%s (while parsing '%.*s')",
-                                               jv_string_value(msg),
-+                                              length,
-                                               string));
-     jv_free(msg);
-   }
diff --git a/pkgs/by-name/jq/jq/CVE-2026-40164.patch b/pkgs/by-name/jq/jq/CVE-2026-40164.patch
deleted file mode 100644
index 483316f64b4b..000000000000
--- a/pkgs/by-name/jq/jq/CVE-2026-40164.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 Mon Sep 17 00:00:00 2001
-From: itchyny <itchyny@cybozu.co.jp>
-Date: Mon, 13 Apr 2026 08:53:26 +0900
-Subject: [PATCH] Randomize hash seed to mitigate hash collision DoS attacks
-
-The hash function used a fixed seed, allowing attackers to craft colliding keys
-and cause O(n^2) object parsing performance. Initialize the seed from a random
-source at process startup to prevent the attack. This fixes CVE-2026-40164.
-
-Co-authored-by: Asaf Meizner <asafmeizner@gmail.com>
----
- configure.ac |  2 ++
- src/jv.c     | 34 ++++++++++++++++++++++++++++++++--
- 2 files changed, 34 insertions(+), 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 5dac42655a..f7067a4341 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -149,6 +149,8 @@ AC_CHECK_MEMBER([struct tm.tm_gmtoff], [AC_DEFINE([HAVE_TM_TM_GMT_OFF],1,[Define
- AC_CHECK_MEMBER([struct tm.__tm_gmtoff], [AC_DEFINE([HAVE_TM___TM_GMT_OFF],1,[Define to 1 if the system has the __tm_gmt_off field in struct tm])],
-                 [], [[#include <time.h>]])
- AC_FIND_FUNC([setlocale], [c], [#include <locale.h>], [0,0])
-+AC_FIND_FUNC([arc4random], [c], [#include <stdlib.h>], [])
-+AC_FIND_FUNC([getentropy], [c], [#include <unistd.h>], [0, 0])
- 
- dnl Figure out if we have the pthread functions we actually need
- AC_FIND_FUNC_NO_LIBS([pthread_key_create], [], [#include <pthread.h>], [NULL, NULL])
-diff --git a/src/jv.c b/src/jv.c
-index 2a62b48419..607ac174f7 100644
---- a/src/jv.c
-+++ b/src/jv.c
-@@ -40,6 +40,10 @@
- #include <limits.h>
- #include <math.h>
- #include <float.h>
-+#include <time.h>
-+#include <unistd.h>
-+#include <fcntl.h>
-+#include <pthread.h>
- 
- #include "jv_alloc.h"
- #include "jv.h"
-@@ -1206,7 +1210,33 @@ static jv jvp_string_append(jv string, const char* data, uint32_t len) {
-   }
- }
- 
--static const uint32_t HASH_SEED = 0x432A9843;
-+static uint32_t hash_seed;
-+static pthread_once_t hash_seed_once = PTHREAD_ONCE_INIT;
-+
-+static void jvp_hash_seed_init(void) {
-+  uint32_t seed;
-+#if defined(HAVE_ARC4RANDOM)
-+  seed = arc4random();
-+#elif defined(HAVE_GETENTROPY)
-+  if (getentropy(&seed, sizeof(seed)) != 0)
-+    seed = (uint32_t)getpid() ^ (uint32_t)time(NULL);
-+#else
-+  int fd = open("/dev/urandom", O_RDONLY);
-+  if (fd >= 0) {
-+    if (read(fd, &seed, sizeof(seed)) != 4)
-+      seed = (uint32_t)getpid() ^ (uint32_t)time(NULL);
-+    close(fd);
-+  } else {
-+    seed = (uint32_t)getpid() ^ (uint32_t)time(NULL);
-+  }
-+#endif
-+  hash_seed = seed;
-+}
-+
-+static uint32_t jvp_hash_seed(void) {
-+  pthread_once(&hash_seed_once, jvp_hash_seed_init);
-+  return hash_seed;
-+}
- 
- static uint32_t rotl32 (uint32_t x, int8_t r){
-   return (x << r) | (x >> (32 - r));
-@@ -1225,7 +1255,7 @@ static uint32_t jvp_string_hash(jv jstr) {
-   int len = (int)jvp_string_length(str);
-   const int nblocks = len / 4;
- 
--  uint32_t h1 = HASH_SEED;
-+  uint32_t h1 = jvp_hash_seed();
- 
-   const uint32_t c1 = 0xcc9e2d51;
-   const uint32_t c2 = 0x1b873593;
diff --git a/pkgs/by-name/jq/jq/musl.patch b/pkgs/by-name/jq/jq/musl.patch
deleted file mode 100644
index 3632899882e7..000000000000
--- a/pkgs/by-name/jq/jq/musl.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 63e9449a8142ce30c83fcd7e9396e5de9843774e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Thu, 3 Jul 2025 11:00:13 +0200
-Subject: [PATCH] jq.test: drop non-portable %F test
-
-%F is a non-portable GNU extension, not supported by all strptime
-implementations (for example musl's).
-
-Link: https://github.com/jqlang/jq/pull/3365
----
- tests/jq.test | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/tests/jq.test b/tests/jq.test
-index 4ecf72f..6bfb6f8 100644
---- a/tests/jq.test
-+++ b/tests/jq.test
-@@ -1848,10 +1848,6 @@ try ["OK", strflocaltime({})] catch ["KO", .]
- "2015-03-05T23:51:47Z"
- [[2015,2,5,23,51,47,4,63],1425599507]
- 
--[strptime("%FT%T")|(.,mktime)]
--"2025-06-07T08:09:10"
--[[2025,5,7,8,9,10,6,157],1749283750]
--
- # Check day-of-week and day of year computations
- # (should trip an assert if this fails)
- last(range(365 * 67)|("1970-03-01T01:02:03Z"|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime) + (86400 * .)|strftime("%Y-%m-%dT%H:%M:%SZ")|strptime("%Y-%m-%dT%H:%M:%SZ"))
--- 
-2.49.0
-
diff --git a/pkgs/by-name/jq/jq/package.nix b/pkgs/by-name/jq/jq/package.nix
index 70b6bb169fce..edf9b16ec356 100644
--- a/pkgs/by-name/jq/jq/package.nix
+++ b/pkgs/by-name/jq/jq/package.nix
@@ -14,12 +14,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jq";
-  version = "1.8.1";
+  version = "1.8.2";
 
   # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
   src = fetchurl {
     url = "https://github.com/jqlang/jq/releases/download/jq-${finalAttrs.version}/jq-${finalAttrs.version}.tar.gz";
-    hash = "sha256-K+ZOcSnOyxHVkGKQ66EK9pT7nj5/n8IIoxHcM8qDfrA=";
+    hash = "sha256-cbjW6PX+gfbG0NEQ44kiUfbOdu0JWr0xXibm4Rk6868=";
   };
 
   outputs = [
@@ -30,15 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     "out"
   ];
 
-  patches = [
-    ./musl.patch
-    ./CVE-2026-32316.patch
-    ./CVE-2026-33947.patch
-    ./CVE-2026-33948.patch
-    ./CVE-2026-39979.patch
-    ./CVE-2026-40164.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.is32bit [
+  patches = lib.optionals stdenv.hostPlatform.is32bit [
     # needed because epoch conversion test here is right at the end of 32 bit integer space
     # See also: https://github.com/jqlang/jq/blob/859a8073ee8a21f2133154eea7c2bd5e0d60837f/tests/optional.test#L15-L18
     # "-D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64" would be preferrable, but breaks with dynamic linking,

From 6a56b38c1324b2a4cb755210ea9caa77fca88035 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 21 Jun 2026 09:48:15 +0200
Subject: [PATCH 702/831] python3Packages.fasthtml: 0.12.48 -> 0.13.3

.starlette upgrade in 83ece5c3a1e broke compatibility:
https://hydra.nixos.org/build/331250021/nixlog/6/tail

Upstream fixes that v0.13.0 and updating past 0.13.3 would need resolving
 - fastcore>=1.12.41 not satisfied by version 1.12.39
(which isn't great approach for stable 26.05 which motivates this commit)
https://github.com/AnswerDotAI/fasthtml/releases
---
 pkgs/development/python-modules/fasthtml/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fasthtml/default.nix b/pkgs/development/python-modules/fasthtml/default.nix
index 3f47dd2ce5a7..12b9b77c0435 100644
--- a/pkgs/development/python-modules/fasthtml/default.nix
+++ b/pkgs/development/python-modules/fasthtml/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fasthtml";
-  version = "0.12.48";
+  version = "0.13.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AnswerDotAI";
     repo = "fasthtml";
     tag = finalAttrs.version;
-    hash = "sha256-lMAuIw4sMkS3XSG/0Bs0iQPSjMusbmjUKv0w4cINwas=";
+    hash = "sha256-PS5HGegC6pG/bJAGrKDsRYguBnNS9EDrZIjWvjErO4M=";
   };
 
   build-system = [

From 9482fd756772c8c9cc1b4c6844a73f2ed1e5f083 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:06:33 +0200
Subject: [PATCH 703/831] scribus: 1.7.2 -> 1.7.3

changelog: https://wiki.scribus.net/canvas/ChangeLog

Co-authored-by: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
---
 pkgs/by-name/sc/scribus/package.nix | 31 +++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sc/scribus/package.nix b/pkgs/by-name/sc/scribus/package.nix
index ea6dbf56309e..d8a55eb8e7d3 100644
--- a/pkgs/by-name/sc/scribus/package.nix
+++ b/pkgs/by-name/sc/scribus/package.nix
@@ -3,6 +3,7 @@
   cairo,
   cmake,
   cups,
+  fetchpatch,
   fetchurl,
   fontconfig,
   freetype,
@@ -39,11 +40,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "scribus";
 
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-nY4RzGusLNlsVTnvvXGSIv9/cOHBhZcogNn7MFHhONA=";
+    hash = "sha256-iC7lXKRJfALE4F8wrMaJ6h9IXC6AI8nrKT9RwsW+Bq0=";
   };
 
   nativeBuildInputs = [
@@ -96,6 +97,32 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [ (lib.cmakeBool "WANT_GRAPHICSMAGICK" true) ];
 
+  patches = [
+    (fetchpatch {
+      name = "fix-build-with-poppler-26.05.0.patch";
+      url = "https://github.com/scribusproject/scribus/commit/14a287fc1db2a44abfe1743260554447b31b4adf.patch";
+      hash = "sha256-bhxnyL5zWVCjkfkW67CPykLW/uqDP+n3djnRKGMyhjw=";
+    })
+    (fetchpatch {
+      # required for the next patch to apply cleanly
+      url = "https://github.com/scribusproject/scribus/commit/3aed8aa40d01d1affd2b55b107b48878d4b06eab.patch";
+      includes = [ "scribus/plugins/import/pdf/importpdf.cpp" ];
+      hash = "sha256-tiGXGW8CnG0Tj5YaimngelvNvO3CCSa5eXc3bSKJD54=";
+    })
+    (fetchpatch {
+      name = "fix-build-with-poppler-26.06.0.patch";
+      url = "https://github.com/scribusproject/scribus/commit/2b9405a00a96a09e0183190ddc9f83d44963d4e0.patch";
+      hash = "sha256-4v+Ba+JODwNg4YLmwpFeBfIxk1j+RcZdtznPFeQ+H+w=";
+    })
+  ];
+
+  postPatch = ''
+    # revert non-whitespace changes made by the second patch, i.e.,
+    # https://github.com/scribusproject/scribus/commit/3aed8aa40d01d1affd2b55b107b48878d4b06eab
+    substituteInPlace scribus/plugins/import/pdf/importpdf.cpp \
+      --replace-fail 'QSizeF()' '"Custom"'
+  '';
+
   preFixup = ''
     qtWrapperArgs+=(
       --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"

From a638725eb90eabc13107a8f651c6f5625c83009e Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:06:58 +0200
Subject: [PATCH 704/831] inkscape: fix build with poppler 26.06.0

---
 .../graphics/inkscape/default.nix             |   8 +
 .../inkscape/fix-build-poppler-26.06.0.patch  | 487 ++++++++++++++++++
 2 files changed, 495 insertions(+)
 create mode 100644 pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch

diff --git a/pkgs/applications/graphics/inkscape/default.nix b/pkgs/applications/graphics/inkscape/default.nix
index 7a5b12418a12..ccea323f700b 100644
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -103,6 +103,14 @@ stdenv.mkDerivation (finalAttrs: {
       # Fix path to ps2pdf binary
       inherit ghostscript;
     })
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/7919
+    (fetchpatch {
+      name = "fix-build-poppler-26.05.0";
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/98828255aa0c1212329236b3ff4ac7f41efb4a67.patch";
+      hash = "sha256-ujUl0SxZyb/TyJRmq1ETNn5W8lDDNn3JqHQQQPU5klA=";
+    })
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/7968
+    ./fix-build-poppler-26.06.0.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch b/pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch
new file mode 100644
index 000000000000..e9af942188db
--- /dev/null
+++ b/pkgs/applications/graphics/inkscape/fix-build-poppler-26.06.0.patch
@@ -0,0 +1,487 @@
+From 35a470d9cbff50467cc700bc17ab2c4e8f5cf0bc Mon Sep 17 00:00:00 2001
+From: KrIr17 <elendil.krir17@gmail.com>
+Date: Mon, 8 Jun 2026 20:16:32 +0200
+Subject: [PATCH] Fix Building with Poppler 26.06.0
+
+- pdfparser: Some `const PDFRectangle *` to `const PDFRectangle &` [1]
+- pdfparser: Some `const GfxColor *` to `const GfxColor &` [2]
+- pdf-utils: Add a `getRect(const PDFRectangle &)` alongside `getRect(const
+  PDFRectangle *)`
+- poppler-cairo-font-engine: `getKey()` now returns std::string and not
+  char[], so change `strcmp` to `std::string(...).compare(...)` [3]
+- poppler-utils: `obj->dictGetKey()` etc. were removed; use
+  `obj->dict()->getKey()` instead (these have also existed in poppler
+  since the beginning, so shouldn't break any old poppler) [4,5]
+- svg-builder: `convertGfxColor` now takes `const GfxColor &` as input.
+  A convenience function taking `const GfxColor *` (for older poppler)
+  now calls the new one after confirming `color` is a valid pointer
+- svg-builder: `_addStopToGradient` now  takes `const GfxColor &` as
+  input. This was used only in `convertGfxColor` and therefore doesn't
+  need a helper function for compatibility
+- testfiles pdf-utils-test: `<poppler/*.h>` to `<*.h>` (see e3eb1210)
+- testfiles pdf-utils-test: Some `const PDFRectangle *`
+  to `const PDFRectangle &` [1]
+
+Fixes https://gitlab.com/inkscape/inkscape/-/work_items/6210
+
+Upstream Commits:
+
+[1] https://gitlab.freedesktop.org/poppler/poppler/-/commit/d50a4510
+[2] https://gitlab.freedesktop.org/poppler/poppler/-/commit/0f94f530
+[3] https://gitlab.freedesktop.org/poppler/poppler/-/commit/a3de7f8a
+[4] https://gitlab.freedesktop.org/poppler/poppler/-/commit/bb13b0f5
+[5] https://gitlab.freedesktop.org/poppler/poppler/-/commit/8ae0f8e7
+---
+ src/extension/internal/pdfinput/pdf-input.cpp | 14 +++++-
+ .../internal/pdfinput/pdf-parser.cpp          | 45 ++++++++++---------
+ src/extension/internal/pdfinput/pdf-parser.h  |  4 +-
+ src/extension/internal/pdfinput/pdf-utils.cpp |  5 +++
+ src/extension/internal/pdfinput/pdf-utils.h   |  1 +
+ .../pdfinput/poppler-cairo-font-engine.cpp    |  2 +-
+ .../pdfinput/poppler-transition-api.h         | 16 +++++++
+ .../internal/pdfinput/poppler-utils.cpp       | 20 +++++----
+ .../internal/pdfinput/svg-builder.cpp         | 36 +++++++++------
+ src/extension/internal/pdfinput/svg-builder.h |  3 +-
+ testfiles/src/pdf-utils-test.cpp              |  7 +--
+ 11 files changed, 100 insertions(+), 53 deletions(-)
+
+diff --git a/src/extension/internal/pdfinput/pdf-input.cpp b/src/extension/internal/pdfinput/pdf-input.cpp
+index aa4285b01d..dc5394c3d8 100644
+--- a/src/extension/internal/pdfinput/pdf-input.cpp
++++ b/src/extension/internal/pdfinput/pdf-input.cpp
+@@ -820,7 +820,11 @@ PdfInput::add_builder_page(std::shared_ptr<PDFDoc>pdf_doc, SvgBuilder *builder,
+     }
+ 
+     // Apply crop settings
++#if POPPLER_CHECK_VERSION(26, 2, 0)
++    std::optional<PDFRectangle> clipToBox;
++#else
+     _POPPLER_CONST PDFRectangle *clipToBox = nullptr;
++#endif
+ 
+     if (crop_to == "media-box") {
+         clipToBox = page->getMediaBox();
+@@ -834,8 +838,16 @@ PdfInput::add_builder_page(std::shared_ptr<PDFDoc>pdf_doc, SvgBuilder *builder,
+         clipToBox = page->getArtBox();
+     }
+ 
++    std::optional<PDFRectangle> cropBox;
++#if POPPLER_CHECK_VERSION(26, 2, 0)
++    cropBox = clipToBox;
++#else
++    if (clipToBox) {
++        cropBox = *clipToBox;
++    }
++#endif
+     // Create parser  (extension/internal/pdfinput/pdf-parser.h)
+-    auto pdf_parser = PdfParser(pdf_doc, builder, page, clipToBox);
++    auto pdf_parser = PdfParser(pdf_doc, builder, page, cropBox);
+ 
+     // Set up approximation precision for parser. Used for converting Mesh Gradients into tiles.
+     if ( color_delta <= 0.0 ) {
+diff --git a/src/extension/internal/pdfinput/pdf-parser.cpp b/src/extension/internal/pdfinput/pdf-parser.cpp
+index b336c48ce3..86fc51b1f2 100644
+--- a/src/extension/internal/pdfinput/pdf-parser.cpp
++++ b/src/extension/internal/pdfinput/pdf-parser.cpp
+@@ -43,6 +43,7 @@
+ #include <poppler/GlobalParams.h>
+ #include <poppler/Lexer.h>
+ #include <poppler/Object.h>
++#include <poppler/OptionalContent.h>
+ #include <poppler/OutputDev.h>
+ #include <poppler/PDFDoc.h>
+ #include <poppler/Page.h>
+@@ -264,7 +265,7 @@ GfxPatch blankPatch()
+ //------------------------------------------------------------------------
+ 
+ PdfParser::PdfParser(std::shared_ptr<PDFDoc> pdf_doc, Inkscape::Extension::Internal::SvgBuilder *builderA, Page *page,
+-                     _POPPLER_CONST PDFRectangle *cropBox)
++                     const std::optional<PDFRectangle> &cropBox)
+     : _pdf_doc(pdf_doc)
+     , xref(pdf_doc->getXRef())
+     , builder(builderA)
+@@ -307,8 +308,8 @@ PdfParser::PdfParser(std::shared_ptr<PDFDoc> pdf_doc, Inkscape::Extension::Inter
+     builder->setMargins(getRect(page->getTrimBox()) * scale,
+                         getRect(page->getArtBox()) * scale,
+                         getRect(page->getBleedBox()) * scale);
+-    if (cropBox && getRect(cropBox) != page_box) {
+-        builder->cropPage(getRect(cropBox) * scale);
++     if (cropBox && getRect(*cropBox) != page_box) {
++         builder->cropPage(getRect(*cropBox) * scale);
+     }
+ 
+     saveState();
+@@ -331,7 +332,7 @@ PdfParser::PdfParser(XRef *xrefA, Inkscape::Extension::Internal::SvgBuilder *bui
+     , printCommands(false)
+     , res(new GfxResources(xref, resDict, nullptr))
+     , // start the resource stack
+-    state(new GfxState(72, 72, box, 0, false))
++    state(new _POPPLER_GFX_STATE(72, 72, *box, 0, false))
+     , fontChanged(gFalse)
+     , clip(clipNone)
+     , ignoreUndef(0)
+@@ -964,7 +965,7 @@ void PdfParser::opSetFillGray(Object args[], int /*numArgs*/)
+   state->setFillPattern(nullptr);
+   state->setFillColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(std::make_unique<GfxDeviceGrayColorSpace>()));
+   color.c[0] = dblToCol(args[0].getNum());
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -976,7 +977,7 @@ void PdfParser::opSetStrokeGray(Object args[], int /*numArgs*/)
+   state->setStrokePattern(nullptr);
+   state->setStrokeColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(std::make_unique<GfxDeviceGrayColorSpace>()));
+   color.c[0] = dblToCol(args[0].getNum());
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -991,7 +992,7 @@ void PdfParser::opSetFillCMYKColor(Object args[], int /*numArgs*/)
+   for (i = 0; i < 4; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1005,7 +1006,7 @@ void PdfParser::opSetStrokeCMYKColor(Object args[], int /*numArgs*/)
+   for (int i = 0; i < 4; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1019,7 +1020,7 @@ void PdfParser::opSetFillRGBColor(Object args[], int /*numArgs*/)
+   for (int i = 0; i < 3; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1032,7 +1033,7 @@ void PdfParser::opSetStrokeRGBColor(Object args[], int /*numArgs*/) {
+   for (int i = 0; i < 3; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1048,7 +1049,7 @@ void PdfParser::opSetFillColorSpace(Object args[], int numArgs)
+     GfxColor color;
+     colorSpace->getDefaultColor(&color);
+     state->setFillColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(colorSpace));
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     builder->updateStyle(state);
+   } else {
+     error(errSyntaxError, getPos(), "Bad color space (fill)");
+@@ -1069,7 +1070,7 @@ void PdfParser::opSetStrokeColorSpace(Object args[], int numArgs)
+     GfxColor color;
+     colorSpace->getDefaultColor(&color);
+     state->setStrokeColorSpace(_POPPLER_CONSUME_UNIQPTR_ARG(colorSpace));
+-    state->setStrokeColor(&color);
++    state->_POPPLER_SET_STROKE_COLOR(color);
+     builder->updateStyle(state);
+   } else {
+     error(errSyntaxError, getPos(), "Bad color space (stroke)");
+@@ -1089,7 +1090,7 @@ void PdfParser::opSetFillColor(Object args[], int numArgs) {
+   for (i = 0; i < numArgs; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setFillColor(&color);
++  state->_POPPLER_SET_FILL_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1106,7 +1107,7 @@ void PdfParser::opSetStrokeColor(Object args[], int numArgs) {
+   for (i = 0; i < numArgs; ++i) {
+     color.c[i] = dblToCol(args[i].getNum());
+   }
+-  state->setStrokeColor(&color);
++  state->_POPPLER_SET_STROKE_COLOR(color);
+   builder->updateStyle(state);
+ }
+ 
+@@ -1127,7 +1128,7 @@ void PdfParser::opSetFillColorN(Object args[], int numArgs) {
+ 	  color.c[i] = dblToCol(args[i].getNum());
+ 	}
+       }
+-      state->setFillColor(&color);
++      state->_POPPLER_SET_FILL_COLOR(color);
+       builder->updateStyle(state);
+     }
+     if (auto pattern = lookupPattern(&(args[numArgs - 1]), state)) {
+@@ -1146,7 +1147,7 @@ void PdfParser::opSetFillColorN(Object args[], int numArgs) {
+ 	color.c[i] = dblToCol(args[i].getNum());
+       }
+     }
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     builder->updateStyle(state);
+   }
+ }
+@@ -1170,7 +1171,7 @@ void PdfParser::opSetStrokeColorN(Object args[], int numArgs) {
+ 	  color.c[i] = dblToCol(args[i].getNum());
+ 	}
+       }
+-      state->setStrokeColor(&color);
++      state->_POPPLER_SET_STROKE_COLOR(color);
+       builder->updateStyle(state);
+     }
+     if (auto pattern = lookupPattern(&(args[numArgs - 1]), state)) {
+@@ -1189,7 +1190,7 @@ void PdfParser::opSetStrokeColorN(Object args[], int numArgs) {
+ 	color.c[i] = dblToCol(args[i].getNum());
+       }
+     }
+-    state->setStrokeColor(&color);
++    state->_POPPLER_SET_STROKE_COLOR(color);
+     builder->updateStyle(state);
+   }
+ }
+@@ -1673,7 +1674,7 @@ void PdfParser::doFunctionShFill1(GfxFunctionShading *shading,
+ 
+     // use the center color
+     shading->getColor(xM, yM, &fillColor);
+-    state->setFillColor(&fillColor);
++    state->_POPPLER_SET_FILL_COLOR(fillColor);
+ 
+     // fill the rectangle
+     state->moveTo(x0 * matrix[0] + y0 * matrix[2] + matrix[4],
+@@ -1799,7 +1800,7 @@ void PdfParser::gouraudFillTriangle(double x0, double y0, GfxColor *color0,
+     }
+   }
+   if (i == nComps || depth == maxDepths[pdfGouraudTriangleShading-1]) {
+-    state->setFillColor(color0);
++    state->_POPPLER_SET_FILL_COLOR(*color0);
+     state->moveTo(x0, y0);
+     state->lineTo(x1, y1);
+     state->lineTo(x2, y2);
+@@ -1877,7 +1878,7 @@ void PdfParser::fillPatch(_POPPLER_CONST GfxPatch *patch, int nComps, int depth)
+     color.c[i] = GfxColorComp(patch->color[0][0].c[i]);
+   }
+   if (i == nComps || depth == maxDepths[pdfPatchMeshShading-1]) {
+-    state->setFillColor(&color);
++    state->_POPPLER_SET_FILL_COLOR(color);
+     state->moveTo(patch->x[0][0], patch->y[0][0]);
+     state->curveTo(patch->x[0][1], patch->y[0][1],
+                   patch->x[0][2], patch->y[0][2],
+diff --git a/src/extension/internal/pdfinput/pdf-parser.h b/src/extension/internal/pdfinput/pdf-parser.h
+index 098ff26e26..29dd259167 100644
+--- a/src/extension/internal/pdfinput/pdf-parser.h
++++ b/src/extension/internal/pdfinput/pdf-parser.h
+@@ -113,8 +113,8 @@ struct OpHistoryEntry {
+ class PdfParser {
+ public:
+ 
+-  // Constructor for regular output.
+-    PdfParser(std::shared_ptr<PDFDoc> pdf_doc, SvgBuilder *builderA, Page *page, _POPPLER_CONST PDFRectangle *cropBox);
++    // Constructor for regular output.
++    PdfParser(std::shared_ptr<PDFDoc> pdf_doc, SvgBuilder *builderA, Page *page, const std::optional<PDFRectangle> &cropBox);
+     // Constructor for a sub-page object.
+     PdfParser(XRef *xrefA, SvgBuilder *builderA, Dict *resDict, _POPPLER_CONST PDFRectangle *box);
+ 
+diff --git a/src/extension/internal/pdfinput/pdf-utils.cpp b/src/extension/internal/pdfinput/pdf-utils.cpp
+index 22e5df62c8..3aa6c02d3c 100644
+--- a/src/extension/internal/pdfinput/pdf-utils.cpp
++++ b/src/extension/internal/pdfinput/pdf-utils.cpp
+@@ -133,6 +133,11 @@ Geom::Rect getRect(_POPPLER_CONST PDFRectangle *box)
+     return Geom::Rect(box->x1, box->y1, box->x2, box->y2);
+ }
+ 
++Geom::Rect getRect(const PDFRectangle &box)
++{
++    return Geom::Rect(box.x1, box.y1, box.x2, box.y2);
++}
++
+ Geom::PathVector getPathV(GfxPath *path) 
+ {
+     if (!path) {
+diff --git a/src/extension/internal/pdfinput/pdf-utils.h b/src/extension/internal/pdfinput/pdf-utils.h
+index d259a8c2f7..30e9b5bf86 100644
+--- a/src/extension/internal/pdfinput/pdf-utils.h
++++ b/src/extension/internal/pdfinput/pdf-utils.h
+@@ -59,6 +59,7 @@ private:
+ };
+ 
+ Geom::Rect getRect(_POPPLER_CONST PDFRectangle *box);
++Geom::Rect getRect(_POPPLER_CONST PDFRectangle &box);
+ Geom::PathVector getPathV(GfxPath *gPath);
+ 
+ #endif /* PDF_UTILS_H */
+diff --git a/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp b/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
+index 19ebd26693..39ce22af38 100644
+--- a/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
++++ b/src/extension/internal/pdfinput/poppler-cairo-font-engine.cpp
+@@ -713,7 +713,7 @@ CairoType3Font *CairoType3Font::create(GfxFont *gfxFont, PDFDoc *doc, CairoFontE
+         codeToGID[i] = 0;
+         if (charProcs && (name = enc[i])) {
+             for (int j = 0; j < charProcs->getLength(); j++) {
+-                if (strcmp(name, charProcs->getKey(j)) == 0) {
++                if (std::string(charProcs->getKey(j)).compare(name) == 0) {
+                     codeToGID[i] = j;
+                 }
+             }
+diff --git a/src/extension/internal/pdfinput/poppler-transition-api.h b/src/extension/internal/pdfinput/poppler-transition-api.h
+index d69829d512..23550a3068 100644
+--- a/src/extension/internal/pdfinput/poppler-transition-api.h
++++ b/src/extension/internal/pdfinput/poppler-transition-api.h
+@@ -15,6 +15,22 @@
+ #include <glib/poppler-features.h>
+ #include <UTF.h>
+ 
++#if POPPLER_CHECK_VERSION(26, 6, 0)
++#define _POPPLER_GET_GRAY(color, gray) getGray(color, gray)
++#define _POPPLER_GET_RGB(color, rgb) getRGB(color, rgb)
++#define _POPPLER_GET_CMYK(color, cmyk) getCMYK(color, cmyk)
++#define _POPPLER_SET_FILL_COLOR(color) setFillColor(color)
++#define _POPPLER_SET_STROKE_COLOR(color) setStrokeColor(color)
++#define _POPPLER_GFX_STATE(h, v, Rect, rotateA, upsideDown) GfxState(h, v, Rect, rotateA, upsideDown)
++#else
++#define _POPPLER_GET_GRAY(color, gray) getGray(&color, gray)
++#define _POPPLER_GET_RGB(color, rgb) getRGB(&color, rgb)
++#define _POPPLER_GET_CMYK(color, cmyk) getCMYK(&color, cmyk)
++#define _POPPLER_SET_FILL_COLOR(color) setFillColor(&color)
++#define _POPPLER_SET_STROKE_COLOR(color) setStrokeColor(&color)
++#define _POPPLER_GFX_STATE(h, v, Rect, rotateA, upsideDown) GfxState(h, v, &Rect, rotateA, upsideDown)
++#endif
++
+ #if POPPLER_CHECK_VERSION(26, 2, 0)
+ #define _POPPLER_WMODE GfxFont::WritingMode
+ #define _POPPLER_WMODE_HORIZONTAL GfxFont::WritingMode::Horizontal
+diff --git a/src/extension/internal/pdfinput/poppler-utils.cpp b/src/extension/internal/pdfinput/poppler-utils.cpp
+index 2338dbe2d9..66dcf85e1d 100644
+--- a/src/extension/internal/pdfinput/poppler-utils.cpp
++++ b/src/extension/internal/pdfinput/poppler-utils.cpp
+@@ -196,15 +196,17 @@ void InkFontDict::hashFontObject1(const Object *obj, FNVHash *h)
+                 hashFontObject1(&obj2, h);
+             }
+             break;
+-        case objDict:
+-            h->hash('d');
+-            n = obj->dictGetLength();
+-            h->hash((char *)&n, sizeof(int));
+-            for (i = 0; i < n; ++i) {
+-                p = obj->dictGetKey(i);
+-                h->hash(p, (int)strlen(p));
+-                const Object &obj2 = obj->dictGetValNF(i);
+-                hashFontObject1(&obj2, h);
++        case objDict: {
++                h->hash('d');
++                auto objdict = obj->getDict();
++                n = objdict->getLength();
++                h->hash((char *)&n, sizeof(int));
++                for (i = 0; i < n; ++i) {
++                    auto p = std::string(objdict->getKey(i));
++                    h->hash(p.c_str(), p.length());
++                    const Object &obj2 = objdict->getValNF(i);
++                    hashFontObject1(&obj2, h);
++                }
+             }
+             break;
+         case objStream:
+diff --git a/src/extension/internal/pdfinput/svg-builder.cpp b/src/extension/internal/pdfinput/svg-builder.cpp
+index 3dfdfbbed4..bf7ccf1a8b 100644
+--- a/src/extension/internal/pdfinput/svg-builder.cpp
++++ b/src/extension/internal/pdfinput/svg-builder.cpp
+@@ -392,7 +392,15 @@ static std::string svgConvertGfxRGB(GfxRGB *color)
+     return svgConvertRGBToText(r, g, b);
+ }
+ 
+-std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *space)
++// for poppler < 26.06.0
++std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *space) {
++    if (!color) {
++        return "";
++    }
++    return convertGfxColor(*color, space);
++}
++
++std::string SvgBuilder::convertGfxColor(const GfxColor &color, GfxColorSpace *space)
+ {
+     std::string icc = "";
+     switch (space->getMode()) {
+@@ -419,7 +427,7 @@ std::string SvgBuilder::convertGfxColor(const GfxColor *color, GfxColorSpace *sp
+         Inkscape::CSSOStringStream icc_color;
+         icc_color << rgb_color << " icc-color(" << icc;
+         for (int i = 0; i < space->getNComps(); ++i) {
+-            icc_color << ", " << colToDbl((*color).c[i]);
++            icc_color << ", " << colToDbl((color).c[i]);
+         }
+         icc_color << ");";
+         return icc_color.str();
+@@ -1204,7 +1212,7 @@ gchar *SvgBuilder::_createGradient(GfxShading *shading, const Geom::Affine pat_m
+ /**
+  * \brief Adds a stop with the given properties to the gradient's representation
+  */
+-void SvgBuilder::_addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor *color, GfxColorSpace *space,
++void SvgBuilder::_addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor &color, GfxColorSpace *space,
+                                     double opacity)
+ {
+     Inkscape::XML::Node *stop = _xml_doc->createElement("svg:stop");
+@@ -1255,8 +1263,8 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+         if (!svgGetShadingColor(shading, 0.0, &stop1) || !svgGetShadingColor(shading, 1.0, &stop2)) {
+             return false;
+         } else {
+-            _addStopToGradient(gradient, 0.0, &stop1, space, 1.0);
+-            _addStopToGradient(gradient, 1.0, &stop2, space, 1.0);
++            _addStopToGradient(gradient, 0.0, stop1, space, 1.0);
++            _addStopToGradient(gradient, 1.0, stop2, space, 1.0);
+         }
+     } else if (type == _POPPLER_FUNCTION_TYPE_STITCHING) {
+         auto stitchingFunc = static_cast<_POPPLER_CONST StitchingFunction*>(func);
+@@ -1269,7 +1277,7 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+         // Add stops from all the stitched functions
+         GfxColor prev_color, color;
+         svgGetShadingColor(shading, bounds[0], &prev_color);
+-        _addStopToGradient(gradient, bounds[0], &prev_color, space, 1.0);
++        _addStopToGradient(gradient, bounds[0], prev_color, space, 1.0);
+         for ( int i = 0 ; i < num_funcs ; i++ ) {
+             svgGetShadingColor(shading, bounds[i + 1], &color);
+             // Add stops
+@@ -1279,14 +1287,14 @@ bool SvgBuilder::_addGradientStops(Inkscape::XML::Node *gradient, GfxShading *sh
+                     expE = (bounds[i + 1] - bounds[i])/expE;    // approximate exponential as a single straight line at x=1
+                     if (encode[2*i] == 0) {    // normal sequence
+                         auto offset = (bounds[i + 1] - expE) / max_bound;
+-                        _addStopToGradient(gradient, offset, &prev_color, space, 1.0);
++                        _addStopToGradient(gradient, offset, prev_color, space, 1.0);
+                     } else {                   // reflected sequence
+                         auto offset = (bounds[i] + expE) / max_bound;
+-                        _addStopToGradient(gradient, offset, &color, space, 1.0);
++                        _addStopToGradient(gradient, offset, color, space, 1.0);
+                     }
+                 }
+             }
+-            _addStopToGradient(gradient, bounds[i + 1] / max_bound, &color, space, 1.0);
++            _addStopToGradient(gradient, bounds[i + 1] / max_bound, color, space, 1.0);
+             prev_color = color;
+         }
+     } else { // Unsupported function type
+diff --git a/src/extension/internal/pdfinput/svg-builder.h b/src/extension/internal/pdfinput/svg-builder.h
+index c4b217f58e..348f3a2ce3 100644
+--- a/src/extension/internal/pdfinput/svg-builder.h
++++ b/src/extension/internal/pdfinput/svg-builder.h
+@@ -186,7 +186,7 @@ private:
+     // Pattern creation
+     gchar *_createPattern(GfxPattern *pattern, GfxState *state, bool is_stroke=false);
+     gchar *_createGradient(GfxShading *shading, const Geom::Affine pat_matrix, bool for_shading = false);
+-    void _addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor *color, GfxColorSpace *space,
++    void _addStopToGradient(Inkscape::XML::Node *gradient, double offset, GfxColor &color, GfxColorSpace *space,
+                             double opacity);
+     bool _addGradientStops(Inkscape::XML::Node *gradient, GfxShading *shading,
+                            _POPPLER_CONST Function *func);
+@@ -239,6 +239,7 @@ private:
+     static bool _attrEqual(Inkscape::XML::Node *a, Inkscape::XML::Node *b, char const *attr);
+ 
+     // Colors
++    std::string convertGfxColor(const GfxColor &color, GfxColorSpace *space);
+     std::string convertGfxColor(const GfxColor *color, GfxColorSpace *space);
+     std::string _getColorProfile(cmsHPROFILE hp);
+ 

From a2e1ce512230df392b976cb54941c11a722fc645 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:08:00 +0200
Subject: [PATCH 705/831] libreoffice: fix build with poppler 26.06.0

---
 .../office/libreoffice/default.nix            | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
index 75880b33f528..74eeadee0ef3 100644
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@@ -397,6 +397,34 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Don't detect Qt paths from qmake, so our patched-in onese are used
     ./dont-detect-qt-paths-from-qmake.patch
+
+    # Fix build with Poppler 26.02
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.02.0.patch";
+      hash = "sha256-IInhSoqTemDITB+AtkvVa9eGbodTbUGSpMMpC9N/mmg=";
+    })
+    # Fix build with Poppler 26.04
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.04.0.patch";
+      hash = "sha256-I9owj/NTCTi6ISszuasH410NLlhunPn/Ig22tenu8tw=";
+    })
+    # Fix build with Poppler 26.05
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.05.0.patch";
+      hash = "sha256-7wdiciTf/LrTk0MibBBYGliWRCvK1rtTGESgH7db1I4=";
+    })
+    # Fix build with Poppler 26.06
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-3/fix_build_with_poppler_26.06.0.patch";
+      hash = "sha256-j66IsrzaqQ55MRVzhlw25guuoDtxx1D4XeJsBhgWP2c=";
+    })
+  ]
+  ++ lib.optionals (variant != "fresh") [
+    # Fix build with Poppler 26.01
+    (fetchpatch2 {
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/25.8.7-2/fix_build_with_poppler_26.01.0.patch";
+      hash = "sha256-5JTTvJFIV5MG0Gz7y46wAr3q9tWdSVoZ9TJQlMJVqBc=";
+    })
   ]
   ++ lib.optionals (variant != "collabora" && variant != "collabora-coda") [
     # Revert part of https://github.com/LibreOffice/core/commit/6f60670877208612b5ea320b3677480ef6508abb that broke zlib linking

From 356c27549af413b6a5cf842a9b133d09868ad980 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:08:40 +0200
Subject: [PATCH 706/831] kdePackages.calligra: fix build with poppler 26.04.0

---
 pkgs/kde/gear/calligra/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/kde/gear/calligra/default.nix b/pkgs/kde/gear/calligra/default.nix
index 4e816b99551e..cbd17e8fc688 100644
--- a/pkgs/kde/gear/calligra/default.nix
+++ b/pkgs/kde/gear/calligra/default.nix
@@ -1,6 +1,7 @@
 {
   mkKdeDerivation,
   lib,
+  fetchpatch,
   boost,
   eigen,
   gsl,
@@ -26,6 +27,14 @@
 mkKdeDerivation {
   pname = "calligra";
 
+  patches = [
+    # Fix build with Poppler 26.04
+    (fetchpatch {
+      url = "https://invent.kde.org/office/calligra/-/commit/e9aae90db47ca87d639b8f2b17ec75c1b6093e27.patch";
+      hash = "sha256-V21Bw0xV/E4a9v8Yrt0vZ3AU1LJFHul1k92u+nsp85I=";
+    })
+  ];
+
   extraBuildInputs = [
     boost
     eigen

From a18a24775c6999cc49a766ebf5f04bcdb7953e1c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 09:31:25 -0700
Subject: [PATCH 707/831] python3Packages.pyturbojpeg: 2.2.0 -> 2.3.0

Diff: https://github.com/lilohuang/PyTurboJPEG/compare/v2.2.0...v2.3.0

Changelog: https://github.com/lilohuang/PyTurboJPEG/releases/tag/v2.3.0
---
 pkgs/development/python-modules/pyturbojpeg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyturbojpeg/default.nix b/pkgs/development/python-modules/pyturbojpeg/default.nix
index 05d24e31f8d4..f6aa0ba577f3 100644
--- a/pkgs/development/python-modules/pyturbojpeg/default.nix
+++ b/pkgs/development/python-modules/pyturbojpeg/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyturbojpeg";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lilohuang";
     repo = "PyTurboJPEG";
     tag = "v${version}";
-    hash = "sha256-Sue8S/2/dY3aF7fihHuqpHXotcXcijcqAXGCJn8Z5VE=";
+    hash = "sha256-rMn5NmiwKhyj4U9kyyRf9ZheVnETpixZoL/AVlBlImQ=";
   };
 
   patches = [

From c6adddfbc2c8de7336cbf9f2b6e3daf5433600cd Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:36:03 +0000
Subject: [PATCH 708/831] lib/systems/flake-systems: drop `x86_64-darwin`

---
 flake.nix                     | 30 +++++++++++++++++++-----------
 lib/systems/flake-systems.nix |  1 -
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/flake.nix b/flake.nix
index b8e348845bc8..6c3321e8c7fe 100644
--- a/flake.nix
+++ b/flake.nix
@@ -220,17 +220,25 @@
         evaluation. Evaluating the attribute value tends to require a significant
         amount of computation, even considering lazy evaluation.
       */
-      legacyPackages = forAllSystems (
-        system:
-        (import ./. {
-          inherit system;
-          overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
-            (final: prev: {
-              lib = prev.lib.extend libVersionInfoOverlay;
-            })
-          ];
-        })
-      );
+      legacyPackages =
+        let
+          # We include `x86_64-darwin` here to ensure that users get a
+          # good error message for the 26.11 deprecation of the platform,
+          # while excluding it from `lib.systems.flakeExposed` so that we
+          # don’t break `nix flake check` for downstream users.
+          forAllSystems' = lib.genAttrs (lib.systems.flakeExposed ++ [ "x86_64-darwin" ]);
+        in
+        forAllSystems' (
+          system:
+          (import ./. {
+            inherit system;
+            overlays = import ./pkgs/top-level/impure-overlays.nix ++ [
+              (final: prev: {
+                lib = prev.lib.extend libVersionInfoOverlay;
+              })
+            ];
+          })
+        );
 
       /**
         Optional modules that can be imported into a NixOS configuration.
diff --git a/lib/systems/flake-systems.nix b/lib/systems/flake-systems.nix
index 851dc1af7181..1589ff23baa4 100644
--- a/lib/systems/flake-systems.nix
+++ b/lib/systems/flake-systems.nix
@@ -11,7 +11,6 @@
   "x86_64-linux"
   # Tier 2
   "aarch64-linux"
-  "x86_64-darwin"
   # Tier 3
   "armv6l-linux"
   "armv7l-linux"

From 45dd7d3fb24b79355670982f665d1da7778135d8 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 02:25:26 +0000
Subject: [PATCH 709/831] release: stop building for `x86_64-darwin`

---
 doc/preface.chapter.md                        |  2 +-
 doc/using/platform-support.chapter.md         |  5 +-
 .../nixpkgs-basic-release-checks.nix          |  6 +-
 pkgs/top-level/release-haskell.nix            |  5 +-
 pkgs/top-level/release-supported-systems.json |  3 +-
 pkgs/top-level/release.nix                    | 88 +++----------------
 6 files changed, 18 insertions(+), 91 deletions(-)

diff --git a/doc/preface.chapter.md b/doc/preface.chapter.md
index a4ff07bf5a63..30722e9fcdaa 100644
--- a/doc/preface.chapter.md
+++ b/doc/preface.chapter.md
@@ -42,7 +42,7 @@ shows the status of tests for the `nixpkgs-unstable` channel.
 
 The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
 which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
+`x86_64-linux`, `aarch64-linux`, and `aarch64-darwin`.
 The binaries are made available via a [binary cache](https://cache.nixos.org).
 
 The current Nix expressions of the channels are available in the
diff --git a/doc/using/platform-support.chapter.md b/doc/using/platform-support.chapter.md
index d5a985c90d35..061c1b128d42 100644
--- a/doc/using/platform-support.chapter.md
+++ b/doc/using/platform-support.chapter.md
@@ -29,8 +29,7 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 | `x86_64-unknown-linux-musl`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `aarch64-unknown-linux-musl`          | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `x86_64-unknown-unknown-freebsd`      | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌\*                     |
-| `x86_64-apple-darwin`                 | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌\*                     |
+| `arm64-apple-darwin`                  | [Tier 2](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-2) | Some | ✔️            | ✔️            | ✔️                 | ❌                       |
 | `i686-unknown-linux-gnu`              | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | Limited        | ❌             | ✔️                 | ✔️                      |
 | `riscv32-unknown-linux-gnu`           | [Tier 4](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-4) | None | ❌             | ❌             | ❌                  | ✔️                      |
 | `riscv64-unknown-linux-gnu`           | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
@@ -45,5 +44,3 @@ Platform Tiers [4 through 7](https://github.com/NixOS/rfcs/blob/master/rfcs/0046
 | `powerpc64-unknown-linux-gnuabielfv2` | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
 | `powerpc64le-unknown-linux-gnu`       | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
 | `s390x-unknown-linux-gnu`             | [Tier 3](https://github.com/NixOS/rfcs/blob/master/rfcs/0046-platform-support-tiers.md#tier-3) | None | ❌             | ❌             | ✔️                 | ✔️                      |
-
-\* - Cross compiling is only supported on Darwin hosts.
diff --git a/pkgs/top-level/nixpkgs-basic-release-checks.nix b/pkgs/top-level/nixpkgs-basic-release-checks.nix
index 1c7e60655985..b12f121f2ae8 100644
--- a/pkgs/top-level/nixpkgs-basic-release-checks.nix
+++ b/pkgs/top-level/nixpkgs-basic-release-checks.nix
@@ -56,7 +56,7 @@ pkgs.runCommand "nixpkgs-release-checks"
           set -x
           nix-env -f $src \
               --show-trace --argstr system "$platform" \
-              --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+              --arg config '{ allowAliases = false; }' \
               --option lint-url-literals fatal \
               -qa --drv-path --system-filter \* --system \
               "''${opts[@]}" 2> eval-warnings.log > packages1
@@ -72,7 +72,7 @@ pkgs.runCommand "nixpkgs-release-checks"
 
         nix-env -f $src2 \
             --show-trace --argstr system "$platform" \
-            --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+            --arg config '{ allowAliases = false; }' \
             --option lint-url-literals fatal \
             -qa --drv-path --system-filter \* --system \
             "''${opts[@]}" > packages2
@@ -95,7 +95,7 @@ pkgs.runCommand "nixpkgs-release-checks"
 
         nix-env -f $src \
             --show-trace --argstr system "$platform" \
-            --arg config '{ allowAliases = false; allowDeprecatedx86_64Darwin = true; }' \
+            --arg config '{ allowAliases = false; }' \
             --option lint-url-literals fatal \
             -qa --drv-path --system-filter \* --system --meta --xml \
             "''${opts[@]}" > /dev/null
diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 6ed29a18e494..847843a8e307 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -192,7 +192,7 @@ let
   #   -> [a]  -- list of elements from which to remove
   #   -> [a]
   #
-  # > removeMany ["aarch64-linux" "x86_64-darwin"] ["aarch64-linux" "x86_64-darwin" "x86_64-linux"]
+  # > removeMany ["aarch64-linux" "aarch64-darwin"] ["aarch64-linux" "aarch64-darwin" "x86_64-linux"]
   # ["x86_64-linux"]
   removeMany = itemsToRemove: list: lib.foldr lib.remove list itemsToRemove;
 
@@ -373,7 +373,6 @@ let
             "aarch64-linux"
 
             # musl only supports linux, not darwin.
-            "x86_64-darwin"
             "aarch64-darwin"
           ]
           {
@@ -401,7 +400,6 @@ let
             "aarch64-linux" # times out on Hydra
 
             # Static doesn't work on darwin
-            "x86_64-darwin"
             "aarch64-darwin"
           ]
           {
@@ -500,7 +498,6 @@ let
               # Testing cross from x86_64-linux
               "aarch64-darwin"
               "aarch64-linux"
-              "x86_64-darwin"
             ]
             {
               haskellPackages = {
diff --git a/pkgs/top-level/release-supported-systems.json b/pkgs/top-level/release-supported-systems.json
index 44c18f1abf0e..8746d3955ce6 100644
--- a/pkgs/top-level/release-supported-systems.json
+++ b/pkgs/top-level/release-supported-systems.json
@@ -1,6 +1,5 @@
 [
   "aarch64-linux",
   "aarch64-darwin",
-  "x86_64-linux",
-  "x86_64-darwin"
+  "x86_64-linux"
 ]
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index c8b59f37e0ae..65c5490592e9 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -26,7 +26,6 @@
     "aarch64-unknown-linux-gnu"
     "aarch64-unknown-linux-musl"
     "i686-unknown-linux-gnu"
-    "x86_64-apple-darwin"
     "x86_64-unknown-linux-gnu"
     "x86_64-unknown-linux-musl"
     # we can uncomment that once our bootstrap tarballs are fixed
@@ -90,10 +89,7 @@ let
 
   inherit (release-lib.lib.attrsets) unionOfDisjoint;
 
-  supportDarwin = genAttrs [
-    "x86_64"
-    "aarch64"
-  ] (arch: elem "${arch}-darwin" supportedSystems);
+  supportDarwin = elem "aarch64-darwin" supportedSystems;
 
   nonPackageJobs = {
     tarball = import ./make-tarball.nix {
@@ -112,7 +108,7 @@ let
     metrics = import ./metrics.nix { inherit pkgs nixpkgs; };
 
     darwin-tested =
-      if supportDarwin.x86_64 || supportDarwin.aarch64 then
+      if supportDarwin then
         pkgs.releaseTools.aggregate {
           name = "nixpkgs-darwin-${jobs.tarball.version}";
           meta.description = "Release-critical builds for the Nixpkgs darwin channel";
@@ -120,49 +116,7 @@ let
             jobs.tarball
             jobs.release-checks
           ]
-          ++ optionals supportDarwin.x86_64 [
-            jobs.cabal2nix.x86_64-darwin
-            jobs.ghc.x86_64-darwin
-            jobs.git.x86_64-darwin
-            jobs.go.x86_64-darwin
-            jobs.mariadb.x86_64-darwin
-            jobs.nix.x86_64-darwin
-            jobs.nixpkgs-review.x86_64-darwin
-            jobs.nix-info.x86_64-darwin
-            jobs.nix-info-tested.x86_64-darwin
-            jobs.openssh.x86_64-darwin
-            jobs.openssl.x86_64-darwin
-            jobs.pandoc.x86_64-darwin
-            jobs.postgresql.x86_64-darwin
-            jobs.python3.x86_64-darwin
-            jobs.ruby.x86_64-darwin
-            jobs.rustc.x86_64-darwin
-            # blocking ofBorg CI 2020-02-28
-            # jobs.stack.x86_64-darwin
-            jobs.stdenv.x86_64-darwin
-            jobs.vim.x86_64-darwin
-            jobs.cachix.x86_64-darwin
-            jobs.darwin.linux-builder.x86_64-darwin
-
-            # UI apps
-            # jobs.firefox-unwrapped.x86_64-darwin
-            jobs.qt5.qtmultimedia.x86_64-darwin
-            jobs.inkscape.x86_64-darwin
-            jobs.gimp2.x86_64-darwin # FIXME replace with gimp once https://github.com/NixOS/nixpkgs/issues/411189 is resoved
-            jobs.emacs.x86_64-darwin
-            jobs.wireshark.x86_64-darwin
-
-            # Tests
-            /*
-              jobs.tests.cc-wrapper.default.x86_64-darwin
-              jobs.tests.cc-wrapper.llvmPackages.clang.x86_64-darwin
-              jobs.tests.cc-wrapper.llvmPackages.libcxx.x86_64-darwin
-              jobs.tests.stdenv-inputs.x86_64-darwin
-              jobs.tests.macOSSierraShared.x86_64-darwin
-              jobs.tests.stdenv.hooks.patch-shebangs.x86_64-darwin
-            */
-          ]
-          ++ optionals supportDarwin.aarch64 [
+          ++ optionals supportDarwin [
             jobs.cabal2nix.aarch64-darwin
             jobs.ghc.aarch64-darwin
             jobs.git.aarch64-darwin
@@ -251,33 +205,7 @@ let
         */
       ]
       ++ collect isDerivation jobs.stdenvBootstrapTools
-      ++ optionals supportDarwin.x86_64 [
-        jobs.stdenv.x86_64-darwin
-        jobs.cargo.x86_64-darwin
-        jobs.cachix.x86_64-darwin
-        jobs.devenv.x86_64-darwin
-        jobs.go.x86_64-darwin
-        jobs.python3.x86_64-darwin
-        jobs.nixpkgs-review.x86_64-darwin
-        jobs.nix.x86_64-darwin
-        jobs.nix-info.x86_64-darwin
-        jobs.nix-info-tested.x86_64-darwin
-        jobs.git.x86_64-darwin
-        jobs.mariadb.x86_64-darwin
-        jobs.vim.x86_64-darwin
-        jobs.inkscape.x86_64-darwin
-        jobs.qt5.qtmultimedia.x86_64-darwin
-        jobs.darwin.linux-builder.x86_64-darwin
-        /*
-          jobs.tests.cc-wrapper.default.x86_64-darwin
-          jobs.tests.cc-wrapper.llvmPackages.clang.x86_64-darwin
-          jobs.tests.cc-wrapper.llvmPackages.libcxx.x86_64-darwin
-          jobs.tests.stdenv-inputs.x86_64-darwin
-          jobs.tests.macOSSierraShared.x86_64-darwin
-          jobs.tests.stdenv.hooks.patch-shebangs.x86_64-darwin
-        */
-      ]
-      ++ optionals supportDarwin.aarch64 [
+      ++ optionals supportDarwin [
         jobs.stdenv.aarch64-darwin
         jobs.cargo.aarch64-darwin
         jobs.cachix.aarch64-darwin
@@ -294,7 +222,13 @@ let
         jobs.inkscape.aarch64-darwin
         jobs.qt5.qtmultimedia.aarch64-darwin
         jobs.darwin.linux-builder.aarch64-darwin
-        # consider adding tests, as suggested above for x86_64-darwin
+        /*
+          jobs.tests.cc-wrapper.default.aarch64-darwin
+          jobs.tests.cc-wrapper.llvmPackages.clang.aarch64-darwin
+          jobs.tests.cc-wrapper.llvmPackages.libcxx.aarch64-darwin
+          jobs.tests.stdenv-inputs.aarch64-darwin
+          jobs.tests.stdenv.hooks.patch-shebangs.aarch64-darwin
+        */
       ];
     };
 

From 90796a20f3161359ee63f4bd17b9d0b2f95285b7 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 02:25:26 +0000
Subject: [PATCH 710/831] top-level: add error for `x86_64-darwin` deprecation

---
 doc/redirects.json                   |  3 ++
 doc/release-notes/rl-2611.section.md | 11 +++++
 pkgs/top-level/config.nix            | 18 ++++----
 pkgs/top-level/default.nix           | 62 +++++++++++++++-------------
 4 files changed, 56 insertions(+), 38 deletions(-)

diff --git a/doc/redirects.json b/doc/redirects.json
index d21aa2dde8d0..51839e8ee9b0 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -1091,6 +1091,9 @@
   "x86_64-darwin-26.05": [
     "release-notes.html#x86_64-darwin-26.05"
   ],
+  "x86_64-darwin-26.11": [
+    "release-notes.html#x86_64-darwin-26.11"
+  ],
   "zip-files": [
     "index.html#zip-files"
   ],
diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 2d03b3d265fd..93531d9caa96 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -10,6 +10,17 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- []{#x86_64-darwin-26.11}
+
+  Support for `x86_64-darwin` has been dropped, due to Apple’s deprecation of the platform and limited build infrastructure and developer time.
+  We will no longer build packages for the platform or support building them from source.
+
+  The Nixpkgs 26.05 stable branch will still maintain platform support and binaries will be built until it goes out of support at the end of 2026.
+  Users of `x86_64-darwin` will receive an error message explaining how to switch to 26.05.
+
+  By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
+  We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
+
 - Paths under `/etc/xdg/` from packages in `environment.systemPackages` are no longer linked into the global `/etc/` by default. Modules depending on such directories must declare them explicitly using `environment.pathsToLink`.
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
diff --git a/pkgs/top-level/config.nix b/pkgs/top-level/config.nix
index f2066315efb5..d6cbb036465b 100644
--- a/pkgs/top-level/config.nix
+++ b/pkgs/top-level/config.nix
@@ -454,18 +454,18 @@ let
     };
 
     allowDeprecatedx86_64Darwin = mkOption {
-      # `force` does nothing; it’s reserved for forward compatibility
-      # with 26.11. We hide it from the documentation to avoid a
-      # footgun, as it will make the error in 26.11 less useful.
-      type = types.either types.bool (types.enum [ "force" ]) // {
-        inherit (types.bool) description descriptionClass;
-      };
+      # `true` does nothing; it silenced the warning in 26.05.
+      type = types.either types.bool (types.enum [ "force" ]);
       default = false;
       description = ''
-        Silence the warning for the upcoming deprecation of the
-        `x86_64-darwin` platform in Nixpkgs 26.11.
+        Set to `"force"` to allow evaluating for the `x86_64-darwin`
+        platform despite its deprecation in Nixpkgs 26.11.
 
-        See the [release notes](#x86_64-darwin-26.05) for more
+        This is not expected to function, and Hydra will not build
+        binaries for the platform. It is provided only as an escape
+        hatch for custom setups, and comes with no support.
+
+        See the [release notes](#x86_64-darwin-26.11) for more
         information.
       '';
     };
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index 443496f650fb..a6bbbdf680b4 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -18,25 +18,6 @@
   or dot-files.
 */
 
-let
-  # We hoist this above the closure so that the same thunk is shared
-  # between multiple imports of Nixpkgs. This ensures that commands
-  # like `nix eval nixpkgs#legacyPackages.x86_64-darwin.pkgsStatic.hello`
-  # print only one warning, which would otherwise be spammy in common
-  # scenarios that instantiate many copies of Nixpkgs.
-  #
-  # Unfortunately, flakes’ handling of transitive dependencies mean
-  # that it’s still likely users will see multiple warnings, but
-  # there’s nothing we can do about that within the constraints of the
-  # Nix language.
-  x86_64DarwinDeprecationWarning =
-    pristineLib.warn
-      "Nixpkgs 26.05 will be the last release to support x86_64-darwin; see https://nixos.org/manual/nixpkgs/unstable/release-notes#x86_64-darwin-26.05"
-      (x: x);
-
-  pristineLib = import ../../lib;
-in
-
 {
   # The system packages will be built on. See the manual for the
   # subtle division of labor between these two `*System`s and the three
@@ -74,6 +55,8 @@ let # Rename the function arguments
 
 in
 let
+  pristineLib = import ../../lib;
+
   lib =
     if __allowFileset then
       pristineLib
@@ -93,7 +76,33 @@ let
         }
       );
 
-  inherit (lib) throwIfNot;
+  inherit (lib) throwIfNot throwIf;
+
+  x86_64DarwinDeprecationMessage = ''
+    Nixpkgs 26.11 has dropped support for x86_64-darwin.
+
+    The 26.05 stable branch still supports x86_64-darwin, and will
+    receive security fixes until the end of 2026. If you use channels,
+    you can switch to 26.05 as follows:
+
+        $ sudo nix-channel --add https://nixos.org/channels/nixpkgs-26.05-darwin nixpkgs
+        $ sudo nix-channel --update
+
+    If this doesn’t work, you may need to run:
+
+        # Lack of sudo is deliberate:
+        $ nix-channel --remove nixpkgs
+
+    If you use flakes, switch your flake input:
+
+        inputs.nixpkgs = {
+          url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
+        };
+
+    See the release notes for more information and alternatives:
+
+      https://nixos.org/manual/nixpkgs/unstable/release-notes#x86_64-darwin-26.11
+  '';
 
   checked =
     (throwIfNot (lib.isList overlays) "The overlays argument to nixpkgs must be a list.")
@@ -101,15 +110,10 @@ let
       (throwIfNot (lib.isList crossOverlays) "The crossOverlays argument to nixpkgs must be a list.")
       (throwIfNot (lib.all lib.isFunction crossOverlays) "All crossOverlays passed to nixpkgs must be functions.")
       (
-        if
-          (
-            ((localSystem.isDarwin && localSystem.isx86) || (crossSystem.isDarwin && crossSystem.isx86))
-            && config.allowDeprecatedx86_64Darwin == false
-          )
-        then
-          x86_64DarwinDeprecationWarning
-        else
-          x: x
+        throwIf (
+          ((localSystem.isDarwin && localSystem.isx86) || (crossSystem.isDarwin && crossSystem.isx86))
+          && config.allowDeprecatedx86_64Darwin != "force"
+        ) x86_64DarwinDeprecationMessage
       );
 
   localSystem = lib.systems.elaborate args.localSystem;

From 0e8006c9ab1c7551e82d2395d7b8805efba1d748 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:10:14 +0000
Subject: [PATCH 711/831] pkgsx86_64Darwin: drop

---
 pkgs/top-level/aliases.nix  |  1 +
 pkgs/top-level/variants.nix | 22 ----------------------
 2 files changed, 1 insertion(+), 22 deletions(-)

diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 19b65f801709..3b394b927c5a 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1793,6 +1793,7 @@ mapAliases {
   pingvin-share = throw "'pingvin-share' has been removed as it was broken and archived upstream"; # Added 2025-11-08
   pipecontrol = throw "'pipecontrol' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   piper-train = throw "piper-train is now part of the piper package using the `withTrain` override"; # Added 2025-09-03
+  pkgsx86_64Darwin = throw "pkgsx86_64Darwin has been removed, as support for the platform has been dropped; see https://nixos.org/manual/nixpkgs/unstable/release-notes#x86_64-darwin-26.11"; # Added 2026-06-21
   plandex = throw "plandex has been removed, as it is not maintained anymore"; # Added 2026-05-18
   plandex-server = throw "plandex has been removed, as it is not maintained anymore"; # Added 2026-05-18
   plant-it = throw "plant-it backend was discontinued in september 2025"; # Added 2026-01-30
diff --git a/pkgs/top-level/variants.nix b/pkgs/top-level/variants.nix
index fb6a38029c96..5652c62986a9 100644
--- a/pkgs/top-level/variants.nix
+++ b/pkgs/top-level/variants.nix
@@ -81,28 +81,6 @@ self: super: {
     else
       throw "Musl libc only supports 64-bit Linux systems, and i686-linux.";
 
-  # x86_64-darwin packages for aarch64-darwin users to use with Rosetta for incompatible packages
-  pkgsx86_64Darwin =
-    if stdenv.hostPlatform.isDarwin then
-      nixpkgsFun {
-        overlays = [
-          (self': super': {
-            pkgsx86_64Darwin = super';
-          })
-        ]
-        ++ overlays;
-        localSystem = {
-          config = lib.systems.parse.tripleFromSystem (
-            stdenv.hostPlatform.parsed
-            // {
-              cpu = lib.systems.parse.cpuTypes.x86_64;
-            }
-          );
-        };
-      }
-    else
-      throw "x86_64 Darwin package set can only be used on Darwin systems.";
-
   # Full package set with rocm on cuda off
   # Mostly useful for asserting pkgs.pkgsRocm.torchWithRocm == pkgs.torchWithRocm and similar
   pkgsRocm = nixpkgsFun {

From 9770319c3e2acb0446f93f734decc3d2fc5e3970 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:13:46 +0000
Subject: [PATCH 712/831] release-lib: drop support for `x86_64-darwin`

---
 pkgs/top-level/release-lib.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/top-level/release-lib.nix b/pkgs/top-level/release-lib.nix
index 6bbcc48ee651..ec22e346a7ec 100644
--- a/pkgs/top-level/release-lib.nix
+++ b/pkgs/top-level/release-lib.nix
@@ -65,7 +65,6 @@ let
       pkgs_aarch64_darwin = packageSet' { system = "aarch64-darwin"; };
       pkgs_armv6l_linux = packageSet' { system = "armv6l-linux"; };
       pkgs_armv7l_linux = packageSet' { system = "armv7l-linux"; };
-      pkgs_x86_64_darwin = packageSet' { system = "x86_64-darwin"; };
       pkgs_x86_64_freebsd = packageSet' { system = "x86_64-freebsd"; };
       pkgs_i686_freebsd = packageSet' { system = "i686-freebsd"; };
       pkgs_i686_cygwin = packageSet' { system = "i686-cygwin"; };
@@ -87,8 +86,6 @@ let
       pkgs_armv6l_linux
     else if system == "armv7l-linux" then
       pkgs_armv7l_linux
-    else if system == "x86_64-darwin" then
-      pkgs_x86_64_darwin
     else if system == "x86_64-freebsd" then
       pkgs_x86_64_freebsd
     else if system == "i686-freebsd" then

From 41341de6697fee9b3a29676b90919631dbda197b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:04:56 +0000
Subject: [PATCH 713/831] lib/systems/examples: drop `x86_64-darwin`

---
 lib/systems/examples.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 055f727d53c9..ab062f82bce3 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -332,12 +332,6 @@ rec {
     platform = { };
   };
 
-  x86_64-darwin = {
-    config = "x86_64-apple-darwin";
-    xcodePlatform = "MacOSX";
-    platform = { };
-  };
-
   #
   # UEFI
   #

From bd83232593676314c15ae321c888ded2cc0da0b9 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:36:03 +0000
Subject: [PATCH 714/831] lib/systems/doubles: drop `x86_64-darwin`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This ensures that `lib.platforms.darwin` doesn’t include
`x86_64-darwin` and that the unsupported platform check will trigger
even once the bespoke deprecation error is removed. It doesn’t break
`lib.systems.elaborate "x86_64-darwin"`.
---
 doc/stdenv/cross-compilation.chapter.md | 2 +-
 lib/systems/doubles.nix                 | 1 -
 lib/tests/systems.nix                   | 2 --
 3 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/doc/stdenv/cross-compilation.chapter.md b/doc/stdenv/cross-compilation.chapter.md
index 18f3b2344607..ea707ceba677 100644
--- a/doc/stdenv/cross-compilation.chapter.md
+++ b/doc/stdenv/cross-compilation.chapter.md
@@ -50,7 +50,7 @@ The exact schema these fields follow is a bit ill-defined due to a long and conv
 
 `system`
 
-: This is a two-component shorthand for the platform. Examples of this would be "x86_64-darwin" and "i686-linux"; see `lib.systems.doubles` for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform (`[cpu]-[os]`). This format has built-in support in Nix, such as the `builtins.currentSystem` impure string.
+: This is a two-component shorthand for the platform. Examples of this would be "aarch64-darwin" and "i686-linux"; see `lib.systems.doubles` for more. The first component corresponds to the CPU architecture of the platform and the second to the operating system of the platform (`[cpu]-[os]`). This format has built-in support in Nix, such as the `builtins.currentSystem` impure string.
 
 `config`
 
diff --git a/lib/systems/doubles.nix b/lib/systems/doubles.nix
index d3e184320fbd..6c7457930e09 100644
--- a/lib/systems/doubles.nix
+++ b/lib/systems/doubles.nix
@@ -19,7 +19,6 @@ let
     "x86_64-cygwin"
 
     # Darwin
-    "x86_64-darwin"
     "aarch64-darwin"
 
     # FreeBSD
diff --git a/lib/tests/systems.nix b/lib/tests/systems.nix
index e2b9093511c6..a27861b09253 100644
--- a/lib/tests/systems.nix
+++ b/lib/tests/systems.nix
@@ -127,7 +127,6 @@ lib.runTests (
     ];
     testx86_64 = mseteq x86_64 [
       "x86_64-linux"
-      "x86_64-darwin"
       "x86_64-freebsd"
       "x86_64-genode"
       "x86_64-redox"
@@ -145,7 +144,6 @@ lib.runTests (
       "x86_64-cygwin"
     ];
     testdarwin = mseteq darwin [
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
     testfreebsd = mseteq freebsd [

From 1ddb57c89f2dfa1ce43ec0f1e0cd98771be2c966 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 13:47:00 -0700
Subject: [PATCH 715/831] imagemagick: 7.1.2-25 -> 7.1.2-26

Diff: https://github.com/ImageMagick/ImageMagick/compare/7.1.2-25...7.1.2-26

Changelog: https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
---
 pkgs/by-name/im/imagemagick/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index 896fd1c6d0b2..80b5314f5a31 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -89,13 +89,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-25";
+  version = "7.1.2-26";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-7z1oIKXZcumsESLrFRvU6z0M8JVsogG7yDWwF62jPwo=";
+    hash = "sha256-Nl4C5XLwwQviy+GsLgNfbq+Ed6gWsI/ozB3BzM8bkV8=";
   };
 
   outputs = [

From f335cf68bc16f9c97e48290538bd1aa75d01edf2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 14:17:09 -0700
Subject: [PATCH 716/831] python3Packages.grpc-google-iam-v1: 3.31.3 -> 0.14.4

Diff: https://github.com/googleapis/google-cloud-python/compare/grpc-google-iam-v1-v3.31.3...grpc-google-iam-v1-v0.14.4

Changelog: https://github.com/googleapis/google-cloud-python/blob/grpc-google-iam-v1-v0.14.4/packages/grpc-google-iam-v1/CHANGELOG.md
---
 .../python-modules/grpc-google-iam-v1/default.nix    | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
index 871ed0c66ead..51a51e67e3a7 100644
--- a/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
+++ b/pkgs/development/python-modules/grpc-google-iam-v1/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  gitUpdater,
   googleapis-common-protos,
   grpcio,
   pytestCheckHook,
@@ -10,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "grpc-google-iam-v1";
-  version = "3.31.3";
+  version = "0.14.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
-    tag = "google-cloud-build-v${version}";
-    hash = "sha256-qQ+8X6I8lt4OTgbvODsbdab2dYUk0wxWsbaVT2T651U=";
+    tag = "grpc-google-iam-v1-v${version}";
+    hash = "sha256-i2t8qtF2czaP9vgGOUN9AjQ3XhLkk8g05FtXUdk/Vng=";
   };
 
   sourceRoot = "${src.name}/packages/grpc-google-iam-v1";
@@ -42,6 +43,11 @@ buildPythonPackage rec {
     "-Wignore::DeprecationWarning"
   ];
 
+  passthru = {
+    skipBulkUpdate = true; # chooses tag for a different project
+    updateScript = gitUpdater { rev-prefix = "grpc-google-iam-v1-v"; };
+  };
+
   meta = {
     description = "GRPC library for the google-iam-v1 service";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/grpc-google-iam-v1";

From 1363f8e04535d27233fc0e54a76366733fcbd733 Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 14 Jun 2026 06:42:55 -0400
Subject: [PATCH 717/831] giflib: suppress missing symbol error on Darwin

giflib fails to build due to a missing symbol in libutil.dylib. The
included patch is based on the discussion in the upstream bug.
---
 ...ess-undefined-symbol-error-on-Darwin.patch | 25 +++++++++++++++++++
 pkgs/by-name/gi/giflib/package.nix            |  3 +++
 2 files changed, 28 insertions(+)
 create mode 100644 pkgs/by-name/gi/giflib/0001-Suppress-undefined-symbol-error-on-Darwin.patch

diff --git a/pkgs/by-name/gi/giflib/0001-Suppress-undefined-symbol-error-on-Darwin.patch b/pkgs/by-name/gi/giflib/0001-Suppress-undefined-symbol-error-on-Darwin.patch
new file mode 100644
index 000000000000..461f4d06512a
--- /dev/null
+++ b/pkgs/by-name/gi/giflib/0001-Suppress-undefined-symbol-error-on-Darwin.patch
@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Randy Eckenrode <randy@largeandhighquality.com>
+Date: Sun, 14 Jun 2026 10:49:22 -0400
+Subject: [PATCH] Suppress undefined symbol error on Darwin
+
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index f347162..720bffa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -133,7 +133,7 @@ libgif.a: $(OBJECTS) $(HEADERS)
+ 
+ $(LIBUTILSO): $(UOBJECTS) $(UHEADERS)
+ ifeq ($(UNAME), Darwin)
+-	$(CC) $(CFLAGS) -dynamiclib -current_version $(LIBVER) $(UOBJECTS) -o $(LIBUTILSO)
++	$(CC) $(CFLAGS) -dynamiclib -current_version $(LIBVER) $(UOBJECTS) -Wl,-U,_GifErrorString -o $(LIBUTILSO)
+ else
+ 	$(CC) $(CFLAGS) $(CPPLAGS) -shared $(LDFLAGS) -Wl,-soname -Wl,$(LIBUTILSOMAJOR) -o $(LIBUTILSO) $(UOBJECTS)
+ endif
+-- 
+2.54.0
+
diff --git a/pkgs/by-name/gi/giflib/package.nix b/pkgs/by-name/gi/giflib/package.nix
index b2142aa2869f..1fa7deb61a00 100644
--- a/pkgs/by-name/gi/giflib/package.nix
+++ b/pkgs/by-name/gi/giflib/package.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
+    # Fix missing symbol error on Darwin when linking libutil.dylib.
+    # Based on discussion in https://sourceforge.net/p/giflib/bugs/189/.
+    ./0001-Suppress-undefined-symbol-error-on-Darwin.patch
   ]
   ++ lib.optionals stdenv.hostPlatform.isMinGW [
     # Build dll libraries.

From e499a5c28d6ced698b485fea96b0e264f0a92ca3 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 1 Apr 2026 13:22:06 +0200
Subject: [PATCH 718/831] libnice: 0.1.22 -> 0.1.23

---
 pkgs/by-name/li/libnice/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index 6d2361b25d2e..99b58d0dc778 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libnice";
-  version = "0.1.22";
+  version = "0.1.23";
 
   outputs = [
     "bin"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
-    hash = "sha256-pfckzwnq5QxBp1FxQdidpKYeyerKMtpKAHP67VQXrX4=";
+    hash = "sha256-YY/E6N45O3GbFkHB2O7AGCbU050VrekmedIhx/Xk5w0=";
   };
 
   patches = [

From e65353450301b26d8bd129b87c0736ac5672266f Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 1 Apr 2026 13:21:21 +0200
Subject: [PATCH 719/831] gstreamer: use odd-unstable versioning

---
 pkgs/development/libraries/gstreamer/bad/default.nix         | 2 +-
 pkgs/development/libraries/gstreamer/base/default.nix        | 2 +-
 pkgs/development/libraries/gstreamer/core/default.nix        | 2 +-
 pkgs/development/libraries/gstreamer/devtools/default.nix    | 2 +-
 pkgs/development/libraries/gstreamer/ges/default.nix         | 2 +-
 pkgs/development/libraries/gstreamer/good/default.nix        | 2 +-
 pkgs/development/libraries/gstreamer/libav/default.nix       | 2 +-
 pkgs/development/libraries/gstreamer/rtsp-server/default.nix | 2 +-
 pkgs/development/libraries/gstreamer/ugly/default.nix        | 2 +-
 pkgs/development/libraries/gstreamer/vaapi/default.nix       | 2 +-
 pkgs/development/python-modules/gst-python/default.nix       | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 1b704e101443..f45bd1dddddb 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -416,7 +416,7 @@ stdenv.mkDerivation (finalAttrs: {
       };
     };
 
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 6b1b2671e381..99142f3f8f56 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -190,7 +190,7 @@ stdenv.mkDerivation (finalAttrs: {
     glEnabled = enableGl;
     waylandEnabled = enableWayland;
 
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 05409199e303..604d89f9f0aa 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -144,7 +144,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index d9c788cfdd59..0c81bee90b9c 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     updateScript =
       let
-        updateSource = directoryListingUpdater { };
+        updateSource = directoryListingUpdater { odd-unstable = true; };
 
         updateLockfile = {
           command = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 743c0e475e9a..2a93586cb97a 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 9c531daf1486..81d5a78a3062 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -292,7 +292,7 @@ stdenv.mkDerivation (finalAttrs: {
       };
     };
 
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 05319b971754..788682a76fcd 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 182433745fd4..7e03e3981e6a 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 3f225da93ed1..287d203fb2ba 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
       };
     };
 
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 903be8f1e245..1ad79efdda09 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 797f0a320a9d..ab053e13b806 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -96,7 +96,7 @@ buildPythonPackage rec {
   '';
 
   passthru = {
-    updateScript = directoryListingUpdater { };
+    updateScript = directoryListingUpdater { odd-unstable = true; };
   };
 
   meta = {

From 8e7dcb86111d57a6ab93f57c965c07dd2582ee13 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 27 Apr 2026 15:43:12 +0200
Subject: [PATCH 720/831] orc: 0.4.41 -> 0.4.42

---
 pkgs/by-name/or/orc/package.nix | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/or/orc/package.nix b/pkgs/by-name/or/orc/package.nix
index ff7b71fbb4a8..4373c742ec9c 100644
--- a/pkgs/by-name/or/orc/package.nix
+++ b/pkgs/by-name/or/orc/package.nix
@@ -4,10 +4,10 @@
   fetchurl,
   meson,
   ninja,
-  file,
-  docbook-xsl-nons,
-  gtk-doc ? null,
-  buildDevDoc ? gtk-doc != null,
+  # FIXME: hotdoc errors out due to issues discovering libclang paths
+  # See https://github.com/NixOS/nixpkgs/issues/514723
+  hotdoc,
+  buildDevDoc ? false,
 
   # for passthru.tests
   gnuradio,
@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "orc";
-  version = "0.4.41";
+  version = "0.4.42";
 
   outputs = [
     "out"
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/orc/orc-${finalAttrs.version}.tar.xz";
-    hash = "sha256-yxv9T2VSic05vARkLVl76d5UJ2I/CGHB/BnAjZhGf6I=";
+    hash = "sha256-fskSq1mvPMl4dMRWpWqK4e7FIMOF7ER+ihArK9EiyQw=";
   };
 
   postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
@@ -38,7 +38,10 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   mesonFlags = [
-    (lib.mesonEnable "gtk_doc" buildDevDoc)
+    (lib.mesonEnable "examples" false)
+    (lib.mesonEnable "benchmarks" false)
+    (lib.mesonEnable "tests" finalAttrs.finalPackage.doCheck)
+    (lib.mesonEnable "hotdoc" buildDevDoc)
   ];
 
   nativeBuildInputs = [
@@ -46,9 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
   ]
   ++ lib.optionals buildDevDoc [
-    gtk-doc
-    file
-    docbook-xsl-nons
+    hotdoc
   ];
 
   # https://gitlab.freedesktop.org/gstreamer/orc/-/issues/41
@@ -77,6 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
       bsd2
     ];
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 })

From d6af1a2833913c6fb32ff50df10e71aea8b139ba Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 1 Apr 2026 13:26:14 +0200
Subject: [PATCH 721/831] gstreamer: 1.26.11 -> 1.28.4

---
 pkgs/development/libraries/gstreamer/bad/default.nix     | 9 +++++++--
 pkgs/development/libraries/gstreamer/base/default.nix    | 4 ++--
 pkgs/development/libraries/gstreamer/core/default.nix    | 4 ++--
 .../development/libraries/gstreamer/devtools/default.nix | 6 +++---
 pkgs/development/libraries/gstreamer/ges/default.nix     | 4 ++--
 pkgs/development/libraries/gstreamer/good/default.nix    | 4 ++--
 pkgs/development/libraries/gstreamer/libav/default.nix   | 4 ++--
 .../libraries/gstreamer/rtsp-server/default.nix          | 4 ++--
 pkgs/development/libraries/gstreamer/ugly/default.nix    | 4 ++--
 9 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index f45bd1dddddb..6f1333d287db 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -115,7 +115,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-bad";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -124,7 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EQ+4J5Xw5Wmx4nsSq5aZ01x3YuH/TblTNdasjRRCrz0=";
+    hash = "sha256-MytzIPMMYPLVlBRG0DudBeN4HywlYb776IcYvXd/Dkc=";
   };
 
   patches = [
@@ -311,6 +311,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dwasapi=disabled" # not packaged in nixpkgs as of writing / no Windows support
     "-Dwasapi2=disabled" # not packaged in nixpkgs as of writing / no Windows support
     "-Dwpe=disabled" # required `wpe-webkit` library not packaged in nixpkgs as of writing
+    "-Dwpe2=disabled"
     "-Dgs=disabled" # depends on `google-cloud-cpp`
     "-Donnx=disabled" # depends on `libonnxruntime` not packaged in nixpkgs as of writing
     "-Dopenaptx=enabled" # since gstreamer-1.20.1 `libfreeaptx` is supported for circumventing the dubious license conflict with `libopenaptx`
@@ -326,6 +327,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "webrtcdsp" webrtcAudioProcessingSupport)
     (lib.mesonEnable "isac" webrtcAudioProcessingSupport)
   ]
+  ++ lib.mapAttrsToList lib.mesonEnable {
+    mpeghdec = false; # mpeghdec not packaged
+    tflite = false;
+  }
   ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
     "-Ddoc=disabled" # needs gstcuda to be enabled which is Linux-only
   ]
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 99142f3f8f56..ad2ce3e6f46b 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-base";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz";
-    hash = "sha256-/FD4hdQfXQQHzgh27HI12ee4LUjbL0vHLF8kSkrHkmM=";
+    hash = "sha256-qJiv1XZhcrAEnmeBVY4GiQmL+HudgrhGxlLlccAdYNg=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index 604d89f9f0aa..bb44c1bf6de6 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gstreamer";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "bin"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-LgvRktBDjqYGpvdqlcjhZUIWdlb/7Cwrw6r27gg3+/Y=";
+    hash = "sha256-9a3H6PRIwQJgs7JaoQHJ1UBnTI2aVMK3eobQTys7UN0=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 0c81bee90b9c..aa976bd07f21 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-devtools";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Vl9IU4jJSYr+v3gAQYPN/xATEhEoZBqlbtql6pRBK+I=";
+    hash = "sha256-EdTxGIY506l2IDkGW7t7LDCbeo7Mb6Su0SJFVovwDbM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
       cargoRoot
       ;
     name = "gst-devtools-${finalAttrs.version}";
-    hash = "sha256-sqN1IBkbrT3pQqUQKU2pr8G1t4kNMKk0NR7NH7dTvAE=";
+    hash = "sha256-5VYzDwAMyVN2HR/sS8rCwTR7UW/tt60AS7wZMjx+w74=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 2a93586cb97a..52a76936bf25 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-editing-services";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz";
-    hash = "sha256-o26HkAtErBYIYS8tYW/AMvnX2SAyfE0jGv+2/pNJcU0=";
+    hash = "sha256-b361Xlhxjd5bWGn2Ge2Q6/Owz6A3bBacG4P8dzgRkUo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 81d5a78a3062..a1f1eddc95e6 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -78,7 +78,7 @@ assert raspiCameraSupport -> hostSupportsRaspiCamera;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-good";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz";
-    hash = "sha256-AB3rCHbV10PNNEir90onrew/2FABL8sbAJlIYb1sEUU=";
+    hash = "sha256-yCXqc3xZzqDkoMQdojiARf9d0y0WIiCsk6eoLuSgTmE=";
   };
 
   patches = [
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 788682a76fcd..8d80eb36ec34 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-libav";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
-    hash = "sha256-m7PSaB7w3pLRsanZVRhiNu4i5k83Lbm/wNIuLQ3xmGU=";
+    hash = "sha256-vRel3yh0p6WLy697lAIjN5rZYTYk246teD2wPnS7kEs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 7e03e3981e6a..7ae3face595a 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-rtsp-server";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-th1DBNjOqqoboTn7HOk18E8ac9fhgkPAoFsvsEMFQG8=";
+    hash = "sha256-v7Z4BUK/DUAnNiMq6ubFoblDxEV3W/QDBby4bKcHBaA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index 287d203fb2ba..feb1fbaaeaa9 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gst-plugins-ugly";
-  version = "1.26.11";
+  version = "1.28.4";
 
   outputs = [
     "out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-v5yfcu43SCXP1DhowoW8sBcA3yWEBp51169FX+SCRPg=";
+    hash = "sha256-VIbNFFxa9DJZ/TfKylnQSOKmfdsHCC6o9Q7w8CqF+KU=";
   };
 
   nativeBuildInputs = [

From 95d2a3227bcc8a589ad2a908dc1f94b605fc8cca Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 14:47:48 +0300
Subject: [PATCH 722/831] python3Packages.numpy: make numpy.pc more visible

This change also enables scipy to find numpy via pkg-config, and not
only via `scipy.passthru.buildConfig.properties.numpy-include-dir`, and
thus enables free threading via f2py. See:

https://github.com/scipy/scipy/commit/7fd20c742b74264e7c75e86292b7b8748a63d53c#diff-b39b7bda5a39c101be8d9e0b3b6d4da335b6daf7385c2a43463125b0a1f33778

Arguably, this makes the `numpy.passthru.coreIncludeDir` definition
redundant, but we will keep it for backwards compatibility.
---
 pkgs/development/python-modules/numpy/2.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 1a5eaecaa010..6849c82285c0 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -113,6 +113,14 @@ buildPythonPackage (finalAttrs: {
     typing-extensions
   ];
 
+  # Enables any dependent package to easily find numpy.pc via standard
+  # pkg-config call. The `$out/include` symlink matches what's written in the
+  # numpy.pc file.
+  postInstall = ''
+    ln -s $out/${python.sitePackages}/numpy/_core/lib/pkgconfig $out/lib/pkgconfig
+    ln -s ${placeholder "out"}/${finalAttrs.passthru.coreIncludeInnerDir} $out/include
+  '';
+
   preCheck = ''
     pushd $out
     # For numpy-config executable to be available during tests
@@ -192,7 +200,11 @@ buildPythonPackage (finalAttrs: {
       name = "site.cfg";
       text = lib.generators.toINI { } finalAttrs.finalPackage.buildConfig;
     };
-    coreIncludeDir = "${finalAttrs.finalPackage}/${python.sitePackages}/numpy/_core/include";
+    # Need to be defined with two variables for postInstall to use `placeholder
+    # "out"` where here we have to use `${finalAttrs.finalPackage}`, that would
+    # cause infinite recursion if used in postInstall too.
+    coreIncludeInnerDir = "${python.sitePackages}/numpy/_core/include";
+    coreIncludeDir = "${finalAttrs.finalPackage}/${finalAttrs.finalPackage.passthru.coreIncludeInnerDir}";
     tests = {
       inherit sage;
     };

From 6f7e99b2f4e303804f4153b43be2e4cd706b04b3 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 26 May 2026 17:36:13 +0300
Subject: [PATCH 723/831] python3Packages.scipy: 1.17.1 -> 1.18.0

Diff: https://github.com/scipy/scipy/compare/v1.17.1...v1.18.0

Changelog: https://github.com/scipy/scipy/releases/tag/v1.18.0
---
 .../python-modules/scipy/default.nix          | 31 +++++--------------
 1 file changed, 8 insertions(+), 23 deletions(-)

diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index cdecd986e4ef..914b8ce07842 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -27,7 +27,7 @@
   pybind11,
   pooch,
   xsimd,
-  boost189,
+  boost191,
   qhull,
 
   # dependencies
@@ -44,41 +44,26 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "scipy";
-  version = "1.17.1";
+  version = "1.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipy";
     repo = "scipy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lFmqdbCf7pcosdZ7RFMv+8H9+ztMJbDS5g5fQs8Nws8=";
+    hash = "sha256-qVTFWYZ9krhZNYLyuZTfiS7UYmMZL40GFqod84l+VHI=";
     fetchSubmodules = true;
   };
 
   patches = [
     # Helps with cross compilation, see https://github.com/scipy/scipy/pull/18167
     (fetchpatch {
-      url = "https://github.com/scipy/scipy/commit/dd50ac9d98dbb70625333a23e3a90e493228e3be.patch";
-      hash = "sha256-Vf6/hhwu6X5s8KWhq8bUZKtSkdVu/GtEpGtj8Olxe7s=";
-      excludes = [ "doc/source/dev/contributor/meson_advanced.rst" ];
+      url = "https://github.com/scipy/scipy/commit/33696c545b74d6fda6f6f39e818d26c2b7631498.patch";
+      hash = "sha256-R5rgSz/9+T2+fpDFTfZQLTvdISTGUAuHEBAWT39x9LQ=";
+      excludes = [ "doc/source/building/cross_compilation.rst" ];
     })
   ];
-  # A NOTE regarding the Numpy version relaxing: Both Numpy versions 1.x &
-  # 2.x are supported. However upstream wants to always build with Numpy 2,
-  # and with it to still be able to run with a Numpy 1 or 2. We insist to
-  # perform this substitution even though python3.pkgs.numpy is of version 2
-  # nowadays, because our ecosystem unfortunately doesn't allow easily
-  # separating runtime and build-system dependencies. See also:
-  #
-  # https://discourse.nixos.org/t/several-comments-about-priorities-and-new-policies-in-the-python-ecosystem/51790
-  #
-  # Being able to build (& run) with Numpy 1 helps for python environments
-  # that override globally the `numpy` attribute to point to `numpy_1`.
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "numpy>=2.0.0,<2.7" numpy
-  ''
-  + lib.optionalString (stdenv.hostPlatform.isDarwin) ''
+  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin) ''
     substituteInPlace scipy/meson.build \
       --replace-fail "r = run_command('xcrun', '-sdk', 'macosx', '--show-sdk-version', check: true)" ""
     substituteInPlace scipy/meson.build \
@@ -101,7 +86,7 @@ buildPythonPackage (finalAttrs: {
     pybind11
     pooch
     xsimd
-    boost189
+    boost191
     qhull
   ];
 

From 5f39a670cb848d150588636b0d5cdd0a069c808e Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 13:09:33 +0300
Subject: [PATCH 724/831] python3Packages.numpy: 2.4.6 -> 2.5.0

Diff: https://github.com/numpy/numpy/compare/v2.4.6...v2.5.0

Changelog: https://github.com/numpy/numpy/releases/tag/v2.5.0
---
 pkgs/development/python-modules/numpy/2.nix | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 6849c82285c0..92536065a492 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -34,7 +34,7 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 buildPythonPackage (finalAttrs: {
   pname = "numpy";
-  version = "2.4.6";
+  version = "2.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -42,7 +42,7 @@ buildPythonPackage (finalAttrs: {
     repo = "numpy";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-jHi3cYiSwFRm3G0Dl4dL6yACSP4lAUECotVI+4KXMg8=";
+    hash = "sha256-RiC1dLoDamK5B2VzHBL0V//K/Vix25q11wNGcl3Witk=";
   };
 
   patches = lib.optionals python.hasDistutilsCxxPatch [
@@ -86,11 +86,7 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
 
-  # we default openblas to build with 64 threads
-  # if a machine has more than 64 threads, it will segfault
-  # see https://github.com/OpenMathLib/OpenBLAS/issues/2993
   preConfigure = ''
-    sed -i 's/-faltivec//' numpy/distutils/system_info.py
     export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
   '';
 

From edf956849141a27628a419babff611c89dbe3325 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 6 Jan 2026 15:30:46 +0200
Subject: [PATCH 725/831] python3Packages.numpy: assert blas & lapack use
 compatible integer size

Allow them to be both 32bit or both 64 bit.
---
 pkgs/development/python-modules/numpy/2.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index 92536065a492..be54cb4d312e 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -30,7 +30,8 @@
   typing-extensions,
 }:
 
-assert (!blas.isILP64) && (!lapack.isILP64);
+# Verify these are compatible
+assert blas.isILP64 == lapack.isILP64;
 
 buildPythonPackage (finalAttrs: {
   pname = "numpy";
@@ -62,7 +63,11 @@ buildPythonPackage (finalAttrs: {
       --replace-fail '/bin/true' '${lib.getExe' coreutils "true"}'
   '';
 
-  mesonFlags = lib.optionals (!stdenv.hostPlatform.isLoongArch64) [
+  mesonFlags = [
+    # See https://numpy.org/devdocs/building/blas_lapack.html
+    "-Duse-ilp64=${if blas.isILP64 then "true" else "false"}"
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isLoongArch64) [
     # This is required to support CPUs with feature-sets earlier than x86-64-v2
     # (before 2009). This will still build optimizations for newer features, but
     # allow for importing with older machines. See:

From e148ed0b557c47ae10c1b5fd53f9680f4133df4f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 22 Jun 2026 18:20:56 +0000
Subject: [PATCH 726/831] libfabric: 2.5.1 -> 2.6.0

---
 pkgs/by-name/li/libfabric/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libfabric/package.nix b/pkgs/by-name/li/libfabric/package.nix
index 2bd139469e2c..c826fff3ad34 100644
--- a/pkgs/by-name/li/libfabric/package.nix
+++ b/pkgs/by-name/li/libfabric/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libfabric";
-  version = "2.5.1";
+  version = "2.6.0";
 
   enableParallelBuilding = true;
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ofiwg";
     repo = "libfabric";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-d8ZdHMo3ErwBtLtUiLetjR+wu6H9bj3jnGZDYX544Jc=";
+    sha256 = "sha256-/zQnXfEveIGCpPZ3lgrOLnXSS7m8U2spVjkqsXuaL0o=";
   };
 
   outputs = [

From 327c5bcd4a618cc1cc4cb91a89a240dc3a43853f Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 21:38:44 +0300
Subject: [PATCH 727/831] python3Packages.polars: use finalAttrs

---
 .../python-modules/polars/default.nix         | 26 +++++++++----------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index 41ff1ff2918e..14722a3a0896 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -36,32 +36,30 @@
     assert builtins.elem "--disable-initial-exec-tls" jemalloc'.configureFlags;
     jemalloc',
 
-  polars,
   python,
 }:
 
 let
-  version = "1.40.1";
 
   # Hide symbols to prevent accidental use
   rust-jemalloc-sys = throw "polars: use polarsMemoryAllocator over rust-jemalloc-sys";
   jemalloc = throw "polars: use polarsMemoryAllocator over jemalloc";
 in
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "polars";
-  inherit version;
+  version = "1.40.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pola-rs";
     repo = "polars";
-    tag = "py-${version}";
+    tag = "py-${finalAttrs.version}";
     hash = "sha256-QlrEYwoYPALELK3UGBC/92vCBIzFrigJAwU8qxn7Pys=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-rmCJ5SY5okvkgfd63yPDO2YOksqAWgKa9nqxTqP7Grw=";
   };
 
@@ -128,7 +126,7 @@ buildPythonPackage rec {
         nativeBuildInputs = [
           (python.withPackages (ps: [
             ps.pyarrow
-            polars
+            finalAttrs.finalPackage
           ]))
         ];
       }
@@ -145,7 +143,7 @@ buildPythonPackage rec {
         nativeBuildInputs = [
           (python.withPackages (ps: [
             ps.pyarrow
-            polars
+            finalAttrs.finalPackage
           ]))
         ];
         failureHook = ''
@@ -159,13 +157,13 @@ buildPythonPackage rec {
         EOF
       '';
   passthru.tests.pytest = stdenv.mkDerivation {
-    pname = "${polars.pname}-pytest";
+    pname = "${finalAttrs.pname}-pytest";
 
-    inherit (polars) version src;
+    inherit (finalAttrs) version src;
 
     requiredSystemFeatures = [ "big-parallel" ];
 
-    sourceRoot = "${src.name}/py-polars";
+    sourceRoot = "${finalAttrs.src.name}/py-polars";
     postPatch = ''
       for f in * ; do
         [[ "$f" == "tests" ]] || \
@@ -183,7 +181,7 @@ buildPythonPackage rec {
     checkPhase = "pytestCheckPhase";
     nativeBuildInputs = [
       (python.withPackages (ps: [
-        polars
+        finalAttrs.finalPackage
         ps.aiosqlite
         ps.altair
         ps.boto3
@@ -292,7 +290,7 @@ buildPythonPackage rec {
   meta = {
     description = "Dataframes powered by a multithreaded, vectorized query engine, written in Rust";
     homepage = "https://github.com/pola-rs/polars";
-    changelog = "https://github.com/pola-rs/polars/releases/tag/py-${version}";
+    changelog = "https://github.com/pola-rs/polars/releases/tag/py-${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       happysalada
@@ -301,4 +299,4 @@ buildPythonPackage rec {
     mainProgram = "polars";
     platforms = lib.platforms.all;
   };
-}
+})

From 854971a587e0d09fd53ea0745f6837b7651477f2 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 22 Jun 2026 21:58:57 +0300
Subject: [PATCH 728/831] python3Packages.polars: 1.40.1 -> 1.41.2

Diff: https://github.com/pola-rs/polars/compare/py-1.40.1...py-1.41.2

Changelog: https://github.com/pola-rs/polars/releases/tag/py-1.41.2
---
 pkgs/development/python-modules/polars/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/polars/default.nix b/pkgs/development/python-modules/polars/default.nix
index 14722a3a0896..3d1fdfb9c674 100644
--- a/pkgs/development/python-modules/polars/default.nix
+++ b/pkgs/development/python-modules/polars/default.nix
@@ -48,19 +48,19 @@ in
 
 buildPythonPackage (finalAttrs: {
   pname = "polars";
-  version = "1.40.1";
+  version = "1.41.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pola-rs";
     repo = "polars";
     tag = "py-${finalAttrs.version}";
-    hash = "sha256-QlrEYwoYPALELK3UGBC/92vCBIzFrigJAwU8qxn7Pys=";
+    hash = "sha256-Wys56Tj75+7sNNwi3U5a62Wwkddep/W1MjtAHOuDdwc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-rmCJ5SY5okvkgfd63yPDO2YOksqAWgKa9nqxTqP7Grw=";
+    hash = "sha256-tmc8n0TVaXmc4C8XXTgPVsTRs0C/V+88f6T1vOamt00=";
   };
 
   requiredSystemFeatures = [ "big-parallel" ];
@@ -215,7 +215,6 @@ buildPythonPackage (finalAttrs: {
     ];
     nativeCheckInputs = [
       pytestCheckHook
-      pytest-codspeed
       pytest-cov-stub
       pytest-xdist
       pytest-benchmark

From 7ac506e79fd11a772a8326c4cd40478508bb032e Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 22 Jun 2026 22:15:23 +0200
Subject: [PATCH 729/831] valgrind: backport x86_64-unknown-linux-musl fix

Fixes: 4f72341536ca ("valgrind: 3.26.0 -> 3.27.0")
---
 pkgs/by-name/va/valgrind/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/va/valgrind/package.nix b/pkgs/by-name/va/valgrind/package.nix
index 4d09b6c7acd8..25bc383f0ecb 100644
--- a/pkgs/by-name/va/valgrind/package.nix
+++ b/pkgs/by-name/va/valgrind/package.nix
@@ -30,6 +30,11 @@ stdenv.mkDerivation rec {
       url = "https://bugsfiles.kde.org/attachment.cgi?id=186451";
       hash = "sha256-IGmyHwwGoy00hcz3XxQSDcwcU8zHLBJ9dfqTvWDQ520=";
     })
+    (fetchpatch {
+      name = "reallocarray-test-musl.patch";
+      url = "https://sourceware.org/git/?p=valgrind.git;a=patch;h=991961ece87e4cdc0771a05c956c55baa437bb07";
+      hash = "sha256-U16384rLXMhLE5Em9z8FKYbshPlnq8l9ejC2+epL7M4=";
+    })
 
     # Fix build on armv7l.
     # see also https://bugs.kde.org/show_bug.cgi?id=454346

From ce5d29c0b708cfa69eeb63c625e419c54f2f7281 Mon Sep 17 00:00:00 2001
From: Artemis Tosini <artemis.tosini@obsidian.systems>
Date: Mon, 22 Jun 2026 14:40:33 -0400
Subject: [PATCH 730/831] fontconfig: Fix cross building

The fontconfig autotools build attempts to check for va_copy with a
test program. This doesn't work cross, but we can hardcode the result.

It may be best to use meson in the future.
---
 pkgs/development/libraries/fontconfig/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/fontconfig/default.nix b/pkgs/development/libraries/fontconfig/default.nix
index 9e4c1fb36057..515e31901db1 100644
--- a/pkgs/development/libraries/fontconfig/default.nix
+++ b/pkgs/development/libraries/fontconfig/default.nix
@@ -67,11 +67,12 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "--with-arch=${stdenv.hostPlatform.parsed.cpu.name}"
+    "ac_cv_va_copy=C99"
   ];
 
   enableParallelBuilding = true;
 
-  doCheck = true;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   installFlags = [
     # Don't try to write to /var/cache/fontconfig at install time.

From 1db0dc7c1bb5513b987682782b3c474451c6fe53 Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Mon, 22 Jun 2026 22:38:49 +0200
Subject: [PATCH 731/831] ffmpeg_8: 8.1.1 -> 8.1.2

---
 pkgs/development/libraries/ffmpeg/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index acfedac85f4d..d5f1e1922186 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -30,8 +30,8 @@ let
     hash = "sha256-GDN0+tJY8Nap9UkNUfzqT9cGV1IVCuy5Du/64G+8QdE=";
   };
   v8 = {
-    version = "8.1.1";
-    hash = "sha256-WPGfjTZjsgpR5QiANRWF4g6LF2ejGzFQUrLjhzw9cfQ=";
+    version = "8.1.2";
+    hash = "sha256-wJ3c8VVo/tK84K7bKYs/UWcln4mSO+tf/w5NLNjKhiI=";
   };
 in
 

From b0983d5f06aede186c051e938b31d01b141afaa7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 21 Jun 2026 09:02:04 -0700
Subject: [PATCH 732/831] python3Packages.mistune: 3.2.1 -> 3.3.2

Diff: https://github.com/lepture/mistune/compare/v3.2.1...v3.3.2

Changelog: https://github.com/lepture/mistune/blob/v3.3.2/docs/changes.rst
---
 pkgs/development/python-modules/mistune/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mistune/default.nix b/pkgs/development/python-modules/mistune/default.nix
index 8cdfa4023ded..99f3922ee0fa 100644
--- a/pkgs/development/python-modules/mistune/default.nix
+++ b/pkgs/development/python-modules/mistune/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mistune";
-  version = "3.2.1";
+  version = "3.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "mistune";
     tag = "v${version}";
-    hash = "sha256-8AEEh/SWAk/Esq0jAoZGLw1FIQUw6C5Xq8CgnI2fjv0=";
+    hash = "sha256-uyOJFtDvVn0Y3VypphOXsSW3pX5XVCcfQ7dtFiL/5qY=";
   };
 
   build-system = [ setuptools ];

From ccc474fdb4007ac2788533b50ec26740d47e9a56 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Wed, 27 May 2026 00:22:46 +0200
Subject: [PATCH 733/831] systemd: v260.2 -> v261

---
 ...e-usr-share-zoneinfo-to-etc-zoneinfo.patch | 20 ++++++++---------
 ...e-NSCD-when-DNSSEC-validation-is-dis.patch |  8 +++----
 pkgs/os-specific/linux/systemd/default.nix    | 22 +++++++++----------
 pkgs/top-level/all-packages.nix               |  2 ++
 4 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/0002-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0002-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index a9ec66f9dd3d..5d993d1493d7 100644
--- a/pkgs/os-specific/linux/systemd/0002-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -35,10 +35,10 @@ index 3a13e04a27..4fd58068a1 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 5dd00af952..b97a41f6ac 100644
+index eb74de32c2..6906462b36 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1443,7 +1443,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+@@ -1456,7 +1456,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
  
          assert(ret);
  
@@ -47,7 +47,7 @@ index 5dd00af952..b97a41f6ac 100644
          if (!f)
                  return -errno;
  
-@@ -1488,7 +1488,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+@@ -1501,7 +1501,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
  
          assert(ret);
  
@@ -56,7 +56,7 @@ index 5dd00af952..b97a41f6ac 100644
          if (!f)
                  return -errno;
  
-@@ -1603,7 +1603,7 @@ int verify_timezone(const char *name, int log_level) {
+@@ -1616,7 +1616,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
                  return -ENAMETOOLONG;
  
@@ -65,7 +65,7 @@ index 5dd00af952..b97a41f6ac 100644
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
          if (fd < 0)
-@@ -1675,7 +1675,7 @@ int get_timezone(char **ret) {
+@@ -1688,7 +1688,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* Return EINVAL if not a symlink */
  
@@ -75,10 +75,10 @@ index 5dd00af952..b97a41f6ac 100644
                  return -EINVAL;
          if (!timezone_is_valid(e, LOG_DEBUG))
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index ae1899593c..20d3071114 100644
+index e922abdd63..986a9e25d1 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -584,7 +584,7 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) {
+@@ -601,7 +601,7 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) {
  
  static int process_timezone(int rfd, sd_varlink **mute_console_link) {
          _cleanup_close_ int pfd = -EBADF;
@@ -87,7 +87,7 @@ index ae1899593c..20d3071114 100644
          const char *e;
          int r;
  
-@@ -630,12 +630,9 @@ static int process_timezone(int rfd, sd_varlink **mute_console_link) {
+@@ -647,12 +647,9 @@ static int process_timezone(int rfd, sd_varlink **mute_console_link) {
          if (isempty(arg_timezone))
                  return 0;
  
@@ -103,10 +103,10 @@ index ae1899593c..20d3071114 100644
                  return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
  
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 84e94e845a..8e1f1a6ea2 100644
+index 7f7ceac318..5f3faa7bf4 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1856,8 +1856,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
+@@ -1757,8 +1757,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
diff --git a/pkgs/os-specific/linux/systemd/0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch b/pkgs/os-specific/linux/systemd/0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
index bf6ebeebe59a..0724cd661fd5 100644
--- a/pkgs/os-specific/linux/systemd/0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
+++ b/pkgs/os-specific/linux/systemd/0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
@@ -13,13 +13,13 @@ directly.
  1 file changed, 11 insertions(+)
 
 diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c
-index 96d0dd5c2b..ee7cc4bd17 100644
+index 5e0d13023a..1bfe0b1e6f 100644
 --- a/src/timesync/timesyncd.c
 +++ b/src/timesync/timesyncd.c
-@@ -25,6 +25,11 @@
+@@ -22,6 +22,11 @@
+ #include "timesyncd-bus.h"
  #include "timesyncd-conf.h"
  #include "timesyncd-manager.h"
- #include "user-util.h"
 +#include "env-util.h"
 +
 +struct traced_file;
@@ -28,7 +28,7 @@ index 96d0dd5c2b..ee7cc4bd17 100644
  
  static int advance_tstamp(int fd, usec_t epoch) {
          assert(fd >= 0);
-@@ -204,6 +209,12 @@ static int run(int argc, char *argv[]) {
+@@ -169,6 +174,12 @@ static int run(int argc, char *argv[]) {
          if (r < 0)
                  return log_error_errno(r, "Failed to parse fallback server strings: %m");
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 4d91ed2e72a5..c46ba6792a86 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -35,7 +35,6 @@
   lz4,
   openssl,
   libgcrypt,
-  libgpg-error,
   libidn2,
   curl,
   zlib,
@@ -106,6 +105,7 @@
   withHostnamed ? true,
   withHwdb ? true,
   withImportd ? true,
+  withImds ? true,
   withKmod ? true,
   withLibBPF ?
     lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
@@ -142,6 +142,7 @@
   withRemote ? true,
   withResolved ? true,
   withShellCompletions ? true,
+  withSysinstall ? true,
   withSysusers ? true,
   withSysupdate ? true,
   withTimedated ? true,
@@ -190,7 +191,7 @@ assert withRepart -> withCryptsetup;
 assert withBootloader -> withEfi;
 
 let
-  wantCurl = withRemote || withImportd;
+  wantCurl = withRemote || withImportd || withImds;
 
   # Use the command below to update `releaseTimestamp` on every (major) version
   # change. More details in the commentary at mesonFlags.
@@ -201,13 +202,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "260.2";
+  version = "261";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-NXmmSV7/9WIW6C8wjdOwaerCy4v7Zcrd8+XDzcS8rEk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6IB1ZEQqQ0impwBhCaLZAEgMVkVFU61JDVlGotxNzGQ=";
   };
 
   # PATCH POLICY
@@ -308,11 +309,7 @@ stdenv.mkDerivation (finalAttrs: {
         jinja2
       ]
       ++ lib.optional withEfi ps.pyelftools
-      # pefile is only required to trigger a check in meson to actually build
-      # ukify. This module should never appear in the runtime closure of ukify.
-      # Instead the pefile from buildInputs should be used.
-      # Remove this when it's fixed upstream: https://github.com/systemd/systemd/pull/41959
-      ++ lib.optional withUkify ps.pefile
+      ++ lib.optional (withUkify && finalAttrs.finalPackage.doCheck) ps.pefile
     ))
   ]
   ++ lib.optionals withLibBPF [
@@ -331,7 +328,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   ++ lib.optionals withGcrypt [
     libgcrypt
-    libgpg-error
   ]
   ++ lib.optionals withOpenSSL [ openssl ]
   ++ lib.optional withTests glib
@@ -347,7 +343,7 @@ stdenv.mkDerivation (finalAttrs: {
     zstd
   ]
   ++ lib.optional withCoredump elfutils
-  ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
+  ++ lib.optional withCryptsetup cryptsetup
   ++ lib.optional withKexectools kexec-tools
   ++ lib.optional withKmod kmod
   ++ lib.optional withLibidn2 libidn2
@@ -498,6 +494,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "apparmor" withApparmor)
     (lib.mesonEnable "gcrypt" withGcrypt)
     (lib.mesonEnable "importd" withImportd)
+    (lib.mesonEnable "imds" withImds)
     (lib.mesonEnable "homed" withHomed)
     (lib.mesonEnable "polkit" withPolkit)
     (lib.mesonEnable "elfutils" withCoredump)
@@ -539,6 +536,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "coredump" withCoredump)
     (lib.mesonBool "firstboot" withFirstboot)
     (lib.mesonBool "resolve" withResolved)
+    (lib.mesonBool "sysinstall" withSysinstall)
     (lib.mesonBool "sysusers" withSysusers)
     (lib.mesonBool "efi" withEfi)
     (lib.mesonBool "utmp" withUtmp)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4368ded8af14..c3c268a911ff 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8319,6 +8319,7 @@ with pkgs;
     withHomed = false;
     withHwdb = false;
     withImportd = false;
+    withImds = false;
     withLibBPF = false;
     withLibidn2 = false;
     withLocaled = false;
@@ -8335,6 +8336,7 @@ with pkgs;
     withRemote = false;
     withResolved = false;
     withShellCompletions = false;
+    withSysinstall = false;
     withSysupdate = false;
     withSysusers = false;
     withTimedated = false;

From f9831ac04ca1fbb5e3608ea11dd81c49e64f2348 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 22 Jun 2026 14:43:42 +0200
Subject: [PATCH 734/831] python3Packages.pytest-django: 4.11.1 -> 4.12.0

Changelog: https://github.com/pytest-dev/pytest-django/blob/v4.12.0/docs/changelog.rst
---
 pkgs/development/python-modules/pytest-django/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-django/default.nix b/pkgs/development/python-modules/pytest-django/default.nix
index cc41563099e5..fc5cb01cf15d 100644
--- a/pkgs/development/python-modules/pytest-django/default.nix
+++ b/pkgs/development/python-modules/pytest-django/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pytest-django";
-  version = "4.11.1";
+  version = "4.12.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pytest_django";
     inherit (finalAttrs) version;
-    hash = "sha256-qUkUGh7hA8sOeiDxRR01X4P15KXQe91Nz90f0P8ieZE=";
+    hash = "sha256-35TsgZqDyJecj23hPZzfvnbowh05Rzz+K0DJ/Jvjx1g=";
   };
 
   build-system = [

From b6c4b911f063a11f3f45124582c08cc4c91d8677 Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Tue, 23 Jun 2026 13:20:54 +0200
Subject: [PATCH 735/831] systemd: disable repart-factory-reset test since it
 its broken upstream

---
 pkgs/os-specific/linux/systemd/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index c46ba6792a86..39ce581ae5b7 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -778,7 +778,7 @@ stdenv.mkDerivation (finalAttrs: {
           systemd-repart-basic
           systemd-repart-create-root
           systemd-repart-encrypt-tpm2
-          systemd-repart-factory-reset
+          # systemd-repart-factory-reset # broken upstream
           ;
       }
       // {

From 7c2629ab708ac947d30e14c30a0b85e949870d9b Mon Sep 17 00:00:00 2001
From: nikstur <nikstur@outlook.com>
Date: Tue, 23 Jun 2026 13:21:21 +0200
Subject: [PATCH 736/831] nixos/test-instrumentation: disable minimum uptime
 for tests

---
 nixos/modules/testing/test-instrumentation.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/testing/test-instrumentation.nix b/nixos/modules/testing/test-instrumentation.nix
index 4d20b20090b4..de2cb3d2afc8 100644
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@@ -78,6 +78,8 @@ let
     # Allow very slow start
     DefaultTimeoutStartSec = 300;
     DefaultDeviceTimeoutSec = 300;
+    # Don't enforce a minimum uptime before shutting down.
+    MinimumUptimeSec = 0;
   };
 
 in

From f4caa95ddef0d1e67621f20a82f28ed639dc6f6c Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Tue, 23 Jun 2026 16:12:55 +0200
Subject: [PATCH 737/831] lttng-ust: fix musl crashes

Caught by the tests.  I've linked to my submitted upstream patch, but
I'm not confident enough in it to apply it here without upstream
review, so for now just build with an increased stack size across the
board.  We can remove it if upstream does something to address the
stack size issue.

Fixes: 6d8c12b2b36e ("lttng-ust: 2.14.0 -> 2.15.0")
---
 pkgs/by-name/lt/lttng-ust/package.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/lt/lttng-ust/package.nix b/pkgs/by-name/lt/lttng-ust/package.nix
index 9749f6c938e1..9f359b838cb9 100644
--- a/pkgs/by-name/lt/lttng-ust/package.nix
+++ b/pkgs/by-name/lt/lttng-ust/package.nix
@@ -67,7 +67,15 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs .
   '';
 
-  configureFlags = [ "--disable-examples" ];
+  configureFlags = [
+    "--disable-examples"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    # lttng-ust puts a single array on the stack that's the size of
+    # musl's whole default stack.
+    # https://review.lttng.org/c/lttng-ust/+/18160
+    "CFLAGS=-Wl,-z,stack-size=2097152"
+  ];
 
   doCheck = true;
 

From c565d77c0c78191ce8158266869ce30e7ca42a0a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Mon, 15 Jun 2026 18:42:43 +0200
Subject: [PATCH 738/831] cdparanoia: fix build for FreeBSD

---
 pkgs/by-name/cd/cdparanoia-iii/freebsd.patch | 45 ++++++++++++++++++++
 pkgs/by-name/cd/cdparanoia-iii/package.nix   |  1 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/by-name/cd/cdparanoia-iii/freebsd.patch

diff --git a/pkgs/by-name/cd/cdparanoia-iii/freebsd.patch b/pkgs/by-name/cd/cdparanoia-iii/freebsd.patch
new file mode 100644
index 000000000000..a66482a91e5a
--- /dev/null
+++ b/pkgs/by-name/cd/cdparanoia-iii/freebsd.patch
@@ -0,0 +1,45 @@
+From 368ea1fcdf4e8f9a5de4e7ade590242292ccb8fa Mon Sep 17 00:00:00 2001
+From: Alyssa Ross <hi@alyssa.is>
+Date: Mon, 15 Jun 2026 18:40:07 +0200
+Subject: [PATCH] Fix designated initializers in memcpy arguments
+
+On FreeBSD, memcpy is a macro, and the lack of parentheses causes a
+compilation failure.
+---
+ interface/scsi_interface.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/interface/scsi_interface.c b/interface/scsi_interface.c
+index adbb9bf..7805559 100644
+--- a/interface/scsi_interface.c
++++ b/interface/scsi_interface.c
+@@ -674,7 +674,7 @@ static int scsi_read_toc (cdrom_drive *d){
+   }
+ 
+   for (i = first; i <= last; i++){
+-    memcpy(cmd, (char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}, 10);
++    memcpy(cmd, ((char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}), 10);
+     cmd[1]=d->lun<<5;
+     cmd[6]=i;
+     
+@@ -695,7 +695,7 @@ static int scsi_read_toc (cdrom_drive *d){
+     }
+   }
+ 
+-  memcpy(cmd, (char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}, 10);
++  memcpy(cmd, ((char []){ 0x43, 0, 0, 0, 0, 0, 0, 0, 12, 0}), 10);
+   cmd[1]=d->lun<<5;
+   cmd[6]=0xAA;
+     
+@@ -745,7 +745,7 @@ static int scsi_read_toc2 (cdrom_drive *d){
+   }
+ 
+   for (i = 0; i < tracks; i++){
+-    memcpy(cmd, (char[]){ 0xe5, 0, 0, 0, 0, 0, 0, 0, 0, 0}, 10);
++    memcpy(cmd, ((char[]){ 0xe5, 0, 0, 0, 0, 0, 0, 0, 0, 0}), 10);
+     cmd[5]=i+1;
+     cmd[8]=255;
+     
+-- 
+2.54.0
+
diff --git a/pkgs/by-name/cd/cdparanoia-iii/package.nix b/pkgs/by-name/cd/cdparanoia-iii/package.nix
index 813adc115078..de38e46763c3 100644
--- a/pkgs/by-name/cd/cdparanoia-iii/package.nix
+++ b/pkgs/by-name/cd/cdparanoia-iii/package.nix
@@ -62,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://salsa.debian.org/optical-media-team/cdparanoia/-/raw/f7bab3024c5576da1fdb7497abbd6abc8959a98c/debian/patches/04-endian.patch";
         hash = "sha256-krfprwls0L3hsNfoj2j69J5k1RTKEQtzE0fLYG9EJKo=";
       })
+      ./freebsd.patch
     ]
     ++ lib.optional stdenv.hostPlatform.isMusl ./utils.patch
     ++ lib.optional (!stdenv.hostPlatform.isDarwin) [

From ef24f13fc07c44bf13a0cd16f61aabdb166bddcc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 23 Jun 2026 18:13:04 +0000
Subject: [PATCH 739/831] libarchive: 3.8.7 -> 3.8.8

---
 pkgs/by-name/li/libarchive/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index 8f9f756a2ee9..fe81d018859c 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -32,13 +32,13 @@
 assert xarSupport -> libxml2 != null;
 stdenv.mkDerivation (finalAttrs: {
   pname = "libarchive";
-  version = "3.8.7";
+  version = "3.8.8";
 
   src = fetchFromGitHub {
     owner = "libarchive";
     repo = "libarchive";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-LpD+lE+0PZi/3nYDVPXhBQL9A7mvqelOzRLskVtg9Y0=";
+    hash = "sha256-l8xh+z6lP7VnxMIf9tfoSByerjwN6Z4dE3JNA9zS3LM=";
   };
 
   outputs = [

From df1af8eb905cc5e929b62b3b2b6e35d5fb2107ae Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Mon, 27 Apr 2026 15:45:34 +0200
Subject: [PATCH 740/831] python3Packages.gst-python: 1.26.11 -> 1.28.4

---
 .../python-modules/gst-python/default.nix     | 15 ++++++-------
 .../gst-python/fix-test-plugin-imports.patch  | 22 +++++++++++++++++++
 2 files changed, 29 insertions(+), 8 deletions(-)
 create mode 100644 pkgs/development/python-modules/gst-python/fix-test-plugin-imports.patch

diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index ab053e13b806..45c25c2550a6 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "gst-python";
-  version = "1.26.11";
+  version = "1.28.4";
 
   pyproject = false;
 
@@ -32,14 +32,13 @@ buildPythonPackage rec {
 
   src = fetchurl {
     url = "https://gstreamer.freedesktop.org/src/gst-python/gst-python-${version}.tar.xz";
-    hash = "sha256-ETFrp2m1bSbYsUZMcZipkkyurkgTT321kXH68ac9xDY=";
+    hash = "sha256-xOs4JyC0RD+4AaU0GN/wvUzXR4cW1c7Uk1BKZ1tNCf0=";
   };
 
-  # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4322
-  postPatch = ''
-    substituteInPlace testsuite/meson.build \
-      --replace-fail "['gstinit', 'test_gst_init.py']," ""
-  '';
+  patches = [
+    # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/9918#note_3530752
+    ./fix-test-plugin-imports.patch
+  ];
 
   # Python 2.x is not supported.
   disabled = !isPy3k;
@@ -103,6 +102,6 @@ buildPythonPackage rec {
     homepage = "https://gstreamer.freedesktop.org";
     description = "Python bindings for GStreamer";
     license = lib.licenses.lgpl2Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tmarkus ];
   };
 }
diff --git a/pkgs/development/python-modules/gst-python/fix-test-plugin-imports.patch b/pkgs/development/python-modules/gst-python/fix-test-plugin-imports.patch
new file mode 100644
index 000000000000..a08142a85a03
--- /dev/null
+++ b/pkgs/development/python-modules/gst-python/fix-test-plugin-imports.patch
@@ -0,0 +1,22 @@
+diff --git a/subprojects/gst-python/testsuite/test_plugin.py b/subprojects/gst-python/testsuite/test_plugin.py
+index 3ab299d54c..4ed1e85c82 100644
+--- a/testsuite/test_plugin.py
++++ b/testsuite/test_plugin.py
+@@ -18,14 +18,14 @@
+ # License along with this library; if not, write to the Free Software
+ # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301  USA
+ 
+-from gi.repository import Gst
+-import gi
+-from common import TestCase, unittest
+ import overrides_hack
+ overrides_hack
+ 
++from common import TestCase, unittest
+ 
++import gi
+ gi.require_version("Gst", "1.0")
++from gi.repository import Gst
+ 
+ 
+ class TestPlugin(TestCase):

From 59c13e1be6d4a4ab2f2fe0a36ad7848c63178e10 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Wed, 29 Apr 2026 14:29:59 +0200
Subject: [PATCH 741/831] gstreamer: enable strictDeps/structuredAttrs

---
 pkgs/development/libraries/gstreamer/bad/default.nix     | 9 ++++++---
 pkgs/development/libraries/gstreamer/base/default.nix    | 1 +
 pkgs/development/libraries/gstreamer/core/default.nix    | 1 +
 .../development/libraries/gstreamer/devtools/default.nix | 5 +++++
 pkgs/development/libraries/gstreamer/ges/default.nix     | 5 +++++
 pkgs/development/libraries/gstreamer/good/default.nix    | 3 +++
 .../libraries/gstreamer/icamerasrc/default.nix           | 7 ++++++-
 pkgs/development/libraries/gstreamer/libav/default.nix   | 5 +++++
 .../libraries/gstreamer/rtsp-server/default.nix          | 5 +++++
 pkgs/development/libraries/gstreamer/ugly/default.nix    | 5 +++++
 pkgs/development/libraries/gstreamer/vaapi/default.nix   | 7 +++++--
 11 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index 6f1333d287db..a29f2edff208 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -134,6 +134,12 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  # Argument list too long
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
@@ -390,9 +396,6 @@ stdenv.mkDerivation (finalAttrs: {
       ]
   );
 
-  # Argument list too long
-  strictDeps = true;
-
   postPatch = ''
     patchShebangs \
       scripts/extract-release-date-from-doap-file.py
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index ad2ce3e6f46b..a2a478c76ff2 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -64,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-qJiv1XZhcrAEnmeBVY4GiQmL+HudgrhGxlLlccAdYNg=";
   };
 
+  __structuredAttrs = true;
   strictDeps = true;
   depsBuildBuild = [
     pkg-config
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index bb44c1bf6de6..d50923558017 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
 
+  __structuredAttrs = true;
   strictDeps = true;
   nativeBuildInputs = [
     meson
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index aa976bd07f21..e856bd59b233 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -49,6 +49,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-5VYzDwAMyVN2HR/sS8rCwTR7UW/tt60AS7wZMjx+w74=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 52a76936bf25..e41fa069923b 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -35,6 +35,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-b361Xlhxjd5bWGn2Ge2Q6/Owz6A3bBacG4P8dzgRkUo=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index a1f1eddc95e6..4a689f5d82c7 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -97,6 +97,9 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
   strictDeps = true;
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
index 35801332a7da..9bd3f34d49da 100644
--- a/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
+++ b/pkgs/development/libraries/gstreamer/icamerasrc/default.nix
@@ -34,6 +34,11 @@ stdenv.mkDerivation {
     export STRIP_VIRTUAL_CHANNEL_CAMHAL=ON
   '';
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   buildInputs = [
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
@@ -46,7 +51,7 @@ stdenv.mkDerivation {
     apple-sdk_gstreamer
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error"
     # gstcameradeinterlace.cpp:55:10: fatal error: gst/video/video.h: No such file or directory
     "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0"
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 8d80eb36ec34..ecff969ca150 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-vRel3yh0p6WLy697lAIjN5rZYTYk246teD2wPnS7kEs=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 7ae3face595a..b71da6b03adb 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -31,6 +31,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-v7Z4BUK/DUAnNiMq6ubFoblDxEV3W/QDBby4bKcHBaA=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index feb1fbaaeaa9..279dbb12b173 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -39,6 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-VIbNFFxa9DJZ/TfKylnQSOKmfdsHCC6o9Q7w8CqF+KU=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
diff --git a/pkgs/development/libraries/gstreamer/vaapi/default.nix b/pkgs/development/libraries/gstreamer/vaapi/default.nix
index 1ad79efdda09..e5796cc6a9e8 100644
--- a/pkgs/development/libraries/gstreamer/vaapi/default.nix
+++ b/pkgs/development/libraries/gstreamer/vaapi/default.nix
@@ -48,6 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-8S+TAnPHodPg1/hblP+dE3nRYqzMky6Mo9OJk+0n/Kw=";
   };
 
+  separateDebugInfo = true;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
   nativeBuildInputs = [
     meson
     ninja
@@ -87,8 +92,6 @@ stdenv.mkDerivation (finalAttrs: {
     apple-sdk_gstreamer
   ];
 
-  strictDeps = true;
-
   mesonFlags = [
     "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
     (lib.mesonEnable "doc" enableDocumentation)

From 9fab97bbb3e5aebc164e49dd6aa241c4c81ec5c4 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 24 Jun 2026 09:14:58 +0200
Subject: [PATCH 742/831] nodejs_24: 24.17.0 -> 24.18.0

---
 pkgs/development/web/nodejs/v24.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index ae766cfeb5db..359e20891269 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "24.17.0";
-  sha256 = "a7ab562ed2369a29c68b72fa00e3103bcdfe37063dff799c6acc8e404e275fcd";
+  version = "24.18.0";
+  sha256 = "e94afde24db08e0c564ee7110a2d5aab51ee0059382c9fd8233c54eec47b28f9";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then

From 2ce8cee0973ed577b01d688ae41c3a5eee280e5c Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 24 Jun 2026 17:30:55 -0700
Subject: [PATCH 743/831] spirv-llvm-translator: add version for new LLVM 22

---
 pkgs/by-name/sp/spirv-llvm-translator/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/sp/spirv-llvm-translator/package.nix b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
index ce8f31de261d..a32d9481ee9c 100644
--- a/pkgs/by-name/sp/spirv-llvm-translator/package.nix
+++ b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
@@ -16,6 +16,11 @@ let
   llvmMajor = lib.versions.major llvm.version;
 
   versions = {
+    "22" = rec {
+      version = "22.1.3";
+      rev = "v${version}";
+      hash = "sha256-u/OytBH9LgAyGF9PX+5lmAbGPQ7iVv52w8mwQ+6fi/s=";
+    };
     "21" = rec {
       version = "21.1.0";
       rev = "v${version}";

From 3605cd7b4275c84e56f9ce67c20dcc969f9d226d Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 24 Jun 2026 17:33:43 -0700
Subject: [PATCH 744/831] spirv-headers: backport patch for SPIRV translator w/
 LLVM 22

spirv-llvm-translator needs new definitions to compile with LLVM 22,
and there isn't a release containing this patch yet, so we must
backport it.

Additionally, switch spirv-llvm-translator to use `srcOnly` instead
of `.src` so that the new patch is picked up.
---
 pkgs/by-name/sp/spirv-headers/package.nix         | 6 ++++++
 pkgs/by-name/sp/spirv-llvm-translator/package.nix | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/sp/spirv-headers/package.nix b/pkgs/by-name/sp/spirv-headers/package.nix
index 3f4c75ed5962..ddb49d7af092 100644
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -24,6 +24,12 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/1a22b167081842915a1c78a0b5b5a353a23284aa.diff";
       hash = "sha256-XUHfPHnk7bWK4vnozfW/84vaZN+rbFJUZSa6Og8GUAU=";
     })
+    # Backport new predicated load/store instructions, needed by spirv-llvm-translator
+    # Not in any tagged releases yet, should exist in the next release after 1.4.350.1.
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/b8a32968473ce852a809b9de5f04f02a5a9dfa78.patch";
+      hash = "sha256-59jmN28ifEhAxySXCpuGZ62jo1WVsRPnVosK8X4yrjM=";
+    })
   ];
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sp/spirv-llvm-translator/package.nix b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
index a32d9481ee9c..b86f3424f750 100644
--- a/pkgs/by-name/sp/spirv-llvm-translator/package.nix
+++ b/pkgs/by-name/sp/spirv-llvm-translator/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  srcOnly,
   fetchFromGitHub,
   fetchpatch,
   cmake,
@@ -84,7 +85,7 @@ stdenv.mkDerivation {
     "-DLLVM_SPIRV_BUILD_EXTERNAL=YES"
     # RPATH of binary /nix/store/.../bin/llvm-spirv contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
-    "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}"
+    "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${srcOnly spirv-headers}"
   ]
   ++ lib.optional (
     lib.toInt llvmMajor >= 19

From 4da4d4bc7bcb17ec91c2ab318ec8175bdf942ae6 Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Wed, 24 Jun 2026 17:36:15 -0700
Subject: [PATCH 745/831] llvmPackages_22.libclc: prepare_builtins was removed
 in LLVM 22.1

Or more specifically, in:
https://github.com/llvm/llvm-project/commit/f07988ff3ec8b8b838f5c6ce9e1ec519e16432a9
---
 pkgs/development/compilers/llvm/common/libclc/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/common/libclc/default.nix b/pkgs/development/compilers/llvm/common/libclc/default.nix
index 62a8dff18ec3..69350a9d3834 100644
--- a/pkgs/development/compilers/llvm/common/libclc/default.nix
+++ b/pkgs/development/compilers/llvm/common/libclc/default.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [ llvm ];
   strictDeps = true;
 
-  postInstall = ''
+  postInstall = lib.optionalString (lib.versionOlder finalAttrs.version "22.1") ''
     install -Dt $dev/bin prepare_builtins
   '';
 

From c3d7e253bfdf5ce05f35bd8f4e8d2933ee977301 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:01 +0200
Subject: [PATCH 746/831] ocamlPackages.merlin: init at 5.8-505 for OCaml 5.5

---
 pkgs/development/tools/ocaml/merlin/4.x.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/tools/ocaml/merlin/4.x.nix b/pkgs/development/tools/ocaml/merlin/4.x.nix
index dbb685cf3d5b..5358e4aed773 100644
--- a/pkgs/development/tools/ocaml/merlin/4.x.nix
+++ b/pkgs/development/tools/ocaml/merlin/4.x.nix
@@ -34,6 +34,7 @@
       "5.3.0" = "5.6-503";
       "5.4.0" = "5.7.1-504";
       "5.4.1" = "5.7.1-504";
+      "5.5.0" = "5.8-505";
     }
     ."${ocaml.version}",
 }:
@@ -54,6 +55,7 @@ let
     "5.6-503" = "sha256-sNytCSqq96I/ZauaCJ6HYb1mXMcjV5CeCsbCGC9PwtQ=";
     "5.6-504" = "sha256-gtZIpBgNbVqjoIMhjii/GX9OnxR4hN6TArtoEa2Yt38=";
     "5.7.1-504" = "sha256-E5sHPPkUs4tyXFT3W4tkL2VMNJjQpLqM+oMf8CqJcNU=";
+    "5.8-505" = "sha256-VkLN6EhqhKrZj6XFkLcOjcxgdNf72zubjEayxbQvZTs=";
   };
 
 in

From 3a9a3fcc5aa7f43eba75da66cb17567323a6bba9 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:05 +0200
Subject: [PATCH 747/831] ocamlPackages.lsp: init at 1.27.0 for OCaml 5.5

---
 pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix | 9 ++++++++-
 pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix     | 4 +++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
index 1c6bd1dcab7a..de8d03343690 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
@@ -9,7 +9,9 @@
   lib,
   ocaml,
   version ?
-    if lib.versionAtLeast ocaml.version "5.4" then
+    if lib.versionAtLeast ocaml.version "5.5" then
+      "1.27.0"
+    else if lib.versionAtLeast ocaml.version "5.4" then
       "1.26.0"
     else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"
@@ -28,6 +30,11 @@
 let
   params =
     {
+      "1.27.0" = {
+        name = "lsp";
+        minimalOCamlVersion = "5.3";
+        sha256 = "sha256-BDrNaSP4pcuq2RVFI1cKsTlzuu72mOK1VTIT3WN5JxU=";
+      };
       "1.26.0" = {
         name = "lsp";
         minimalOCamlVersion = "5.3";
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
index 55ebec5fba50..660c4ff90b7a 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
@@ -25,7 +25,9 @@
   ocamlformat-rpc-lib,
   ocaml,
   version ?
-    if lib.versionAtLeast ocaml.version "5.4" then
+    if lib.versionAtLeast ocaml.version "5.5" then
+      "1.27.0"
+    else if lib.versionAtLeast ocaml.version "5.4" then
       "1.26.0"
     else if lib.versionAtLeast ocaml.version "5.3" then
       "1.23.1"

From eaa1851d424fd344072bf62cce4fd9abc2f12390 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:08 +0200
Subject: [PATCH 748/831] =?UTF-8?q?ocamlPackages.batteries:=20update=20for?=
 =?UTF-8?q?=20OCaml=20=E2=89=A5=205.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/batteries/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/ocaml-modules/batteries/default.nix b/pkgs/development/ocaml-modules/batteries/default.nix
index 707c855b4944..6e30c7f50d09 100644
--- a/pkgs/development/ocaml-modules/batteries/default.nix
+++ b/pkgs/development/ocaml-modules/batteries/default.nix
@@ -3,20 +3,19 @@
   fetchFromGitHub,
   buildDunePackage,
   ocaml,
+  fetchpatch,
   ounit,
   qtest,
   qcheck,
   num,
   camlp-streams,
-  doCheck ? lib.versionAtLeast ocaml.version "4.08",
+  doCheck ? true,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "batteries";
   version = "3.10.0";
 
-  minimalOCamlVersion = "4.05";
-
   src = fetchFromGitHub {
     owner = "ocaml-batteries-team";
     repo = "batteries-included";
@@ -24,6 +23,11 @@ buildDunePackage (finalAttrs: {
     hash = "sha256-cD0O4kEDE58yCYnUuS83O1CJNHJuCGVhvKJSKQeQGkc=";
   };
 
+  patches = lib.optional (lib.versionAtLeast ocaml.version "5.5") (fetchpatch {
+    url = "https://github.com/ocaml-batteries-team/batteries-included/commit/f6e091266599aea93c8a94115cf08f50e88c5dd0.patch";
+    hash = "sha256-6CUcq24x4fnumduK4BJ5cVQ5DHPbVLyLUxl57q2JVtw=";
+  });
+
   nativeCheckInputs = [ qtest ];
   checkInputs = [
     ounit

From 61ae2648aa9c5a8afa131e115c6257c25522ac80 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:11 +0200
Subject: [PATCH 749/831] =?UTF-8?q?ocamlPackages.accessor=5Fcore:=20mark?=
 =?UTF-8?q?=20as=20broken=20with=20OCaml=20=E2=89=A5=205.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/janestreet/0.17.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/ocaml-modules/janestreet/0.17.nix b/pkgs/development/ocaml-modules/janestreet/0.17.nix
index 1250dfe2b447..dc1d5018bbcc 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.17.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.17.nix
@@ -60,6 +60,7 @@ with self;
     pname = "accessor_core";
     hash = "sha256-ku83ZfLtVI8FvQhrKcnJmhmoNlYcVMKx1tor5N8Nq7M=";
     meta.description = "Accessors for Core types, for use with the Accessor library";
+    meta.broken = lib.versionAtLeast ocaml.version "5.5";
     propagatedBuildInputs = [
       accessor_base
       core_kernel

From 463b1ae1c65ee7436eee40f4bfdd69b1d34bca21 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:13 +0200
Subject: [PATCH 750/831] =?UTF-8?q?ocamlPackages.ppx=5Fimport:=20mark=20as?=
 =?UTF-8?q?=20broken=20with=20OCaml=20=E2=89=A5=205.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/ppx_import/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/ocaml-modules/ppx_import/default.nix b/pkgs/development/ocaml-modules/ppx_import/default.nix
index fdd59a094f5e..185154a4ec7b 100644
--- a/pkgs/development/ocaml-modules/ppx_import/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_import/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   fetchurl,
+  ocaml,
   buildDunePackage,
   ounit,
   ppx_deriving,
@@ -53,5 +54,6 @@ buildDunePackage {
     description = "Syntax extension for importing declarations from interface files";
     license = lib.licenses.mit;
     homepage = "https://github.com/ocaml-ppx/ppx_import";
+    broken = lib.versionAtLeast ocaml.version "5.5";
   };
 }

From 9fc9431347481b81764e019d6ab4b93130a17c76 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:16 +0200
Subject: [PATCH 751/831] =?UTF-8?q?frama-c:=20mark=20as=20broken=20with=20?=
 =?UTF-8?q?OCaml=20=E2=89=A5=205.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/fr/frama-c/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/fr/frama-c/package.nix b/pkgs/by-name/fr/frama-c/package.nix
index bb9229a8803a..e5e751dbe005 100644
--- a/pkgs/by-name/fr/frama-c/package.nix
+++ b/pkgs/by-name/fr/frama-c/package.nix
@@ -134,6 +134,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.unix;
     mainProgram = "frama-c";
-    broken = !lib.versionAtLeast ocamlPackages.ocaml.version "4.14";
+    broken =
+      !lib.versionAtLeast ocamlPackages.ocaml.version "4.14"
+      || lib.versionAtLeast ocamlPackages.ocaml.version "5.5";
   };
 })

From 5103b5b35b10b44256ac6398ea7a4f5b2e4f32fd Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 10:17:32 +0200
Subject: [PATCH 752/831] ocamlPackages.camlp4: fix eval for unsupported OCaml
 versions

---
 .../tools/ocaml/camlp4/default.nix            | 291 +++++++++---------
 1 file changed, 147 insertions(+), 144 deletions(-)

diff --git a/pkgs/development/tools/ocaml/camlp4/default.nix b/pkgs/development/tools/ocaml/camlp4/default.nix
index 9b28e342de4c..caea5a20711d 100644
--- a/pkgs/development/tools/ocaml/camlp4/default.nix
+++ b/pkgs/development/tools/ocaml/camlp4/default.nix
@@ -9,150 +9,153 @@
   findlib,
 }:
 
-if lib.versionAtLeast ocaml.version "5.5" then
-  throw "camlp4 is not available for OCaml ${ocaml.version}"
-else
-
-  let
-    param =
-      {
-        "4.02" = {
-          version = "4.02+6";
-          sha256 = "06yl4q0qazl7g25b0axd1gdkfd4qpqzs1gr5fkvmkrcbz113h1hj";
-        };
-        "4.03" = {
-          version = "4.03+1";
-          sha256 = "1f2ndch6f1m4fgnxsjb94qbpwjnjgdlya6pard44y6n0dqxi1wsq";
-        };
-        "4.04" = {
-          version = "4.04+1";
-          sha256 = "1ad7rygqjxrc1im95gw9lp8q83nhdaf383f2808f1p63yl42xm7k";
-        };
-        "4.05" = {
-          version = "4.05+1";
-          sha256 = "0wm795hpwvwpib9c9z6p8kw2fh7p7b2hml6g15z8zry3y7w738sv";
-        };
-        "4.06" = {
-          version = "4.06+1";
-          sha256 = "0fazfw2l7wdmbwnqc22xby5n4ri1wz27lw9pfzhsbcdrighykysf";
-        };
-        "4.07" = {
-          version = "4.07+1";
-          sha256 = "0cxl4hkqcvspvkx4f2k83217rh6051fll9i2yz7cw6m3bq57mdvl";
-        };
-        "4.08" = {
-          version = "4.08+1";
-          sha256 = "0qplawvxwai25bi27niw2cgz2al01kcnkj8wxwhxslpi21z6pyx1";
-        };
-        "4.09" = {
-          version = "4.09+1";
-          sha256 = "1gr33x6xs1rs0bpyq4vzyfxd6vn47jfkg8imi81db2r0cbs0kxx1";
-        };
-        "4.10" = {
-          version = "4.10+1";
-          sha256 = "093bc1c28wid5li0jwglnd4p3csxw09fmbs9ffybq2z41a5mgay6";
-        };
-        "4.11" = {
-          version = "4.11+1";
-          sha256 = "0sn7f6im940qh0ixmx1k738xrwwdvy9g7r19bv5218jb6mh0g068";
-        };
-        "4.12" = {
-          version = "4.12+1";
-          sha256 = "1cfk5ppnd511vzsr9gc0grxbafmh0m3m897aij198rppzxps5kyz";
-        };
-        "4.13" = {
-          version = "4.13+1";
-          sha256 = "0fzxa1zdhk74mlxpin7p90flks6sp4gkc0mfclmj9zak15rii55n";
-        };
-        "4.14" = {
-          version = "4.14+1";
-          sha256 = "sha256-cPN3GioZT/Zt6uzbjGUPEGVJcPQdsAnCkU/AQoPfvuo=";
-        };
-        "5.0" = {
-          version = "5.0";
-          sha256 = "sha256-oZptFNPUEAq5YlcqAoDWfLghGMF9AN7E7hUN55SAX+4=";
-        };
-        "5.1" = {
-          version = "5.1";
-          sha256 = "sha256-Ubedjg3BeHA0bJbEalQN9eEk5+LRAI/er+8mWfVYchg=";
-        };
-        "5.2" = {
-          version = "5.2";
-          sha256 = "sha256-lzbc9xsgeYlbVf71O+PWYS14QivAH1aPdnvWhe0HHME=";
-        };
-        "5.3" = {
-          version = "5.3";
-          sha256 = "sha256-V/kKhTP9U4jWDFuQKuB7BS3XICg1lq/2Avj7UJR55+k=";
-        };
-        "5.4" = {
-          version = "5.4";
-          sha256 = "sha256-7FsKEr0cRVF4LIOvROWMyXBefRTBaS66ZqwtP2VLefM=";
-        };
-      }
-      .${ocaml.meta.branch};
-  in
-
-  stdenv.mkDerivation rec {
-    pname = "camlp4";
-    inherit (param) version;
-
-    src = fetchzip {
-      url = "https://github.com/ocaml/camlp4/archive/${version}.tar.gz";
-      inherit (param) sha256;
+let
+  params = {
+    "4.02" = {
+      version = "4.02+6";
+      sha256 = "06yl4q0qazl7g25b0axd1gdkfd4qpqzs1gr5fkvmkrcbz113h1hj";
     };
-
-    strictDeps = true;
-
-    nativeBuildInputs = [
-      which
-      ocaml
-      ocamlbuild
-    ]
-    ++ lib.optionals (lib.versionAtLeast ocaml.version "5.0") [
-      findlib
-    ];
-
-    buildInputs = lib.optionals (lib.versionAtLeast ocaml.version "5.0") [
-      camlp-streams
-      ocamlbuild
-    ];
-
-    # build fails otherwise
-    enableParallelBuilding = false;
-
-    dontAddPrefix = true;
-
-    preConfigure = ''
-      # increase stack space for spacetime variant of the compiler
-      # https://github.com/ocaml/ocaml/issues/7435
-      # but disallowed by darwin sandbox
-      ulimit -s unlimited || true
-
-      configureFlagsArray=(
-        --bindir=$out/bin
-        --libdir=$out/lib/ocaml/${ocaml.version}/site-lib
-        --pkgdir=$out/lib/ocaml/${ocaml.version}/site-lib
-      )
-    '';
-
-    postConfigure = ''
-      substituteInPlace camlp4/META.in \
-      --replace +camlp4 $out/lib/ocaml/${ocaml.version}/site-lib/camlp4
-    '';
-
-    makeFlags = [ "all" ];
-
-    installTargets = [
-      "install"
-      "install-META"
-    ];
-
-    dontStrip = true;
-
-    meta = {
-      description = "Software system for writing extensible parsers for programming languages";
-      homepage = "https://github.com/ocaml/camlp4";
-      platforms = ocaml.meta.platforms or [ ];
-      license = lib.licenses.WITH lib.licenses.lgpl2Only lib.licenses.ocamlLgplLinkingException;
+    "4.03" = {
+      version = "4.03+1";
+      sha256 = "1f2ndch6f1m4fgnxsjb94qbpwjnjgdlya6pard44y6n0dqxi1wsq";
     };
+    "4.04" = {
+      version = "4.04+1";
+      sha256 = "1ad7rygqjxrc1im95gw9lp8q83nhdaf383f2808f1p63yl42xm7k";
+    };
+    "4.05" = {
+      version = "4.05+1";
+      sha256 = "0wm795hpwvwpib9c9z6p8kw2fh7p7b2hml6g15z8zry3y7w738sv";
+    };
+    "4.06" = {
+      version = "4.06+1";
+      sha256 = "0fazfw2l7wdmbwnqc22xby5n4ri1wz27lw9pfzhsbcdrighykysf";
+    };
+    "4.07" = {
+      version = "4.07+1";
+      sha256 = "0cxl4hkqcvspvkx4f2k83217rh6051fll9i2yz7cw6m3bq57mdvl";
+    };
+    "4.08" = {
+      version = "4.08+1";
+      sha256 = "0qplawvxwai25bi27niw2cgz2al01kcnkj8wxwhxslpi21z6pyx1";
+    };
+    "4.09" = {
+      version = "4.09+1";
+      sha256 = "1gr33x6xs1rs0bpyq4vzyfxd6vn47jfkg8imi81db2r0cbs0kxx1";
+    };
+    "4.10" = {
+      version = "4.10+1";
+      sha256 = "093bc1c28wid5li0jwglnd4p3csxw09fmbs9ffybq2z41a5mgay6";
+    };
+    "4.11" = {
+      version = "4.11+1";
+      sha256 = "0sn7f6im940qh0ixmx1k738xrwwdvy9g7r19bv5218jb6mh0g068";
+    };
+    "4.12" = {
+      version = "4.12+1";
+      sha256 = "1cfk5ppnd511vzsr9gc0grxbafmh0m3m897aij198rppzxps5kyz";
+    };
+    "4.13" = {
+      version = "4.13+1";
+      sha256 = "0fzxa1zdhk74mlxpin7p90flks6sp4gkc0mfclmj9zak15rii55n";
+    };
+    "4.14" = {
+      version = "4.14+1";
+      sha256 = "sha256-cPN3GioZT/Zt6uzbjGUPEGVJcPQdsAnCkU/AQoPfvuo=";
+    };
+    "5.0" = {
+      version = "5.0";
+      sha256 = "sha256-oZptFNPUEAq5YlcqAoDWfLghGMF9AN7E7hUN55SAX+4=";
+    };
+    "5.1" = {
+      version = "5.1";
+      sha256 = "sha256-Ubedjg3BeHA0bJbEalQN9eEk5+LRAI/er+8mWfVYchg=";
+    };
+    "5.2" = {
+      version = "5.2";
+      sha256 = "sha256-lzbc9xsgeYlbVf71O+PWYS14QivAH1aPdnvWhe0HHME=";
+    };
+    "5.3" = {
+      version = "5.3";
+      sha256 = "sha256-V/kKhTP9U4jWDFuQKuB7BS3XICg1lq/2Avj7UJR55+k=";
+    };
+    "5.4" = {
+      version = "5.4";
+      sha256 = "sha256-7FsKEr0cRVF4LIOvROWMyXBefRTBaS66ZqwtP2VLefM=";
+    };
+  };
+  param = {
+    # Dummy version to let the `meta` attribute set evaluate
+    version = "";
+    sha256 = lib.fakeSha256;
   }
+  // (params.${ocaml.meta.branch} or {
+  }
+  );
+in
+
+stdenv.mkDerivation rec {
+  pname = "camlp4";
+  inherit (param) version;
+
+  src = fetchzip {
+    url = "https://github.com/ocaml/camlp4/archive/${version}.tar.gz";
+    inherit (param) sha256;
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    which
+    ocaml
+    ocamlbuild
+  ]
+  ++ lib.optionals (lib.versionAtLeast ocaml.version "5.0") [
+    findlib
+  ];
+
+  buildInputs = lib.optionals (lib.versionAtLeast ocaml.version "5.0") [
+    camlp-streams
+    ocamlbuild
+  ];
+
+  # build fails otherwise
+  enableParallelBuilding = false;
+
+  dontAddPrefix = true;
+
+  preConfigure = ''
+    # increase stack space for spacetime variant of the compiler
+    # https://github.com/ocaml/ocaml/issues/7435
+    # but disallowed by darwin sandbox
+    ulimit -s unlimited || true
+
+    configureFlagsArray=(
+      --bindir=$out/bin
+      --libdir=$out/lib/ocaml/${ocaml.version}/site-lib
+      --pkgdir=$out/lib/ocaml/${ocaml.version}/site-lib
+    )
+  '';
+
+  postConfigure = ''
+    substituteInPlace camlp4/META.in \
+    --replace +camlp4 $out/lib/ocaml/${ocaml.version}/site-lib/camlp4
+  '';
+
+  makeFlags = [ "all" ];
+
+  installTargets = [
+    "install"
+    "install-META"
+  ];
+
+  dontStrip = true;
+
+  meta = {
+    description = "Software system for writing extensible parsers for programming languages";
+    homepage = "https://github.com/ocaml/camlp4";
+    platforms = ocaml.meta.platforms;
+    license = lib.licenses.WITH lib.licenses.lgpl2Only lib.licenses.ocamlLgplLinkingException;
+    broken = !(params ? ${ocaml.meta.branch});
+  };
+}

From 844b1a9267f1994ea1a11ee99f7bb62e630f6850 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 25 Jun 2026 08:13:21 +0200
Subject: [PATCH 753/831] ocamlPackages_5_5.ocaml: init at 5.5.0

---
 pkgs/development/compilers/ocaml/5.5.nix | 6 ++++++
 pkgs/top-level/ocaml-packages.nix        | 4 +++-
 2 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/compilers/ocaml/5.5.nix

diff --git a/pkgs/development/compilers/ocaml/5.5.nix b/pkgs/development/compilers/ocaml/5.5.nix
new file mode 100644
index 000000000000..8ed4b494db7c
--- /dev/null
+++ b/pkgs/development/compilers/ocaml/5.5.nix
@@ -0,0 +1,6 @@
+import ./generic.nix {
+  major_version = "5";
+  minor_version = "5";
+  patch_version = "0";
+  sha256 = "sha256-/MauZl0exR1SUQ6qx4NKhqmAa/WiWLt8ynhzP8zwFbo=";
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 71cfe7da5118..e9ab2b42c35c 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2400,7 +2400,9 @@ rec {
 
   ocamlPackages_5_4 = mkOcamlPackages (callPackage ../development/compilers/ocaml/5.4.nix { });
 
-  ocamlPackages_latest = ocamlPackages_5_4;
+  ocamlPackages_5_5 = mkOcamlPackages (callPackage ../development/compilers/ocaml/5.5.nix { });
+
+  ocamlPackages_latest = ocamlPackages_5_5;
 
   ocamlPackages = ocamlPackages_5_4;
 

From 940ca9b84b0a7b066ee8179dce01fbe03367ab46 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 24 Jun 2026 07:24:23 -0400
Subject: [PATCH 754/831] curlMinimal: 8.20.0 -> 8.21.0

https://github.com/curl/curl/releases/tag/curl-8_21_0

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 .../curlMinimal/fix-wakeup-consumption.patch  | 32 -------------------
 pkgs/by-name/cu/curlMinimal/package.nix       | 11 ++-----
 2 files changed, 2 insertions(+), 41 deletions(-)
 delete mode 100644 pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch

diff --git a/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch b/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
deleted file mode 100644
index 0bc04b60bb87..000000000000
--- a/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 2a2104f3cff44bb28bb570a093be52bbeeed8f23 Mon Sep 17 00:00:00 2001
-From: Stefan Eissing <stefan@eissing.org>
-Date: Mon, 11 May 2026 14:56:04 +0200
-Subject: [PATCH] event: fix wakeup consumption
-
-The events on a multi wakeup socketpair were only consumed via
-curl_multi_poll()/curl_multi_wait() but not in event based processing on
-a curl_multi_socket() call. That led to busy loops as reported in
-
-Fixes #21547
-Reported-by: Earnestly on github
-Closes #21549
----
- lib/multi.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/lib/multi.c b/lib/multi.c
-index be32740a7097..5e84133f13fd 100644
---- a/lib/multi.c
-+++ b/lib/multi.c
-@@ -2703,6 +2703,11 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
-   Curl_uint32_bset_remove(&multi->dirty, data->mid);
- 
-   if(data == multi->admin) {
-+#ifdef ENABLE_WAKEUP
-+    /* Consume any pending wakeup signals before processing.
-+     * This is necessary for event based processing. See #21547 */
-+    (void)Curl_wakeup_consume(multi->wakeup_pair, TRUE);
-+#endif
- #ifdef USE_RESOLV_THREADED
-     Curl_async_thrdd_multi_process(multi);
- #endif
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index a25ea809c62b..832ffbbd04b6 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -84,7 +84,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.20.0";
+  version = "8.21.0";
 
   src = fetchurl {
     urls = [
@@ -93,16 +93,9 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-Y/4twUi6DOromSLvg49+XJRicsLni3xZ+rS3nTziuJY=";
+    hash = "sha256-qhtmpw6s6D3GJFCHRWRsCK5WHeUSq0A63/uTrIf8cuY=";
   };
 
-  patches = [
-    # https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
-    # According to <https://curl.se/mail/distros-2026-05/0000.html>, this fixes
-    # a performance regression, causing high CPU usage
-    ./fix-wakeup-consumption.patch
-  ];
-
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''

From ce113a1be55206fbb91c1969cb82f615d4dfc7ff Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 24 Jun 2026 22:46:44 -0400
Subject: [PATCH 755/831] Revert "python3Packages.pycapnp: backport patch for
 py314 compat"

This reverts commit 9518afa893a183c0154b8597d6f5cd587dc1b5a1.

Patch already included in 2.2.3 which causes applying the patch to fail
---
 pkgs/development/python-modules/pycapnp/default.nix | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/pkgs/development/python-modules/pycapnp/default.nix b/pkgs/development/python-modules/pycapnp/default.nix
index c5c58935f5d4..d60a1b28d4b3 100644
--- a/pkgs/development/python-modules/pycapnp/default.nix
+++ b/pkgs/development/python-modules/pycapnp/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   replaceVars,
   fetchFromGitHub,
-  fetchpatch,
   setuptools,
   wheel,
   capnproto,
@@ -36,12 +35,6 @@ buildPythonPackage rec {
     # other than the builtin schemas (based on quick GitHub code search), so I don't
     # think it's worthwhile.
     (replaceVars ./include-paths.patch { inherit capnproto; })
-
-    (fetchpatch {
-      url = "https://github.com/capnproto/pycapnp/commit/aa90ab6844df4718f02e2ca4974858d5ab0b079c.patch";
-      name = "python314-compat.patch";
-      hash = "sha256-pscOdgPotLZsW0XWyRTJigIDl3uWOizA1W0gQGZHSyg=";
-    })
   ];
 
   build-system = [

From 200ea92beda611794cfea33cfe23b314fab66d00 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 24 Jun 2026 21:55:37 -0400
Subject: [PATCH 756/831] lix: revert performance patch for curl

curl 8.21.0 contains
https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
which breaks lix for some reason. Revert this single change just for lix
as a workaround

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 .../tools/package-management/lix/common-lix.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index d5277055efd2..fdd550e8c8d1 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -39,6 +39,7 @@ assert lib.assertMsg (
   darwin,
   doxygen,
   editline,
+  fetchpatch2,
   flex,
   git,
   gtest,
@@ -127,16 +128,24 @@ let
         substitute $inputPath $out --replace-fail @deps@ "$(cat ${deps})"
       '';
 
-  # https://github.com/NixOS/nixpkgs/pull/525953 backported a performance patch
-  # that /somehow/ breaks Lix unit tests.
-  # FIXME revert when the patch is gone in curl drv
+  # curl 8.21.0 /somehow/ breaks Lix unit tests.
+  # See https://github.com/NixOS/nixpkgs/issues/534713
+  # FIXME remove once fixed
   curl-fixed = curl.overrideAttrs (
     {
       patches ? [ ],
       ...
     }:
     {
-      patches = lib.filter (patch: !lib.strings.hasSuffix "fix-wakeup-consumption.patch" patch) patches;
+      patches = patches ++ [
+        # See https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
+        (fetchpatch2 {
+          name = "fix-wakeup-consumption-revert.patch";
+          url = "https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23.patch";
+          hash = "sha256-dkwr1ZaR7XB408JxeIKhuHxJrlwf3J01jL6lnOLXo1I=";
+          revert = true;
+        })
+      ];
     }
   );
 in

From 64274e3429a380ed40d984556ec33db0534a9db0 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Thu, 25 Jun 2026 13:41:03 -0400
Subject: [PATCH 757/831] expat: 2.8.1 -> 2.8.2

blog: https://blog.hartwork.org/posts/expat-2-8-2-released/
changelog: https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes
diff: https://github.com/libexpat/libexpat/compare/R_2_8_1...R_2_8_2

Fixes: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
       CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
       CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
       CVE-2026-56412
---
 pkgs/by-name/ex/expat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index 78ff9e9253b0..72459e1c2ac6 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.8.1";
+  version = "2.8.2";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-ELGV7ngWCpCDiBgKj+NgPU6aEvR1X79fOBayOp11DaA=";
+    hash = "sha256-OtibhYjmZEvU5JmBSA1IshKJ7rvNTwoaSvscKfmbarQ=";
   };
 
   strictDeps = true;

From 2a567867307bdff584db00ba93b9a6d320ad136b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 25 Jun 2026 22:47:06 +0100
Subject: [PATCH 758/831] socat: 1.8.1.1 -> 1.8.1.2

Changes: http://www.dest-unreach.org/socat/CHANGES
---
 pkgs/by-name/so/socat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/so/socat/package.nix b/pkgs/by-name/so/socat/package.nix
index 40f1308046a3..e4e6a23e58ed 100644
--- a/pkgs/by-name/so/socat/package.nix
+++ b/pkgs/by-name/so/socat/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "socat";
-  version = "1.8.1.1";
+  version = "1.8.1.2";
 
   src = fetchurl {
     url = "http://www.dest-unreach.org/socat/download/socat-${version}.tar.bz2";
-    hash = "sha256-Xrxja39CcFP5iAZpZSFlOmFMfgZGSRA1PL9U4jJ63Bs=";
+    hash = "sha256-Dht+rAxuPW+k1Vtjx/zd8D9KLqpZ+pOx8w3Cxz1Cqg0=";
   };
 
   postPatch = ''

From 0db12fb6e4d5be16ef13c0c5fed739739af703c4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 26 Jun 2026 00:31:38 +0000
Subject: [PATCH 759/831] uthash: 2.3.0 -> 2.4.0

---
 pkgs/by-name/ut/uthash/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ut/uthash/package.nix b/pkgs/by-name/ut/uthash/package.nix
index 03576564438c..60296d2114d7 100644
--- a/pkgs/by-name/ut/uthash/package.nix
+++ b/pkgs/by-name/ut/uthash/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uthash";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "troydhanson";
     repo = "uthash";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-F0M5ENT3bMn3dD16Oaq9mBFYOWzVliVWupAIrLc2nkQ=";
+    sha256 = "sha256-pEuBQVQSszuL7dIPZYSAyrr3tf6BTc/NWMBoFESCYkw=";
   };
 
   doCheck = true;

From 6eb243853e0700bf5d4df5f69ea4f3edd735544f Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Fri, 26 Jun 2026 06:04:49 +0200
Subject: [PATCH 760/831] ocamlPackages.camlp4: init at 5.5+1 for OCaml 5.5

---
 pkgs/development/tools/ocaml/camlp4/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/tools/ocaml/camlp4/default.nix b/pkgs/development/tools/ocaml/camlp4/default.nix
index caea5a20711d..ae434dbddeb7 100644
--- a/pkgs/development/tools/ocaml/camlp4/default.nix
+++ b/pkgs/development/tools/ocaml/camlp4/default.nix
@@ -83,6 +83,10 @@ let
       version = "5.4";
       sha256 = "sha256-7FsKEr0cRVF4LIOvROWMyXBefRTBaS66ZqwtP2VLefM=";
     };
+    "5.5" = {
+      version = "5.5+1";
+      sha256 = "sha256-ERzTg6CFXm1Z0/NSXP5MwM0H/fSpN/4D2ISFcJa1qSI=";
+    };
   };
   param = {
     # Dummy version to let the `meta` attribute set evaluate

From 17a4d7bc6a1c51a7792c3ad6c3688fd966a8c498 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:22:25 +0000
Subject: [PATCH 761/831] stdenv/darwin: drop `x86_64-darwin` bootstrap tools

---
 .../bootstrap-files/x86_64-apple-darwin.nix   | 22 -------------------
 pkgs/stdenv/darwin/default.nix                |  2 +-
 2 files changed, 1 insertion(+), 23 deletions(-)
 delete mode 100644 pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix

diff --git a/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix b/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix
deleted file mode 100644
index 1f4bf0b7cf1f..000000000000
--- a/pkgs/stdenv/darwin/bootstrap-files/x86_64-apple-darwin.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-# Autogenerated by maintainers/scripts/bootstrap-files/refresh-tarballs.bash as:
-# $ ./refresh-tarballs.bash --targets=x86_64-apple-darwin
-#
-# Metadata:
-# - nixpkgs revision: d8657587c0c1ce2191b4b489299c386b5b7148c6
-# - hydra build: https://hydra.nixos.org/job/nixpkgs/trunk/stdenvBootstrapTools.x86_64-apple-darwin.build/latest
-# - resolved hydra build: https://hydra.nixos.org/build/290554343
-# - instantiated derivation: /nix/store/38sk9c8s4zyhjrifcr9cd3a8d9hyi4zj-stdenv-bootstrap-tools.drv
-# - output directory: /nix/store/y617yisg19x2pj34hzxg9zcm3wlsfj29-stdenv-bootstrap-tools
-# - build time: Thu, 20 Feb 2025 12:38:34 +0000
-{
-  bootstrapTools = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d8657587c0c1ce2191b4b489299c386b5b7148c6/bootstrap-tools.tar.xz";
-    hash = "sha256-gtkeaUaV8ZXY8JxEkyd7ZeB75MESpsBPjaux0B2c0lE=";
-  };
-  unpack = import <nix/fetchurl.nix> {
-    url = "http://tarballs.nixos.org/stdenv/x86_64-apple-darwin/d8657587c0c1ce2191b4b489299c386b5b7148c6/unpack.nar.xz";
-    hash = "sha256-vgfZGKo6I565ORLZ/AGKh6SUpgLhgaanFuhYk897+zw=";
-    name = "unpack";
-    unpack = true;
-  };
-}
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 7bb4082bd6f7..f98c8ce0a53d 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -18,7 +18,7 @@
     if localSystem.isAarch64 then
       import ./bootstrap-files/aarch64-apple-darwin.nix
     else
-      import ./bootstrap-files/x86_64-apple-darwin.nix
+      throw "Unsupported platform for the Darwin stdenv"
   ),
 }:
 

From b4a2fd42de3ad1015fd166cd85b438d09c2d42d2 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:23:31 +0000
Subject: [PATCH 762/831] nixos/nixpkgs: replace `x86_64-darwin` in test

---
 nixos/modules/misc/nixpkgs/test.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/misc/nixpkgs/test.nix b/nixos/modules/misc/nixpkgs/test.nix
index 1d4eff6a72cd..96c461cf795b 100644
--- a/nixos/modules/misc/nixpkgs/test.nix
+++ b/nixos/modules/misc/nixpkgs/test.nix
@@ -36,7 +36,7 @@ let
     nixpkgs.hostPlatform = "aarch64-linux";
     nixpkgs.buildPlatform = "aarch64-darwin";
     nixpkgs.system = "x86_64-linux";
-    nixpkgs.localSystem.system = "x86_64-darwin";
+    nixpkgs.localSystem.system = "x86_64-freebsd";
     nixpkgs.crossSystem.system = "i686-linux";
     imports = [
       {

From c11129861a4d2816f76fe1e277c9a90662186ba5 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:59:08 +0000
Subject: [PATCH 763/831] nixos/testing: drop `x86_64-darwin` support

---
 nixos/lib/testing/nodes.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/lib/testing/nodes.nix b/nixos/lib/testing/nodes.nix
index f83f268c88b3..6a90990b1829 100644
--- a/nixos/lib/testing/nodes.nix
+++ b/nixos/lib/testing/nodes.nix
@@ -27,7 +27,6 @@ let
     else
       let
         hostToGuest = {
-          "x86_64-darwin" = "x86_64-linux";
           "aarch64-darwin" = "aarch64-linux";
         };
 

From 77b50cc00fe8bc9d219824508b1b2cb6c720447b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:57:38 +0000
Subject: [PATCH 764/831] nixos/lib/qemu-common: drop `x86_64-darwin` support

---
 nixos/lib/qemu-common.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/nixos/lib/qemu-common.nix b/nixos/lib/qemu-common.nix
index 9ff482b83f3a..346d3ffcef5a 100644
--- a/nixos/lib/qemu-common.nix
+++ b/nixos/lib/qemu-common.nix
@@ -46,15 +46,10 @@ rec {
         powerpc64-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
         riscv32-linux = "${qemuPkg}/bin/qemu-system-riscv32 -machine virt";
         riscv64-linux = "${qemuPkg}/bin/qemu-system-riscv64 -machine virt";
-        x86_64-darwin = "${qemuPkg}/bin/qemu-system-x86_64 -machine accel=${accel "kvm"} -cpu max";
       };
       otherHostGuestMatrix = {
         aarch64-darwin = {
           aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -machine virt,gic-version=2,accel=${accel "hvf"} -cpu max";
-          inherit (otherHostGuestMatrix.x86_64-darwin) x86_64-linux;
-        };
-        x86_64-darwin = {
-          x86_64-linux = "${qemuPkg}/bin/qemu-system-x86_64 -machine type=q35,accel=${accel "hvf"} -cpu max";
         };
       };
 

From ac9d740544ddd0b60d18e97394d3cf172120abaf Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:58:06 +0000
Subject: [PATCH 765/831] nixos/qemu-vm: replace `x86_64-darwin` in example

---
 nixos/modules/virtualisation/qemu-vm.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 8d2817c23bf0..d99a491b8579 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -740,7 +740,7 @@ in
       default = pkgs;
       defaultText = literalExpression "pkgs";
       example = literalExpression ''
-        import pkgs.path { system = "x86_64-darwin"; }
+        import pkgs.path { system = "aarch64-darwin"; }
       '';
       description = ''
         Package set to use for the host-specific packages of the VM runner.

From 4c84757778f06303649662c0eac4c5d8a8e3ca0a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 06:01:41 +0000
Subject: [PATCH 766/831] nixos/tests/installer: drop `x86_64-darwin` support

---
 nixos/tests/installer.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/tests/installer.nix b/nixos/tests/installer.nix
index 76b3b62c0389..e3d184c42a15 100644
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@@ -677,7 +677,6 @@ let
         # non-EFI tests can only run on x86
         platforms = mkIf (!isEfi) [
           "x86_64-linux"
-          "x86_64-darwin"
           "i686-linux"
         ];
         inherit broken;

From ca72a42fcb1c2b96ae0cf8f2a5d767a81db87e9f Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 09:46:51 +0000
Subject: [PATCH 767/831] release-haskell: drop `x86_64-darwin` mention in
 comment

---
 pkgs/top-level/release-haskell.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/release-haskell.nix b/pkgs/top-level/release-haskell.nix
index 847843a8e307..686d09922259 100644
--- a/pkgs/top-level/release-haskell.nix
+++ b/pkgs/top-level/release-haskell.nix
@@ -204,11 +204,11 @@ let
   #   -> AttrSet
   #
   # > attrSet = {
-  #     foo = ["aarch64-linux" "x86_64-darwin" "x86_64-linux"];
+  #     foo = ["aarch64-linux" "aarch64-darwin" "x86_64-linux"];
   #     bar.baz = ["aarch64-linux" "x86_64-linux"];
-  #     bar.quux = ["aarch64-linux" "x86_64-darwin"];
+  #     bar.quux = ["aarch64-linux" "aarch64-darwin"];
   #   }
-  # > removePlatforms ["aarch64-linux" "x86_64-darwin"] attrSet
+  # > removePlatforms ["aarch64-linux" "aarch64-darwin"] attrSet
   # {
   #   foo = ["x86_64-linux"];
   #   bar = {

From e6c5b18fba4b00bdd52c1006387c77a21432e284 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 06:00:18 +0000
Subject: [PATCH 768/831] maintainers/scripts/haskell/hydra-report: drop
 `x86_64-darwin` support

---
 maintainers/scripts/haskell/hydra-report.hs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/maintainers/scripts/haskell/hydra-report.hs b/maintainers/scripts/haskell/hydra-report.hs
index 263d0aa50e6e..5ef28baa41e0 100755
--- a/maintainers/scripts/haskell/hydra-report.hs
+++ b/maintainers/scripts/haskell/hydra-report.hs
@@ -272,7 +272,7 @@ instance FromJSON JobMaintainers where
 -- @@
 --  fromList
 --    [ ("arion.aarch64-linux", ["rob22"])
---    , ("conduit.x86_64-darwin", ["snoyb", "webber"])
+--    , ("conduit.aarch64-darwin", ["snoyb", "webber"])
 --    ]
 -- @@
 type MaintainerMap = Map JobName (NonEmpty Text)
@@ -404,15 +404,13 @@ platformIcon :: Platform -> Text
 platformIcon (Platform x) = case x of
    "x86_64-linux" -> "🐧"
    "aarch64-linux" -> "📱"
-   "x86_64-darwin" -> "🍎"
-   "aarch64-darwin" -> "🍏"
+   "aarch64-darwin" -> "🍎"
    _ -> x
 
 platformIsOS :: OS -> Platform -> Bool
 platformIsOS os (Platform x) = case (os, x) of
    (Linux, "x86_64-linux") -> True
    (Linux, "aarch64-linux") -> True
-   (Darwin, "x86_64-darwin") -> True
    (Darwin, "aarch64-darwin") -> True
    _ -> False
 

From a4f45c476d7270d51e64d1e8b4d1f56886456f6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 00:28:26 -0700
Subject: [PATCH 769/831] python3Packages.libtfr: use setuptools_80

Otherwise it fails to build with

    ModuleNotFoundError: No module named 'pkg_resources'
---
 pkgs/development/python-modules/libtfr/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/libtfr/default.nix b/pkgs/development/python-modules/libtfr/default.nix
index 4a66aa6b71ea..cbc89c8da6e0 100644
--- a/pkgs/development/python-modules/libtfr/default.nix
+++ b/pkgs/development/python-modules/libtfr/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
 
   # build-system
-  setuptools,
+  setuptools_80,
   pkg-config,
   cython,
   pkgconfig,
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    setuptools
+    setuptools_80
   ];
 
   dependencies = [

From 37be0a2dedace2a185db8ae448dd848aedbfadde Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 26 Jun 2026 10:12:41 +0100
Subject: [PATCH 770/831] Revert "gccNGPackages_15: 15.2.0 -> 15.3.0"

This reverts commit a960983be330dfaff54f72c4fd50b1b47eafbcec.
---
 pkgs/development/compilers/gcc/ng/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/gcc/ng/default.nix b/pkgs/development/compilers/gcc/ng/default.nix
index 4eb9ca23b9b5..c849367aa1fc 100644
--- a/pkgs/development/compilers/gcc/ng/default.nix
+++ b/pkgs/development/compilers/gcc/ng/default.nix
@@ -14,7 +14,7 @@
 }@packageSetArgs:
 let
   versions = {
-    "15.3.0".officialRelease.sha256 = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
+    "15.2.0".officialRelease.sha256 = "sha256-Q4/ZloJrDIJIWinaA6ctcdbjVBqD7HAt9Ccfb+Al0k4=";
   }
   // gccVersions;
 

From 035141be98cd7f4d904535ce60ffcbeb360ccf32 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 26 Jun 2026 10:12:41 +0100
Subject: [PATCH 771/831] Revert "gcc: fix download issue for new release"

This reverts commit a237f34fe760618b117993a49018e4199ae66880.
---
 pkgs/build-support/fetchurl/mirrors.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index cf30c54fe8c3..5d7ebc7cd87b 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -54,8 +54,6 @@
 
   # GCC
   gcc = [
-    "https://gcc.gnu.org/pub/gcc/"
-    "https://sourceware.org/pub/gcc/"
     "https://mirror.koddos.net/gcc/"
     "https://bigsearcher.com/mirrors/gcc/"
     "ftp://ftp.nluug.nl/mirror/languages/gcc/"

From f7f32bfe216eed051f6cf13322d0e4c83b0b3623 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 26 Jun 2026 10:12:41 +0100
Subject: [PATCH 772/831] Revert "gcc15: 15.2.0 -> 15.3.0"

Broke `aarch64-linux` and Darwin. Reverting pending fixes.

This reverts commit 7049a93a44d73f6e3ac18feb3facd7f7bda29858.
---
 .../gcc/patches/15/aarch64-sve-rtx.patch      | 87 +++++++++++++++++++
 .../compilers/gcc/patches/default.nix         |  3 +
 pkgs/development/compilers/gcc/versions.nix   |  4 +-
 3 files changed, 92 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch

diff --git a/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch b/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch
new file mode 100644
index 000000000000..257c76d735da
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/15/aarch64-sve-rtx.patch
@@ -0,0 +1,87 @@
+Without the change `libhwy-1.3.0` ICEs when built for aarch64-linux as:
+https://github.com/NixOS/nixpkgs/pull/320616#issuecomment-3764400891
+
+Upstream report: http://gcc.gnu.org/PR120718
+Upstream fix: https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00
+Fetched as:
+$ curl -L 'https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00' > aarch64-sve-rtx.patch
+
+From: Richard Sandiford <richard.sandiford@arm.com>
+Date: Thu, 14 Aug 2025 16:56:50 +0000 (+0100)
+Subject: Remove MODE_COMPOSITE_P test from simplify_gen_subreg [PR120718]
+X-Git-Url: https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff_plain;h=d755aa03db0ad5b71ee7f39b09c92870789f2f00
+
+Remove MODE_COMPOSITE_P test from simplify_gen_subreg [PR120718]
+
+simplify_gen_subreg rejected subregs of literal constants if
+MODE_COMPOSITE_P.  This was added by the fix for PR96648 in
+g:c0f772894b6b3cd8ed5c5dd09d0c7917f51cf70f.  Jakub said:
+
+  As for the simplify_gen_subreg change, I think it would be desirable
+  to just avoid creating SUBREGs of constants on all targets and for all
+  constants, if simplify_immed_subreg simplified, fine, otherwise punt,
+  but as we are late in GCC11 development, the patch instead guards this
+  behavior on MODE_COMPOSITE_P (outermode) - i.e. only conversions to
+  powerpc{,64,64le} double double long double - and only for the cases where
+  simplify_immed_subreg was called.
+
+I'm not sure about relaxing the codes further, since subregs might
+be wanted for CONST, SYMBOL_REF and LABEL_REF.  But removing the
+MODE_COMPOSITE_P is needed to fix PR120718, where we get an ICE
+from generating a subreg of a V2SI const_vector.
+
+Unlike the trunk version, this backport does not remove the
+VOIDmode test; see PR121501.
+
+gcc/
+	PR rtl-optimization/120718
+	* simplify-rtx.cc (simplify_context::simplify_gen_subreg):
+	Remove MODE_COMPOSITE_P condition.
+
+gcc/testsuite/
+	PR rtl-optimization/120718
+	* gcc.target/aarch64/sve/acle/general/pr120718.c: New test.
+---
+
+diff --git a/gcc/simplify-rtx.cc b/gcc/simplify-rtx.cc
+index 88d31a71c05a..8d4cbf1371a3 100644
+--- a/gcc/simplify-rtx.cc
++++ b/gcc/simplify-rtx.cc
+@@ -8317,14 +8317,11 @@ simplify_context::simplify_gen_subreg (machine_mode outermode, rtx op,
+ 
+   if (GET_CODE (op) == SUBREG
+       || GET_CODE (op) == CONCAT
+-      || GET_MODE (op) == VOIDmode)
+-    return NULL_RTX;
+-
+-  if (MODE_COMPOSITE_P (outermode)
+-      && (CONST_SCALAR_INT_P (op)
+-	  || CONST_DOUBLE_AS_FLOAT_P (op)
+-	  || CONST_FIXED_P (op)
+-	  || GET_CODE (op) == CONST_VECTOR))
++      || GET_MODE (op) == VOIDmode
++      || CONST_SCALAR_INT_P (op)
++      || CONST_DOUBLE_AS_FLOAT_P (op)
++      || CONST_FIXED_P (op)
++      || GET_CODE (op) == CONST_VECTOR)
+     return NULL_RTX;
+ 
+   if (validate_subreg (outermode, innermode, op, byte))
+diff --git a/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c b/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c
+new file mode 100644
+index 000000000000..9ca0938e36bf
+--- /dev/null
++++ b/gcc/testsuite/gcc.target/aarch64/sve/acle/general/pr120718.c
+@@ -0,0 +1,12 @@
++/* { dg-options "-O2" } */
++
++#include <arm_sve.h>
++typedef int __attribute__((vector_size(8))) v2si;
++typedef struct { int x; int y; } A;
++void bar(A a);
++void foo()
++{
++    A a;
++    *(v2si *)&a = (v2si){0, (int)svcntd_pat(SV_ALL)};
++    bar(a);
++}
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 06981780da3f..cc0b5b47e9b4 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -112,6 +112,9 @@ optionals noSysDirs (
 # c++tools: Don't check --enable-default-pie.
 # --enable-default-pie breaks bootstrap gcc otherwise, because libiberty.a is not found
 ++ optional (is14 || is15) ./c++tools-dont-check-enable-default-pie.patch
+# http://gcc.gnu.org/PR120718 backport (will be inclkuded in 15.3.0) to
+# fix `highway-1.3.0` ICE on aarch64-linux.
+++ optional is15 ./15/aarch64-sve-rtx.patch
 
 ## 2. Patches relevant on specific platforms ####################################
 
diff --git a/pkgs/development/compilers/gcc/versions.nix b/pkgs/development/compilers/gcc/versions.nix
index 6e49faf18628..ca6b2c91033d 100644
--- a/pkgs/development/compilers/gcc/versions.nix
+++ b/pkgs/development/compilers/gcc/versions.nix
@@ -1,7 +1,7 @@
 let
   majorMinorToVersionMap = {
     "16" = "16.1.0";
-    "15" = "15.3.0";
+    "15" = "15.2.0";
     "14" = "14.3.0";
     "13" = "13.4.0";
   };
@@ -15,7 +15,7 @@ let
       # 3 digits: releases (14.2.0)
       # 4 digits: snapshots (14.2.1.20250322)
       "16.1.0" = "sha256-UO+02Uwzl6/zsNYaWr10i03THZ0/Kre+BbFx02pRD3k=";
-      "15.3.0" = "sha256-+lnBvu+JlfJ8TXHB3yJ1hxiTFdPm+v8btDBuYbDFMOs=";
+      "15.2.0" = "sha256-Q4/ZloJrDIJIWinaA6ctcdbjVBqD7HAt9Ccfb+Al0k4=";
       "14.3.0" = "sha256-4Nx3KXYlYxrI5Q+pL//v6Jmk63AlktpcMu8E4ik6yjo=";
       "13.4.0" = "sha256-nEzm27BAVo/cVFWIrAPFy8lajb8MeqSQFwhDr7WcqPU=";
     }

From d7de769f9a1a6e3763a9dd18871c03240c579822 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 19 Jun 2026 16:59:45 +0200
Subject: [PATCH 773/831] jsoncpp: modernize

---
 pkgs/by-name/js/jsoncpp/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/js/jsoncpp/package.nix b/pkgs/by-name/js/jsoncpp/package.nix
index b5f4373d5bd1..288e5dc6ed51 100644
--- a/pkgs/by-name/js/jsoncpp/package.nix
+++ b/pkgs/by-name/js/jsoncpp/package.nix
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "open-source-parsers";
     repo = "jsoncpp";
-    rev = finalAttrs.version;
-    sha256 = "sha256-5cH9G4/TVCM5HX6QSk3P4m5+cwuK4x8hP9FohBcmjik=";
+    tag = finalAttrs.version;
+    hash = "sha256-5cH9G4/TVCM5HX6QSk3P4m5+cwuK4x8hP9FohBcmjik=";
   };
 
   /*
@@ -60,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   ) "-DJSONCPP_WITH_TESTS=OFF";
 
   meta = {
+    changelog = "https://github.com/open-source-parsers/jsoncpp/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/open-source-parsers/jsoncpp";
     description = "C++ library for interacting with JSON";
     maintainers = [ ];

From 1ec1e0a7213f7cb343db5a9d65f7b643393f3bef Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 19 Jun 2026 17:00:12 +0200
Subject: [PATCH 774/831] jsoncpp: add hythera as maintainer

---
 pkgs/by-name/js/jsoncpp/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/js/jsoncpp/package.nix b/pkgs/by-name/js/jsoncpp/package.nix
index 288e5dc6ed51..25d1bcdf8fe0 100644
--- a/pkgs/by-name/js/jsoncpp/package.nix
+++ b/pkgs/by-name/js/jsoncpp/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/open-source-parsers/jsoncpp/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/open-source-parsers/jsoncpp";
     description = "C++ library for interacting with JSON";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
   };

From 339d13830e1ef7c50d1a856e1e706b71881f4f69 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Fri, 26 Jun 2026 11:30:25 -0400
Subject: [PATCH 775/831] python3Packages.pycurl: Allow websockets tests to run

curlFull comes with websockets support which seems to fail the
websockets tests in pycurl, as it needs python websockets.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/development/python-modules/pycurl/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index e37e001a3419..c9fd2a8d43f2 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -11,6 +11,7 @@
   flaky,
   flask,
   numpy,
+  websockets,
   setuptools,
 }:
 
@@ -50,6 +51,7 @@ buildPythonPackage rec {
     flaky
     flask
     numpy
+    websockets
     pytestCheckHook
   ];
 

From d97307b76f4898528c59c895e86412d9607a9436 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Fri, 26 Jun 2026 11:31:34 -0400
Subject: [PATCH 776/831] python3Packages.pycurl: add support for curl 8.21.0
 websockets

Backport of https://github.com/pycurl/pycurl/pull/1028

Seems like a new release of pycurl is also imminent, which means we may
be able to drop this patch soon.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/development/python-modules/pycurl/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index c9fd2a8d43f2..c7c32e9e20d3 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   isPyPy,
   fetchFromGitHub,
+  fetchpatch2,
   curl,
   openssl,
   bottle,
@@ -29,6 +30,14 @@ buildPythonPackage rec {
     hash = "sha256-F40bJ7TYFK2dVkDJGGxl7XV46fKmjwvUYYulcwGL6hk=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "pycurl-curl-8.21.0-ws-support.patch";
+      url = "https://github.com/pycurl/pycurl/commit/c78fd8aba82e2f8037275063138eaa7706c111af.diff?full_index=1";
+      hash = "sha256-EBXgGiaMtXTsgJOOrzzZFJ7Q/ofAlc4zuipoEpfdFqU=";
+    })
+  ];
+
   preConfigure = ''
     substituteInPlace setup.py \
       --replace-fail '--static-libs' '--libs'

From 8ff970916b975cfd1b79ff3751061526fe88614b Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:40:20 +0200
Subject: [PATCH 777/831] openmpCheckPhaseHook: init

---
 .../op/openmpCheckPhaseHook/omp-check-hook.sh        | 11 +++++++++++
 pkgs/by-name/op/openmpCheckPhaseHook/package.nix     | 12 ++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh
 create mode 100644 pkgs/by-name/op/openmpCheckPhaseHook/package.nix

diff --git a/pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh b/pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh
new file mode 100644
index 000000000000..b3279b170360
--- /dev/null
+++ b/pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh
@@ -0,0 +1,11 @@
+preCheckHooks+=('setupOmpCheck')
+preInstallCheckHooks+=('setupOmpCheck')
+
+
+setupOmpCheck() {
+  # Limit number of OpenMP threads. Default is "all cores".
+  # Using all cores causes high load on builders if checks are executed with NIX_BUILD_CORE parallelism.
+  # This gets even worse if multiple builds are scheduled on the same machine, potentially growing O(n^3) without explicit core limits.
+  export OMP_NUM_THREADS="${OMP_NUM_THREADS:-1}"
+}
+
diff --git a/pkgs/by-name/op/openmpCheckPhaseHook/package.nix b/pkgs/by-name/op/openmpCheckPhaseHook/package.nix
new file mode 100644
index 000000000000..9e30609e8de5
--- /dev/null
+++ b/pkgs/by-name/op/openmpCheckPhaseHook/package.nix
@@ -0,0 +1,12 @@
+{
+  lib,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "omp-checkPhase-hook";
+
+  __structuredAttrs = true;
+
+  meta.license = lib.licenses.mit;
+} ./omp-check-hook.sh

From 71fbdd6512fcf27434aa34bbb9a830c1a8a2068b Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:50:01 +0200
Subject: [PATCH 778/831] doc/openmpCheckPhaseHook: init

---
 doc/hooks/index.md                     |  1 +
 doc/hooks/openmp-check-hook.section.md | 10 ++++++++++
 doc/redirects.json                     |  3 +++
 3 files changed, 14 insertions(+)
 create mode 100644 doc/hooks/openmp-check-hook.section.md

diff --git a/doc/hooks/index.md b/doc/hooks/index.md
index 7fb76b72953e..63cc9b2ded64 100644
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@@ -34,6 +34,7 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
+openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
diff --git a/doc/hooks/openmp-check-hook.section.md b/doc/hooks/openmp-check-hook.section.md
new file mode 100644
index 000000000000..5a5842eb5e29
--- /dev/null
+++ b/doc/hooks/openmp-check-hook.section.md
@@ -0,0 +1,10 @@
+# openmpCheckPhaseHook {#setup-hook-omp-check}
+
+
+This hook can be used to setup a check phase that
+requires running a OpenMP application. It mostly
+serves to limit `OMP_NUM_THREADS` to avoid overloading
+build machines.
+
+This hook will not attempt to override an already existing
+definition of `OMP_NUM_THREADS` in the environment.
diff --git a/doc/redirects.json b/doc/redirects.json
index 51839e8ee9b0..c9d3a004e3e3 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -2881,6 +2881,9 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
+  "setup-hook-omp-check": [
+    "index.html#setup-hook-omp-check"
+  ],
   "ninja": [
     "index.html#ninja"
   ],

From 240ef095c6bc783e437fb69b74442db6219d0e49 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:51:33 +0200
Subject: [PATCH 779/831] mpiCheckPhaseHook: propagate openmpCheckPhaseHook

---
 pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh | 3 ---
 pkgs/by-name/mp/mpiCheckPhaseHook/package.nix       | 6 +++++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh b/pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh
index be2203951c0f..139dc932366f 100644
--- a/pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh
+++ b/pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh
@@ -72,8 +72,5 @@ setupMpiCheck() {
       export HWLOC_XMLFILE="@topology@"
       ;;
   esac
-
-  # Limit number of OpenMP threads. Default is "all cores".
-  export OMP_NUM_THREADS=1
 }
 
diff --git a/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix b/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix
index e5bdc817379d..db5832c28a6e 100644
--- a/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix
+++ b/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix
@@ -1,8 +1,8 @@
 {
   lib,
-  callPackage,
   makeSetupHook,
   stdenv,
+  openmpCheckPhaseHook,
 }:
 
 makeSetupHook {
@@ -13,5 +13,9 @@ makeSetupHook {
     topology = ./topology.xml;
   };
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   meta.license = lib.licenses.mit;
 } ./mpi-check-hook.sh

From 559ae88af990e9cc835f791f1fca62283ac574a7 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:52:29 +0200
Subject: [PATCH 780/831] llvmPackages.openmp: propagate openmpCheckPhaseHook

---
 pkgs/development/compilers/llvm/common/openmp/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/llvm/common/openmp/default.nix b/pkgs/development/compilers/llvm/common/openmp/default.nix
index a08376522d9e..10f9ce154cb4 100644
--- a/pkgs/development/compilers/llvm/common/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/common/openmp/default.nix
@@ -19,7 +19,7 @@
   ompdSupport ? true,
   ompdGdbSupport ? ompdSupport,
   getVersionFile,
-  fetchpatch,
+  openmpCheckPhaseHook,
 }:
 
 assert lib.assertMsg (ompdGdbSupport -> ompdSupport) "OMPD GDB support requires OMPD support!";
@@ -60,6 +60,10 @@ stdenv.mkDerivation (finalAttrs: {
     lit
   ];
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   buildInputs = [
     llvm
   ]

From df838c503eaeb72f9a100ccf8e5914fe65a11502 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 17:53:36 +0200
Subject: [PATCH 781/831] blas: propagate openmpCheckPhaseHook

---
 pkgs/by-name/bl/blas/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/bl/blas/package.nix b/pkgs/by-name/bl/blas/package.nix
index 01ad1839c339..51deec6c5c64 100644
--- a/pkgs/by-name/bl/blas/package.nix
+++ b/pkgs/by-name/bl/blas/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   lapack-reference,
   openblas,
+  openmpCheckPhaseHook,
   isILP64 ? false,
   blasProvider ? openblas,
 }:
@@ -186,6 +187,10 @@ stdenv.mkDerivation {
     "dev"
   ];
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   meta = (blasProvider'.meta or { }) // {
     description = "${lib.getName blasProvider} with just the BLAS C and FORTRAN ABI";
   };

From b3944a1e306623cb152573d1aaad9ba569a9d67f Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:42:53 +0200
Subject: [PATCH 782/831] python3Packages.numpy: propagate openmpCheckPhaseHook

---
 pkgs/development/python-modules/numpy/2.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index be54cb4d312e..c62619db4422 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -19,6 +19,8 @@
   coreutils,
   lapack,
 
+  openmpCheckPhaseHook,
+
   # Reverse dependency
   sage,
 
@@ -122,6 +124,10 @@ buildPythonPackage (finalAttrs: {
     ln -s ${placeholder "out"}/${finalAttrs.passthru.coreIncludeInnerDir} $out/include
   '';
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   preCheck = ''
     pushd $out
     # For numpy-config executable to be available during tests

From ef8b8d8f58919deb3d462416e582dadafe3fb833 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:43:24 +0200
Subject: [PATCH 783/831] python3Packages.*: remove explicit OMP_NUM_THREADS
 definitions where numpy is used

---
 pkgs/development/python-modules/astropy/default.nix        | 4 ----
 pkgs/development/python-modules/captum/default.nix         | 4 ----
 pkgs/development/python-modules/geometric/default.nix      | 4 ----
 pkgs/development/python-modules/imread/default.nix         | 1 -
 pkgs/development/python-modules/linearmodels/default.nix   | 2 --
 pkgs/development/python-modules/mace-torch/default.nix     | 4 ----
 pkgs/development/python-modules/numpy/1.nix                | 7 ++++++-
 pkgs/development/python-modules/numpy/2.nix                | 4 ----
 pkgs/development/python-modules/pyscf/default.nix          | 1 -
 pkgs/development/python-modules/qutip/default.nix          | 1 -
 pkgs/development/python-modules/scikit-bio/default.nix     | 4 ----
 pkgs/development/python-modules/scikit-learn/default.nix   | 1 -
 pkgs/development/python-modules/scipy/default.nix          | 5 -----
 .../development/python-modules/torch-geometric/default.nix | 4 ----
 pkgs/development/python-modules/x-transformers/default.nix | 4 ----
 15 files changed, 6 insertions(+), 44 deletions(-)

diff --git a/pkgs/development/python-modules/astropy/default.nix b/pkgs/development/python-modules/astropy/default.nix
index 639e234acbb0..94376d603d5e 100644
--- a/pkgs/development/python-modules/astropy/default.nix
+++ b/pkgs/development/python-modules/astropy/default.nix
@@ -143,10 +143,6 @@ buildPythonPackage rec {
 
   preCheck = ''
     export HOME="$(mktemp -d)"
-    export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
-    if [ $OMP_NUM_THREADS -eq 0 ]; then
-      export OMP_NUM_THREADS=1
-    fi
 
     # See https://github.com/astropy/astropy/issues/17649 and see
     # --hypothesis-profile=ci pytest flag below.
diff --git a/pkgs/development/python-modules/captum/default.nix b/pkgs/development/python-modules/captum/default.nix
index 455eac5c5fc1..858e9abc4110 100644
--- a/pkgs/development/python-modules/captum/default.nix
+++ b/pkgs/development/python-modules/captum/default.nix
@@ -52,10 +52,6 @@ buildPythonPackage rec {
     scikit-learn
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   disabledTestPaths =
     lib.optionals stdenv.hostPlatform.isDarwin [
       # These tests may fail if multiple builds run them at the same time due
diff --git a/pkgs/development/python-modules/geometric/default.nix b/pkgs/development/python-modules/geometric/default.nix
index ec1553e164ab..08301b669d5c 100644
--- a/pkgs/development/python-modules/geometric/default.nix
+++ b/pkgs/development/python-modules/geometric/default.nix
@@ -28,10 +28,6 @@ buildPythonPackage rec {
     six
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
diff --git a/pkgs/development/python-modules/imread/default.nix b/pkgs/development/python-modules/imread/default.nix
index a26b89fb2b02..bc0934f5bd7c 100644
--- a/pkgs/development/python-modules/imread/default.nix
+++ b/pkgs/development/python-modules/imread/default.nix
@@ -49,7 +49,6 @@ buildPythonPackage rec {
   preCheck = ''
     cd $TMPDIR
     export HOME=$TMPDIR
-    export OMP_NUM_THREADS=1
   '';
 
   meta = {
diff --git a/pkgs/development/python-modules/linearmodels/default.nix b/pkgs/development/python-modules/linearmodels/default.nix
index d67690e48774..9a5ae03ffe5f 100644
--- a/pkgs/development/python-modules/linearmodels/default.nix
+++ b/pkgs/development/python-modules/linearmodels/default.nix
@@ -67,8 +67,6 @@ buildPythonPackage (finalAttrs: {
 
   preCheck = ''
     rm linearmodels/__init__.py
-
-    export OMP_NUM_THREADS=1
   '';
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/mace-torch/default.nix b/pkgs/development/python-modules/mace-torch/default.nix
index 4ed39d479782..3c8b486f643b 100644
--- a/pkgs/development/python-modules/mace-torch/default.nix
+++ b/pkgs/development/python-modules/mace-torch/default.nix
@@ -82,10 +82,6 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   disabledTests = [
     # _pickle.PickleError: ScriptFunction cannot be pickled
     "test_run_eval_fail_with_wrong_model"
diff --git a/pkgs/development/python-modules/numpy/1.nix b/pkgs/development/python-modules/numpy/1.nix
index 4fc274257916..7167ff94637e 100644
--- a/pkgs/development/python-modules/numpy/1.nix
+++ b/pkgs/development/python-modules/numpy/1.nix
@@ -18,6 +18,8 @@
   blas,
   lapack,
 
+  openmpCheckPhaseHook,
+
   # Reverse dependency
   sage,
 
@@ -93,7 +95,6 @@ buildPythonPackage (finalAttrs: {
   # see https://github.com/OpenMathLib/OpenBLAS/issues/2993
   preConfigure = ''
     sed -i 's/-faltivec//' numpy/distutils/system_info.py
-    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
   '';
 
   preBuild = ''
@@ -110,6 +111,10 @@ buildPythonPackage (finalAttrs: {
     typing-extensions
   ];
 
+  propagatedNativeBuildInputs = [
+    openmpCheckPhaseHook
+  ];
+
   preCheck = ''
     cd "$out"
   '';
diff --git a/pkgs/development/python-modules/numpy/2.nix b/pkgs/development/python-modules/numpy/2.nix
index c62619db4422..712130d6a0a8 100644
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -93,10 +93,6 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ mesonEmulatorHook ];
 
-  preConfigure = ''
-    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 64 ? 64 : NIX_BUILD_CORES))
-  '';
-
   buildInputs = [
     blas
     lapack
diff --git a/pkgs/development/python-modules/pyscf/default.nix b/pkgs/development/python-modules/pyscf/default.nix
index a248a1bb0d49..012d23f0dcfb 100644
--- a/pkgs/development/python-modules/pyscf/default.nix
+++ b/pkgs/development/python-modules/pyscf/default.nix
@@ -80,7 +80,6 @@ buildPythonPackage (finalAttrs: {
   preCheck = ''
     # Set config used by tests to ensure reproducibility
     echo 'pbc_tools_pbc_fft_engine = "NUMPY"' > pyscf/pyscf_config.py
-    export OMP_NUM_THREADS=1
     ulimit -s 20000
     export PYSCF_CONFIG_FILE=$(pwd)/pyscf/pyscf_config.py
   '';
diff --git a/pkgs/development/python-modules/qutip/default.nix b/pkgs/development/python-modules/qutip/default.nix
index 89e77b995785..aa968f51180d 100644
--- a/pkgs/development/python-modules/qutip/default.nix
+++ b/pkgs/development/python-modules/qutip/default.nix
@@ -62,7 +62,6 @@ buildPythonPackage (finalAttrs: {
   # This is due to the Cython-compiled modules not being in the correct location
   # of the source tree.
   preCheck = ''
-    export OMP_NUM_THREADS=$NIX_BUILD_CORES
     mkdir -p test && cd test
   '';
 
diff --git a/pkgs/development/python-modules/scikit-bio/default.nix b/pkgs/development/python-modules/scikit-bio/default.nix
index c909d8d66d08..1190d875005a 100644
--- a/pkgs/development/python-modules/scikit-bio/default.nix
+++ b/pkgs/development/python-modules/scikit-bio/default.nix
@@ -62,10 +62,6 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   # only the $out dir contains the built cython extensions, so we run the tests inside there
   enabledTestPaths = [ "${placeholder "out"}/${python.sitePackages}/skbio" ];
 
diff --git a/pkgs/development/python-modules/scikit-learn/default.nix b/pkgs/development/python-modules/scikit-learn/default.nix
index b48f5a5d8f72..bf50ab0b7a63 100644
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@@ -116,7 +116,6 @@ buildPythonPackage rec {
   preCheck = ''
     cd $TMPDIR
     export HOME=$TMPDIR
-    export OMP_NUM_THREADS=1
   '';
 
   pythonImportsCheck = [ "sklearn" ];
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 914b8ce07842..785a917fcf0d 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -175,11 +175,6 @@ buildPythonPackage (finalAttrs: {
   '';
 
   preCheck = ''
-    export OMP_NUM_THREADS=$(( $NIX_BUILD_CORES / 4 ))
-    if [ $OMP_NUM_THREADS -eq 0 ]; then
-      export OMP_NUM_THREADS=1
-    fi
-
     cd $out
   '';
 
diff --git a/pkgs/development/python-modules/torch-geometric/default.nix b/pkgs/development/python-modules/torch-geometric/default.nix
index 839f5c8e02e5..06863712e7c5 100644
--- a/pkgs/development/python-modules/torch-geometric/default.nix
+++ b/pkgs/development/python-modules/torch-geometric/default.nix
@@ -185,10 +185,6 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   pytestFlags = [
     # DeprecationWarning: Failing to pass a value to the 'type_params' parameter of
     # 'typing._eval_type' is deprecated, as it leads to incorrect behaviour when calling
diff --git a/pkgs/development/python-modules/x-transformers/default.nix b/pkgs/development/python-modules/x-transformers/default.nix
index 1496775f5eec..16d3dff4fd61 100644
--- a/pkgs/development/python-modules/x-transformers/default.nix
+++ b/pkgs/development/python-modules/x-transformers/default.nix
@@ -42,10 +42,6 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  preCheck = ''
-    export OMP_NUM_THREADS=1
-  '';
-
   # RuntimeError: torch.compile is not supported on Python 3.14+
   disabledTests = lib.optionals (pythonAtLeast "3.14") [ "test_up" ];
 

From d5ae461bf7277e6fcbb5239e4b268ed2792e6ef2 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:16:07 +0200
Subject: [PATCH 784/831] treewide: remove explicit OMP_NUM_THREADS where
 openmpCheckPhaseHook is in effect

---
 pkgs/by-name/cp/cpcm-x/package.nix                           | 4 ----
 pkgs/by-name/df/dftd4/package.nix                            | 4 ----
 pkgs/by-name/el/elpa/package.nix                             | 3 ---
 pkgs/by-name/er/ergoscf/package.nix                          | 1 -
 pkgs/by-name/gr/greenx/package.nix                           | 4 ----
 pkgs/by-name/mc/mctc-lib/package.nix                         | 4 ----
 pkgs/by-name/mo/mopac/package.nix                            | 4 ----
 pkgs/by-name/mp/mpb/package.nix                              | 2 --
 pkgs/by-name/mu/multicharge/package.nix                      | 4 ----
 pkgs/by-name/nu/numsa/package.nix                            | 4 ----
 pkgs/by-name/pi/pixman/package.nix                           | 5 -----
 pkgs/by-name/wa/wannier90/package.nix                        | 3 ---
 pkgs/by-name/xt/xtb/package.nix                              | 3 ---
 .../libraries/science/chemistry/simple-dftd3/default.nix     | 3 ---
 .../libraries/science/chemistry/tblite/default.nix           | 4 ----
 15 files changed, 52 deletions(-)

diff --git a/pkgs/by-name/cp/cpcm-x/package.nix b/pkgs/by-name/cp/cpcm-x/package.nix
index 99484edfc1d2..7a5049365423 100644
--- a/pkgs/by-name/cp/cpcm-x/package.nix
+++ b/pkgs/by-name/cp/cpcm-x/package.nix
@@ -89,10 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/df/dftd4/package.nix b/pkgs/by-name/df/dftd4/package.nix
index c58a7400c404..b4bc8271cf33 100644
--- a/pkgs/by-name/df/dftd4/package.nix
+++ b/pkgs/by-name/df/dftd4/package.nix
@@ -81,10 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
       app/tester.py
   '';
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Generally Applicable Atomic-Charge Dependent London Dispersion Correction";
     changelog = "https://github.com/dftd4/dftd4/releases/tag/${finalAttrs.src.tag}";
diff --git a/pkgs/by-name/el/elpa/package.nix b/pkgs/by-name/el/elpa/package.nix
index 170f03f697e8..650d59f93de4 100644
--- a/pkgs/by-name/el/elpa/package.nix
+++ b/pkgs/by-name/el/elpa/package.nix
@@ -116,9 +116,6 @@ stdenv.mkDerivation (finalAttrs: {
   preCheck = ''
     #patchShebangs ./
 
-    # Run dual threaded
-    export OMP_NUM_THREADS=2
-
     # Reduce test problem sizes
     export TEST_FLAGS="1500 50 16"
   '';
diff --git a/pkgs/by-name/er/ergoscf/package.nix b/pkgs/by-name/er/ergoscf/package.nix
index 9514bb89f1e4..59ccb179b2bd 100644
--- a/pkgs/by-name/er/ergoscf/package.nix
+++ b/pkgs/by-name/er/ergoscf/package.nix
@@ -39,7 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
       "-lblas"
       "-llapack"
     ];
-    OMP_NUM_THREADS = 2; # required for check phase
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/gr/greenx/package.nix b/pkgs/by-name/gr/greenx/package.nix
index c08356a17058..fb360c6728b8 100644
--- a/pkgs/by-name/gr/greenx/package.nix
+++ b/pkgs/by-name/gr/greenx/package.nix
@@ -34,10 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Uses a hacky python setup run by cmake, which is hard to get running
   doCheck = false;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Library for Green’s function based electronic structure theory calculations";
     license = [ lib.licenses.asl20 ];
diff --git a/pkgs/by-name/mc/mctc-lib/package.nix b/pkgs/by-name/mc/mctc-lib/package.nix
index abf2cd1a8509..5e677272f307 100644
--- a/pkgs/by-name/mc/mctc-lib/package.nix
+++ b/pkgs/by-name/mc/mctc-lib/package.nix
@@ -63,10 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   postPatch = ''
     patchShebangs --build config/install-mod.py
   '';
diff --git a/pkgs/by-name/mo/mopac/package.nix b/pkgs/by-name/mo/mopac/package.nix
index c5e5dacccb9b..c70b46ded59c 100644
--- a/pkgs/by-name/mo/mopac/package.nix
+++ b/pkgs/by-name/mo/mopac/package.nix
@@ -39,10 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Semiempirical quantum chemistry";
     homepage = "https://github.com/openmopac/mopac";
diff --git a/pkgs/by-name/mp/mpb/package.nix b/pkgs/by-name/mp/mpb/package.nix
index eb001a94446d..f92f7bfeeadf 100644
--- a/pkgs/by-name/mp/mpb/package.nix
+++ b/pkgs/by-name/mp/mpb/package.nix
@@ -59,8 +59,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = "export OMP_NUM_THREADS=2";
-
   meta = {
     description = "MIT Photonic-Bands: computation of photonic band structures in periodic media";
     homepage = "https://mpb.readthedocs.io/en/latest/";
diff --git a/pkgs/by-name/mu/multicharge/package.nix b/pkgs/by-name/mu/multicharge/package.nix
index 677b9ec7f29e..625263e9d163 100644
--- a/pkgs/by-name/mu/multicharge/package.nix
+++ b/pkgs/by-name/mu/multicharge/package.nix
@@ -80,10 +80,6 @@ stdenv.mkDerivation (finalAttrs: {
     echo 'set(custom-lapack_FOUND TRUE)' >> config/cmake/Findcustom-lapack.cmake
   '';
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Electronegativity equilibration model for atomic partial charges";
     mainProgram = "multicharge";
diff --git a/pkgs/by-name/nu/numsa/package.nix b/pkgs/by-name/nu/numsa/package.nix
index c823b92a5036..336aef737d9f 100644
--- a/pkgs/by-name/nu/numsa/package.nix
+++ b/pkgs/by-name/nu/numsa/package.nix
@@ -90,10 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/pi/pixman/package.nix b/pkgs/by-name/pi/pixman/package.nix
index 367fa018c860..3ef554a9eb07 100644
--- a/pkgs/by-name/pi/pixman/package.nix
+++ b/pkgs/by-name/pi/pixman/package.nix
@@ -61,11 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dneon=disabled"
   ];
 
-  preConfigure = ''
-    # https://gitlab.freedesktop.org/pixman/pixman/-/issues/62
-    export OMP_NUM_THREADS=$((NIX_BUILD_CORES > 184 ? 184 : NIX_BUILD_CORES))
-  '';
-
   enableParallelBuilding = true;
 
   doCheck = !stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/wa/wannier90/package.nix b/pkgs/by-name/wa/wannier90/package.nix
index 2a8996daf779..321c34e4e0e7 100644
--- a/pkgs/by-name/wa/wannier90/package.nix
+++ b/pkgs/by-name/wa/wannier90/package.nix
@@ -73,9 +73,6 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
   checkInputs = [ python3 ];
   checkTarget = [ "test-serial" ];
-  preCheck = ''
-    export OMP_NUM_THREADS=4
-  '';
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/by-name/xt/xtb/package.nix b/pkgs/by-name/xt/xtb/package.nix
index 47f1010308fb..278220960454 100644
--- a/pkgs/by-name/xt/xtb/package.nix
+++ b/pkgs/by-name/xt/xtb/package.nix
@@ -89,9 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   doCheck = true;
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
 
   passthru.updateScript = nix-update-script {
     extraArgs = [ "--version=branch" ];
diff --git a/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix b/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix
index 7b84749d9552..8b9b68ccec9a 100644
--- a/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix
+++ b/pkgs/development/libraries/science/chemistry/simple-dftd3/default.nix
@@ -64,9 +64,6 @@ stdenv.mkDerivation rec {
   ];
 
   doCheck = true;
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
 
   meta = {
     description = "Reimplementation of the DFT-D3 program";
diff --git a/pkgs/development/libraries/science/chemistry/tblite/default.nix b/pkgs/development/libraries/science/chemistry/tblite/default.nix
index 1c21aa56c2ec..a10cea0d64db 100644
--- a/pkgs/development/libraries/science/chemistry/tblite/default.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/default.nix
@@ -100,10 +100,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = buildType == "meson";
 
-  preCheck = ''
-    export OMP_NUM_THREADS=2
-  '';
-
   meta = {
     description = "Light-weight tight-binding framework";
     mainProgram = "tblite";

From cd137f1c889116425f507d709e709dead46dbcea Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:16:24 +0200
Subject: [PATCH 785/831] pixman: use openmpCheckPhaseHook

---
 pkgs/by-name/pi/pixman/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/pi/pixman/package.nix b/pkgs/by-name/pi/pixman/package.nix
index 3ef554a9eb07..23755586fe6c 100644
--- a/pkgs/by-name/pi/pixman/package.nix
+++ b/pkgs/by-name/pi/pixman/package.nix
@@ -6,6 +6,7 @@
   ninja,
   pkg-config,
   libpng,
+  openmpCheckPhaseHook,
   glib, # just passthru
 
   # for passthru.tests
@@ -46,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
+    openmpCheckPhaseHook
     __flattenIncludeHackHook
   ];
 

From 576031cf3c432361b33dff42e71ce639518a9219 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 26 Jun 2026 18:16:50 +0200
Subject: [PATCH 786/831] mctc-lib: use openmpCheckPhaseHook

---
 pkgs/by-name/mc/mctc-lib/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/mc/mctc-lib/package.nix b/pkgs/by-name/mc/mctc-lib/package.nix
index 5e677272f307..a2de791d14f0 100644
--- a/pkgs/by-name/mc/mctc-lib/package.nix
+++ b/pkgs/by-name/mc/mctc-lib/package.nix
@@ -10,6 +10,7 @@
   pkg-config,
   python3,
   jonquil,
+  openmpCheckPhaseHook,
 }:
 
 assert (
@@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     gfortran
     pkg-config
     python3
+    openmpCheckPhaseHook
   ]
   ++ lib.optionals (buildType == "meson") [
     meson

From fa7fbd4ac9c5e4e52a35ce200d5dd43b1e35d5d6 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:24:03 +0000
Subject: [PATCH 787/831] darwin.Csu: drop

---
 .../ap/apple-sdk/common/propagate-inputs.nix   | 18 +++++++-----------
 pkgs/stdenv/darwin/default.nix                 |  2 --
 pkgs/top-level/darwin-aliases.nix              |  1 +
 3 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
index f9551b5b9bad..f6e9cf4e2ef2 100644
--- a/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/propagate-inputs.nix
@@ -48,17 +48,13 @@ in
 self: super: {
   # These packages are propagated only because other platforms include them in their libc (or otherwise by default).
   # Reducing the number of special cases required to support Darwin makes supporting it easier for package authors.
-  propagatedBuildInputs =
-    super.propagatedBuildInputs or [ ]
-    ++ [
-      libiconv
-      darwin.libresolv
-      darwin.libsbuf
-      # Shipped with the SDK only as a library with no headers
-      (lib.getLib darwin.libutil)
-    ]
-    # x86_64-darwin links the object files from Csu when targeting very old releases
-    ++ lib.optionals stdenvNoCC.hostPlatform.isx86_64 [ darwin.Csu ];
+  propagatedBuildInputs = super.propagatedBuildInputs or [ ] ++ [
+    libiconv
+    darwin.libresolv
+    darwin.libsbuf
+    # Shipped with the SDK only as a library with no headers
+    (lib.getLib darwin.libutil)
+  ];
 
   # The Darwin module for Swift requires certain headers to be included in the SDK (and not just be propagated).
   buildPhase = super.buildPhase or "" + ''
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index f98c8ce0a53d..b19cdcc54de2 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -285,7 +285,6 @@ let
   };
   sdkDarwinPackages = prevStage: {
     inherit (prevStage.darwin)
-      Csu
       adv_cmds
       copyfile
       libiconv
@@ -1059,7 +1058,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
             prevStage.updateAutotoolsGnuConfigScriptsHook
             prevStage.updateAutotoolsGnuConfigScriptsHook.gnu_config
           ]
-          ++ lib.optionals localSystem.isx86_64 [ prevStage.darwin.Csu ]
           ++ (with prevStage.darwin; [
             binutils
             binutils.bintools
diff --git a/pkgs/top-level/darwin-aliases.nix b/pkgs/top-level/darwin-aliases.nix
index 2d4608cc2201..96aab9d0af29 100644
--- a/pkgs/top-level/darwin-aliases.nix
+++ b/pkgs/top-level/darwin-aliases.nix
@@ -108,6 +108,7 @@ stubs
 
   ### C ###
 
+  Csu = throw "darwin.Csu has been removed, as it was only used on `x86_64-darwin`, which is no longer supported"; # added 2026-06-26
   cctools = pkgs.cctools; # added 2024-07-17
   cctools-apple = pkgs.cctools; # added 2024-07-01
   cctools-llvm = pkgs.cctools; # added 2024-07-01

From fafbfd85dbfb9331b27a888ab0e0c7b246ea161a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:51:41 +0000
Subject: [PATCH 788/831] darwin.ICU: drop `x86_64-darwin` support

---
 .../darwin/by-name/ic/ICU/package.nix         | 66 ++++++++-----------
 1 file changed, 28 insertions(+), 38 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix b/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
index d2678d47b0bc..300dd48f27f3 100644
--- a/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ic/ICU/package.nix
@@ -104,48 +104,38 @@ let
     ++ lib.optional withStatic "static";
     outputBin = "dev";
 
-    postPatch =
-      lib.optionalString self.finalPackage.doCheck (
-        ''
-          # Skip test for missing encodingSamples data.
-          substituteInPlace test/cintltst/ucsdetst.c \
-            --replace-fail "&TestMailFilterCSS" "NULL"
+    postPatch = lib.optionalString self.finalPackage.doCheck ''
+      # Skip test for missing encodingSamples data.
+      substituteInPlace test/cintltst/ucsdetst.c \
+        --replace-fail "&TestMailFilterCSS" "NULL"
 
-          # Disable failing tests
-          substituteInPlace test/cintltst/cloctst.c \
-            --replace-fail 'TESTCASE(TestCanonicalForm);' ""
+      # Disable failing tests
+      substituteInPlace test/cintltst/cloctst.c \
+        --replace-fail 'TESTCASE(TestCanonicalForm);' ""
 
-          substituteInPlace test/intltest/rbbitst.cpp \
-            --replace-fail 'TESTCASE_AUTO(TestExternalBreakEngineWithFakeYue);' ""
+      substituteInPlace test/intltest/rbbitst.cpp \
+        --replace-fail 'TESTCASE_AUTO(TestExternalBreakEngineWithFakeYue);' ""
 
-          # Add missing test data. It’s not included in the source release.
-          chmod u+w "$NIX_BUILD_TOP/source/icu"
-          tar -C "$NIX_BUILD_TOP/source" -axf ${lib.escapeShellArg icu78.src} icu/testdata
-        ''
-        + lib.optionalString stdenv.hostPlatform.isx86_64 ''
-          # These tests fail under Rosetta 2 with a floating-point exception.
-          substituteInPlace test/intltest/caltest.cpp \
-            --replace-fail 'TESTCASE_AUTO(Test22633RollTwiceGetTimeOverflow);' "" \
-            --replace-fail 'TESTCASE_AUTO(Test22750Roll);' ""
-        ''
-      )
-      + ''
-        # Otherwise `make install` is broken.
-        substituteInPlace Makefile.in \
-          --replace-fail '$(top_srcdir)/../LICENSE' "$NIX_BUILD_TOP/source/icu/LICENSE"
-        substituteInPlace config/dist-data.sh \
-          --replace-fail "\''${top_srcdir}/../LICENSE" "$NIX_BUILD_TOP/source/icu/LICENSE"
+      # Add missing test data. It’s not included in the source release.
+      chmod u+w "$NIX_BUILD_TOP/source/icu"
+      tar -C "$NIX_BUILD_TOP/source" -axf ${lib.escapeShellArg icu78.src} icu/testdata
 
-        # Make sure this ICU build puts C++ symbols in a distinct namespace to avoid symbol clashes with other ICU
-        # implementations (including both the system ICU and builds of the upstream ICU).
-        # This breaks binary compatibility for the C++ API, but it’s not ABI stable anyway. Without doing this,
-        # `dotnet` crashes on macOS 26.4 when linked against `libicucore.A.dylib` from Nixpkgs.
-        substituteInPlace common/unicode/uvernum.h \
-          --replace-fail 'U_ICU_VERSION_SUFFIX ' 'U_ICU_VERSION_SUFFIX _nix'
-        # Only enable symbol renaming for C++ symbols. C symbols need to remain unversioned for compatibility.
-        substituteInPlace common/unicode/uversion.h \
-          --replace-fail U_DISABLE_RENAMING 0
-      '';
+      # Otherwise `make install` is broken.
+      substituteInPlace Makefile.in \
+        --replace-fail '$(top_srcdir)/../LICENSE' "$NIX_BUILD_TOP/source/icu/LICENSE"
+      substituteInPlace config/dist-data.sh \
+        --replace-fail "\''${top_srcdir}/../LICENSE" "$NIX_BUILD_TOP/source/icu/LICENSE"
+
+      # Make sure this ICU build puts C++ symbols in a distinct namespace to avoid symbol clashes with other ICU
+      # implementations (including both the system ICU and builds of the upstream ICU).
+      # This breaks binary compatibility for the C++ API, but it’s not ABI stable anyway. Without doing this,
+      # `dotnet` crashes on macOS 26.4 when linked against `libicucore.A.dylib` from Nixpkgs.
+      substituteInPlace common/unicode/uvernum.h \
+        --replace-fail 'U_ICU_VERSION_SUFFIX ' 'U_ICU_VERSION_SUFFIX _nix'
+      # Only enable symbol renaming for C++ symbols. C symbols need to remain unversioned for compatibility.
+      substituteInPlace common/unicode/uversion.h \
+        --replace-fail U_DISABLE_RENAMING 0
+    '';
 
     # remove dependency on bootstrap-tools in early stdenv build
     postInstall =

From f95c28dbb5d5f11f1a02c2f476b55fa70a4fa897 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:55:49 +0000
Subject: [PATCH 789/831] darwin.diskdev_cmds: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in b/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in
index 00270488507a..ab4a184efaa9 100644
--- a/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in
+++ b/pkgs/os-specific/darwin/by-name/di/diskdev_cmds/meson.build.in
@@ -114,7 +114,6 @@ executable(
     dependencies : [ apfs, libdisk ],
     include_directories : [ 'edt_fstab', 'fsck.tproj', 'mount_flags_dir' ],
     install : true,
-    link_args : host_machine.cpu_family() == 'x86_64' ? [ '-Wl,-undefined,dynamic_lookup' ] : [ ],
     sources : [
         'edt_fstab/edt_fstab.c',
         'mount.tproj/mount.c',

From 08b44da1274f60c609613d5d92a2b307c6b41f7f Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:56:56 +0000
Subject: [PATCH 790/831] darwin.dyld: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/dy/dyld/package.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix b/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
index 27ae0af42ab1..9a2cd1afa6ea 100644
--- a/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
+++ b/pkgs/os-specific/darwin/by-name/dy/dyld/package.nix
@@ -35,13 +35,8 @@ let
         '${Libc}/include/_bounds.h'
 
       mkdir -p "$out/include/System"
-      for dir in arm i386 machine; do
-        mkdir -p "$out/include/$dir"
-        for file in '${xnu}/osfmk/'$dir/*; do
-          name=$(basename "$file")
-          # Skip copying `endian.h` because it conflicts with the SDK, breaking the build on x86_64-darwin.
-          test "$name" != endian.h && cp -r "$file" "$out/include/$dir/$name"
-        done
+      for dir in arm machine; do
+        cp -r '${xnu}/osfmk/'$dir "$out/include/$dir"
         ln -s "$out/include/$dir" "$out/include/System/$dir"
       done
 

From 06add4c94beffca657d93d32fd747924758361c1 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:51:41 +0000
Subject: [PATCH 791/831] darwin.file_cmds: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix b/pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix
index ba754ddee3ee..8c61f41b7e74 100644
--- a/pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/fi/file_cmds/package.nix
@@ -70,12 +70,6 @@ let
       typedef int32_t user32_time_t;
       typedef int64_t user64_addr_t;
       typedef int64_t user64_time_t;
-      #elif defined(__x86_64__)
-      /* https://github.com/apple-oss-distributions/xnu/blob/94d3b452840153a99b38a3a9659680b2a006908e/bsd/i386/types.h#L128-L142 */
-      typedef int32_t user32_addr_t;
-      typedef int32_t user32_time_t;
-      typedef int64_t user64_addr_t __attribute__((aligned(8)));
-      typedef int64_t user64_time_t __attribute__((aligned(8)));
       #else
       #error "Tried to build file_cmds for an unsupported architecture"
       #endif

From 98dd6b587f18847fdc19d3202bc370bc8e41e01c Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 04:58:07 +0000
Subject: [PATCH 792/831] darwin.libffi: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/li/libffi/package.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/li/libffi/package.nix b/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
index 7aefb636900e..0411e61a1f9e 100644
--- a/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
+++ b/pkgs/os-specific/darwin/by-name/li/libffi/package.nix
@@ -53,16 +53,14 @@ mkAppleDerivation (finalAttrs: {
 
   postConfigure = ''
     # Use Apple’s configuration instead of the one generated by the `configure` script.
-    cp darwin/include/fficonfig_${stdenv.hostPlatform.darwinArch}.h build/fficonfig.h
-    cp darwin/include/ffitarget_${
-      if stdenv.hostPlatform.isAarch64 then "arm64" else "x86"
-    }.h build/include/ffitarget.h
+    cp darwin/include/fficonfig_arm64.h build/fficonfig.h
+    cp darwin/include/ffitarget_arm64.h build/include/ffitarget.h
     # Use `macCatalyst` instead of `iosmac` to avoid errors due to invalid availability annotations.
     substitute darwin/include/ffi.h build/include/ffi.h \
       --replace-fail iosmac macCatalyst
   '';
 
-  postBuild = lib.optionalString stdenv.hostPlatform.isAarch64 ''
+  postBuild = ''
     $CC -Os -Wl,-allowable_client,! -Wl,-not_for_dyld_shared_cache -Wl,-no_compact_unwind \
       src/aarch64/trampoline.S -dynamiclib -o libffi-trampolines.dylib \
       -Iinclude -Ibuild -Ibuild/include \
@@ -75,7 +73,7 @@ mkAppleDerivation (finalAttrs: {
       ln -s "$dev/include" "$dev/include/ffi"
     ''
     # Install the trampoline dylib since it is build manually.
-    + lib.optionalString stdenv.hostPlatform.isAarch64 ''
+    + ''
       cp libffi-trampolines.dylib "$out/lib/libffi-trampolines.dylib"
     '';
 

From 0fef4fe6d3c44b3416ceea22790bd2410326b68d Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:07:10 +0000
Subject: [PATCH 793/831] darwin.network_cmds: drop `x86_64-darwin` support

---
 pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
index 51455f86897f..39faf051ad14 100644
--- a/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ne/network_cmds/package.nix
@@ -32,17 +32,16 @@ let
         '${xnu}/libkern/firehose/firehose_types_private.h' \
         '${xnu}/libkern/firehose/tracepoint_private.h'
 
-      for dir in arm i386 kern machine; do
+      for dir in arm kern machine; do
         mkdir -p "$out/include/$dir"
         for file in '${xnuHeaders}/include/'$dir/*; do
           name=$(basename "$file")
-          # Skip copying `endian.h` because it conflicts with the SDK, breaking the build on x86_64-darwin.
+          # Skip copying `endian.h` because it conflicts with the SDK, breaking the build.
           test "$name" != endian.h && cp -r "$file" "$out/include/$dir/$name"
         done
       done
 
       unifdef -x 1 -DKERNEL_PRIVATE -o "$out/include/arm/locks.h" '${xnu}/osfmk/arm/locks.h'
-      unifdef -x 1 -DKERNEL_PRIVATE -o "$out/include/i386/locks.h" '${xnu}/osfmk/i386/locks.h'
 
       install -D -t "$out/include/net" \
         '${xnuHeaders}/include/net/bpf.h' \

From 23c05205023464c322a0df9ac0834c00f4da9fa8 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 07:33:08 +0000
Subject: [PATCH 794/831] ld64: drop `x86_64-darwin` support

---
 pkgs/by-name/ld/ld64/package.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/by-name/ld/ld64/package.nix b/pkgs/by-name/ld/ld64/package.nix
index f21f90a37929..184f635cffe3 100644
--- a/pkgs/by-name/ld/ld64/package.nix
+++ b/pkgs/by-name/ld/ld64/package.nix
@@ -138,9 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     xar
   ];
 
-  # ld built with this fails to link glib's gio on x86_64 darwin
-  hardeningDisable = [ "libcxxhardeningfast" ];
-
   dontUseCmakeConfigure = true; # CMake is only needed because it’s used by Meson to find LLVM.
 
   # Note for overrides: ld64 cannot be built as a debug build because of UB in its iteration implementations,

From c84755936aa28c5e991edc49fcebb3eed38fd46a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 18 Feb 2026 05:08:38 +0000
Subject: [PATCH 795/831] apple-sdk: drop `x86_64-darwin` support

---
 pkgs/by-name/ap/apple-sdk/common/plists.nix | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/ap/apple-sdk/common/plists.nix b/pkgs/by-name/ap/apple-sdk/common/plists.nix
index a79581e7767d..304f02c6ee4d 100644
--- a/pkgs/by-name/ap/apple-sdk/common/plists.nix
+++ b/pkgs/by-name/ap/apple-sdk/common/plists.nix
@@ -28,26 +28,24 @@ let
   # These files are all based off of Xcode spec files found in
   # /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Xcode/PrivatePlugIns/IDEOSXSupportCore.ideplugin/Contents/Resources.
 
-  # Based off of the "MacOSX Architectures.xcspec" file. All i386 stuff
-  # is removed because NixPkgs only supports darwin-x86_64 and darwin-arm64.
+  # Based off of the "MacOSX Architectures.xcspec" file. All x86 stuff
+  # is removed because Nixpkgs only supports aarch64-darwin.
   Architectures = [
     {
       Identifier = "Standard";
       Type = "Architecture";
-      Name = "Standard Architectures (Apple Silicon, 64-bit Intel)";
+      Name = "Standard Architectures (Apple Silicon)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD";
     }
     {
       Identifier = "Universal";
       Type = "Architecture";
-      Name = "Universal (Apple Silicon, 64-bit Intel)";
+      Name = "Universal (Apple Silicon)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_32_64_BIT";
     }
@@ -60,17 +58,16 @@ let
     {
       Identifier = "Standard64bit";
       Type = "Architecture";
-      Name = "Apple Silicon, 64-bit Intel";
+      Name = "Apple Silicon";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_64_BIT";
     }
     {
       Identifier = stdenvNoCC.hostPlatform.darwinArch;
       Type = "Architecture";
-      Name = "Apple Silicon or Intel 64-bit";
+      Name = "Apple Silicon";
     }
     {
       Identifier = "Standard_Including_64_bit";
@@ -78,7 +75,6 @@ let
       Name = "Standard Architectures (including 64-bit)";
       RealArchitectures = [
         "arm64"
-        "x86_64"
       ];
       ArchitectureSetting = "ARCHS_STANDARD_INCLUDING_64_BIT";
     }

From 75e6236ca1e8dcfc2d03299f3b2f3f3629b1163c Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Thu, 25 Jun 2026 12:11:53 +0200
Subject: [PATCH 796/831] python3Packages.tornado: 6.5.4 -> 6.5.7

https://www.tornadoweb.org/en/stable/releases/v6.5.5.html
https://www.tornadoweb.org/en/stable/releases/v6.5.6.html
https://www.tornadoweb.org/en/stable/releases/v6.5.7.html

Fixes: CVE-2026-49853, CVE-2026-49855, CVE-2026-49854
---
 pkgs/development/python-modules/tornado/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/tornado/default.nix b/pkgs/development/python-modules/tornado/default.nix
index 4327db46ac9e..2cd462786b20 100644
--- a/pkgs/development/python-modules/tornado/default.nix
+++ b/pkgs/development/python-modules/tornado/default.nix
@@ -18,16 +18,16 @@
   urllib3,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tornado";
-  version = "6.5.4";
+  version = "6.5.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tornadoweb";
     repo = "tornado";
-    tag = "v${version}";
-    hash = "sha256-d6lKg8yrQqaCeKxdPjQNzv7Nc23U/v8d5x3sE3trRM4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-iE0Tf95zmPoZJhw7FDLzTmv8HaWds3ZU5xzZSMvxFH4=";
   };
 
   build-system = [ setuptools ];
@@ -63,9 +63,10 @@ buildPythonPackage rec {
   };
 
   meta = {
+    changelog = "https://www.tornadoweb.org/en/stable/releases/${finalAttrs.src.tag}.html";
     description = "Web framework and asynchronous networking library";
     homepage = "https://www.tornadoweb.org/";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})

From 6a12e4797665ab59aa79d9bd05d1df7d843ec00a Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Thu, 25 Jun 2026 12:07:09 +0200
Subject: [PATCH 797/831] motioneye: 0.43.1 -> 0.44.0

Diff: https://github.com/motioneye-project/motioneye/compare/0.43.1...0.44.0
---
 pkgs/by-name/mo/motioneye/package.nix | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/mo/motioneye/package.nix b/pkgs/by-name/mo/motioneye/package.nix
index 7a5ee72311ef..721cc8d75f9d 100644
--- a/pkgs/by-name/mo/motioneye/package.nix
+++ b/pkgs/by-name/mo/motioneye/package.nix
@@ -2,31 +2,20 @@
   lib,
   python3Packages,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "motioneye";
-  version = "0.43.1";
+  version = "0.44.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "motioneye-project";
     repo = "motioneye";
     tag = version;
-    hash = "sha256-ckOgYmOP5irjNutcC3FMZPBexn/CldG0UtFZ+tPYNJ4=";
+    hash = "sha256-4sXttSSkmMgsoZb7PXEXXh8KNORTSmqq4lYp3JBDmPo=";
   };
 
-  patches = [
-    # fix pytest
-    # https://github.com/motioneye-project/motioneye/pull/3271
-    (fetchpatch {
-      url = "https://github.com/motioneye-project/motioneye/commit/41c0727e2872af1b758743c41b529e76dcac6f84.patch";
-      hash = "sha256-0zDveoAN1T0SuCob0U/9GEGTh7pj2CXH/j4YrjO0VE0=";
-      includes = [ "conftest.py" ];
-    })
-  ];
-
   build-system = with python3Packages; [
     setuptools
   ];
@@ -38,6 +27,7 @@ python3Packages.buildPythonApplication rec {
     pillow
     pycurl
     tornado
+    argon2-cffi
   ];
 
   nativeCheckInputs = with python3Packages; [

From 8221f1e025fb754f284be899aee5f5ecdf8a011c Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Thu, 25 Jun 2026 12:20:06 +0200
Subject: [PATCH 798/831] motioneye: add versionCheckHook

---
 pkgs/by-name/mo/motioneye/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/mo/motioneye/package.nix b/pkgs/by-name/mo/motioneye/package.nix
index 721cc8d75f9d..a947a722d8c1 100644
--- a/pkgs/by-name/mo/motioneye/package.nix
+++ b/pkgs/by-name/mo/motioneye/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -34,10 +35,17 @@ python3Packages.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
   pythonImportsCheck = [
     "motioneye"
   ];
 
+  versionCheckProgram = "${placeholder "out"}/bin/meyectl";
+  versionCheckProgramArg = "-v";
+
   meta = {
     description = "Web frontend for the motion daemon";
     homepage = "https://github.com/motioneye-project/motioneye";

From 8b4b26561ff97ba3bad6339742cd5fc7d9eae346 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Fri, 26 Jun 2026 20:19:32 +0100
Subject: [PATCH 799/831] socat: 1.8.1.2 -> 1.8.1.3

Changes: http://www.dest-unreach.org/socat/CHANGES
---
 pkgs/by-name/so/socat/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/so/socat/package.nix b/pkgs/by-name/so/socat/package.nix
index e4e6a23e58ed..40cf1ef10dcc 100644
--- a/pkgs/by-name/so/socat/package.nix
+++ b/pkgs/by-name/so/socat/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "socat";
-  version = "1.8.1.2";
+  version = "1.8.1.3";
 
   src = fetchurl {
     url = "http://www.dest-unreach.org/socat/download/socat-${version}.tar.bz2";
-    hash = "sha256-Dht+rAxuPW+k1Vtjx/zd8D9KLqpZ+pOx8w3Cxz1Cqg0=";
+    hash = "sha256-JbxkdikrLmFCIJicd7C2/Kh7slJdl0ezGmY5sftgJBg=";
   };
 
   postPatch = ''

From 2f05530db272b87de4091030b556e383ffc95ded Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 17 Jun 2026 00:34:10 +0000
Subject: [PATCH 800/831] libidn: 1.43 -> 1.44

https://codeberg.org/libidn/libidn/src/tag/v1.44/NEWS

Fixes: CVE-2026-57053
---
 pkgs/by-name/li/libidn/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libidn/package.nix b/pkgs/by-name/li/libidn/package.nix
index d36eedac8fe9..071b7f08f15d 100644
--- a/pkgs/by-name/li/libidn/package.nix
+++ b/pkgs/by-name/li/libidn/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libidn";
-  version = "1.43";
+  version = "1.44";
 
   src = fetchurl {
     url = "mirror://gnu/libidn/libidn-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-vcZiwS0EGyU50OY486bnQRMM2zOmRO80lpY6RDSC0WQ=";
+    sha256 = "sha256-SZYIurOmVlCg6lKIjBOo3uvj9xQI4xms2exS4C6xOVk=";
   };
 
   outputs = [
@@ -30,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
   meta = {
+    changelog = "https://codeberg.org/libidn/libidn/src/tag/v${finalAttrs.version}/NEWS";
     homepage = "https://www.gnu.org/software/libidn/";
     description = "Library for internationalized domain names";
 

From 66e7adfa8f255bff2e1ec8c12b888a8514aad48c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:04:00 +0200
Subject: [PATCH 801/831] perlPackages.CpanelJSONXS: 4.37 -> 4.42

Fixes CVE-2026-9334, CVE-2026-9516. Supersedes the in-tree CVE-2025-40929 patch.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../Cpanel-JSON-XS-CVE-2025-40929.patch       | 47 -------------------
 pkgs/top-level/perl-packages.nix              |  7 ++-
 2 files changed, 3 insertions(+), 51 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch

diff --git a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch b/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
deleted file mode 100644
index 0f76f7313fde..000000000000
--- a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 5592bfb58eb8d1c8a644e67c9bba795d1384a995 Mon Sep 17 00:00:00 2001
-From: Marc Lehmann <schmorp@schmorp.de>
-Date: Sat, 6 Sep 2025 11:31:36 +0200
-Subject: [PATCH 1/2] fix json_atof_scan1 overflows
-
-with fuzzed overlong numbers. CVE-2025-40928
-Really the comparisons were wrong.
----
- XS.xs | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/XS.xs b/XS.xs
-index 9b1ce2b..94ab0d6 100755
---- a/XS.xs
-+++ b/XS.xs
-@@ -710,16 +710,16 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
-   /* if we recurse too deep, skip all remaining digits */
-   /* to avoid a stack overflow attack */
-   if (UNLIKELY(--maxdepth <= 0))
--    while (((U8)*s - '0') < 10)
-+    while ((U8)(*s - '0') < 10)
-       ++s;
- 
-   for (;;)
-     {
--      U8 dig = (U8)*s - '0';
-+      U8 dig = (U8)(*s - '0');
- 
-       if (UNLIKELY(dig >= 10))
-         {
--          if (dig == (U8)((U8)'.' - (U8)'0'))
-+          if (dig == (U8)('.' - '0'))
-             {
-               ++s;
-               json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -739,7 +739,7 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
-               else if (*s == '+')
-                 ++s;
- 
--              while ((dig = (U8)*s - '0') < 10)
-+              while ((dig = (U8)(*s - '0')) < 10)
-                 exp2 = exp2 * 10 + *s++ - '0';
- 
-               *expo += neg ? -exp2 : exp2;
--- 
-2.50.1
-
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 3cf8a274f583..e464b0b489fc 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6673,12 +6673,11 @@ with self;
 
   CpanelJSONXS = buildPerlPackage {
     pname = "Cpanel-JSON-XS";
-    version = "4.37";
+    version = "4.42";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.37.tar.gz";
-      hash = "sha256-wkFhWg4X/3Raqoa79Gam4pzSQFFeZfBqegUBe2GebUs=";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.42.tar.gz";
+      hash = "sha256-4awvqx46bS2ZjTRAxgAGc2W9x9vwyPKyBZy85LTIMXM=";
     };
-    patches = [ ../development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch ];
     meta = {
       description = "CPanel fork of JSON::XS, fast and correct serializing";
       license = with lib.licenses; [

From 7a4c9efd01e0980532edff7245f49768ad1deb01 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:06:54 +0200
Subject: [PATCH 802/831] perlPackages.HTMLParser: 3.81 -> 3.85

Fixes CVE-2026-8829.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e464b0b489fc..45b5b61a9351 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16264,10 +16264,10 @@ with self;
 
   HTMLParser = buildPerlPackage {
     pname = "HTML-Parser";
-    version = "3.81";
+    version = "3.85";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTML-Parser-3.81.tar.gz";
-      hash = "sha256-wJEKXI+S+IF+3QbM/SJLocLr6MEPVR8DJYeh/IPWL/I=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTML-Parser-3.85.tar.gz";
+      hash = "sha256-/UK6ar4HJBzwrVe+JGw5gAZfaD5EZeWbRq+e/ryODHE=";
     };
     propagatedBuildInputs = [
       HTMLTagset

From 9020587aa04036671788a5745f2ea63df581b064 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:07:12 +0200
Subject: [PATCH 803/831] perlPackages.NetStatsd: 0.12 -> 0.13

Fixes CVE-2026-46739.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 45b5b61a9351..4283b4ef7dd6 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -26365,10 +26365,10 @@ with self;
 
   NetStatsd = buildPerlPackage {
     pname = "Net-Statsd";
-    version = "0.12";
+    version = "0.13";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CO/COSIMO/Net-Statsd-0.12.tar.gz";
-      hash = "sha256-Y+RTYD2hZbxtHEygtV7aPSIE8EDFkwSkd4LFqniGVlw=";
+      url = "mirror://cpan/authors/id/C/CO/COSIMO/Net-Statsd-0.13.tar.gz";
+      hash = "sha256-xKYP9dP002ompqR3YxGI7HnNzp4wUMZ6NOm1rikgoQA=";
     };
     meta = {
       description = "Perl client for Etsy's statsd daemon";

From 0002e3ea35b952f747cc1cd19657f729422b7f42 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:07:28 +0200
Subject: [PATCH 804/831] perlPackages.ProtocolHTTP2: 1.11 -> 1.13

Fixes CVE-2026-10725.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4283b4ef7dd6..68c949be39ae 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -29098,10 +29098,10 @@ with self;
 
   ProtocolHTTP2 = buildPerlModule {
     pname = "Protocol-HTTP2";
-    version = "1.11";
+    version = "1.13";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.11.tar.gz";
-      hash = "sha256-Vp8Fsavpl7UHyCUVMMyB0e6WvZMsxoJTS2zkhlNQCRM=";
+      url = "mirror://cpan/authors/id/C/CR/CRUX/Protocol-HTTP2-1.13.tar.gz";
+      hash = "sha256-LsO0oYpkqGHgKYHO/Y7W8iOHUTj75e/us0DvF5ZVMGI=";
     };
     buildInputs = [
       AnyEvent

From f1ec9089c3939acbba18a7e3c1650eff87cdf9c4 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:08:56 +0200
Subject: [PATCH 805/831] perlPackages.CryptPBKDF2: 0.161520 -> 0.261630

Fixes CVE-2017-20240, CVE-2026-9638, CVE-2026-9641.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 68c949be39ae..0f46b4433bae 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7725,15 +7725,19 @@ with self;
     };
   };
 
-  CryptPBKDF2 = buildPerlPackage {
+  CryptPBKDF2 = buildPerlModule {
     pname = "Crypt-PBKDF2";
-    version = "0.161520";
+    version = "0.261630";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AR/ARODLAND/Crypt-PBKDF2-0.161520.tar.gz";
-      hash = "sha256-l9+nmjCaCG4YSk5hBH+KEP+z2wUQJefSIqJfGRMLpBc=";
+      url = "mirror://cpan/authors/id/A/AR/ARODLAND/Crypt-PBKDF2-0.261630.tar.gz";
+      hash = "sha256-GHVxiWOJMrMJs0xFu4EKo+SFbj7VgBAAF9reZXk/RsA=";
     };
-    buildInputs = [ TestFatal ];
+    buildInputs = [
+      ModuleBuildTiny
+      TestFatal
+    ];
     propagatedBuildInputs = [
+      CryptURandom
       DigestHMAC
       DigestSHA3
       Moo

From 32536524aff1b490a54ec6d4e60c89f6f2252423 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:39 +0200
Subject: [PATCH 806/831] perlPackages.ExtUtilsHelpers: 0.026 -> 0.028

Required by ExtUtils::Builder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 0f46b4433bae..c61855502a35 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12662,10 +12662,10 @@ with self;
 
   ExtUtilsHelpers = buildPerlPackage {
     pname = "ExtUtils-Helpers";
-    version = "0.026";
+    version = "0.028";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Helpers-0.026.tar.gz";
-      hash = "sha256-3pAbZ5CkVXz07JCBSeA1eDsSW/EV65ZA/rG8HCTDNBY=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Helpers-0.028.tar.gz";
+      hash = "sha256-yFdIdczgc+fcU0WnsG1QLlIETWiJT5FgID/KqzeVFP4=";
     };
     meta = {
       description = "Various portability utilities for module builders";

From f57d979624839d4840d60f6c134a24b83dd95ecb Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 807/831] perlPackages.ExtUtilsConfig: 0.008 -> 0.010

Required by ExtUtils::Builder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index c61855502a35..290e701f15d0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12571,10 +12571,10 @@ with self;
 
   ExtUtilsConfig = buildPerlPackage {
     pname = "ExtUtils-Config";
-    version = "0.008";
+    version = "0.010";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Config-0.008.tar.gz";
-      hash = "sha256-rlEE9jRlDc6KebftE/tZ1no5whOmd2z9qj7nSeYvGow=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Config-0.010.tar.gz";
+      hash = "sha256-gufk6Qy+OA4VL13m4+QDdGmC1QLdMBl6EjZS5GYQxm0=";
     };
     meta = {
       description = "Wrapper for perl's configuration";

From 5ebb6bf806f336e1a44479bcfc65ae10c7284a79 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 808/831] perlPackages.ExtUtilsBuilder: init at 0.020

Dependency of Dist::Build.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 290e701f15d0..8c7dbaef472d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12552,6 +12552,27 @@ with self;
     };
   };
 
+  ExtUtilsBuilder = buildPerlPackage {
+    pname = "ExtUtils-Builder";
+    version = "0.020";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Builder-0.020.tar.gz";
+      hash = "sha256-UtZR46oDJyUOR5h9Rf9I6cyQtbe9L7D/P3h4PlMq/8w=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsConfig
+      ExtUtilsHelpers
+    ];
+    meta = {
+      description = "Abstract representation of build processes";
+      homepage = "https://github.com/Leont/extutils-builder-plan";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ExtUtilsCChecker = buildPerlModule {
     pname = "ExtUtils-CChecker";
     version = "0.11";

From 47c2f1daf9350d321fe5a41ef4fa550f3f8a7d85 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 16:25:40 +0200
Subject: [PATCH 809/831] perlPackages.ExtUtilsBuilderCompiler: init at 0.037

Dependency of Dist::Build.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8c7dbaef472d..585f9c025304 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -12573,6 +12573,27 @@ with self;
     };
   };
 
+  ExtUtilsBuilderCompiler = buildPerlPackage {
+    pname = "ExtUtils-Builder-Compiler";
+    version = "0.037";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/ExtUtils-Builder-Compiler-0.037.tar.gz";
+      hash = "sha256-s5VNaI45gDkoUnkWfG6+7nVX8Q6VYBzj/baBkyY2h7g=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsBuilder
+      ExtUtilsConfig
+    ];
+    meta = {
+      description = "Interface around different compilers";
+      homepage = "https://github.com/Leont/extutils-builder-compiler";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ExtUtilsCChecker = buildPerlModule {
     pname = "ExtUtils-CChecker";
     version = "0.11";

From 46324ed6bb63470975f19e9e4ba58e9ceadf268c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:21:35 +0200
Subject: [PATCH 810/831] perlPackages.DistBuild: init at 0.028
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build dependency of Crypt::Argon2.

Co-authored-by: Robert Schütz <nix@dotlambda.de>
Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 585f9c025304..b4069aa21f7d 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -11004,6 +11004,31 @@ with self;
     };
   };
 
+  DistBuild = buildPerlModule {
+    pname = "Dist-Build";
+    version = "0.028";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Dist-Build-0.028.tar.gz";
+      hash = "sha256-JPFLFA4Tq3x1PU25bI0zbQnepcb1H+1IvA92Khyhgx8=";
+    };
+    propagatedBuildInputs = [
+      ExtUtilsBuilder
+      ExtUtilsBuilderCompiler
+      ExtUtilsConfig
+      ExtUtilsHelpers
+      ExtUtilsInstallPaths
+    ];
+    meta = {
+      changelog = "https://github.com/Leont/dist-build/blob/v0.028/Changes";
+      description = "Modern module builder, author tools not included";
+      homepage = "https://github.com/Leont/dist-build";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   DistributionMetadata = buildPerlModule {
     pname = "Distribution-Metadata";
     version = "0.10";

From de1d803f4387e8afbccf6a7650b8a8ff0c45b2fc Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:21:35 +0200
Subject: [PATCH 811/831] perlPackages.CryptArgon2: 0.019 -> 0.031
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes CVE-2026-8463.

Co-authored-by: Robert Schütz <nix@dotlambda.de>
Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b4069aa21f7d..1a6501821477 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6871,13 +6871,15 @@ with self;
 
   CryptArgon2 = buildPerlModule {
     pname = "Crypt-Argon2";
-    version = "0.019";
+    version = "0.031";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Argon2-0.019.tar.gz";
-      hash = "sha256-+Fm+6NL2tAf11EZFwiOu4hL+AFkd/YLlBlrhvnio5Dg=";
+      url = "mirror://cpan/authors/id/L/LE/LEONT/Crypt-Argon2-0.031.tar.gz";
+      hash = "sha256-1l5RoZQ+6AglEkUNw1KuUpUQZswJI/u38uYK+l8WTi0=";
     };
     nativeBuildInputs = [ pkgs.ld-is-cc-hook ];
+    buildInputs = [ DistBuild ];
     meta = {
+      changelog = "https://github.com/Leont/crypt-argon2/blob/v0.031/Changes";
       description = "Perl interface to the Argon2 key derivation functions";
       license = with lib.licenses; [ cc0 ];
     };

From 9f61f7a1b02416d738b87a5c97d586d8fe3dd250 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:25:57 +0200
Subject: [PATCH 812/831] perlPackages.ClassErrorHandler: init at 0.04

Dependency of Convert::PEM.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 1a6501821477..2b541e48903b 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -5074,6 +5074,22 @@ with self;
     };
   };
 
+  ClassErrorHandler = buildPerlPackage {
+    pname = "Class-ErrorHandler";
+    version = "0.04";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TO/TOKUHIROM/Class-ErrorHandler-0.04.tar.gz";
+      hash = "sha256-NC0tz8eXogvugXmxuWuFwK56W0iCc1lSPNjHTD5wRQI=";
+    };
+    meta = {
+      description = "Base class for error handling";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ClassInspector = buildPerlPackage {
     pname = "Class-Inspector";
     version = "1.36";

From b7bd8c9e93c0cab35230863db815c3cafaa9bd41 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:26:10 +0200
Subject: [PATCH 813/831] perlPackages.CryptDESEDE3: init at 0.03

Dependency of Convert::PEM.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2b541e48903b..cd6006e5ae3e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7016,6 +7016,23 @@ with self;
     };
   };
 
+  CryptDESEDE3 = buildPerlPackage {
+    pname = "Crypt-DES_EDE3";
+    version = "0.03";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DES_EDE3-0.03.tar.gz";
+      hash = "sha256-KFktt7njR0WqkfPhnl27uDqvRyop5we5eR0NArPiJ/U=";
+    };
+    propagatedBuildInputs = [ CryptDES ];
+    meta = {
+      description = "Triple-DES EDE encryption/decryption";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   CryptDH = buildPerlPackage {
     pname = "Crypt-DH";
     version = "0.07";

From f098e09528a436b2119e1bdee879d12079b8567f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:26:22 +0200
Subject: [PATCH 814/831] perlPackages.ConvertPEM: init at 0.13

Dependency of Crypt::DSA.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index cd6006e5ae3e..fd990d8864f3 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6395,6 +6395,29 @@ with self;
     };
   };
 
+  ConvertPEM = buildPerlPackage {
+    pname = "Convert-PEM";
+    version = "0.13";
+    src = fetchurl {
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Convert-PEM-0.13.tar.gz";
+      hash = "sha256-eZ+jLCcAgfTmKSsN31GAlScQqKS+Ey6Qe9oxdqe9HCM=";
+    };
+    buildInputs = [ TestException ];
+    propagatedBuildInputs = [
+      ClassErrorHandler
+      ConvertASN1
+      CryptDESEDE3
+      CryptX
+    ];
+    meta = {
+      description = "Read/write encrypted ASN.1 PEM files";
+      license = with lib.licenses; [
+        artistic1
+        gpl1Plus
+      ];
+    };
+  };
+
   ConvertUU = buildPerlPackage {
     pname = "Convert-UU";
     version = "0.5201";

From e86a4b4e44855be1d7c7ba081f2d057c98ebb928 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:27:45 +0200
Subject: [PATCH 815/831] perlPackages.CryptDSA: 1.17 -> 1.21

Fixes CVE-2026-8700, CVE-2026-8704, CVE-2026-12205.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index fd990d8864f3..e5e0a4bd728c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7098,14 +7098,17 @@ with self;
 
   CryptDSA = buildPerlPackage {
     pname = "Crypt-DSA";
-    version = "1.17";
+    version = "1.21";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/A/AD/ADAMK/Crypt-DSA-1.17.tar.gz";
-      hash = "sha256-0bhYX2v3RvduXcXaNkHTJe1la8Ll80S1RRS1XDEAmgM=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.21.tar.gz";
+      hash = "sha256-pGIB6DkOi6O75RER12SJ8x2v2g9qYLCrkxndUr0rMrA=";
     };
     propagatedBuildInputs = [
+      ConvertASN1
+      ConvertPEM
+      CryptSysRandom
+      CryptURandom
       DataBuffer
-      DigestSHA1
       FileWhich
     ];
     meta = {

From 261df4c82cbef82eff433195316c3222c9dd5873 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:31:40 +0200
Subject: [PATCH 816/831] perlPackages.Sereal: 5.004 -> 5.006

Fixes CVE-2026-8796. Covers Sereal, Sereal::Decoder and Sereal::Encoder.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index e5e0a4bd728c..fd3d5aa012a4 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -30674,10 +30674,10 @@ with self;
 
   SerealDecoder = buildPerlPackage {
     pname = "Sereal-Decoder";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-5.004.tar.gz";
-      hash = "sha256-aO8DFNh9Gm5guw9m/PQ+ssrN6xdUQy9eJeeE450+Z4Q=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Decoder-5.006.tar.gz";
+      hash = "sha256-eZGFXpGBo3nJsBIv6PwvaONEnJFhaow1eSbxFh9oR2g=";
     };
     buildInputs = [
       TestDeep
@@ -30699,10 +30699,10 @@ with self;
 
   SerealEncoder = buildPerlPackage {
     pname = "Sereal-Encoder";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-5.004.tar.gz";
-      hash = "sha256-XlqGzNMtrjTtgJMuy+XGjil1K13g6bCnk6t+sspVyxs=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-Encoder-5.006.tar.gz";
+      hash = "sha256-kLQsyHdZgq4MdJno9ZLOeu+ug0M1g+EKWtVxKBHRcK0=";
     };
     buildInputs = [
       SerealDecoder
@@ -30724,10 +30724,10 @@ with self;
 
   Sereal = buildPerlPackage {
     pname = "Sereal";
-    version = "5.004";
+    version = "5.006";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-5.004.tar.gz";
-      hash = "sha256-nCW7euS9c20ksa0dk9dzlbDGXKh0HiZr/Ay+VCJh128=";
+      url = "mirror://cpan/authors/id/Y/YV/YVES/Sereal-5.006.tar.gz";
+      hash = "sha256-uwXnY+1ry+pEx5IX/vCy05GKwVRxlHIwOMbER+5vWd4=";
     };
     buildInputs = [
       TestDeep

From 5fb740257c36a83351b79b1dc15d8056a1533976 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:36:58 +0200
Subject: [PATCH 817/831] perlPackages.XMLLibXML: 2.0210 -> 2.0213

Fixes CVE-2026-8177. Drops the libxml-2.13 test patch, now included upstream.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 .../XML-LibXML-fix-tests-libxml-2.13.0.patch  | 242 ------------------
 pkgs/top-level/perl-packages.nix              |  10 +-
 2 files changed, 3 insertions(+), 249 deletions(-)
 delete mode 100644 pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch

diff --git a/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch b/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
deleted file mode 100644
index 5433d3afd934..000000000000
--- a/pkgs/development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
+++ /dev/null
@@ -1,242 +0,0 @@
-From bee8338fd1cbd7aad4bf60c2965833343b6ead6f Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Tue, 21 May 2024 15:17:30 +0200
-Subject: [PATCH 1/3] Fix test suite with libxml2 2.13.0
-
----
- t/02parse.t                        | 7 ++++++-
- t/08findnodes.t                    | 8 +++++++-
- t/19die_on_invalid_utf8_rt_58848.t | 2 +-
- t/25relaxng.t                      | 4 ++--
- t/26schema.t                       | 4 ++--
- t/60error_prev_chain.t             | 8 ++++----
- 6 files changed, 22 insertions(+), 11 deletions(-)
-
-diff --git a/t/02parse.t b/t/02parse.t
-index b111507b..40aa5f13 100644
---- a/t/02parse.t
-+++ b/t/02parse.t
-@@ -884,7 +884,12 @@ EOXML
-         eval {
-            $doc2    = $parser->parse_string( $xmldoc );
-         };
--        isnt($@, '', "error parsing $xmldoc");
-+        # https://gitlab.gnome.org/GNOME/libxml2/-/commit/b717abdd
-+        if (XML::LibXML::LIBXML_RUNTIME_VERSION() < 21300) {
-+            isnt($@, '', "error parsing $xmldoc");
-+        } else {
-+            is( $doc2->documentElement()->firstChild()->nodeName(), "foo" );
-+        }
- 
-         $parser->validation(1);
- 
-diff --git a/t/08findnodes.t b/t/08findnodes.t
-index 016c85a1..e9417bc5 100644
---- a/t/08findnodes.t
-+++ b/t/08findnodes.t
-@@ -123,7 +123,13 @@ my $docstring = q{
- my @ns = $root->findnodes('namespace::*');
- # TEST
- 
--is(scalar(@ns), 2, ' TODO : Add test name' );
-+# https://gitlab.gnome.org/GNOME/libxml2/-/commit/aca16fb3
-+# fixed xmlCopyNamespace with XML namespace.
-+if (XML::LibXML::LIBXML_RUNTIME_VERSION() < 21300) {
-+    is(scalar(@ns), 2, ' TODO : Add test name' );
-+} else {
-+    is(scalar(@ns), 3, ' TODO : Add test name' );
-+}
- 
- # bad xpaths
- # TEST:$badxpath=4;
-diff --git a/t/19die_on_invalid_utf8_rt_58848.t b/t/19die_on_invalid_utf8_rt_58848.t
-index aa8ad105..4160cb27 100644
---- a/t/19die_on_invalid_utf8_rt_58848.t
-+++ b/t/19die_on_invalid_utf8_rt_58848.t
-@@ -16,7 +16,7 @@ use XML::LibXML;
-     my $err = $@;
- 
-     # TEST
--    like ("$err", qr{parser error : Input is not proper UTF-8},
-+    like ("$err", qr{not proper UTF-8|Invalid bytes in character encoding},
-         'Parser error.',
-     );
- }
-diff --git a/t/25relaxng.t b/t/25relaxng.t
-index 93e61883..71383b2a 100644
---- a/t/25relaxng.t
-+++ b/t/25relaxng.t
-@@ -132,7 +132,7 @@ print "# 6 check that no_network => 1 works\n";
- {
-     my $rng = eval { XML::LibXML::RelaxNG->new( location => $netfile, no_network => 1 ) };
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'RNG from file location with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'RNG from file location with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $rng, 'RNG from file location with external import and no_network => 1 is not loaded.' );
- }
-@@ -152,7 +152,7 @@ print "# 6 check that no_network => 1 works\n";
- </grammar>
- EOF
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'RNG from buffer with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'RNG from buffer with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $rng, 'RNG from buffer with external import and no_network => 1 is not loaded.' );
- }
-diff --git a/t/26schema.t b/t/26schema.t
-index 17f641e4..c404cedd 100644
---- a/t/26schema.t
-+++ b/t/26schema.t
-@@ -117,7 +117,7 @@ EOF
- {
-     my $schema = eval { XML::LibXML::Schema->new( location => $netfile, no_network => 1 ) };
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'Schema from file location with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'Schema from file location with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $schema, 'Schema from file location with external import and no_network => 1 is not loaded.' );
- }
-@@ -129,7 +129,7 @@ EOF
- </xsd:schema>
- EOF
-     # TEST
--    like( $@, qr{I/O error : Attempt to load network entity}, 'Schema from buffer with external import and no_network => 1 throws an exception.' );
-+    like( $@, qr{Attempt to load network entity}, 'Schema from buffer with external import and no_network => 1 throws an exception.' );
-     # TEST
-     ok( !defined $schema, 'Schema from buffer with external import and no_network => 1 is not loaded.' );
- }
-diff --git a/t/60error_prev_chain.t b/t/60error_prev_chain.t
-index e48215c4..55ac0b2e 100644
---- a/t/60error_prev_chain.t
-+++ b/t/60error_prev_chain.t
-@@ -16,13 +16,11 @@ use XML::LibXML;
- 
- {
-     my $parser = XML::LibXML->new();
--    $parser->validation(0);
--    $parser->load_ext_dtd(0);
- 
-     eval
-     {
-         local $^W = 0;
--        $parser->parse_file('example/JBR-ALLENtrees.htm');
-+        $parser->parse_string('<doc>&ldquo;&nbsp;&rdquo;</doc>');
-     };
- 
-     my $err = $@;
-@@ -31,7 +29,7 @@ use XML::LibXML;
-     if( $err && !ref($err) ) {
-       plan skip_all => 'The local libxml library does not support errors as objects to $@';
-     }
--    plan tests => 1;
-+    plan tests => 2;
- 
-     while (defined($err) && $count < 200)
-     {
-@@ -44,6 +42,8 @@ use XML::LibXML;
- 
-     # TEST
-     ok ((!$err), "Reached the end of the chain.");
-+    # TEST
-+    is ($count, 3, "Correct number of errors reported")
- }
- 
- =head1 COPYRIGHT & LICENSE
-
-From c9f9c2fe51173b0a00969f01b577399f1098aa47 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Thu, 13 Feb 2025 19:50:35 +0100
-Subject: [PATCH 2/3] Fix test suite with libxml2 2.14.0
-
----
- t/16docnodes.t   | 7 ++++++-
- t/49_load_html.t | 8 +++++++-
- 2 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/t/16docnodes.t b/t/16docnodes.t
-index db7bc1fc..0b0ae005 100644
---- a/t/16docnodes.t
-+++ b/t/16docnodes.t
-@@ -60,7 +60,12 @@ for my $time (0 .. 2) {
-     $doc->setDocumentElement($node);
- 
-     # TEST
--    is( $node->serialize(), '<test contents="&#xE4;"/>', 'Node serialise works.' );
-+    # libxml2 2.14 avoids unnecessary escaping of attribute values.
-+    if (XML::LibXML::LIBXML_VERSION() >= 21400) {
-+        is( $node->serialize(), "<test contents=\"\xE4\"/>", 'Node serialise works.' );
-+    } else {
-+        is( $node->serialize(), '<test contents="&#xE4;"/>', 'Node serialise works.' );
-+    }
- 
-     $doc->setEncoding('utf-8');
-     # Second output
-diff --git a/t/49_load_html.t b/t/49_load_html.t
-index 70d26607..3861edf8 100644
---- a/t/49_load_html.t
-+++ b/t/49_load_html.t
-@@ -52,7 +52,13 @@ use XML::LibXML;
- </div>
- EOS
- 
--    {
-+    SKIP: {
-+        # libxml2 2.14 tokenizes HTML according to HTML5 where
-+        # this isn't an error, see "13.2.5.73 Named character
-+        # reference state".
-+        skip("libxml2 version >= 21400", 1)
-+            if XML::LibXML::LIBXML_VERSION >= 21400;
-+
-         my $buf = '';
-         open my $fh, '>', \$buf;
-         # redirect STDERR there
-
-From ecbebc2f33fecb66b3d5487c6e48bea353e374f9 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <wellnhofer@aevum.de>
-Date: Fri, 16 May 2025 19:11:12 +0200
-Subject: [PATCH 3/3] Remove tests that disable line numbers
-
-Line numbers are always enabled since libxml2 2.15.0.
----
- t/02parse.t | 13 ++-----------
- 1 file changed, 2 insertions(+), 11 deletions(-)
-
-diff --git a/t/02parse.t b/t/02parse.t
-index 40aa5f13..17419f8f 100644
---- a/t/02parse.t
-+++ b/t/02parse.t
-@@ -14,7 +14,7 @@ use locale;
- 
- POSIX::setlocale(LC_ALL, "C");
- 
--use Test::More tests => 533;
-+use Test::More tests => 531;
- use IO::File;
- 
- use XML::LibXML::Common qw(:libxml);
-@@ -25,7 +25,7 @@ use constant XML_DECL => "<?xml version=\"1.0\"?>\n";
- 
- use Errno qw(ENOENT);
- 
--# TEST*533
-+# TEST*531
- 
- ##
- # test values
-@@ -773,15 +773,6 @@ EOXML
- 
-     my $newkid = $root->appendChild( $doc->createElement( "bar" ) );
-     is( $newkid->line_number(), 0, "line number is 0");
--
--    $parser->line_numbers(0);
--    eval { $doc = $parser->parse_string( $goodxml ); };
--
--    $root = $doc->documentElement();
--    is( $root->line_number(), 0, "line number is 0");
--
--    @kids = $root->childNodes();
--    is( $kids[1]->line_number(), 0, "line number is 0");
- }
- 
- SKIP: {
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index fd3d5aa012a4..d3379d5774ad 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -38886,10 +38886,10 @@ with self;
 
   XMLLibXML = buildPerlPackage {
     pname = "XML-LibXML";
-    version = "2.0210";
+    version = "2.0213";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/XML-LibXML-2.0210.tar.gz";
-      hash = "sha256-opvz8Aq5ye4EIYFU4K/I95m/I2dOuZwantTeH0BZpI0=";
+      url = "mirror://cpan/authors/id/T/TO/TODDR/XML-LibXML-2.0213.tar.gz";
+      hash = "sha256-KvIcXWGsNOompfq/FbpaWEHmSPcYnbPjO28otUiYAqs=";
     };
     env.SKIP_SAX_INSTALL = 1;
     buildInputs = [
@@ -38903,10 +38903,6 @@ with self;
         zlib
       ]
     );
-    patches = [
-      # https://github.com/shlomif/perl-XML-LibXML/pull/87
-      ../development/perl-modules/XML-LibXML-fix-tests-libxml-2.13.0.patch
-    ];
     propagatedBuildInputs = [ XMLSAX ];
     meta = {
       description = "Perl Binding for libxml2";

From 62e6ec8536bbdb987df446af821549d619a10aca Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:37:47 +0200
Subject: [PATCH 818/831] perlPackages.CryptPasswdMD5: 1.42 -> 1.43

Fixes CVE-2026-6659.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d3379d5774ad..59ee0f27bc15 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7302,11 +7302,12 @@ with self;
 
   CryptPasswdMD5 = buildPerlPackage {
     pname = "Crypt-PasswdMD5";
-    version = "1.42";
+    version = "1.43";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RS/RSAVAGE/Crypt-PasswdMD5-1.42.tgz";
-      hash = "sha256-/Tlubn9E7rkj6TyZOUC49nqa7Vb8dKrK8Dj8QFPvO1k=";
+      url = "mirror://cpan/authors/id/R/RS/RSAVAGE/Crypt-PasswdMD5-1.43.tgz";
+      hash = "sha256-Qr+Sk0UQlYXUlWkCVX7ONdBh7aQ454lPhucHV0EoB1k=";
     };
+    propagatedBuildInputs = [ CryptURandom ];
     meta = {
       description = "Provide interoperable MD5-based crypt() functions";
       license = with lib.licenses; [

From 4b37127ec079734d0201385a0f3f96e1c6c20f45 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:38:37 +0200
Subject: [PATCH 819/831] perlPackages.CryptScryptKDF: 0.010 -> 0.011

Fixes CVE-2026-8647.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 59ee0f27bc15..b4366c504dad 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -7540,12 +7540,15 @@ with self;
 
   CryptScryptKDF = buildPerlModule {
     pname = "Crypt-ScryptKDF";
-    version = "0.010";
+    version = "0.011";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIK/Crypt-ScryptKDF-0.010.tar.gz";
-      hash = "sha256-fRbulczj61TBdGc6cpn0wIb7o6yF+EfQ4TT+7V93YBc=";
+      url = "mirror://cpan/authors/id/M/MI/MIK/Crypt-ScryptKDF-0.011.tar.gz";
+      hash = "sha256-IZLJ8E8rX/cHN/XNrz9PZ6VXE8MeoIVAOMvzXjttFrQ=";
     };
-    propagatedBuildInputs = [ CryptOpenSSLRandom ];
+    propagatedBuildInputs = [
+      CryptOpenSSLRandom
+      CryptX
+    ];
     meta = {
       description = "Scrypt password based key derivation function";
       homepage = "https://github.com/DCIT/perl-Crypt-ScryptKDF";

From d22c1175af2ad1614c19f547a34677bc9250618d Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:40:15 +0200
Subject: [PATCH 820/831] perlPackages.Starlet: 0.31 -> 0.32

Fixes CVE-2026-40561.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index b4366c504dad..358f2bcc0a74 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -31505,10 +31505,10 @@ with self;
 
   Starlet = buildPerlPackage {
     pname = "Starlet";
-    version = "0.31";
+    version = "0.32";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KA/KAZUHO/Starlet-0.31.tar.gz";
-      hash = "sha256-uWA7jmKIDLRYL2p5Oer+xl5u/T2QDyx900Ll9MaNYtg=";
+      url = "mirror://cpan/authors/id/K/KA/KAZUHO/Starlet-0.32.tar.gz";
+      hash = "sha256-gZI9OmCX3YHH4Og9SBvuof89ZejgHY0f59yziFV1vY8=";
     };
     buildInputs = [
       LWP

From 55c68fd7a07225921f12f09c3fca242c5335dd53 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:41:21 +0200
Subject: [PATCH 821/831] perlPackages.GD: 2.78 -> 2.86

Fixes CVE-2026-11526.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 358f2bcc0a74..2953ec4b86e0 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -14767,10 +14767,10 @@ with self;
 
   GD = buildPerlPackage {
     pname = "GD";
-    version = "2.78";
+    version = "2.86";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/R/RU/RURBAN/GD-2.78.tar.gz";
-      hash = "sha256-aDEFS/VCS09cI9NifT0UhEgPb5wsZmMiIpFfKFG+buQ=";
+      url = "mirror://cpan/authors/id/R/RU/RURBAN/GD-2.86.tar.gz";
+      hash = "sha256-bWTTvhQpzB606IqPICL+yRDqPgeS2k/ljT7fdpXEbKI=";
     };
 
     nativeBuildInputs = [
@@ -14785,6 +14785,7 @@ with self;
       pkgs.fontconfig
       pkgs.libxpm
       ExtUtilsPkgConfig
+      FileWhich
       TestFork
       TestNoWarnings
     ];

From 02ee43b56f68a424ce31e1c986b9fe4dccb1cb2f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:41:41 +0200
Subject: [PATCH 822/831] perlPackages.ConfigIniFiles: 3.000003 -> 3.002000

Fixes CVE-2026-11527.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 2953ec4b86e0..044bd764f9dc 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6043,10 +6043,10 @@ with self;
 
   ConfigIniFiles = buildPerlPackage {
     pname = "Config-IniFiles";
-    version = "3.000003";
+    version = "3.002000";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/Config-IniFiles-3.000003.tar.gz";
-      hash = "sha256-PEV7ZdmOX/QL25z4FLDVmD6wxT+4aWvaO6A1rSrNaAI=";
+      url = "mirror://cpan/authors/id/S/SH/SHLOMIF/Config-IniFiles-3.002000.tar.gz";
+      hash = "sha256-Bmke17QZl+hQxOfGs05cOWFF4M0FCvGUSiDQaMOlpAs=";
     };
     propagatedBuildInputs = [ IOStringy ];
     meta = {

From 3cb2e3221aacd925b9a2ff29b2f7ba60a0517bad Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:44:06 +0200
Subject: [PATCH 823/831] perlPackages.CookieBaker: 0.11 -> 0.12

Required by Plack::Middleware::Session 0.36.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 044bd764f9dc..467b42750904 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6501,10 +6501,10 @@ with self;
 
   CookieBaker = buildPerlModule {
     pname = "Cookie-Baker";
-    version = "0.11";
+    version = "0.12";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KA/KAZEBURO/Cookie-Baker-0.11.tar.gz";
-      hash = "sha256-WSdfR04HwKo2EePmhLiU59uRMzPYIUQgvmPxLsGM16s=";
+      url = "mirror://cpan/authors/id/K/KA/KAZEBURO/Cookie-Baker-0.12.tar.gz";
+      hash = "sha256-mwTfXUfc1FrEKZYmoQ7JkPtAyU7lpjAMOoi9+zV17Ck=";
     };
     buildInputs = [
       ModuleBuildTiny

From 02bfa3d8bc458884286314b9b12121c5578e34f1 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:44:58 +0200
Subject: [PATCH 824/831] perlPackages.PlackMiddlewareSession: 0.33 -> 0.36

Fixes CVE-2025-40923, CVE-2013-10031.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 467b42750904..641ec4012eed 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -28675,12 +28675,13 @@ with self;
 
   PlackMiddlewareSession = buildPerlModule {
     pname = "Plack-Middleware-Session";
-    version = "0.33";
+    version = "0.36";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-Middleware-Session-0.33.tar.gz";
-      hash = "sha256-T/miydGK2ASbRd/ze5vdQSIeLC8eFrr7gb/tyIxRpO4=";
+      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-Middleware-Session-0.36.tar.gz";
+      hash = "sha256-kqWDFliBDSNzLm47rnpEofpafYpqbm3NdbkcapwktGY=";
     };
     propagatedBuildInputs = [
+      CryptSysRandom
       DigestHMAC
       Plack
     ];

From 2c79c8f23a6b7a61195c7f53622ef68ed3a84e9f Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:46:07 +0200
Subject: [PATCH 825/831] perlPackages.YAMLLibYAML: 0.89 -> 0.907.0

Fixes CVE-2025-40908.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 641ec4012eed..4a3d55e2e092 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -39503,11 +39503,12 @@ with self;
 
   YAMLLibYAML = buildPerlPackage {
     pname = "YAML-LibYAML";
-    version = "0.89";
+    version = "0.907.0";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TI/TINITA/YAML-LibYAML-0.89.tar.gz";
-      hash = "sha256-FVq4NnU0XFCt0DMRrPndkVlVcH+Qmiq9ixfXeShZsuw=";
+      url = "mirror://cpan/authors/id/T/TI/TINITA/YAML-LibYAML-v0.907.0.tar.gz";
+      hash = "sha256-a6CHIkkROJ52+hmLFJzsg/BlsKx13cUmGPNJCULNlQY=";
     };
+    buildInputs = [ TestWarnings ];
     meta = {
       description = "Perl YAML Serialization using XS and libyaml";
       license = with lib.licenses; [

From 49ef24302dabf5edc456c4ed56af2133cac0b48c Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:47:18 +0200
Subject: [PATCH 826/831] perlPackages.CryptCBC: 2.33 -> 3.07

Fixes CVE-2025-2814.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 4a3d55e2e092..191240106782 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6972,11 +6972,16 @@ with self;
 
   CryptCBC = buildPerlPackage {
     pname = "Crypt-CBC";
-    version = "2.33";
+    version = "3.07";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/L/LD/LDS/Crypt-CBC-2.33.tar.gz";
-      hash = "sha256-anDeIbbMfysQAGfo4Yjblm6agAG122+pdufLWylK5kU=";
+      url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-CBC-3.07.tar.gz";
+      hash = "sha256-9N37TdasUBPfg0G/pzTZye4PEOLnEhXsj+W/eAt8kSc=";
     };
+    propagatedBuildInputs = [
+      CryptPBKDF2
+      CryptURandom
+      CryptX
+    ];
     meta = {
       description = "Encrypt Data with Cipher Block Chaining Mode";
       license = with lib.licenses; [

From 5b6275f4054ef7e0c374079db3bfd761b710aad4 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 14:48:14 +0200
Subject: [PATCH 827/831] perlPackages.Mojolicious: 9.39 -> 9.46

Fixes CVE-2024-58135.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 191240106782..ac449bd8bfa4 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -22810,10 +22810,10 @@ with self;
 
   Mojolicious = buildPerlPackage {
     pname = "Mojolicious";
-    version = "9.39";
+    version = "9.46";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.39.tar.gz";
-      hash = "sha256-EwpJDXfXYTn3NM4biU1Fm64DgF+x89/dWPxE/oKvPP0=";
+      url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.46.tar.gz";
+      hash = "sha256-/kc9LK5tLe/pUBgCggc2VoJa0F20TwvIxIQhXi1xaqw=";
     };
     meta = {
       description = "Real-time web framework";

From a06c0268f6fadd8d6a070df7f3bf30cec3ee0237 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:21:30 +0200
Subject: [PATCH 828/831] perlPackages.IOCompress: 2.220 -> 2.221

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index ac449bd8bfa4..7c456f4ffd9e 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17667,10 +17667,10 @@ with self;
 
   IOCompress = buildPerlPackage {
     pname = "IO-Compress";
-    version = "2.220";
+    version = "2.221";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
-      hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
+      url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.221.tar.gz";
+      hash = "sha256-r0LJyRBK3313LSVcDZpASjRi6kXnvELQbaCgtR3j0K4=";
     };
     propagatedBuildInputs = [
       CompressRawBzip2

From d95a5e6344e6e7b308e6c6e35cadfd37da5229a9 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:22:08 +0200
Subject: [PATCH 829/831] perlPackages.HTTPMessage: 6.45 -> 7.02

Required by libwww-perl 6.83.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7c456f4ffd9e..76b3b03f6192 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17004,10 +17004,10 @@ with self;
 
   HTTPMessage = buildPerlPackage {
     pname = "HTTP-Message";
-    version = "6.45";
+    version = "7.02";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Message-6.45.tar.gz";
-      hash = "sha256-AcuEBmEqP3OIQtHpcxOuTYdIcNG41tZjMfFgAJQ9TL4=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Message-7.02.tar.gz";
+      hash = "sha256-eKvvHYMxRrSNF9shmxsD1Ty743oozNrQ79zFgzylxgw=";
     };
     buildInputs = [
       TestNeeds
@@ -17015,8 +17015,11 @@ with self;
     ];
     propagatedBuildInputs = [
       Clone
+      CompressRawBzip2
+      CompressRawZlib
       EncodeLocale
       HTTPDate
+      IOCompress
       IOHTML
       LWPMediaTypes
       URI

From 03a06252a45713863ded5d69ef44e0a738281389 Mon Sep 17 00:00:00 2001
From: Stig Palmquist <git@stig.io>
Date: Thu, 18 Jun 2026 15:23:31 +0200
Subject: [PATCH 830/831] perlPackages.libwwwperl: 6.72 -> 6.83

Fixes CVE-2026-8368. Covers both the libwwwperl and LWP attributes.

Assisted-by: Claude Code (Claude Opus 4.8)
Signed-off-by: Stig Palmquist <git@stig.io>
---
 pkgs/top-level/perl-packages.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 76b3b03f6192..c7527717d04c 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -18908,10 +18908,10 @@ with self;
 
   libwwwperl = buildPerlPackage {
     pname = "libwww-perl";
-    version = "6.72";
+    version = "6.83";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.72.tar.gz";
-      hash = "sha256-6bg1T9XiC+IHr+I93VhPzVm/gpmNwHfez2hLodrloF0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.83.tar.gz";
+      hash = "sha256-518PqdPG8Nr1pacvqfixycDSPjqEqFIsy0+DUjK5VQU=";
     };
     buildInputs = [
       HTTPDaemon
@@ -20165,10 +20165,10 @@ with self;
 
   LWP = buildPerlPackage {
     pname = "libwww-perl";
-    version = "6.72";
+    version = "6.83";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.72.tar.gz";
-      hash = "sha256-6bg1T9XiC+IHr+I93VhPzVm/gpmNwHfez2hLodrloF0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/libwww-perl-6.83.tar.gz";
+      hash = "sha256-518PqdPG8Nr1pacvqfixycDSPjqEqFIsy0+DUjK5VQU=";
     };
     propagatedBuildInputs = [
       FileListing

From e2eaadff3972b388d210d102e57156f3d249cd29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 14:32:16 -0700
Subject: [PATCH 831/831] python3Packages.pytest-cases: use setuptools_80

Otherwise it fails to build with

    ModuleNotFoundError: No module named 'pkg_resources'
---
 pkgs/development/python-modules/pytest-cases/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pytest-cases/default.nix b/pkgs/development/python-modules/pytest-cases/default.nix
index 6e5b90d27966..e5680266e742 100644
--- a/pkgs/development/python-modules/pytest-cases/default.nix
+++ b/pkgs/development/python-modules/pytest-cases/default.nix
@@ -6,6 +6,7 @@
   decopatch,
   packaging,
   pytest,
+  setuptools_80,
   setuptools-scm,
 }:
 
@@ -20,7 +21,10 @@ buildPythonPackage rec {
     hash = "sha256-xOGB8bUlyTGjGNSBL6jeZWwsj7d/zPFXHs8Mxf6Of48=";
   };
 
-  build-system = [ setuptools-scm ];
+  build-system = [
+    setuptools_80
+    setuptools-scm
+  ];
 
   dependencies = [
     decopatch