Merge staging-next into staging

ci/default.nix

@@ -51,7 +51,7 @@ let
 
 in
 rec {
-  inherit pkgs fmt;
+  inherit pkgs docPkgs fmt;
   codeownersValidator = pkgs.callPackage ./codeowners-validator { };
 
   # FIXME(lf-): it might be useful to test other Nix implementations

doc/default.nix

@@ -1,5 +1,5 @@
 {
-  pkgs ? (import ../ci { }).pkgs,
+  pkgs ? (import ../ci { }).docPkgs,
   nixpkgs ? { },
 }:
 

lib/tests/modules/types-attrTag.nix

@@ -120,7 +120,17 @@ in
       assert config.merged.positive == { yay = 100; };
       assert config.merged.extensi-foo == { extensible = "foo"; };
       assert config.merged.extensi-bar == { extensible = "bar"; };
+      assert config.docs."submodules.<name>.foo.bar".declarations == [ __curPos.file ];
       assert config.docs."submodules.<name>.foo.bar".type == "signed integer";
+      assert
+        lib.length
+          (options.submodules.type.nestedTypes.elemType.nestedTypes.foo.type.getSubOptions [ ])
+          .bar.declarationPositions == 1;
+      assert
+        (lib.head
+          (options.submodules.type.nestedTypes.elemType.nestedTypes.foo.type.getSubOptions [ ])
+          .bar.declarationPositions
+        ).file == __curPos.file;
       assert config.docs."submodules.<name>.qux".type == "string";
       assert config.docs."submodules.<name>.qux".declarations == [ __curPos.file ];
       assert
@@ -133,8 +143,11 @@ in
       assert config.docs."submodules.<name>.qux".description == "A qux for when you don't want a foo";
       assert config.docs."submodules.<name>.qux".readOnly == false;
       assert config.docs."submodules.<name>.qux".visible == true;
-      # Not available (yet?)
-      # assert config.docs."submodules.<name>.qux".declarationsWithPositions == [ ... ];
+      assert
+        lib.length options.submodules.type.nestedTypes.elemType.nestedTypes.qux.declarationPositions == 1;
+      assert
+        (lib.head options.submodules.type.nestedTypes.elemType.nestedTypes.qux.declarationPositions).file
+        == __curPos.file;
       assert options.submodules.declarations == [ __curPos.file ];
       assert lib.length options.submodules.declarationPositions == 1;
       assert (lib.head options.submodules.declarationPositions).file == __curPos.file;

lib/types.nix

@@ -1140,6 +1140,27 @@ rec {
         else
           throw "The option `${showOption loc}` is defined as ${lib.strings.escapeNixIdentifier choice}, but ${lib.strings.escapeNixIdentifier choice} is not among the valid choices (${choicesStr}). Value ${choice} was defined in ${showFiles (getFiles defs)}.";
       nestedTypes = tags;
+      getSubModules =
+        let
+          tagsWithSubModules = filterAttrs (_: mods: mods != null) (
+            mapAttrs (_: opt: opt.type.getSubModules) tags
+          );
+        in
+        if tagsWithSubModules == { } then null else [ tagsWithSubModules ];
+      substSubModules =
+        allWrappedModules:
+        let
+          tagsWithNewTypes = zipAttrsWith (tag: tags.${tag}.type.substSubModules) (
+            concatMap (
+              { _file, imports }: map (mapAttrs (_: imports: { inherit _file imports; })) imports
+            ) allWrappedModules
+          );
+        in
+        attrTag (
+          mapAttrs (
+            tag: opt: opt // (optionalAttrs (tagsWithNewTypes ? ${tag}) { type = tagsWithNewTypes.${tag}; })
+          ) tags
+        );
       functor = defaultFunctor "attrTag" // {
         type = { tags, ... }: lib.types.attrTag tags;
         payload = { inherit tags; };

maintainers/maintainer-list.nix

@@ -23382,6 +23382,11 @@
     githubId = 77415970;
     name = "Redhawk";
   };
+  redhood = {
+    name = "Alice Liddell";
+    github = "petalmaya";
+    githubId = 258934709;
+  };
   redianthus = {
     github = "redianthus";
     githubId = 16472988;

nixos/modules/services/web-apps/chhoto-url.nix

@@ -30,7 +30,7 @@ in
     settings = lib.mkOption {
       description = ''
         Configuration of Chhoto URL.
-        See <https://github.com/SinTan1729/chhoto-url/blob/main/compose.yaml> for a list of options.
+        See <https://github.com/SinTan1729/chhoto-url/blob/main/docs/INSTALLATION.md#configuration-options> for a list of options.
       '';
       example = {
         port = 4567;
@@ -152,7 +152,7 @@ in
       description = ''
         Files to load environment variables from in addition to [](#opt-services.chhoto-url.settings).
         This is useful to avoid putting secrets into the nix store.
-        See <https://github.com/SinTan1729/chhoto-url/blob/main/compose.yaml> for a list of options.
+        See <https://github.com/SinTan1729/chhoto-url/blob/main/docs/INSTALLATION.md#configuration-options> for a list of options.
       '';
     };
   };

nixos/tests/chhoto-url.nix

@@ -18,7 +18,6 @@
   };
 
   interactive.nodes.machine = {
-    services.glitchtip.listenAddress = "0.0.0.0";
     networking.firewall.allowedTCPPorts = [ 8000 ];
     virtualisation.forwardPorts = [
       {
@@ -29,9 +28,13 @@
     ];
   };
 
+  interactive.sshBackdoor.enable = true;
+  interactive.defaults.virtualisation.graphics = false;
+
   testScript = ''
     import json
     import re
+    import time
 
     machine.wait_for_unit("chhoto-url.service")
     machine.wait_for_open_port(8000)
@@ -53,8 +56,10 @@
     assert (match := re.search(r"(?m)^location: (.+?)\r?$", resp))
     assert match[1] == "https://nixos.org/"
 
+    time.sleep(2)
     resp = json.loads(machine.succeed(f"curl -H 'X-API-Key: api_key' localhost:8000/api/expand -d '{slug}'"))
     assert resp["success"] is True
+    assert resp["longurl"] == "https://nixos.org/"
     assert resp["hits"] == 1
   '';
 }

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-fgIxS3c3+teMTMCXzRINFuV1aebJAQFIXfXC7Q2zHhg=";
+          hash = "sha256-0iSA2ck0tJdOiiDlhwp7XaqYDFEAMZyI9mALIvYD6Zw=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-LdSx/7CspsT5hff6oQKRFmxQS+vi0kpvCgbcq8OQSAA=";
+          hash = "sha256-35dMOAr9pb7Tb5gkiDp2K0xdodGduOEcJ9IFSenD03s=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-ct7RcbzKHiZ/PRl42IFoHroR4i4gDVuHSX1t4FDN+R0=";
+          hash = "sha256-rojFi5393B56j86IAtWWVP0XiNeCsnAvTFIr3CcGZYY=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-N/AeA4E0tSHH3lrPhuyqPDl5nE+aNK/ntsW4ai+Sf5s=";
+          hash = "sha256-X8nXfpfaM9KtZLvL4ACyevrtdm+eihtjXVlYHSSas78=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.197";
+      version = "2.1.198";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/by-name/ch/chhoto-url/package.nix

@@ -8,28 +8,30 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "7.2.1";
+  version = "7.4.1";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-n8fCQeY0gIyZuACKWa8Fk9TQ680PpVS2MHMFy7UgDwk=";
+    hash = "sha256-1kPXsN5gOfY8JyaV6J5X2cEH00Xm06nsU5GNuVDxBJo=";
     fetchLFS = true;
   };
 
-  sourceRoot = "${finalAttrs.src.name}/actix";
+  sourceRoot = "${finalAttrs.src.name}/backend";
 
   postPatch = ''
     substituteInPlace src/{main.rs,services/get.rs,services/utils.rs} \
-      --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
+      --replace-fail "./frontend/" "${placeholder "out"}/share/chhoto-url/frontend/"
+    substituteInPlace Cargo.toml \
+      --replace-fail 'rust-version = "1.96"' 'rust-version = "1.95"'
   '';
 
-  cargoHash = "sha256-9EVGsOipx9ObygpM37iZYLnhYjSMHFhHTDvjHkLWLz8=";
+  cargoHash = "sha256-H3HrHu1y8wIc0j3cCIPOUnFe1jzpx1vCSfZvushIf70=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url
-    cp -r ${finalAttrs.src}/resources $out/share/chhoto-url/resources
+    cp -r ${finalAttrs.src}/frontend $out/share/chhoto-url/frontend
   '';
 
   passthru = {

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.197",
-  "commit": "c8fd8048f30950a21d28734718275aa7e97f5143",
-  "buildDate": "2026-06-29T19:16:30Z",
+  "version": "2.1.198",
+  "commit": "b80c496480ebf28e6dfe755cf0b8e3dd1d7cba1f",
+  "buildDate": "2026-07-01T06:17:25Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "8cc0c4d1e4eb1dca3b0cc92ab02ee3505de764e023f8c901761c167b72041fb8",
-      "size": 227251472
+      "checksum": "ab6f7ee109816ede414f7c285446633f805b623aa609f425609a64266451d61e",
+      "size": 229328464
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "5e8a57cc7a92377f0744fa4c79191cf93d4b26c79cb919b07a407511fed1be26",
-      "size": 235288016
+      "checksum": "280b6cfc60dacc4caed31af1249e53c259c01759556e60633944c02405c82dd0",
+      "size": 238706000
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "fb48473c467c27615ac799a754f4ef0b68c363e4596cefbb59c3815d51a0cc8a",
-      "size": 242334448
+      "checksum": "99b50a6f2b1f3ef07bcaf1e58a2f9883c470c84e428afa321972b1aa20372e9a",
+      "size": 245742320
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "f54e69cbc89b2da61a415700af7ff52a147e862517d4f1b0eecf768448cf7f83",
-      "size": 245517112
+      "checksum": "7066af42a5fe93038c13af5072d4c034dc3928092cb121fdd892c76b94b6b84d",
+      "size": 248900408
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "acb885610ba06d90c46206ded9b14121bc30e96affecbfb3c37d511bf02af2bd",
-      "size": 235582648
+      "checksum": "88cb391085e419457569bcc57a672f734f30b424e17df7323f3bbb421238e801",
+      "size": 238990520
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "2f610c0f81341052426981b5dc59277a33e6ec3df924071b24edbc05e6a096dc",
-      "size": 240202112
+      "checksum": "42892159a03bee492926b616b1270313544f7a52b68d32cb680e91984a4c6659",
+      "size": 243589504
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "038bd9fe90c60304601e19751269a50d62925c541dd6a2b3da5274549e9416ee",
-      "size": 236121248
+      "checksum": "6afd07cb03aa981c5e918808f53a1e2b729015b695122a944f6e41aaf5393933",
+      "size": 239292064
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "8d2baeaf77b0e79ea33cf5ce78a37e64804c3a26d63d35355a830fda404a4f61",
-      "size": 230588064
+      "checksum": "10a6d21332f674c87f52b1dc09926945d0169f1bb82aced84ada100639ab70bc",
+      "size": 233758880
     }
   }
 }

pkgs/by-name/eg/egctl/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "egctl";
-  version = "1.8.0";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "envoyproxy";
     repo = "gateway";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KvXOLyMWtl4ycz6P4LQalODD95ptCY7tQtxtYG2x+28=";
+    hash = "sha256-givYesuucfw/gumEwxpU/NTtyfZQgmGXg7u+xg9Yx0s=";
   };
 
-  vendorHash = "sha256-wiehH9qmDVLho+ZDQH5IbckO0LP3FLxHhYXBMA8aBjs=";
+  vendorHash = "sha256-5Hlycq0+/wvboP81MKlKBFLEgxa545eyXwPtueHONNE=";
   # Fix case-insensitive conflicts producing platform-dependent checksums
   # https://github.com/microsoft/go-mssqldb/issues/234
   proxyVendor = true;

pkgs/by-name/fl/fltk_1_3/package.nix

@@ -35,6 +35,8 @@
   withShared ? true,
 
   nix-update-script,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -68,6 +70,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withDocs [
     doxygen
     graphviz
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs =
@@ -139,6 +145,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
     (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+  ]
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   preBuild = lib.optionalString (withCairo && withShared && stdenv.hostPlatform.isDarwin) ''

pkgs/by-name/fl/fltk_1_4/package.nix

@@ -46,6 +46,8 @@
   withExamples ? (stdenv.buildPlatform == stdenv.hostPlatform),
 
   nix-update-script,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 # pango support depends on Xft
@@ -84,6 +86,10 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withDocs [
     doxygen
     graphviz
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs =
@@ -169,6 +175,12 @@ stdenv.mkDerivation (finalAttrs: {
 
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
     (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true)
+  ]
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   postBuild = lib.optionalString withDocs ''

pkgs/by-name/gt/gtk-mac-integration/package.nix

@@ -9,6 +9,8 @@
   gtk ? gtk3,
   gtk3,
   gobject-introspection,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation rec {
@@ -28,6 +30,8 @@ stdenv.mkDerivation rec {
     pkg-config
     gtk-doc
     gobject-introspection
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
   ];
   buildInputs = [ glib ];
   propagatedBuildInputs = [ gtk ];
@@ -36,6 +40,13 @@ stdenv.mkDerivation rec {
     gtkdocize
   '';
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   meta = {
     description = "Provides integration for GTK applications into the Mac desktop";
     license = lib.licenses.lgpl21;

pkgs/by-name/gt/gtk2/package.nix

@@ -27,6 +27,8 @@
   gdktarget ? if stdenv.hostPlatform.isDarwin then "quartz" else "x11",
   cupsSupport ? config.gtk2.cups or stdenv.hostPlatform.isLinux,
   xineramaSupport ? stdenv.hostPlatform.isLinux,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -56,13 +58,19 @@ stdenv.mkDerivation (finalAttrs: {
     gtkCleanImmodulesCache
   ];
 
-  nativeBuildInputs = finalAttrs.setupHooks ++ [
-    gdk-pixbuf
-    gettext
-    gobject-introspection
-    perl
-    pkg-config
-  ];
+  nativeBuildInputs =
+    finalAttrs.setupHooks
+    ++ [
+      gdk-pixbuf
+      gettext
+      gobject-introspection
+      perl
+      pkg-config
+    ]
+    # TODO: Clean up on `staging`
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      llvmPackages.lld
+    ];
 
   patches = [
     ./patches/2.0-immodules.cache.patch
@@ -120,12 +128,19 @@ stdenv.mkDerivation (finalAttrs: {
     "ac_cv_path_GDK_PIXBUF_CSOURCE=${buildPackages.gdk-pixbuf.dev}/bin/gdk-pixbuf-csource"
   ];
 
-  env = lib.optionalAttrs stdenv.cc.isGNU {
-    NIX_CFLAGS_COMPILE = toString [
-      "-Wno-error=implicit-int"
-      "-Wno-error=incompatible-pointer-types"
-    ];
-  };
+  env =
+    lib.optionalAttrs stdenv.cc.isGNU {
+      NIX_CFLAGS_COMPILE = toString [
+        "-Wno-error=implicit-int"
+        "-Wno-error=incompatible-pointer-types"
+      ];
+    }
+    # Fix for ld64 hardening issue
+    #
+    # TODO: Clean up on `staging`
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   enableParallelBuilding = true;
 

pkgs/by-name/ii/iina/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "iina";
-  version = "1.4.2";
+  version = "1.4.4";
 
   src = fetchurl {
     url = "https://github.com/iina/iina/releases/download/v${finalAttrs.version}/IINA.v${finalAttrs.version}.dmg";
-    hash = "sha256-Lg/Yn7uhySpsEVFx5bUZBIg7tJf75ROmlh0ID7qwj/Y=";
+    hash = "sha256-3Q/AvUs3+1ehyNMNbjIBs6ZLr9KZWf5WlTlkYTI3vrE=";
   };
 
   nativeBuildInputs = [ undmg ];
@@ -35,6 +35,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       arkivm
       FlameFlag
+      kinnrai
       stepbrobd
     ];
     mainProgram = "iina";

pkgs/by-name/mo/moltenvk/package.nix

@@ -17,6 +17,8 @@
   # but that’s not really a concern for nixpkgs, so use them by default.
   # See: https://github.com/KhronosGroup/MoltenVK/blob/main/README.md#metal_private_api
   enablePrivateAPIUsage ? true,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -35,7 +37,11 @@ stdenv.mkDerivation (finalAttrs: {
     vulkan-headers
   ];
 
-  nativeBuildInputs = [ xcbuildHook ];
+  nativeBuildInputs = [
+    xcbuildHook
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
+  ];
 
   outputs = [
     "out"
@@ -114,6 +120,11 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional enablePrivateAPIUsage "-DMVK_USE_METAL_PRIVATE_API=1"
   );
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   env.NIX_LDFLAGS = toString [
     "-lglslang"
     "-lSPIRV"

pkgs/by-name/se/seamonkey/package.nix

@@ -0,0 +1,89 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  gtk3,
+  gtk2,
+  gdk-pixbuf,
+  dbus-glib,
+  libx11,
+  libxcomposite,
+  libxcursor,
+  libxdamage,
+  libxext,
+  libxi,
+  libxrender,
+  libxt,
+  libpulseaudio,
+  libGL,
+  pango,
+  freetype,
+  fontconfig,
+  autoPatchelfHook,
+  makeWrapper,
+  wrapGAppsHook3,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "seamonkey";
+  version = "2.53.23";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # Upstream requires highly deprecated build tools to compile from source
+  src = fetchurl {
+    url = "https://archive.seamonkey-project.org/releases/${version}/linux-x86_64/en-US/seamonkey-${version}.en-US.linux-x86_64.tar.bz2";
+    sha256 = "1si5vqprq7hgm366db76yziqxcqdvxj675kgxb6lp2ppprl8rlkw";
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook3
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  buildInputs = [
+    gtk2
+    gtk3
+    gdk-pixbuf
+    dbus-glib
+    libpulseaudio
+    libGL
+    pango
+    freetype
+    fontconfig
+    libxi
+    libxcursor
+    libxdamage
+    libxrender
+    libxcomposite
+    libxext
+    libx11
+    libxt
+  ];
+
+  installPhase = ''
+    mkdir -p $out/lib/seamonkey $out/bin
+    cp -r * $out/lib/seamonkey/
+
+    ln -s $out/lib/seamonkey/seamonkey $out/bin/seamonkey
+
+    wrapProgram $out/bin/seamonkey \
+      --prefix LD_LIBRARY_PATH : "${
+        lib.makeLibraryPath [
+          libpulseaudio
+          libGL
+        ]
+      }"
+  '';
+
+  meta = with lib; {
+    description = "The SeaMonkey project is a community effort to deliver production-quality releases of code names previously known as 'Mozilla Application Suite'";
+    homepage = "https://www.seamonkey-project.org/";
+    license = licenses.mpl20;
+    platforms = [ "x86_64-linux" ];
+    maintainers = [ lib.maintainers.redhood ];
+    mainProgram = "seamonkey";
+  };
+}

pkgs/by-name/xa/xacro/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromGitHub,
+
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "xacro";
+  version = "2.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ros";
+    repo = "xacro";
+    tag = finalAttrs.version;
+    hash = "sha256-xYFwVM5qpy2/cYKtcf/v5sSlL2e/taIC4IQ48ZiRxiw=";
+  };
+
+  build-system = [
+    python3Packages.setuptools
+    python3Packages.setuptools-scm
+  ];
+
+  dependencies = [
+    python3Packages.pyyaml
+  ];
+
+  pythonImportsCheck = [ "xacro" ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Xacro is an XML macro language. With xacro, you can construct shorter and more readable XML files by using macros that expand to larger XML expressions";
+    homepage = "https://github.com/ros/xacro";
+    changelog = "https://github.com/ros/xacro/blob/${finalAttrs.src.rev}/CHANGELOG.rst";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nim65s ];
+    mainProgram = "xacro";
+  };
+})

pkgs/by-name/xa/xacrodoc/package.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  fetchFromGitHub,
+
+  python3Packages,
+  xacro,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "xacrodoc";
+  version = "2.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "adamheins";
+    repo = "xacrodoc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zuyd+lVcrz06yEgapoTjOZP+mxfOsk52rQE33aKV0qI=";
+  };
+
+  build-system = [
+    python3Packages.hatchling
+  ];
+
+  dependencies = [
+    python3Packages.rospkg
+    xacro
+  ];
+
+  optional-dependencies = {
+    mujoco = [
+      python3Packages.mujoco
+    ];
+  };
+
+  nativeCheckInputs = [
+    python3Packages.pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "xacrodoc"
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Compile xacro files to plain URDF or MJCF from Python or the command line (no ROS required)";
+    homepage = "https://github.com/adamheins/xacrodoc";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nim65s ];
+    mainProgram = "xacrodoc";
+  };
+})

pkgs/development/compilers/swift/compiler/default.nix

@@ -37,6 +37,8 @@
   DarwinTools,
   apple-sdk_14,
   darwinMinVersionHook,
+  # TODO: Clean up on `staging`
+  lld,
 }:
 
 let
@@ -252,6 +254,8 @@ stdenv.mkDerivation {
     DarwinTools # sw_vers
     fixDarwinDylibNames
     cctools.libtool
+    # TODO: Clean up on `staging`
+    lld
   ];
 
   buildInputs = [
@@ -562,6 +566,12 @@ stdenv.mkDerivation {
     #   Fixed in: https://github.com/apple/swift/commit/84083afef1de5931904d5c815d53856cdb3fb232
     cmakeFlags="
       -GNinja
+      ${
+        # Fix for ld64 hardening issue
+        #
+        # TODO: Clean up on staging
+        lib.optionalString stdenv.hostPlatform.isDarwin "-DCMAKE_LINKER_TYPE=LLD"
+      }
       -DBOOTSTRAPPING_MODE=BOOTSTRAPPING${lib.optionalString stdenv.hostPlatform.isDarwin "-WITH-HOSTLIBS"}
       -DSWIFT_ENABLE_EXPERIMENTAL_DIFFERENTIABLE_PROGRAMMING=ON
       -DSWIFT_ENABLE_EXPERIMENTAL_CONCURRENCY=ON

pkgs/development/compilers/swift/default.nix

@@ -15,7 +15,8 @@ let
     inherit stdenv;
 
     swift-unwrapped = callPackage ./compiler {
-      inherit (llvmPackages) stdenv;
+      # TODO: Clean up on `staging`
+      inherit (llvmPackages) stdenv lld;
       inherit (darwin) DarwinTools sigtool;
     };
 

pkgs/development/libraries/ffmpeg/generic.nix

@@ -59,7 +59,7 @@
   withChromaprint ? withFullDeps, # Audio fingerprinting
   withCodec2 ? withFullDeps, # codec2 en/decoding
   withCuda ? withFullDeps && withNvcodec,
-  withCudaLLVM ? withHeadlessDeps,
+  withCudaLLVM ? withHeadlessDeps && !stdenv.hostPlatform.isDarwin, # Cuda isn’t supported on Darwin
   withCudaNVCC ? withFullDeps && withUnfree && config.cudaSupport,
   withCuvid ? withHeadlessDeps && withNvcodec,
   withDav1d ? withHeadlessDeps, # AV1 decoder (focused on speed and correctness)

pkgs/development/libraries/gstreamer/base/default.nix

@@ -46,6 +46,8 @@
   hotdoc,
   directoryListingUpdater,
   apple-sdk_gstreamer,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -87,6 +89,10 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableWayland [
     wayland-scanner
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -159,6 +165,14 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional (!enableCdparanoia) "-Dcdparanoia=disabled"
   ++ lib.optional stdenv.hostPlatform.isDarwin "-Ddrm=disabled";
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CC_LD = "lld";
+    OBJC_LD = "lld";
+  };
+
   postPatch = ''
     patchShebangs \
       scripts/meson-pkg-config-file-fixup.py \

pkgs/development/libraries/gstreamer/core/default.nix

@@ -33,6 +33,8 @@
   hotdoc,
   directoryListingUpdater,
   apple-sdk_gstreamer,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -84,6 +86,10 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableDocumentation [
     hotdoc
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -117,6 +123,14 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "libdw" (withLibunwind && hasElfutils))
   ];
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    CC_LD = "lld";
+    OBJC_LD = "lld";
+  };
+
   postPatch = ''
     patchShebangs \
       gst/parse/get_flex_version.py \

pkgs/development/libraries/gstreamer/good/default.nix

@@ -66,6 +66,8 @@
   gst-plugins-good,
   directoryListingUpdater,
   apple-sdk_gstreamer,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 let
@@ -137,6 +139,10 @@ stdenv.mkDerivation (finalAttrs: {
   )
   ++ lib.optionals enableWayland [
     wayland-protocols
+  ]
+  # TODO: Clean up on `staging`
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -265,6 +271,13 @@ stdenv.mkDerivation (finalAttrs: {
       # linking error on Darwin
       # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
       "-lncurses";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Fix for ld64 hardening issue
+    #
+    # TODO: Clean up on `staging`
+    CC_LD = "lld";
+    OBJC_LD = "lld";
   };
 
   # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"

pkgs/development/libraries/qt-5/modules/qtbase.nix

@@ -20,6 +20,8 @@
   which,
   # darwin support
   xcbuild,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 
   dbus,
   fontconfig,
@@ -192,6 +194,8 @@ stdenv.mkDerivation (
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         xcbuild
+        # TODO: Clean up on `staging`
+        llvmPackages.lld
       ];
 
     }
@@ -373,6 +377,12 @@ stdenv.mkDerivation (
         # if dependency paths contain the string "pq", which can occur in the hash.
         # To prevent these failures, we need to override PostgreSQL detection.
         PSQL_LIBS = "-L${libpq}/lib -lpq";
+      }
+      // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+        # Fix for ld64 hardening issue
+        #
+        # TODO: Clean up on `staging`
+        NIX_CFLAGS_LINK = "-fuse-ld=lld";
       };
 
       prefixKey = "-prefix ";

pkgs/development/python-modules/arviz-plots/default.nix

@@ -112,6 +112,11 @@ buildPythonPackage (finalAttrs: {
     webcolors
   ];
 
+  disabledTests = [
+    # flaky, timeout
+    "test_plot_trace_dist"
+  ];
+
   meta = {
     description = "ArviZ modular plotting";
     homepage = "https://github.com/arviz-devs/arviz-plots";

pkgs/development/python-modules/bottleneck/default.nix

@@ -2,30 +2,37 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
+  versioneer,
   numpy,
   pytestCheckHook,
   python,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "bottleneck";
   version = "1.6.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-Ao1G7ksCWtmrTXmSQROBb4JfYrF7h8nh0NjOFEpKDjE=";
   };
 
-  propagatedBuildInputs = [ numpy ];
+  build-system = [
+    setuptools
+    versioneer
+  ];
+
+  dependencies = [ numpy ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
   preCheck = "pushd $out";
   postCheck = "popd";
 
-  disabledTests = [ "test_make_c_files" ];
-
   pythonImportsCheck = [ "bottleneck" ];
 
   meta = {
@@ -34,4 +41,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd2;
     maintainers = [ ];
   };
-}
+})

pkgs/tools/security/pinentry/mac.nix

@@ -10,6 +10,8 @@
   common-updater-scripts,
   writers,
   re-plistbuddy,
+  # TODO: Clean up on `staging`
+  llvmPackages,
 }:
 
 stdenv.mkDerivation rec {
@@ -47,6 +49,8 @@ stdenv.mkDerivation rec {
     makeBinaryWrapper
     texinfo
     re-plistbuddy
+    # TODO: Clean up on `staging`
+    llvmPackages.lld
   ];
 
   configureFlags = [
@@ -56,6 +60,11 @@ stdenv.mkDerivation rec {
     "--with-libassuan-prefix=${libassuan.dev}"
   ];
 
+  # Fix for ld64 hardening issue
+  #
+  # TODO: Clean up on `staging`
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   installPhase = ''
     mkdir -p $out/Applications $out/bin
     mv macosx/pinentry-mac.app $out/Applications