Merge staging-next into staging

.github/workflows/bot.yml

@@ -91,7 +91,7 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files
         if: |
           github.event_name == 'pull_request_target' &&
@@ -101,7 +101,7 @@ jobs:
           configuration-path: .github/labeler.yml # default
           sync-labels: true
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files (no sync)
         if: |
           github.event_name == 'pull_request_target' &&
@@ -111,7 +111,7 @@ jobs:
           configuration-path: .github/labeler-no-sync.yml
           sync-labels: false
 
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         name: Labels from touched files (development branches)
         # Development branches like staging-next, haskell-updates and python-updates get special labels.
         # This is to avoid the mass of labels there, which is mostly useless - and really annoying for

doc/using/configuration.chapter.md

@@ -31,6 +31,22 @@ Unfree software is not tested or built in Nixpkgs continuous integration, and th
 Most unfree licenses prohibit either executing or distributing the software.
 :::
 
+The `NIXPKGS_CONFIG` environment variable can override the configuration file location.
+Nixpkgs resolves the config in this order:
+
+1.  `$NIXPKGS_CONFIG`, if set and the file exists.
+2.  `~/.config/nixpkgs/config.nix`, if it exists.
+3.  `~/.nixpkgs/config.nix` (legacy), if it exists.
+4.  Empty configuration.
+
+On NixOS, `NIXPKGS_CONFIG` points to `/etc/nix/nixpkgs-config.nix` system-wide.
+Drop a file there to apply configuration to `nix-env`, `nix-shell`, and other user-level commands.
+NixOS does not create this file.
+The [`nixpkgs.config`](https://nixos.org/manual/nixos/stable/options#opt-nixpkgs.config) option does not affect `nix-env`, `nix-shell`, or other user-level commands.
+
+This lookup applies to non-flake usage like channels and `<nixpkgs>`.
+Flakes ignore it; pass `config` directly when importing `nixpkgs`.
+
 ## Installing broken packages {#sec-allow-broken}
 
 There are several ways to try compiling a package which has been marked as broken.

lib/modules.nix

@@ -589,7 +589,8 @@ let
     in
     modulesPath: initialModules: args: {
       modules = filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
-      # Intentionally not shared with `modules` above: this allows `collected`
+      # Intentionally not shared with `modules` above: this allows
+      # the return value of `collectStructuredModules`
       # to be garbage collected after `filterModules` returns.
       graph = toGraph modulesPath (collectStructuredModules unknownModule "" initialModules args);
     };

lib/strings.nix

@@ -337,7 +337,6 @@ rec {
 
   /**
     Concatenate a list of strings, adding a newline at the end of each one.
-    Defined as `concatMapStrings (s: s + "\n")`.
 
     # Inputs
 
@@ -361,7 +360,7 @@ rec {
 
     :::
   */
-  concatLines = concatMapStrings (s: s + "\n");
+  concatLines = lines: optionalString (lines != [ ]) (concatStringsSep "\n" lines + "\n");
 
   /**
     Given string `s`, replace every occurrence of the string `from` with the string `to`.

maintainers/maintainer-list.nix

@@ -4537,6 +4537,12 @@
     githubId = 1945;
     name = "Casey Rodarmor";
   };
+  caseyavila = {
+    email = "casey@theavilas.org";
+    github = "caseyavila";
+    githubId = 53847249;
+    name = "Casey Avila";
+  };
   catap = {
     email = "kirill@korins.ky";
     github = "catap";
@@ -19906,6 +19912,12 @@
     name = "Alessio Caiazza";
     matrix = "@alessio:caiazza.info";
   };
+  nomadium = {
+    email = "miguel@miguel.cc";
+    github = "nomadium";
+    githubId = 79817;
+    name = "Miguel Landaeta";
+  };
   nomaterials = {
     email = "nomaterials@gmail.com";
     github = "no-materials";

nixos/modules/misc/nixpkgs.nix

@@ -2,12 +2,51 @@
   config,
   options,
   lib,
+  pkgs,
   ...
 }:
 let
   cfg = config.nixpkgs;
   opt = options.nixpkgs;
 
+  isConfig = x: builtins.isAttrs x || lib.isFunction x;
+
+  optCall = f: x: if lib.isFunction f then f x else f;
+
+  mergeConfig =
+    lhs_: rhs_:
+    let
+      lhs = optCall lhs_ { inherit lib pkgs; };
+      rhs = optCall rhs_ { inherit lib pkgs; };
+    in
+    lib.recursiveUpdate lhs rhs
+    // lib.optionalAttrs (lhs ? allowUnfreePackages) {
+      allowUnfreePackages = lhs.allowUnfreePackages ++ (lib.attrByPath [ "allowUnfreePackages" ] [ ] rhs);
+    }
+    // lib.optionalAttrs (lhs ? packageOverrides) {
+      packageOverrides =
+        pkgs:
+        optCall lhs.packageOverrides pkgs // optCall (lib.attrByPath [ "packageOverrides" ] { } rhs) pkgs;
+    }
+    // lib.optionalAttrs (lhs ? perlPackageOverrides) {
+      perlPackageOverrides =
+        pkgs:
+        optCall lhs.perlPackageOverrides pkgs
+        // optCall (lib.attrByPath [ "perlPackageOverrides" ] { } rhs) pkgs;
+    };
+
+  configType = lib.mkOptionType {
+    name = "nixpkgs-config";
+    description = "nixpkgs config";
+    check =
+      x:
+      let
+        traceXIfNot = c: if c x then true else lib.traceSeqN 1 x false;
+      in
+      traceXIfNot isConfig;
+    merge = args: lib.foldr (def: mergeConfig def.value) { };
+  };
+
   overlayType = lib.mkOptionType {
     name = "nixpkgs-overlay";
     description = "nixpkgs overlay";
@@ -34,8 +73,6 @@ let
     ++ lib.optional (opt.localSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.localSystem
     ++ lib.optional (opt.crossSystem.highestPrio < (lib.mkOptionDefault { }).priority) opt.crossSystem;
 
-  _configDefinitions = opt.config.definitionsWithLocations;
-
   defaultPkgs =
     if opt.hostPlatform.isDefined then
       let
@@ -53,15 +90,14 @@ let
       in
       import ../../.. (
         {
-          inherit _configDefinitions;
-          inherit (cfg) overlays;
+          inherit (cfg) config overlays;
         }
         // systemArgs
       )
     else
       import ../../.. {
-        inherit _configDefinitions;
         inherit (cfg)
+          config
           overlays
           localSystem
           crossSystem
@@ -129,15 +165,7 @@ in
       example = lib.literalExpression ''
         { allowBroken = true; allowUnfree = true; }
       '';
-      type = lib.types.deferredModuleWith {
-        staticModules = [
-          { _module.args.docPrefix = "https://nixos.org/manual/nixpkgs/unstable/"; }
-          ../../../pkgs/top-level/config.nix
-        ];
-      };
-      # Returns pkgs.config instead of nixpkgs.config
-      # This shadows the deferredModule to make it look like a submodule
-      apply = _: finalPkgs.config;
+      type = configType;
       description = ''
         Global configuration for Nixpkgs.
         The complete list of [Nixpkgs configuration options](https://nixos.org/manual/nixpkgs/unstable/#sec-config-options-reference) is in the [Nixpkgs manual section on global configuration](https://nixos.org/manual/nixpkgs/unstable/#chap-packageconfig).
@@ -378,7 +406,7 @@ in
           '';
         }
         {
-          assertion = opt.pkgs.isDefined -> opt.config.highestPrio == (lib.mkOptionDefault null).priority;
+          assertion = opt.pkgs.isDefined -> cfg.config == { };
           message = ''
             Your system configures nixpkgs with an externally created instance.
             `nixpkgs.config` options should be passed when creating the instance instead.

nixos/modules/programs/nix-required-mounts.nix

@@ -70,7 +70,10 @@ let
 
     zluda = {
       onFeatures = [
+        "amd-gpu"
         "cuda"
+        "gpu"
+        "opengl"
       ];
       paths = [
         pkgs.addDriverRunpath.driverLink

nixos/tests/invidious.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ ... }:
 {
   name = "invidious";
 
@@ -24,7 +24,7 @@
         networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
       };
     machine =
-      { lib, pkgs, ... }:
+      { pkgs, ... }:
       {
         services.invidious = {
           enable = true;
@@ -142,7 +142,7 @@
       # invidious does connect to the sig helper though and crashes when the sig helper is not available
       machine.wait_for_open_port(80)
       curl_assert_status_code("http://invidious.example.com/search", 200)
-      machine.succeed("journalctl -eu invidious.service | grep -o \"SigHelper: Using helper at 'tcp://127.0.0.1:2999'\"")
+      machine.succeed("journalctl -eu invidious.service | grep -o \"WARNING: Invidious companion is required to view and playback videos\"")
 
       postgres_tcp.wait_for_unit("postgresql.target")
       activate_specialisation("postgres-tcp")

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -4950,10 +4950,13 @@ assertNoAdditions {
     };
   });
 
-  vim-flog = super.vim-flog.overrideAttrs {
+  vim-flog = super.vim-flog.overrideAttrs (old: {
     # Not intended to be required, used by vim plugin
     nvimSkipModules = "flog.graph_bin";
-  };
+    meta = old.meta // {
+      license = lib.licenses.vim;
+    };
+  });
 
   vim-fugitive = super.vim-fugitive.overrideAttrs (old: {
     meta = old.meta // {

pkgs/applications/editors/vscode/extensions/ms-vscode.js-debug/default.nix

@@ -34,7 +34,7 @@ let
     };
     makeCacheWritable = true;
 
-    buildInputs = lib.optionals stdenv.isLinux [
+    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
       libsecret
     ];
     nativeBuildInputs = [
@@ -42,10 +42,10 @@ let
       nodejs-slim.python
       npmHooks.npmConfigHook
     ]
-    ++ lib.optionals stdenv.isLinux [
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
       pkg-config
     ]
-    ++ lib.optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
       cctools.libtool
       clang_20 # clang_21 breaks @vscode/vsce's optional dependency keytar
     ];

pkgs/applications/editors/vscode/extensions/prettier.prettier-vscode/default.nix

@@ -32,7 +32,7 @@ let
       hash = "sha256-vktxhQA2a+D9Nr4vhbmGCnNdGzt0U89K50g0SgiV5SE=";
     };
 
-    buildInputs = lib.optionals stdenv.isLinux [
+    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
       libsecret
     ];
 
@@ -41,10 +41,10 @@ let
       nodejs-slim.python
       npmHooks.npmConfigHook
     ]
-    ++ lib.optionals stdenv.isLinux [
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
       pkg-config
     ]
-    ++ lib.optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
       clang_20 # clang_21 breaks @vscode/vsce's optional dependency keytar
     ];
 

pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix

@@ -47,7 +47,7 @@ let
       pkg-config
 
     ]
-    ++ lib.optionals stdenv.isDarwin [ clang_20 ]; # clang_21 breaks keytar
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ clang_20 ]; # clang_21 breaks keytar
 
     # Follows https://github.com/rust-lang/rust-analyzer/blob/41949748a6123fd6061eb984a47f4fe780525e63/xtask/src/dist.rs#L39-L65
     installPhase = ''

pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/node_deps.nix

@@ -22,7 +22,7 @@ buildNpmPackage {
     python3
     pkg-config
   ]
-  ++ lib.optionals stdenv.isDarwin [ clang_20 ]; # clang_21 breaks keytar
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ clang_20 ]; # clang_21 breaks keytar
 
   buildInputs = [ libsecret ];
 

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "ab72423afd429c1e96ca56fbd39094a71270842b";
-    hash = "sha256-j1ZCbB0hKcxay/0BkkuoncYPAkMTgSGEAOzYNgJaAh4=";
+    rev = "c699953afa01bc3f179edbcb14c4cfbeee6107a2";
+    hash = "sha256-s009GuPnsufDT70dBmhwfZmYjdf7pYO13FjycYvUF4c=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/misc/diffpdf/default.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase =
-    if stdenv.isDarwin then
+    if stdenv.hostPlatform.isDarwin then
       ''
         mkdir -p "$out"
         mv diffpdf.app "$out"/

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -914,13 +914,13 @@
     "vendorHash": "sha256-JRqBv5N+i5yhKrC+Eenm1xmwylNF7k/EIJXaklrsFfA="
   },
   "mongey_kafka-connect": {
-    "hash": "sha256-XMGpK22Ww8swvfrnbClxjErVmkBKX3dxdlkjgNJHlCE=",
+    "hash": "sha256-A20rLdvunuTU3zZOJ1bj/yIaWs+xsdvSmpDPuxN7XQc=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka-connect",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka-connect",
-    "rev": "v0.4.3",
+    "rev": "v0.5.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-5cqj1O57snU+NoVqmWc/KIGnowQNMww+rJxYfIPvHWU="
+    "vendorHash": "sha256-ulhKT0DaS6gg9Ucz9pqqIg4mxRpGDGz2rN1R0RNuumg="
   },
   "mongodb_mongodbatlas": {
     "hash": "sha256-8HZOdEHD5KwVuSDe3EDX54nPqn3Uz6kooi/HEGoI3F0=",
@@ -1049,11 +1049,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-xB/wHvFmv14Lz1IR4+n7+l+RbRJCtDqZisLURK9IB4E=",
+    "hash": "sha256-Yt46N9wVwgz8VbPSHQF1UQ4XT1ENIcE+yeKmO0JqnlM=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.12.0",
+    "rev": "v8.13.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/video/obs-studio/plugins/obs-plugin-countdown.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-plugin-countdown";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "ashmanix";
     repo = "obs-plugin-countdown";
     tag = finalAttrs.version;
-    hash = "sha256-rDs+X2eH8aUUH6phEo/pelUY1mHnnJNc6mqcT/lT+6c=";
+    hash = "sha256-0E2pNRg4vwXK54aYuWYZyuRJaNrpwX7X0Dq6V8B/SgA=";
   };
 
   buildInputs = [

pkgs/build-support/rust/hooks/default.nix

@@ -27,7 +27,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoBuildHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoBuildHook;
     };
   } ./cargo-build-hook.sh;
@@ -41,7 +41,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoCheckHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoCheckHook;
     };
   } ./cargo-check-hook.sh;
@@ -54,7 +54,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoInstallHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoInstallHook;
     };
   } ./cargo-install-hook.sh;
@@ -68,7 +68,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoNextestHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoNextestHook;
     };
   } ./cargo-nextest-hook.sh;
@@ -107,7 +107,7 @@
     passthru.tests = {
       test = tests.rust-hooks.cargoSetupHook;
     }
-    // lib.optionalAttrs (stdenv.isLinux) {
+    // lib.optionalAttrs (stdenv.hostPlatform.isLinux) {
       testCross = pkgsCross.riscv64.tests.rust-hooks.cargoSetupHook;
     };
   } ./cargo-setup-hook.sh;

pkgs/by-name/ab/abbaye-des-morts/package.nix

@@ -28,11 +28,11 @@ stdenv.mkDerivation (finalAttrs: {
     "PREFIX=${placeholder "out"}"
     "DESTDIR="
   ]
-  ++ lib.optional stdenv.isDarwin "PLATFORM=mac";
+  ++ lib.optional stdenv.hostPlatform.isDarwin "PLATFORM=mac";
 
   # Even with PLATFORM=mac, the Makefile specifies some GCC-specific CFLAGS that
   # are not supported by modern Clang on macOS
-  postPatch = lib.optionalString stdenv.isDarwin ''
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace Makefile \
       --replace-fail "-funswitch-loops" "" \
       --replace-fail "-fgcse-after-reload" ""

pkgs/by-name/ae/aeron-cpp/package.nix

@@ -60,10 +60,10 @@ stdenv.mkDerivation {
     makeWrapper
     patchelf
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     autoPatchelfHook
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     fixDarwinDylibNames
   ];
 

pkgs/by-name/am/amnezia-vpn-bin/package.nix

@@ -110,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
       --set CQT_PKG_ROOT "$out/share/amnezia-vpn/service"
 
     substituteInPlace $out/share/amnezia-vpn/AmneziaVPN.service \
-      --replace-fail "ExecStart=/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "AmneziaVPN-service" \
+      --replace-fail "/opt/AmneziaVPN/service/AmneziaVPN-service.sh" "AmneziaVPN-service" \
       --replace-fail "Environment=LD_LIBRARY_PATH=/opt/AmneziaVPN/client/lib" ""
     ln -s $out/share/amnezia-vpn/AmneziaVPN.service $out/lib/systemd/system/AmneziaVPN.service
 

pkgs/by-name/am/amnezia-vpn/dev_agw_public_key

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwMJbYlGxn3l+0XiGA9I/
+BHK8HX/aet7A9GVL817apDUeL6sdISRBdopv5Y0FdrBHSJWSUdWtVxVazJB46J8x
+327/5H5pi0nkfRbcgxBGSGxhKOvwRe+WPVb2f81jlkenZK46c9C7dNmX/310rlHY
+BwOnZcdw2oKu6hTNDwk3nyUo2v2/leNIMLsv84RlHAX6Tyx5slq8ysewhcmdfv17
+WQjF7albq12ZafTSjtXqDcsrk2oF8mfyzxLjSXbxQHKIDHkfz3SUXCs/H9tt1ydK
+2Yj6nIxv98HESZ8Ng40OZPhHDex8Ru1NjcWlo2EWNM1xT8IqmBT21PLuyzGjNSwG
+Ojnm1V2EcjerVmRNhFTJG70RkURD/i2MDbG+ZKpqPtW1uL8wEt2IkSqNfKcf+TF+
+UJZZfm1lDUMpWJ2eWJGrgOUX8/f8v/GB+x4PxUo1m7V/pDLqCUPm3l2dkaM9P0sM
+6lO0+jKqfIFnG1zjc3if7r1YbDsZlyl389q9Hrh7t+Lwj/JXkDxFaTnudM8egaXk
+GX5YxZiEDmCCLRskRwBBUaYffXIpFbI8sO2Xj0J5/im5xtu7TtfJktcPzDL9uyG1
+Ebt8oSA4FTzTid6Zwj55YgDfz0FMnNmXh80T1xMzlbi6y+BCuna+I+7McMRo8yz3
+VzzYJ0/J7PpHpXoZv7K1qDsCAwEAAQ==
+-----END PUBLIC KEY-----

pkgs/by-name/am/amnezia-vpn/package.nix

@@ -58,13 +58,26 @@ let
 
   amnezia-xray = callPackage ./xray-lib.nix { };
 
-  amneziaPremiumConfig = fetchurl {
-    url = "https://raw.githubusercontent.com/amnezia-vpn/amnezia-client-lite/f45d6b242c1ac635208a72914e8df76ccb3aa44c/macos-signed-build.sh";
-    hash = "sha256-PnaPVPlyglUphhknWwP7ziuwRz+WOz0k9WRw6Q0nG2c=";
-    postFetch = ''
-      sed -nri '/PROD_AGW_PUBLIC_KEY|PROD_S3_ENDPOINT/p' $out
-    '';
-  };
+  # Amnezia Gateway (AGW) public keys for premium server list verification.
+  # These PEM-formatted RSA public keys are hardcoded in the upstream binary
+  # and used to verify signatures on server list responses from the AGW service.
+  # The original values were extracted from the upstream linux binary using
+  # `strings` command, as they are not present in any public source files.
+  # Newlines are escaped (\n -> \\n) to prevent Makefile generation failures
+  # during build when these variables are exported via preConfigure.
+  dev-agw-public-key = lib.replaceStrings [ "\n" ] [ "\\n" ] (builtins.readFile ./dev_agw_public_key);
+  dev-agw-endpoint = "http://gw.dev.amzsvc.com:80/";
+  dev-s3-endpoint = "https://s3.eu-north-1.amazonaws.com/amnezia-dev/";
+
+  prod-agw-public-key = lib.replaceStrings [ "\n" ] [ "\\n" ] (
+    builtins.readFile ./prod_agw_public_key
+  );
+  prod-s3-endpoint = lib.concatStringsSep ", " [
+    "https://s3.eu-north-1.amazonaws.com/amnezia/"
+    "https://amnzstrg01.blob.core.windows.net/lambda-list/"
+    "https://storage.googleapis.com/lambda-list/"
+    "https://objectstorage.eu-zurich-1.oraclecloud.com/n/zrhfyaq6qxvh/b/lambda-list/o/"
+  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
@@ -134,8 +147,15 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qttools
   ];
 
+  # These environment variables are baked into the binary at build time.
+  # They configure which Amnezia Gateway servers and S3 endpoints the client
+  # uses for fetching verified server lists (premium functionality).
   preConfigure = ''
-    source ${amneziaPremiumConfig}
+    export DEV_AGW_PUBLIC_KEY="${dev-agw-public-key}"
+    export DEV_AGW_ENDPOINT="${dev-agw-endpoint}"
+    export DEV_S3_ENDPOINT="${dev-s3-endpoint}"
+    export PROD_AGW_PUBLIC_KEY="${prod-agw-public-key}"
+    export PROD_S3_ENDPOINT="${prod-s3-endpoint}"
   '';
 
   installPhase = ''

pkgs/by-name/am/amnezia-vpn/prod_agw_public_key

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAj5mxl/4DL3Sk89ntxs5G
+X3JawGQWIoq6rvNkOzNGuNgedNS2+pi6hZl3Izl1Io9om4KiUlMT6mgLO1hTr9q+
+s7CYhlvroFA7ErucF+9L+7FCt0Igi0kIK/R2/vxd/2HaUrorn/aSvvutkYwbfxqW
+SwtzE+RuBeDWGvEt937OW0oqYONPYv9E4T56Dz/EZ6v2t8ejAnKLbGD/GocMmipK
+7etFSiSMAB2RmaztqTq4NleBepfO80XpYlW9pCSXuHcE8wxHczkzxsbyMAMsG/K3
+vUQY6qPtohqqzSSBwa/8u2ptNHBeor7l7DdYXeR/Nqcc4z92VUkZ5lOVR4evkS5V
+/wQqp5tnOJEj3NjUhEhXFoNEapbZd1bh6iQoUk7jC1TdvKJ/nPKGZAsHRpr0rNKz
+fx/N/Oo6lr2yh/+ps6VxTkbPmB6E85WOO3UvjImZUY0XQdBjWle/4iJLdEC77Nr0
+jXhdgeypucy6jkB6iBHMeVMlrNMEV7UxoBR/cCNx55zu/8sml5ByiDvCDT7sRomN
+NgVt5S/FaVjYuzFUifJ12ToChXFgESKFmuso7WluEaWvMIGREdrMrKQKHfYLOzWF
+2B5ZJDqw4o03fU4J/6rw61M1b+rjVpXMjPnzc2A+RgcjTvXv955gfZkwe4lt5wk/
+3j8zMVo3+zLrMTAaEeIUM0UCAwEAAQ==
+-----END PUBLIC KEY-----

pkgs/by-name/am/amp-cli/package-lock.json

@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@sourcegraph/amp": "^0.0.1777624460-g8bb2f0"
+        "@sourcegraph/amp": "^0.0.1778343260-gb9a37d"
       }
     },
     "node_modules/@napi-rs/keyring": {
@@ -228,9 +228,9 @@
       }
     },
     "node_modules/@sourcegraph/amp": {
-      "version": "0.0.1777624460-g8bb2f0",
-      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1777624460-g8bb2f0.tgz",
-      "integrity": "sha512-LGr3VAfyW5W7eJNPa545KvCL11qsac0FFzu67rPrqCR2Xh7v0mP1N7S9TLHKDG74NoqmB3xdhX7o0lIk2ZoGkg==",
+      "version": "0.0.1778343260-gb9a37d",
+      "resolved": "https://registry.npmjs.org/@sourcegraph/amp/-/amp-0.0.1778343260-gb9a37d.tgz",
+      "integrity": "sha512-TY4lL2lqwt+NtBa3ngKZSYfY5Z1qBAOd4UQMCT0nsUKatQGtSOIMec+zQSv6tr0L+z2jrDUzD0cpRkBDkLQjsQ==",
       "license": "Amp Commercial License",
       "dependencies": {
         "@napi-rs/keyring": "1.1.10"

pkgs/by-name/am/amp-cli/package.nix

@@ -9,11 +9,11 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1777624460-g8bb2f0";
+  version = "0.0.1778343260-gb9a37d";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@sourcegraph/amp/-/amp-${finalAttrs.version}.tgz";
-    hash = "sha256-HUoRVq++AsIbQxJHkI4oyPyBbFcji6BvWdWxrqdUQQ0=";
+    hash = "sha256-48FyPDniLNQoeZ+SaheTvzLCYL3r95e9VDCW4Y5gMq8=";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ buildNpmPackage (finalAttrs: {
     chmod +x bin/amp-wrapper.js
   '';
 
-  npmDepsHash = "sha256-Lnnutg8LDp9UMuJ+TuoRABK7lcQNizZDltr1cMFpYEc=";
+  npmDepsHash = "sha256-Ce7TaJuSrha+NcFmppMm/byAFosBR2I/zMY4KA5JXuE=";
 
   propagatedBuildInputs = [
     ripgrep

pkgs/by-name/an/angle/package.nix

@@ -35,7 +35,7 @@ let
       llvmPackages.clang
     ];
     postBuild =
-      if stdenv.isDarwin then
+      if stdenv.hostPlatform.isDarwin then
         ''
           mkdir -p $out/lib/clang/${llvmMajorVersion}/lib/darwin
           ln -s $out/resource-root/lib/darwin/libclang_rt.osx.a \
@@ -67,12 +67,12 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     llvmPackages.bintools
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     xcbuild
   ];
 
   buildInputs =
-    lib.optionals stdenv.isLinux [
+    lib.optionals stdenv.hostPlatform.isLinux [
       glib
       libxcb.dev
       libx11.dev
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
       pciutils
       libGL
     ]
-    ++ lib.optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
       apple-sdk_15
     ];
 

pkgs/by-name/ap/apache-orc/package.nix

@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
     (lib.cmakeBool "BUILD_JAVA" false)
-    (lib.cmakeBool "STOP_BUILD_ON_WARNING" stdenv.isLinux)
+    (lib.cmakeBool "STOP_BUILD_ON_WARNING" stdenv.hostPlatform.isLinux)
     (lib.cmakeBool "INSTALL_VENDORED_LIBS" false)
   ]
   ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [

pkgs/by-name/ap/apko/package.nix

@@ -55,7 +55,7 @@ buildGoModule (finalAttrs: {
   # skip tests on darwin due to some local networking failures
   # `__darwinAllowLocalNetworking = true;` wasn't sufficient for
   # aarch64 or x86_64
-  doCheck = !stdenv.isDarwin;
+  doCheck = !stdenv.hostPlatform.isDarwin;
   preCheck = ''
     # some test data include SOURCE_DATE_EPOCH (which is different from our default)
     # and the default version info which we get by unsetting our ldflags

pkgs/by-name/as/astyle/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astyle";
-  version = "3.6.14";
+  version = "3.6.15";
 
   src = fetchurl {
     url = "mirror://sourceforge/astyle/astyle-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-HEb9wiy+mcYDWTmTt1C6pMouC0yeSx2Q4vtg10nWCNA=";
+    hash = "sha256-W0B31otZQWCJFs2KJjBGo1Yfl1k3A8BIMccwsjCoGuk=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/at/atuin-desktop/package.nix

@@ -153,7 +153,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=ui::viewport::tests::test_add_line_scrolling"
     "--skip=ui::viewport::tests::test_line_wrapping"
   ];
-  doCheck = !stdenv.isDarwin;
+  doCheck = !stdenv.hostPlatform.isDarwin;
 
   __structuredAttrs = true;
 

pkgs/by-name/az/azahar/package.nix

@@ -161,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "ENABLE_SSE42" enableSSE42)
   ];
 
-  installPhase = optionalString stdenv.isDarwin ''
+  installPhase = optionalString stdenv.hostPlatform.isDarwin ''
     runHook preInstall
 
     mkdir -p $out/Applications $out/bin
@@ -176,7 +176,7 @@ stdenv.mkDerivation (finalAttrs: {
     qtWrapperArgs+=(
       --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"
       --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}"
-      ${optionalString stdenv.isDarwin "--prefix DYLD_LIBRARY_PATH : ${
+      ${optionalString stdenv.hostPlatform.isDarwin "--prefix DYLD_LIBRARY_PATH : ${
         lib.makeLibraryPath [ moltenvk ]
       }"}
     )

pkgs/by-name/ba/balatro-mod-manager/package.nix

@@ -92,6 +92,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   meta = {
+    # Rollup for ARM64 is broken with Node modules
+    broken = stdenv.hostPlatform.isAarch64;
     description = "A mod manager for the game Balatro";
     homepage = "https://balatro-mod-manager.dasguney.com/";
     license = lib.licenses.gpl3Plus;

pkgs/by-name/ba/basedpyright/package.nix

@@ -40,7 +40,7 @@ buildNpmPackage rec {
     docify
     pkg-config
   ]
-  ++ lib.optional stdenv.isDarwin [ clang_20 ]; # clang_21 breaks keytar
+  ++ lib.optional stdenv.hostPlatform.isDarwin [ clang_20 ]; # clang_21 breaks keytar
 
   buildInputs = [ libsecret ];
 

pkgs/by-name/bl/bluej/package.nix

@@ -19,7 +19,7 @@ let
     {
       enableJavaFX = true;
     }
-    // lib.optionalAttrs stdenv.isLinux {
+    // lib.optionalAttrs stdenv.hostPlatform.isLinux {
       openjfx_jdk = openjfx21.override { withWebKit = true; };
     }
   );

pkgs/by-name/bm/bmake/package.nix

@@ -62,7 +62,9 @@ stdenv.mkDerivation (finalAttrs: {
       "varmod-localtime"
     ]
     # TODO: drop the name-conditioning on stdenv rebuild
-    ++ lib.optional (stdenv.isDarwin && lib.getName stdenv != "bootstrap-stage1-stdenv-darwin") "export"
+    ++ lib.optional (
+      stdenv.hostPlatform.isDarwin && lib.getName stdenv != "bootstrap-stage1-stdenv-darwin"
+    ) "export"
   );
 
   strictDeps = true;

pkgs/by-name/br/brainflow/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.21.0";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     tag = finalAttrs.version;
-    hash = "sha256-AE8c2ArkNipoAJSCj3NHEM91rulfbWGyANunPESKc/E=";
+    hash = "sha256-DizB9SCw3SMOsBz/bioUqLvDME9lfNaBzOY/pFGzv8g=";
   };
 
   patches = [ ];

pkgs/by-name/br/brave/package.nix

@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.89.145";
+  version = "1.90.121";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-WcLCmhbALtVHL4LEPCUyLfRZR30kdc/41pfHxvE0rJQ=";
+      hash = "sha256-y4wAvJdghCfKF61EQoZHaZ28qmX2/DTmBhISRj+m8EM=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-t7OXN+42gXd/b9fE8sd40aH2l/nW2OvtLvHCqb7/1qI=";
+      hash = "sha256-XOTxy6+P6abDZtE9UlxSVX/eEDfNFrudC/q+9+gE3s4=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-A5SGxb+r0wEbdo7ZkUrwm6zVr86+vpOvtfBpZivmNoE=";
+      hash = "sha256-WI5QIym3rMC8z+CcsLG+K4qgEaRiNzIOO7a7Vf45r1M=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-kTk6BeKuGkteKlGBk2b5ftDeo9F+EaWwk4DoEzlfJGw=";
+      hash = "sha256-a3GJeQ6InfTz3a4jtdOcNfP37MqLsjnuIJo3M451NKc=";
     };
   };
 

pkgs/by-name/br/brogue-ce/package.nix

@@ -46,10 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
     "DATADIR=$(out)/opt/brogue-ce"
     "TERMINAL=${if terminal then "YES" else "NO"}"
     "GRAPHICS=${if graphics then "YES" else "NO"}"
-    "MAC_APP=${if stdenv.isDarwin then "YES" else "NO"}"
+    "MAC_APP=${if stdenv.hostPlatform.isDarwin then "YES" else "NO"}"
   ];
 
-  postBuild = lib.optionalString (stdenv.isDarwin && graphics) ''
+  postBuild = lib.optionalString (stdenv.hostPlatform.isDarwin && graphics) ''
     make Brogue.app $makeFlags
   '';
 
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  postInstall = lib.optionalString (stdenv.isDarwin && graphics) ''
+  postInstall = lib.optionalString (stdenv.hostPlatform.isDarwin && graphics) ''
     mkdir -p $out/Applications
     mv Brogue.app "$out/Applications/Brogue CE.app"
   '';

pkgs/by-name/br/bruno-cli/package.nix

@@ -31,7 +31,7 @@ buildNpmPackage {
   nativeBuildInputs = [
     pkg-config
   ]
-  ++ lib.optional stdenv.isDarwin clang_20; # clang_21 breaks gyp builds
+  ++ lib.optional stdenv.hostPlatform.isDarwin clang_20; # clang_21 breaks gyp builds
 
   buildInputs = [
     pango

pkgs/by-name/br/bruno/package.nix

@@ -42,7 +42,7 @@ buildNpmPackage rec {
   nativeBuildInputs = [
     pkg-config
   ]
-  ++ lib.optional stdenv.isDarwin clang_20 # clang_21 breaks gyp builds
+  ++ lib.optional stdenv.hostPlatform.isDarwin clang_20 # clang_21 breaks gyp builds
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
     makeWrapper
     copyDesktopItems

pkgs/by-name/br/brush-splat/package.nix

@@ -48,7 +48,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     vulkan-loader
     zstd
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     wayland
   ];
 

pkgs/by-name/ca/caido-cli/package.nix

@@ -35,9 +35,10 @@ stdenv.mkDerivation (finalAttrs: {
   );
 
   nativeBuildInputs =
-    lib.optionals stdenv.isLinux [ autoPatchelfHook ] ++ lib.optionals stdenv.isDarwin [ unzip ];
+    lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ unzip ];
 
-  buildInputs = lib.optionals stdenv.isLinux [ libgcc ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libgcc ];
 
   sourceRoot = ".";
 

pkgs/by-name/ca/caido-desktop/package.nix

@@ -113,9 +113,9 @@ let
   };
 
 in
-if stdenv.isLinux then
+if stdenv.hostPlatform.isLinux then
   linux
-else if stdenv.isDarwin then
+else if stdenv.hostPlatform.isDarwin then
   darwin
 else
   throw "caido-desktop: unsupported platform ${stdenv.hostPlatform.system}"

pkgs/by-name/ca/cargo-nextest/package.nix

@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
-  patches = lib.optionals stdenv.isDarwin [
+  patches = lib.optionals stdenv.hostPlatform.isDarwin [
     ./no-dtrace-macos.patch
   ];
 

pkgs/by-name/cg/cgui/fix-gcc15.patch

@@ -0,0 +1,15 @@
+diff --git a/examples/25viewer.c b/examples/25viewer.c
+index 37e4585..a0328f0 100644
+--- a/examples/25viewer.c
++++ b/examples/25viewer.c
+@@ -10,8 +10,9 @@
+ 
+ static const char *fname; /* stores name of file to open */
+ 
+-void quit()
++void quit(void *data)
+ {
++   (void)data;
+    exit(0);
+ }
+ 

pkgs/by-name/cg/cgui/package.nix

@@ -17,6 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "1pp1hvidpilq37skkmbgba4lvzi01rasy04y0cnas9ck0canv00s";
   };
 
+  patches = [
+    ./fix-gcc15.patch
+  ];
+
   buildInputs = [
     texinfo
     allegro

pkgs/by-name/cl/cli53/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cli53";
-  version = "0.8.22";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "barnybug";
     repo = "cli53";
-    rev = finalAttrs.version;
-    sha256 = "sha256-wfb3lK/WB/B8gd4BOqh+Ol10cNZdsoCoQ+hM33+goM8=";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-ojLqveOZ8IIJXNd6PdXbqWYcwXqAjjEpKiquqXwcZt8=";
   };
 
-  vendorHash = "sha256-LKJXoXZS866UfJ+Edwf6AkAZmTV2Q1OI1mZfbsxHb3s=";
+  vendorHash = "sha256-OpBeuIyyFOliVtN1z9Ll9ji2qNS41NvZBjL7vJvRe6E=";
 
   ldflags = [
     "-s"

pkgs/by-name/cl/cloudcompare/package.nix

@@ -157,6 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://cloudcompare.org";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ nh2 ];
+    teams = [ lib.teams.geospatial ];
     mainProgram = "CloudCompare";
     platforms = with lib.platforms; linux; # only tested here; might work on others
   };

pkgs/by-name/cr/creduce/fix-gcc15.patch

@@ -0,0 +1,53 @@
+From 1c715fef9113d5a5291694eab739d4a743ab08d5 Mon Sep 17 00:00:00 2001
+From: Bradley Walters <oss@walters.app>
+Date: Fri, 2 Jan 2026 22:02:30 -0800
+Subject: [PATCH] unifdef: constexpr is reserved in C23
+
+---
+ unifdef/unifdef.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/unifdef/unifdef.c b/unifdef/unifdef.c
+index 5c67cd44..692a1640 100644
+--- a/unifdef/unifdef.c
++++ b/unifdef/unifdef.c
+@@ -201,7 +201,7 @@ static int              depth;			/* current #if nesting */
+ static int              delcount;		/* count of deleted lines */
+ static unsigned         blankcount;		/* count of blank lines */
+ static unsigned         blankmax;		/* maximum recent blankcount */
+-static bool             constexpr;		/* constant #if expression */
++static bool             isconstexpr;		/* constant #if expression */
+ static bool             zerosyms;		/* to format symdepth output */
+ static bool             firstsym;		/* ditto */
+ 
+@@ -1078,7 +1078,7 @@ eval_unary(const struct ops *ops, long *valp, const char **cpp)
+ 			*valp = (value[sym] != NULL);
+ 			lt = *valp ? LT_TRUE : LT_FALSE;
+ 		}
+-		constexpr = false;
++		isconstexpr = false;
+ 	} else if (!endsym(*cp)) {
+ 		debug("eval%d symbol", prec(ops));
+ 		sym = findsym(&cp);
+@@ -1095,7 +1095,7 @@ eval_unary(const struct ops *ops, long *valp, const char **cpp)
+ 			lt = *valp ? LT_TRUE : LT_FALSE;
+ 			cp = skipargs(cp);
+ 		}
+-		constexpr = false;
++		isconstexpr = false;
+ 	} else {
+ 		debug("eval%d bad expr", prec(ops));
+ 		return (LT_ERROR);
+@@ -1162,10 +1162,10 @@ ifeval(const char **cpp)
+ 	long val = 0;
+ 
+ 	debug("eval %s", *cpp);
+-	constexpr = killconsts ? false : true;
++	isconstexpr = killconsts ? false : true;
+ 	ret = eval_table(eval_ops, &val, cpp);
+ 	debug("eval = %d", val);
+-	return (constexpr ? LT_IF : ret == LT_ERROR ? LT_IF : ret);
++	return (isconstexpr ? LT_IF : ret == LT_ERROR ? LT_IF : ret);
+ }
+ 
+ /*

pkgs/by-name/cr/creduce/package.nix

@@ -4,13 +4,15 @@
   fetchFromGitHub,
   cmake,
   makeWrapper,
-  llvm,
-  libclang,
+  llvmPackages_18,
   flex,
   zlib,
   perlPackages,
   util-linux,
 }:
+let
+  llvmPackages = llvmPackages_18;
+in
 
 stdenv.mkDerivation {
   pname = "creduce";
@@ -23,6 +25,11 @@ stdenv.mkDerivation {
     hash = "sha256-RbxFqZegsCxnUaIIA5OfTzx1wflCPeF+enQt90VwMgA=";
   };
 
+  patches = [
+    # https://github.com/csmith-project/creduce/pull/290
+    ./fix-gcc15.patch
+  ];
+
   postPatch = ''
     substituteInPlace {clex,clang_delta,delta,unifdef,creduce,.}/CMakeLists.txt --replace-fail \
     "cmake_minimum_required(VERSION 2.8.12)" "cmake_minimum_required(VERSION 3.10)"
@@ -39,14 +46,14 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     cmake
     makeWrapper
-    llvm.dev
+    llvmPackages.llvm.dev
   ];
   buildInputs = [
     # Ensure stdenv's CC is on PATH before clang-unwrapped
     stdenv.cc
     # Actual deps:
-    llvm
-    libclang
+    llvmPackages.llvm
+    llvmPackages.libclang
     flex
     zlib
   ]

pkgs/by-name/cu/cue/package.nix

@@ -7,6 +7,7 @@
   testers,
   tests,
   callPackage,
+  pkgs,
 }:
 
 buildGoModule (finalAttrs: {
@@ -49,7 +50,7 @@ buildGoModule (finalAttrs: {
 
       tests = {
         validation = tests.cue-validation.override {
-          callPackage = (path: attrs: callPackage path (attrs // { inherit writeCueValidator; }));
+          pkgs = pkgs.extend (_: _: { inherit writeCueValidator; });
         };
 
         test-001-all-good = callPackage ./tests/001-all-good.nix { inherit cue; };

pkgs/by-name/d-/d-seams/cxxopts-cstdint.patch

@@ -0,0 +1,11 @@
+diff --git a/src/include/external/cxxopts.hpp b/src/include/external/cxxopts.hpp
+--- a/src/include/external/cxxopts.hpp
++++ b/src/include/external/cxxopts.hpp
+@@ -26,6 +26,7 @@ THE SOFTWARE.
+ #define CXXOPTS_HPP_INCLUDED
+
+ #include <cctype>
++#include <cstdint>
+ #include <cstring>
+ #include <exception>
+ #include <iostream>

pkgs/by-name/d-/d-seams/package.nix

@@ -36,6 +36,8 @@ clangStdenv.mkDerivation rec {
       url = "https://github.com/d-SEAMS/seams-core/commit/f6156057e43d0aa1a0df9de67d8859da9c30302d.patch";
       hash = "sha256-PLbT1lqdw+69lIHH96MPcGRjfIeZyb88vc875QLYyqw=";
     })
+    # Add missing <cstdint> include for uint8_t in vendored cxxopts.
+    ./cxxopts-cstdint.patch
   ];
   postPatch = ''
     substituteInPlace CMakeLists.txt \

pkgs/by-name/da/dashy-ui/package.nix

@@ -17,16 +17,16 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "4.0.5";
+  version = "4.0.7";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
     tag = finalAttrs.version;
-    hash = "sha256-vcNKnRcSQMU4AuvWTFdTlxVOAA0rlPCKUrDZbd+8/mk=";
+    hash = "sha256-PWuynBFOp4A/0AC5Lc5zAkb5Y5DWJgdZHtDc/douYQc=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-1FRrhNKm38/AP30F6Rf0cCHflIK9bWoxUCMMiT5c1Fc=";
+    hash = "sha256-jU/XnX6i6P1CWWWyUeVXt2q2PXMExDvmPTiLBOEuHcE=";
   };
 
   passthru = {

pkgs/by-name/di/dictu/package.nix

@@ -42,6 +42,9 @@ stdenv.mkDerivation (finalAttrs: {
         -e 's/-flto/${lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation"}/'
   '';
 
+  # bcrypt magic value triggers gcc 15 -Wunterminated-string-initialization.
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unterminated-string-initialization";
+
   cmakeFlags = [
     "-DBUILD_CLI=${if cliSupport then "ON" else "OFF"}"
     "-DDISABLE_HTTP=${if httpSupport then "OFF" else "ON"}"

pkgs/by-name/do/dovecot/generic.nix

@@ -147,9 +147,11 @@ stdenv.mkDerivation (finalAttrs: {
       'NOPLUGIN_LDFLAGS="-undefined dynamic_lookup"'
   '';
 
-  preBuild = lib.optionalString (lib.strings.versionOlder version "2.4" && stdenv.isDarwin) ''
-    export NIX_LDFLAGS="$NIX_LDFLAGS -undefined dynamic_lookup"
-  '';
+  preBuild =
+    lib.optionalString (lib.strings.versionOlder version "2.4" && stdenv.hostPlatform.isDarwin)
+      ''
+        export NIX_LDFLAGS="$NIX_LDFLAGS -undefined dynamic_lookup"
+      '';
 
   # We need this for sysconfdir, see remark below.
   installFlags = [ "DESTDIR=$(out)" ];

pkgs/by-name/do/dovecot_pigeonhole/generic.nix

@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withLDAP "--with-ldap";
 
-  preBuild = lib.optionalString (!isCurrent && stdenv.isDarwin) ''
+  preBuild = lib.optionalString (!isCurrent && stdenv.hostPlatform.isDarwin) ''
     export NIX_LDFLAGS="$NIX_LDFLAGS -undefined dynamic_lookup"
   '';
 

pkgs/by-name/em/emmylua-check/package.nix

@@ -9,7 +9,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_check";
-  inherit (emmylua-ls) version src;
+  inherit (emmylua-ls) version src cargoHash;
 
   nativeBuildInputs = [
     pkg-config
@@ -24,8 +24,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "crates/emmylua_check";
 
-  cargoHash = "sha256-JNirHIKXFsiLme5oByerHjB/3lumuAr2u3pNfxh4qa0=";
-
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

pkgs/by-name/em/emmylua-doc-cli/package.nix

@@ -6,12 +6,10 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_doc_cli";
-  inherit (emmylua-ls) version src;
+  inherit (emmylua-ls) version src cargoHash;
 
   buildAndTestSubdir = "crates/emmylua_doc_cli";
 
-  cargoHash = "sha256-JNirHIKXFsiLme5oByerHjB/3lumuAr2u3pNfxh4qa0=";
-
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

pkgs/by-name/em/emmylua-ls/package.nix

@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emmylua_ls";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "EmmyLuaLs";
     repo = "emmylua-analyzer-rust";
     tag = finalAttrs.version;
-    hash = "sha256-Zj5nLeTH/4sVElYP+erg6bSTX8jFqF7sqiXfaMam8pE=";
+    hash = "sha256-2HC2BeT4x4QGjj2tKB0yM9Bh7zsQ/S0xX/KaJvlgq2o=";
   };
 
   nativeBuildInputs = [
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "crates/emmylua_ls";
 
-  cargoHash = "sha256-JNirHIKXFsiLme5oByerHjB/3lumuAr2u3pNfxh4qa0=";
+  cargoHash = "sha256-AruojLPjozzajHksLDfi39Qq6gvnHem2glgS454yxVQ=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/er/eresi/package.nix

@@ -40,6 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  # K&R-style function-pointer declarations break under gcc 15's C23 default.
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   postPatch = ''
     # Two occurences of fprintf() with only two arguments, which should really
     # be fputs().

pkgs/by-name/fa/fastly/package.nix

@@ -12,13 +12,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fastly";
-  version = "14.3.1";
+  version = "15.0.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8RdJNGI8FzM2HVkJNbWqr2Cw+CkPUTZ7uiiLQVEKTGM=";
+    hash = "sha256-ZSUT0f3U6tmJLtSdpTorAYxJExdR+zVan+Gua3BIcDM=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
     "cmd/fastly"
   ];
 
-  vendorHash = "sha256-XzfsPSG0gEXhlAF9O3VGNn8FGXlvXFxqX7kffQDdsRA=";
+  vendorHash = "sha256-J0UvU/rXUpxJEn/p+ScO8omFwHY2JD3kq7zGes0ohQ8=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/fe/feather-tk/package.nix

@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals enableNFD [
     nativefiledialog-extended
   ]
-  ++ lib.optionals (enableNFD && stdenv.isLinux) [
+  ++ lib.optionals (enableNFD && stdenv.hostPlatform.isLinux) [
     gtk3
   ]
   ++ lib.optionals enablePython [
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = enableTests;
 
-  nativeCheckInputs = lib.optionals (enableTests && stdenv.isLinux) [
+  nativeCheckInputs = lib.optionals (enableTests && stdenv.hostPlatform.isLinux) [
     xvfb-run
   ];
 
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preCheck
 
     cd feather-tk/src/feather-tk-build
-    ${if stdenv.isLinux then "xvfb-run" else ""} ctest --verbose -C Release
+    ${if stdenv.hostPlatform.isLinux then "xvfb-run" else ""} ctest --verbose -C Release
 
     runHook postCheck
   '';

pkgs/by-name/fi/filen-desktop/package.nix

@@ -63,7 +63,7 @@ buildNpmPackage {
     electron
     makeWrapper
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     desktopToDarwinBundle
   ];
 

pkgs/by-name/fi/filtr/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     fontconfig
     freetype
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
     libx11
     libxcomposite

pkgs/by-name/fm/fmit/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  libsForQt5,
+  qt6,
   fftw,
   itstool,
   alsaSupport ? true,
@@ -19,31 +19,34 @@ assert portaudioSupport -> portaudio != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fmit";
-  version = "1.2.14";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "gillesdegottex";
     repo = "fmit";
     rev = "v${finalAttrs.version}";
-    sha256 = "1q062pfwz2vr9hbfn29fv54ip3jqfd9r99nhpr8w7mn1csy38azx";
+    sha256 = "sha256-fi5/JCgum+TYexUuTRZNFWPPsR87P73gfYhozQYx3Rw=";
   };
 
   nativeBuildInputs = [
-    libsForQt5.qmake
+    qt6.qmake
     itstool
-    libsForQt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
   ];
   buildInputs = [
     fftw
-    libsForQt5.qtbase
-    libsForQt5.qtmultimedia
+    qt6.qtbase
+    qt6.qtmultimedia
+    qt6.qtsvg
   ]
   ++ lib.optionals alsaSupport [ alsa-lib ]
   ++ lib.optionals jackSupport [ libjack2 ]
   ++ lib.optionals portaudioSupport [ portaudio ];
 
   postPatch = ''
-    substituteInPlace fmit.pro --replace '$$FMITVERSIONGITPRO' '${finalAttrs.version}'
+    substituteInPlace fmit.pro \
+      --replace-fail 'FMITVERSIONPRO = $$system(git describe --tags --always)' 'FMITVERSIONPRO = ${finalAttrs.version}' \
+      --replace-fail 'FMITBRANCHGITPRO = $$system(git rev-parse --abbrev-ref HEAD)' 'FMITBRANCHGITPRO = master'
   '';
 
   qmakeFlags = [

pkgs/by-name/fo/forgejo-runner/package.nix

@@ -45,7 +45,7 @@ let
     # Timeouts
     "TestRunJob_WithConnectionFromCommandOptions"
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # Uses docker-specific options, unsupported on Darwin
     "TestMergeJobOptions"
   ];

pkgs/by-name/fv/fverb/package.nix

@@ -34,6 +34,6 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     # clang++: error: unsupported option '-mfpu=' for target 'arm64-apple-darwin'
     # clang++: error: unsupported option '-mfloat-abi=' for target 'arm64-apple-darwin'
-    broken = stdenv.isDarwin && stdenv.isAarch64;
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
   };
 }

pkgs/by-name/ga/gate12/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     fontconfig
     freetype
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
     libx11
     libxcomposite

pkgs/by-name/ge/gemini-cli/package.nix

@@ -28,14 +28,14 @@ buildNpmPackage (finalAttrs: {
 
   npmDepsHash = "sha256-4znN1YR3AX2SKeCJjUS8cm6WGcOGPXI27xrQCotBjgQ=";
 
-  dontPatchElf = stdenv.isDarwin;
+  dontPatchElf = stdenv.hostPlatform.isDarwin;
 
   nativeBuildInputs = [
     jq
     pkg-config
     makeWrapper
   ]
-  ++ lib.optionals stdenv.isDarwin [ clang_20 ]; # clang_21 breaks @vscode/vsce's optionalDependencies keytar
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ clang_20 ]; # clang_21 breaks @vscode/vsce's optionalDependencies keytar
 
   buildInputs = [
     ripgrep

pkgs/by-name/gf/gforth/package.nix

@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gforth";
-  version = "0.7.9_20260415";
+  version = "0.7.9_20260508";
 
   src = fetchFromGitHub {
     owner = "forthy42";
     repo = "gforth";
     rev = finalAttrs.version;
-    hash = "sha256-eMBerL8kry9UlsXS4qdXT7jLK4f1S/q//5qkJ5qi3dA=";
+    hash = "sha256-XcGykMUEMmrNQ8y++SM1s0RPfMFgBTDXAIeAGKgU2Iw=";
   };
 
   patches = [ ./use-nproc-instead-of-fhs.patch ];

pkgs/by-name/gi/gitaly/git.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   # required to support pthread_cancel()
   NIX_LDFLAGS =
     lib.optionalString (stdenv.cc.isGNU && stdenv.hostPlatform.libc == "glibc") "-lgcc_s"
-    + lib.optionalString stdenv.isFreeBSD "-lthr";
+    + lib.optionalString stdenv.hostPlatform.isFreeBSD "-lthr";
 
   # The build phase already installs it all
   GIT_PREFIX = placeholder "out";

pkgs/by-name/gn/gnumake/package.nix

@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ]
   ++ lib.optionals (!inBootstrap) [ texinfo ]
-  ++ lib.optional stdenv.isCygwin gettext;
+  ++ lib.optional stdenv.hostPlatform.isCygwin gettext;
 
   buildInputs = lib.optionals guileEnabled [ guile ];
 

pkgs/by-name/go/goverlay/package.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goverlay";
-  version = "1.7.5";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = "goverlay";
     tag = finalAttrs.version;
-    hash = "sha256-q4g6K4iUkeam1dVHOWdkUjH/XAOIKgOXnJDE0dm5HVw=";
+    hash = "sha256-/ItkUqUQq1aeDPB8gHNOQkFp8s+/mOwFthnC77fT+h8=";
   };
 
   outputs = [

pkgs/by-name/gr/grype/package.nix

@@ -106,7 +106,7 @@ buildGoModule (finalAttrs: {
         "Test_dpkgUseCPEsForEOLEnvVar"
         "Test_rpmUseCPEsForEOLEnvVar"
       ]
-      ++ lib.optionals stdenv.isDarwin [
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
         # fails to generate x509 certificate
         # cat: /etc/ssl/openssl.cnf: Operation not permitted
         "Test_defaultHTTPClientHasCert"

pkgs/by-name/ha/hacompanion/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "hacompanion";
-  version = "1.0.27";
+  version = "1.0.30";
 
   src = fetchFromGitHub {
     owner = "tobias-kuendig";
     repo = "hacompanion";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tm9qx2SPkyzxP7fHXAzlk/iMn/67zMJlmeTq9veRg98=";
+    hash = "sha256-TC1ZnYT5WGbKP2Y2pOKaLj8Hmr3lU+LShkNV2DpcyDk=";
   };
 
   vendorHash = "sha256-SohjueM0DwSuh7XVClYiWA/5d0V6x2vmp5aPxgmIJYY=";

pkgs/by-name/ho/hoppscotch/package.nix

@@ -8,22 +8,22 @@
 
 let
   pname = "hoppscotch";
-  version = "26.3.1-0";
+  version = "26.4.0-0";
 
   src =
     fetchurl
       {
         aarch64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-9Ahc/Gi4MRgloWND82lZQhWG2oR85Fytsz2BYi+fVpc=";
+          hash = "sha256-qpwtXAVrBAdDnK9FLkvPdbVtPIZpAaZ0srT+Hw7ckNA=";
         };
         x86_64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-YXvLzdm493xAvCRuRg0WwBTJ4VXKO50wzr2TfWN3J84=";
+          hash = "sha256-LtEHmdSxIiWNHIAkVycsNMhmjS7VWkMiwLcY544fQ1Y=";
         };
         x86_64-linux = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-6dFCCYkof0N4AqWZko741LN6NW2K4F5gpwzzK4U5QCM=";
+          hash = "sha256-bgo+R01NJ3ElfHHvRZ42K8AcioJyjhs52yHkq30nsyg=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

pkgs/by-name/hy/hygg/package.nix

@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ## Skipping this test due to the high variability of its outcome
   ## When the package was merged the test was passing but on hydra its not
   ## Look at PR #448907
-  ++ (if pkgs.stdenv.isDarwin then [ "--skip=test_stdin_processing" ] else [ ]);
+  ++ (if pkgs.stdenv.hostPlatform.isDarwin then [ "--skip=test_stdin_processing" ] else [ ]);
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/hy/hyprviz/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyprviz";
-  version = "0.8.4";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "timasoft";
     repo = "hyprviz";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UvFtZzQuUgqxY/pMfFaMEM/5VRJuMjSBOXiViwLB0TE=";
+    hash = "sha256-d1JNCCzCpJw646VrwSdrj175F4w4AsAfvGv4CnCEEv4=";
   };
 
-  cargoHash = "sha256-QuwxJw77ccUnvHcPNrPD5EwgZ3MJV4VvGb7MtUnYu88=";
+  cargoHash = "sha256-Wjk1nqSoqeHvdTRzoRl3NTJIB5Chp14Cm/6weniVwiI=";
 
   nativeBuildInputs = [
     pkg-config
@@ -35,7 +35,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   postInstall = ''
-    install -Dm644 hyprviz.desktop -t $out/share/applications
+    install -Dm644 assets/hyprviz.desktop -t $out/share/applications
+    install -Dm644 assets/hyprviz.svg -t $out/share/icons/hicolor/scalable/apps
+    install -Dm644 assets/hyprviz.png -t $out/share/icons/hicolor/256x256/apps
   '';
 
   meta = {

pkgs/by-name/id/idris2/libidris2_support.nix

@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [
     "PREFIX=${placeholder "out"}"
   ]
-  ++ lib.optional stdenv.isDarwin "OS=";
+  ++ lib.optional stdenv.hostPlatform.isDarwin "OS=";
 
   buildFlags = [ "support" ];
 

pkgs/by-name/in/inetutils/package.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
     ./inetutils-1_9-PATH_PROCNET_DEV.patch
 
-    (if stdenv.isDarwin then ./tests-libls-2.sh.patch else ./tests-libls.sh.patch)
+    (if stdenv.hostPlatform.isDarwin then ./tests-libls-2.sh.patch else ./tests-libls.sh.patch)
 
     (fetchpatch {
       name = "CVE-2026-24061_1.patch";
@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin "--disable-servers";
 
-  ${if stdenv.isDarwin then "hardeningDisable" else null} = [ "format" ];
+  ${if stdenv.hostPlatform.isDarwin then "hardeningDisable" else null} = [ "format" ];
 
   doCheck = true;
 

pkgs/by-name/is/isle-portable/unwrapped.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
-  postPatch = lib.optionalString stdenv.isDarwin ''
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace packaging/macos/CMakeLists.txt \
       --replace-fail "fixup_bundle" "#fixup_bundle"
   '';

pkgs/by-name/ja/jabref/package.nix

@@ -173,8 +173,8 @@ stdenv.mkDerivation rec {
     zip -d $out/lib/javafx-web-*-*.jar "*.so"
 
     # Use postgresql from nixpkgs since the bundled binary doesn't work on NixOS
-    ARCH1=${if stdenv.isAarch64 then "arm64v8" else "amd64"}
-    ARCH2=${if stdenv.isAarch64 then "arm_64" else "x86_64"}
+    ARCH1=${if stdenv.hostPlatform.isAarch64 then "arm64v8" else "amd64"}
+    ARCH2=${if stdenv.hostPlatform.isAarch64 then "arm_64" else "x86_64"}
     mkdir postgresql
     cd postgresql
     ln -s ${postgresql}/{lib,share} ./

pkgs/by-name/jw/jwt-hack/package.nix

@@ -2,17 +2,19 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  pkg-config,
+  openssl,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jwt-hack";
-  version = "2.0.0";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "jwt-hack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uJur/ABoAaQT3BBO2yprK/0/bQPT138Yg9IbztZ6w2w=";
+    hash = "sha256-kutt5VhMY/YIXBpVZTg/xAwa9d+J5ypfLi5aLakjfaY=";
   };
 
   cargoLock = {
@@ -23,6 +25,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ln -s ${./Cargo.lock} Cargo.lock
   '';
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  OPENSSL_NO_VENDOR = 1;
+
   meta = {
     description = "JSON Web Token Hack Toolkit";
     homepage = "https://github.com/hahwul/jwt-hack";

pkgs/by-name/ki/kimai/package.nix

@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.55.0";
+  version = "2.56.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-p4Y5hCWr5BVOGYUJtFJhhDftm+A/CWxbdBhPgOR1TcY=";
+    hash = "sha256-rax67E/Zr50ejSAjA4Aa1NDsAbJYuAAE4k8hji5UhOg=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-Vlaqe3FTItRZDiYWzOVDL+q7HZ8TgpiLPFTDzUyL4LY=";
+  vendorHash = "sha256-XHicbYXOfCPFIMKrhyBpchd89anj6kG1/7prpER7aCo=";
 
   composerNoPlugins = false;
   postInstall = ''

pkgs/by-name/kn/knot-resolver-manager_6/package.nix

@@ -75,7 +75,7 @@ python3Packages.buildPythonPackage {
     echo -e 'quit()' | env -i ./kresd -a 127.0.0.1#53535 -c test-http.lua
   '';
 
-  doCheck = python3Packages.stdenv.isLinux; # maybe in future
+  doCheck = python3Packages.stdenv.hostPlatform.isLinux; # maybe in future
   nativeCheckInputs = with python3Packages; [
     augeas
     dnspython

pkgs/by-name/kt/kty/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
+  oniguruma,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -23,10 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env = {
     OPENSSL_NO_VENDOR = 1;
+    RUSTONIG_SYSTEM_LIBONIG = 1;
   };
 
   buildInputs = [
     openssl
+    oniguruma
   ];
 
   cargoHash = "sha256-nJ+nof2YhyLrNuLVy69kYj5tw+aG4IJm6nVxHkczbko=";

pkgs/by-name/li/librewolf-bin-unwrapped/package.nix

@@ -36,7 +36,7 @@ let
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "150.0.1-1";
+  version = "150.0.2-1";
 in
 
 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
     url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        x86_64-linux = "sha256-yIZGbTTelMerlFZ2oISCHtK/C62KjGnWd6agO4H+pbo=";
-        aarch64-linux = "sha256-hEAH1/I40f/fjUtODJc6kMuUhr4Xj+TyEvn0TOPSYMc=";
+        x86_64-linux = "sha256-KMpSMcLJ/wkySo2gbiECJfH2/hcxdTSLXwKcZLMkvhk=";
+        aarch64-linux = "sha256-Dxs7eRN6nj3e/6pQ3z0d27tnTtD6CefhUxPZGwTVL+Y=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };

pkgs/by-name/li/libxkbcommon_8/package.nix

@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     bison
     doxygen
   ]
-  ++ lib.optional stdenv.isLinux xvfb
+  ++ lib.optional stdenv.hostPlatform.isLinux xvfb
   ++ lib.optional withWaylandTools wayland-scanner;
 
   buildInputs = [
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Denable-wayland=${lib.boolToString withWaylandTools}"
   ];
 
-  doCheck = stdenv.isLinux; # TODO: disable just a part of the tests
+  doCheck = stdenv.hostPlatform.isLinux; # TODO: disable just a part of the tests
   preCheck = ''
     patchShebangs ../test/
   '';

pkgs/by-name/li/lifelines/package.nix

@@ -32,6 +32,10 @@ stdenv.mkDerivation {
     bison
   ];
 
+  postPatch = ''
+    mkdir -p m4
+  '';
+
   meta = {
     description = "Genealogy tool with ncurses interface";
     homepage = "https://lifelines.github.io/lifelines/";

pkgs/by-name/li/lintspec/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lintspec";
-  version = "0.16.0";
+  version = "0.17.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "lintspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hMBDOpmz8EMSWPKU16EleSxVZbLSbZPynqhrJifgt04=";
+    hash = "sha256-iIanf/lQRD+JZEa9jAa4JNATJq2EYoKoiA4dOmXxgtY=";
   };
 
-  cargoHash = "sha256-WaMuHTvadj1GoFyT0p4II6EFp7nmN5LJN3SOO2kYujM=";
+  cargoHash = "sha256-+Hi9vciLSeIijTH3tCKMv2USTYrWzfuTUaxSOW0hi4g=";
   cargoBuildFlags = [
     "--package"
     "lintspec"

pkgs/by-name/ll/llama-swap/package.nix

@@ -81,7 +81,7 @@ buildGoModule (finalAttrs: {
 
   checkFlags =
     let
-      skippedTests = lib.optionals (stdenv.isDarwin) [
+      skippedTests = lib.optionals (stdenv.hostPlatform.isDarwin) [
         # Fail only on *-darwin intermittently
         # https://github.com/mostlygeek/llama-swap/issues/320
         "TestProcess_AutomaticallyStartsUpstream"

pkgs/by-name/mc/mcap-cli/package.nix

@@ -34,7 +34,7 @@ buildGoModule {
   tags = [
     "sqlite_omit_load_extension"
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     "netgo"
     "osusergo"
   ];

pkgs/by-name/mc/mcporter/package.nix

@@ -13,19 +13,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mcporter";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "steipete";
     repo = "mcporter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MaIduY59Q2zVZheN1IYhAWBklQ3n6iJV3KiTMHCML2U=";
+    hash = "sha256-1wBdYetYu+R04Fl50KR3zZK3QO6S95GV+PEO9k3Thhc=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-jqHEu86dNjJuYBVKDeDlre+KlFEqx55YXZ5K81AK+uY=";
+    hash = "sha256-TZfEoUSjba8cRz6L9uY2PGskYsR7S/xAahiKLd8dhFM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/md/mdwatch/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdwatch";
-  version = "0.1.24";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "vimlinuz";
     repo = "mdwatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dQMGVqCR8DEgKf1G0HG7eCydNju4OBaQ9UMgDD5hdvI=";
+    hash = "sha256-snmyfhOkCTnRsBcKcTTij5caA2NmSA1Csp3+D6BJcw4=";
   };
 
-  cargoHash = "sha256-5HIc0h042gP4mGr4Yp6ej0fkwNW2SDEzlwITgLF2/7I=";
+  cargoHash = "sha256-CAXHIOC0K062zXNnAD1IW2Sb5Mnpc91A1Lamhc3+NLQ=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/me/meshlab/package.nix

@@ -153,6 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
       nim65s
       yzx9
     ];
+    teams = [ lib.teams.geospatial ];
     platforms = with lib.platforms; linux ++ darwin;
   };
 })

pkgs/by-name/mi/microfetch/package.nix

@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-vGvpjRJr4ez322JWUwboVml22vnRVRlwpZ9W4F5wATA=";
 
-  nativeBuildInputs = lib.optionals stdenv.isLinux [ mold ];
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ mold ];
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/mo/moor/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "moor";
-  version = "2.12.3";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "walles";
     repo = "moor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nqwdWDJ4lpWJL79Bjk17U81xqz4l0Q75jG2tJfYmV/w=";
+    hash = "sha256-aEwazj3RXOrPPOxZDfvyHqetO5tvhnzQ19rE+NQf8wQ=";
   };
 
   vendorHash = "sha256-fHOatNwedbDNGp7V8ynW1NiTkqSJmo8vrv6S64gUQqM=";