From 25f0d94ececfb94d491ce05f735323cd8138c339 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 21 Feb 2026 00:35:01 +0000 Subject: [PATCH 01/42] python3Packages.pylint: 4.0.4 -> 4.0.5 --- pkgs/development/python-modules/pylint/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix index 99bcf2293409..e91972254e54 100644 --- a/pkgs/development/python-modules/pylint/default.nix +++ b/pkgs/development/python-modules/pylint/default.nix @@ -23,14 +23,14 @@ buildPythonPackage (finalAttrs: { pname = "pylint"; - version = "4.0.4"; + version = "4.0.5"; pyproject = true; src = fetchFromGitHub { owner = "pylint-dev"; repo = "pylint"; tag = "v${finalAttrs.version}"; - hash = "sha256-mKI/sRYl2ZwZ3JklmqBTs7vRG9EA4zDHaW61d/Xozb4="; + hash = "sha256-RMoX3RR7T54Bvx0bBSmyuEsezqkxfdE/hIUa4G9exjQ="; }; build-system = [ setuptools ]; From 2a346f581dd31f24e46ee99d0b9bec24c8f04e2b Mon Sep 17 00:00:00 2001 From: spr0u <204455541+spr0u@users.noreply.github.com> Date: Mon, 16 Mar 2026 15:35:07 -0500 Subject: [PATCH 02/42] orca-slicer: add nanum font dependency OrcaSlicer crashes when opening the Preferences window if the nanum font is unavailable. This commit adds a font config to OrcaSlicer as a workaround. upstream issue: https://github.com/OrcaSlicer/OrcaSlicer/issues/11641 --- pkgs/by-name/or/orca-slicer/package.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/by-name/or/orca-slicer/package.nix b/pkgs/by-name/or/orca-slicer/package.nix index 36e1193bc0fa..b7e67b9fb65c 100644 --- a/pkgs/by-name/or/orca-slicer/package.nix +++ b/pkgs/by-name/or/orca-slicer/package.nix @@ -29,7 +29,9 @@ ilmbase, libsecret, libpng, + makeFontsConf, mpfr, + nanum, nlopt, opencascade-occt_7_6, openvdb, @@ -60,6 +62,12 @@ let "--enable-secretstore" ]; }); + + # Workaround for crash due to missing font + # https://github.com/OrcaSlicer/OrcaSlicer/issues/11641 + fontsConf = makeFontsConf { + fontDirectories = [ nanum ]; + }; in stdenv.mkDerivation (finalAttrs: { pname = "orca-slicer"; @@ -218,6 +226,7 @@ stdenv.mkDerivation (finalAttrs: { ] }" --set WEBKIT_DISABLE_COMPOSITING_MODE 1 + --set FONTCONFIG_FILE "${fontsConf}" ${lib.optionalString withNvidiaGLWorkaround '' --set __GLX_VENDOR_LIBRARY_NAME mesa --set __EGL_VENDOR_LIBRARY_FILENAMES /run/opengl-driver/share/glvnd/egl_vendor.d/50_mesa.json From 18a283c05f5ace80cf393b60c199daa7764483c0 Mon Sep 17 00:00:00 2001 From: Jamie Magee Date: Sun, 29 Mar 2026 21:16:25 -0700 Subject: [PATCH 03/42] onnxruntime: fix cross-compilation Three things break the cross build: - doCheck was true, so CMake tried to build tests and fetch GTest. FETCHCONTENT_FULLY_DISCONNECTED blocks the download, and the tests can't run on the build machine anyway. Disable doCheck when host != build. - pythonSupport defaulted to true, but FindPython runs the build-platform Python, which can't find target-platform NumPy headers. Default to false when not canExecute. - protobuf was only in nativeBuildInputs (for protoc), so the linker found the build-platform libprotobuf-lite.so. Add it to buildInputs too. Resolves NixOS#462791 --- pkgs/by-name/on/onnxruntime/package.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/on/onnxruntime/package.nix b/pkgs/by-name/on/onnxruntime/package.nix index b01633221af1..08514fbd6c7c 100644 --- a/pkgs/by-name/on/onnxruntime/package.nix +++ b/pkgs/by-name/on/onnxruntime/package.nix @@ -21,7 +21,7 @@ protobuf, microsoft-gsl, darwinMinVersionHook, - pythonSupport ? true, + pythonSupport ? (stdenv.buildPlatform.canExecute stdenv.hostPlatform), cudaSupport ? config.cudaSupport, ncclSupport ? cudaSupport && cudaPackages.nccl.meta.available, rocmSupport ? config.rocmSupport, @@ -165,6 +165,7 @@ effectiveStdenv.mkDerivation (finalAttrs: { libpng nlohmann_json microsoft-gsl + protobuf zlib ] ++ lib.optionals (lib.meta.availableOn effectiveStdenv.hostPlatform cpuinfo) [ @@ -313,6 +314,8 @@ effectiveStdenv.mkDerivation (finalAttrs: { !( cudaSupport || rocmSupport + # cross-compiled test binaries can't execute on the build platform + || (effectiveStdenv.hostPlatform != effectiveStdenv.buildPlatform) || builtins.elem effectiveStdenv.buildPlatform.system [ # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox "aarch64-linux" From 7128d7f1b9e5fbeb2bc3ab982583a26e5ed51481 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ha=CC=88cker?= Date: Sat, 4 Apr 2026 17:12:25 +0200 Subject: [PATCH 04/42] lixPackageSets: add nixos-rebuild-ng --- pkgs/tools/package-management/lix/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix index 8ebcd187f4a3..615281fc99ff 100644 --- a/pkgs/tools/package-management/lix/default.nix +++ b/pkgs/tools/package-management/lix/default.nix @@ -23,6 +23,7 @@ nix-fast-build, haskell, nix-serve-ng, + nixos-rebuild-ng, colmena, nix-update, nix-init, @@ -143,6 +144,10 @@ let })) ]; + nixos-rebuild-ng = nixos-rebuild-ng.override { + nix = self.lix; + }; + colmena = colmena.override { nix = self.lix; inherit (self) nix-eval-jobs; From 64620c3bf687f144b0f2169ebe2bf7766e09b4a9 Mon Sep 17 00:00:00 2001 From: David Wronek Date: Mon, 6 Oct 2025 14:59:10 +0200 Subject: [PATCH 05/42] python3Packages.sebaubuntu-libs: init at 2.0.0 Signed-off-by: David Wronek --- .../sebaubuntu-libs/default.nix | 68 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 + 2 files changed, 70 insertions(+) create mode 100644 pkgs/development/python-modules/sebaubuntu-libs/default.nix diff --git a/pkgs/development/python-modules/sebaubuntu-libs/default.nix b/pkgs/development/python-modules/sebaubuntu-libs/default.nix new file mode 100644 index 000000000000..91a1429d2bcd --- /dev/null +++ b/pkgs/development/python-modules/sebaubuntu-libs/default.nix @@ -0,0 +1,68 @@ +{ + lib, + buildPythonPackage, + fetchFromGitHub, + nix-update-script, + android-image-kitchen, + gitpython, + poetry-core, + pyelftools, + requests, +}: + +buildPythonPackage (finalAttrs: { + pname = "sebaubuntu-libs"; + version = "2.0.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "sebaubuntu-python"; + repo = "sebaubuntu_libs"; + tag = "v${finalAttrs.version}"; + hash = "sha256-LV7Me+GmgOvDh0XGoLaftCKtP/fnB5xVqb8nArOMIys="; + }; + + build-system = [ + poetry-core + ]; + + dependencies = [ + gitpython + pyelftools + requests + ]; + + postPatch = '' + # Patch libaik to use AIK from nixpkgs + substituteInPlace sebaubuntu_libs/libaik/__init__.py \ + --replace-fail \ + "Repo.clone_from(AIK_REPO, self.path)" "" \ + --replace-fail \ + "unpackimg.sh" "${lib.getExe' android-image-kitchen "aik-unpackimg"}" \ + --replace-fail \ + "repack.sh" "${lib.getExe' android-image-kitchen "aik-repackimg"}" \ + --replace-fail \ + "cleanup.sh" "${lib.getExe' android-image-kitchen "aik-cleanup"}" \ + --replace-fail \ + 'command = [self.path / script, "--nosudo", *args]' \ + 'command = [script, "--nosudo", *args]' \ + --replace-fail \ + 'return check_output(command, stderr=STDOUT, universal_newlines=True, encoding="utf-8")' \ + 'return check_output(command, stderr=STDOUT, universal_newlines=True, encoding="utf-8", + cwd=self.path)' + ''; + + # Module has no tests + doCheck = false; + + pythonImportsCheck = [ "sebaubuntu_libs" ]; + + passthru.updateScript = nix-update-script { }; + + meta = { + description = "SebaUbuntu's shared libs"; + homepage = "https://github.com/sebaubuntu-python/sebaubuntu_libs"; + license = lib.licenses.asl20; + maintainers = with lib.maintainers; [ ungeskriptet ]; + }; +}) diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 2f8c149f03c9..7cc328b84589 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -17393,6 +17393,8 @@ self: super: with self; { seatconnect = callPackage ../development/python-modules/seatconnect { }; + sebaubuntu-libs = callPackage ../development/python-modules/sebaubuntu-libs { }; + seccomp = callPackage ../development/python-modules/seccomp { }; secp256k1 = callPackage ../development/python-modules/secp256k1 { inherit (pkgs) secp256k1; }; From 5192eb03bad6282dc2ba4b5e3e9950f8e6e6bb3f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 20 Apr 2026 00:31:24 +0000 Subject: [PATCH 06/42] unifi: 10.1.89 -> 10.2.105 --- pkgs/by-name/un/unifi/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/un/unifi/package.nix b/pkgs/by-name/un/unifi/package.nix index e05dd5ce4ecc..8009886e0a45 100644 --- a/pkgs/by-name/un/unifi/package.nix +++ b/pkgs/by-name/un/unifi/package.nix @@ -10,12 +10,12 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "unifi-controller"; - version = "10.1.89"; + version = "10.2.105"; # see https://community.ui.com/releases / https://www.ui.com/download/unifi src = fetchurl { url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb"; - hash = "sha256-gtnDr+CBeoOKqIeDwKJixW5W20lje7nzR4DC/D+1S3o="; + hash = "sha256-MBTFxNwrIbx6UKZYCcZ+BjYjSlfdxL60Ogei/ba4O+U="; }; nativeBuildInputs = [ From d72fa1cbf3aa2b5181ae2897e7b28fcfe3b9c645 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 20 Apr 2026 13:01:46 +0000 Subject: [PATCH 07/42] oxlint: 1.59.0 -> 1.60.0 --- pkgs/by-name/ox/oxlint/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix index 59acd68893fb..036540e23212 100644 --- a/pkgs/by-name/ox/oxlint/package.nix +++ b/pkgs/by-name/ox/oxlint/package.nix @@ -23,25 +23,25 @@ # runs without an external linter, which leaves `jsPlugins` configs inert. stdenv.mkDerivation (finalAttrs: { pname = "oxlint"; - version = "1.59.0"; + version = "1.60.0"; src = fetchFromGitHub { owner = "oxc-project"; repo = "oxc"; tag = "oxlint_v${finalAttrs.version}"; - hash = "sha256-o4vacOuKNUdLdkd6v94jQcevA8dCXG32fYmO2ZEj330="; + hash = "sha256-RMADw7oEf407J7/KDmIma0k3JKALMBkLqp9pyE+uRkA="; }; cargoDeps = rustPlatform.fetchCargoVendor { inherit (finalAttrs) pname version src; - hash = "sha256-lppnmePEmbguoDDGyIM3gWbEX0ShgymoCjvrx1tK2Lw="; + hash = "sha256-Xla3mPOkBIfA4BMd+3/lO3mXy4V96DgyT+CzuhTTAd0="; }; pnpmDeps = fetchPnpmDeps { inherit (finalAttrs) pname version src; pnpm = pnpm_10; fetcherVersion = 3; - hash = "sha256-5T3lrAjMH03Rngc7u7oCLzp9E1sz7jOvG2XmPhouAz0="; + hash = "sha256-fomJmm0GXIClng63wql3hCo1Pf4CbVUiEtbvAv9DPIo="; }; dontUseCmakeConfigure = true; From b87a1570f0e883aa738ebcf9e692c65d2e42dd26 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 24 Apr 2026 18:51:58 +0000 Subject: [PATCH 08/42] mise: 2026.4.6 -> 2026.4.20 --- pkgs/by-name/mi/mise/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix index 05025fed802c..05c0129dd694 100644 --- a/pkgs/by-name/mi/mise/package.nix +++ b/pkgs/by-name/mi/mise/package.nix @@ -22,16 +22,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "mise"; - version = "2026.4.6"; + version = "2026.4.20"; src = fetchFromGitHub { owner = "jdx"; repo = "mise"; tag = "v${finalAttrs.version}"; - hash = "sha256-tdHjJjLwnf0/0ZxVb9+tgCD8cD8/3TEE3hw6dM3fKtY="; + hash = "sha256-6WGYjXx1AuUDbYIAHh0PdSUC+zDXq4mC5LY+r1vLiKc="; }; - cargoHash = "sha256-8JLwlEqxt8Ixg/b67ZICBBoOjGw8PFIYzNIBRiBJ8OA="; + cargoHash = "sha256-8JAxt9m8StOSNbUKZBNwQWoXwX+gXLGdNZYlRSH0SLM="; nativeBuildInputs = [ installShellFiles From e9de512be1eab9735fa856be1a7c486e41f92192 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 25 Apr 2026 07:54:00 +0000 Subject: [PATCH 09/42] aws-vault: 7.9.15 -> 7.10.2 --- pkgs/by-name/aw/aws-vault/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/aw/aws-vault/package.nix b/pkgs/by-name/aw/aws-vault/package.nix index e4cdcec4065e..f45102a0947f 100644 --- a/pkgs/by-name/aw/aws-vault/package.nix +++ b/pkgs/by-name/aw/aws-vault/package.nix @@ -10,17 +10,17 @@ }: buildGoModule (finalAttrs: { pname = "aws-vault"; - version = "7.9.15"; + version = "7.10.2"; src = fetchFromGitHub { owner = "ByteNess"; repo = "aws-vault"; rev = "v${finalAttrs.version}"; - hash = "sha256-kDzFiuzSyxNyJnj3nechenhvm4bg+fSif+D+/stdTyo="; + hash = "sha256-d8Rk+Qkfv4fcQYt+U/QF1hF+c03dj2dWHRUtuxIi73U="; }; proxyVendor = true; - vendorHash = "sha256-92k0E4zCKgWyCAvXWU49dFaYuiTByYNAWxdTYDeTzoE="; + vendorHash = "sha256-dub/57nE3ERKJEsx5bjTWjJBwIeJcmNSYoG/7iZqe+0="; nativeBuildInputs = [ installShellFiles From bae30ffa4e73107dc4202abcf6c09ca188599a93 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 25 Apr 2026 09:22:56 +0000 Subject: [PATCH 10/42] postmoogle: 0.9.29 -> 0.9.30 --- pkgs/by-name/po/postmoogle/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/po/postmoogle/package.nix b/pkgs/by-name/po/postmoogle/package.nix index 8d002b98f0ad..85227f7c7669 100644 --- a/pkgs/by-name/po/postmoogle/package.nix +++ b/pkgs/by-name/po/postmoogle/package.nix @@ -5,13 +5,13 @@ }: buildGoModule (finalAttrs: { pname = "postmoogle"; - version = "0.9.29"; + version = "0.9.30"; src = fetchFromGitHub { owner = "etkecc"; repo = "postmoogle"; tag = "v${finalAttrs.version}"; - hash = "sha256-VBRlsPfNqDehR07vbLvh0nGUgE6H8izW4jqWfMeHmTE="; + hash = "sha256-eNXc2PK3yfetyEvTyoiuoFXjEpO4ZYbDFyFaLbzwqeY="; }; tags = [ From d8c3f5f5873aada4a5c55b5a02f579fba6a40608 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 25 Apr 2026 19:51:20 +0000 Subject: [PATCH 11/42] luau: 0.714 -> 0.718 --- pkgs/by-name/lu/luau/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix index 9a22f71312ed..e94f1b447b26 100644 --- a/pkgs/by-name/lu/luau/package.nix +++ b/pkgs/by-name/lu/luau/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "luau"; - version = "0.714"; + version = "0.718"; src = fetchFromGitHub { owner = "luau-lang"; repo = "luau"; tag = finalAttrs.version; - hash = "sha256-TSkiVG0ORRU4+4TsAoLBYfMbB1Ki/ctn3cZDAEsRn/Q="; + hash = "sha256-PB+sUCRmvz5ijdtPyDNxpP7asQAhe9GczEHx962GLKA="; }; nativeBuildInputs = [ cmake ]; From d64ed31792d85e49ad607f75e6cf57624349beab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Silva?= Date: Sun, 26 Apr 2026 11:34:16 +0100 Subject: [PATCH 12/42] aquamarine: 0.10.0 -> 0.11.0 --- pkgs/by-name/aq/aquamarine/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/aq/aquamarine/package.nix b/pkgs/by-name/aq/aquamarine/package.nix index c458f0521c0c..03774520b95c 100644 --- a/pkgs/by-name/aq/aquamarine/package.nix +++ b/pkgs/by-name/aq/aquamarine/package.nix @@ -23,13 +23,13 @@ }: gcc15Stdenv.mkDerivation (finalAttrs: { pname = "aquamarine"; - version = "0.10.0"; + version = "0.11.0"; src = fetchFromGitHub { owner = "hyprwm"; repo = "aquamarine"; tag = "v${finalAttrs.version}"; - hash = "sha256-XnkWjCpeXfip9tqYdL0b0zzBDjq+dgdISvEdSVGdVyA="; + hash = "sha256-nGiqEpbQK/tg7Mzyb8kIik9uDcm3cInWDcHRquFAOS4="; }; nativeBuildInputs = [ From c5b3a5cc2e1ab01039f62fef551e64c69b46cd95 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Sun, 26 Apr 2026 03:36:56 -0700 Subject: [PATCH 13/42] mattermost: 10.11.15 -> 11.6.1 Note that this is not yet an ESR. However, 10 -> 11 will be breaking and 11.6 -> 11.7 (which is an ESR) will not be. So push mattermost to be identical to mattermostLatest until the two diverge. --- pkgs/by-name/ma/mattermost/package.nix | 34 ++++---- pkgs/by-name/ma/mattermost/tests.nix | 86 -------------------- pkgs/by-name/ma/mattermostLatest/package.nix | 23 +----- 3 files changed, 17 insertions(+), 126 deletions(-) diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix index 1efa00694488..51e25ec144dc 100644 --- a/pkgs/by-name/ma/mattermost/package.nix +++ b/pkgs/by-name/ma/mattermost/package.nix @@ -5,7 +5,7 @@ buildGoModule, fetchFromGitHub, buildNpmPackage, - nodejs_22, + nodejs, nix-update-script, npm-lockfile-fix, fetchNpmDeps, @@ -13,20 +13,21 @@ nixosTests, versionInfo ? { - # ESR releases only. - # See https://docs.mattermost.com/upgrade/extended-support-release.html + # ESR releases only. Note: if NixOS would release with an ESR that goes out + # of support during the lifetime of the NixOS release, it is acceptable + # to put the latest non-ESR release here if we change it to an ESR shortly after + # the NixOS release. + # + # See . # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update # the version regex here as well. # # Ensure you also check ../mattermostLatest/package.nix. - regex = "^v(10\\.11\\.[0-9]+)$"; - version = "10.11.15"; - srcHash = "sha256-b/hXZHYULl9nNJZT4GtKsaOfX8BEzz/v3Uy3EEbzN8U="; - vendorHash = "sha256-Z94d1eCIkuMG72Mlvk5su/99+4kJoaeHxaeZuk96Hlc="; - npmDepsHash = "sha256-p9dq31qw0EZDQIl2ysKE38JgDyLA6XvSv+VtHuRh+8A="; - lockfileOverlay = '' - unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react") - ''; + regex = "^v(11\\.[67]\\.[0-9]+)$"; + version = "11.6.1"; + srcHash = "sha256-0TUh5qKi64jt3YhgCTceoizOGzqyt70Rh8VH+bSfS5o="; + vendorHash = "sha256-bWl1rdVRTOJzS2HKKsSRhzVcH1sPgEAlRLjrc+/o0lo="; + npmDepsHash = "sha256-30xwoizNh6fAWS0YdEheXtcO6I9MjoFdCekvLnnoBMc="; }, ... }: @@ -223,9 +224,7 @@ buildMattermost rec { --replace-fail 'options: {}' 'options: { disable: true }' ''; - # https://github.com/NixOS/nixpkgs/issues/474535 - nodejs = nodejs_22; - + inherit nodejs; npmDepsHash = npmDeps.hash; makeCacheWritable = true; forceGitDeps = true; @@ -235,10 +234,9 @@ buildMattermost rec { buildPhase = '' runHook preBuild - npm run build --workspace=platform/types - npm run build --workspace=platform/client - npm run build --workspace=platform/components - npm run build --workspace=channels + for ws in platform/{types,client,components,shared} channels; do + npm run build --workspace="$ws" + done runHook postBuild ''; diff --git a/pkgs/by-name/ma/mattermost/tests.nix b/pkgs/by-name/ma/mattermost/tests.nix index 53ccc82ab558..4283d6971b87 100644 --- a/pkgs/by-name/ma/mattermost/tests.nix +++ b/pkgs/by-name/ma/mattermost/tests.nix @@ -4,7 +4,6 @@ gotestsum, which, postgresql, - mariadb, redis, curl, net-tools, @@ -20,7 +19,6 @@ mattermost.overrideAttrs ( nativeCheckInputs = [ which postgresql - mariadb redis curl net-tools @@ -113,11 +111,6 @@ mattermost.overrideAttrs ( fi } - # Waits for MySQL to come up or down. - wait_mysql() { - wait_cmd mysql "$1" mysqladmin ping - } - # Waits for Postgres to come up or down. wait_postgres() { wait_cmd postgres "$1" pg_isready -h localhost @@ -128,33 +121,6 @@ mattermost.overrideAttrs ( wait_cmd redis "$1" redis-cli ping } - # Starts MySQL. - start_mysql() { - echo "Starting MySQL at $MYSQL_HOME" >&2 - mysqld & - mysql_pid=$! - echo "... PID $mysql_pid" >&2 - wait_mysql up - } - - # Stops MySQL. - stop_mysql() { - if [ "$mysql_pid" -gt 0 ]; then - echo "Terminating MySQL at $MYSQL_HOME (PID $mysql_pid)" >&2 - mysqladmin --host=127.0.0.1 --user=root --password=mostest --wait-for-all-slaves --shutdown-timeout=30 shutdown - wait_mysql down - wait_cmd 'mysql pid' down kill -0 "$mysql_pid" - - # Make sure the worker PID went down too (but it may be already gone). - local worker_pid="$(<"$MYSQL_HOME"/mysqld.pid || echo 0)" - if [ -n "$worker_pid" ] && [ $worker_pid -gt 0 ]; then - wait_cmd 'mysql workers' down kill -0 "$worker_pid" - fi - - mysql_pid=0 - fi - } - # Starts Postgres. start_postgres() { echo "Starting Postgres at $PGDATA" >&2 @@ -186,52 +152,6 @@ mattermost.overrideAttrs ( redis_pid=0 } - # Configure MySQL. - export MYSQL_HOME="$NIX_BUILD_TOP/.mysql" - mkdir -p "$MYSQL_HOME" - cat <"$MYSQL_HOME/my.cnf" - [client] - port = 3306 - default-character-set = utf8mb4 - socket = $MYSQL_HOME/mysqld.sock - - [mysqld] - skip-host-cache - skip-name-resolve - basedir = ${mariadb} - datadir = $MYSQL_HOME/ - pid-file = $MYSQL_HOME/mysqld.pid - socket = $MYSQL_HOME/mysqld.sock - port = 3306 - explicit_defaults_for_timestamp - collation-server = utf8mb4_general_ci - init-connect = 'SET NAMES utf8mb4' - character-set-server = utf8mb4 - EOF - - # Start MySQL. - mysql_install_db --skip-name-resolve --auth-root-authentication-method=normal - start_mysql - - # Init MySQL. - cat < Date: Sun, 26 Apr 2026 03:39:57 -0700 Subject: [PATCH 14/42] nixos/mattermost: drop MySQL support It's unsupported in the package since v11, so should be unsupported in the module. --- .../modules/services/web-apps/mattermost.nix | 174 +++++------------- 1 file changed, 43 insertions(+), 131 deletions(-) diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix index cbec4ca230bf..26b6ebc171a9 100644 --- a/nixos/modules/services/web-apps/mattermost.nix +++ b/nixos/modules/services/web-apps/mattermost.nix @@ -27,9 +27,9 @@ let inherit (lib.modules) mkRenamedOptionModule + mkRemovedOptionModule mkMerge mkIf - mkDefault ; inherit (lib.trivial) warnIf throwIf; @@ -55,10 +55,13 @@ let # Ensure that it's inside mutableDataDir since it can get rather large. tempDir = "${mutableDataDir}/tmp"; + # Database supported by Mattermost. + databaseDriverName = "postgres"; + # Creates a database URI. mkDatabaseUri = { - scheme, + scheme ? databaseDriverName, user ? null, password ? null, escapeUserAndPassword ? true, @@ -105,54 +108,24 @@ let let hostIsPath = hasInfix "/" cfg.database.host; in - if cfg.database.driver == "postgres" then - if cfg.database.peerAuth then - mkDatabaseUri { - scheme = cfg.database.driver; - inherit (cfg.database) user; - path = escapeURL cfg.database.name; - query = { - host = cfg.database.socketPath; - } - // cfg.database.extraConnectionOptions; - } - else - mkDatabaseUri { - scheme = cfg.database.driver; - inherit (cfg.database) user password; - host = if hostIsPath then null else cfg.database.host; - port = if hostIsPath then null else cfg.database.port; - path = escapeURL cfg.database.name; - query = - optionalAttrs hostIsPath { host = cfg.database.host; } // cfg.database.extraConnectionOptions; - } - else if cfg.database.driver == "mysql" then - if cfg.database.peerAuth then - mkDatabaseUri { - scheme = null; - inherit (cfg.database) user; - escapeUserAndPassword = false; - host = "unix(${cfg.database.socketPath})"; - escapeHost = false; - path = escapeURL cfg.database.name; - query = cfg.database.extraConnectionOptions; - } - else - mkDatabaseUri { - scheme = null; - inherit (cfg.database) user password; - escapeUserAndPassword = false; - host = - if hostIsPath then - "unix(${cfg.database.host})" - else - "tcp(${cfg.database.host}:${toString cfg.database.port})"; - escapeHost = false; - path = escapeURL cfg.database.name; - query = cfg.database.extraConnectionOptions; + if cfg.database.peerAuth then + mkDatabaseUri { + inherit (cfg.database) user; + path = escapeURL cfg.database.name; + query = { + host = cfg.database.socketPath; } + // cfg.database.extraConnectionOptions; + } else - throw "Invalid database driver: ${cfg.database.driver}"; + mkDatabaseUri { + inherit (cfg.database) user password; + host = if hostIsPath then null else cfg.database.host; + port = if hostIsPath then null else cfg.database.port; + path = escapeURL cfg.database.name; + query = + optionalAttrs hostIsPath { host = cfg.database.host; } // cfg.database.extraConnectionOptions; + }; mattermostPluginDerivations = map ( plugin: @@ -213,7 +186,7 @@ let EnableSecurityFixAlert = cfg.telemetry.enableSecurityAlerts; }; TeamSettings.SiteName = cfg.siteName; - SqlSettings.DriverName = cfg.database.driver; + SqlSettings.DriverName = databaseDriverName; SqlSettings.DataSource = if cfg.database.fromEnvironment then null @@ -358,6 +331,11 @@ in "dataDir" ] ) + (mkRemovedOptionModule [ "services" "mattermost" "database" "driver" ] '' + services.mattermost.database.driver has been removed, as the only option is '${databaseDriverName}' in v11+. + If you were using MySQL, please migrate to Postgres: + https://docs.mattermost.com/deployment-guide/manual-postgres-migration.html + '') ]; options = { @@ -558,22 +536,11 @@ in }; database = { - driver = mkOption { - type = types.enum [ - "postgres" - "mysql" - ]; - default = "postgres"; - description = '' - The database driver to use (Postgres or MySQL). - ''; - }; - create = mkOption { type = types.bool; default = true; description = '' - Create a local PostgreSQL or MySQL database for Mattermost automatically. + Create a local PostgreSQL database for Mattermost automatically. ''; }; @@ -591,13 +558,9 @@ in socketPath = mkOption { type = types.path; - default = - if cfg.database.driver == "postgres" then "/run/postgresql" else "/run/mysqld/mysqld.sock"; - defaultText = '' - if config.services.mattermost.database.driver == "postgres" then "/run/postgresql" else "/run/mysqld/mysqld.sock"; - ''; + default = "/run/postgresql"; description = '' - The database (Postgres or MySQL) socket path. + The database socket path. ''; }; @@ -630,11 +593,8 @@ in port = mkOption { type = types.port; - default = if cfg.database.driver == "postgres" then 5432 else 3306; - defaultText = '' - if config.services.mattermost.database.type == "postgres" then 5432 else 3306 - ''; - example = 3306; + default = 5432; + example = 1234; description = '' Port to use for the database. ''; @@ -660,34 +620,15 @@ in extraConnectionOptions = mkOption { type = with types; attrsOf (either int str); - default = - if cfg.database.driver == "postgres" then - { - sslmode = "disable"; - connect_timeout = 60; - } - else if cfg.database.driver == "mysql" then - { - charset = "utf8mb4"; - writeTimeout = "60s"; - readTimeout = "60s"; - } - else - throw "Invalid database driver ${cfg.database.driver}"; + default = { + sslmode = "disable"; + connect_timeout = 60; + }; defaultText = '' - if config.mattermost.database.driver == "postgres" then - { - sslmode = "disable"; - connect_timeout = 60; - } - else if config.mattermost.database.driver == "mysql" then - { - charset = "utf8mb4"; - writeTimeout = "60s"; - readTimeout = "60s"; - } - else - throw "Invalid database driver"; + { + sslmode = "disable"; + connect_timeout = 60; + } ''; description = '' Extra options that are placed in the connection URI's query parameters. @@ -756,7 +697,7 @@ in }; }; - services.postgresql = mkIf (cfg.database.driver == "postgres" && cfg.database.create) { + services.postgresql = mkIf cfg.database.create { enable = true; ensureDatabases = singleton cfg.database.name; ensureUsers = singleton { @@ -772,26 +713,6 @@ in }; }; - services.mysql = mkIf (cfg.database.driver == "mysql" && cfg.database.create) { - enable = true; - package = mkDefault pkgs.mariadb; - ensureDatabases = singleton cfg.database.name; - ensureUsers = singleton { - name = cfg.database.user; - ensurePermissions = { - "${cfg.database.name}.*" = "ALL PRIVILEGES"; - }; - }; - settings = rec { - mysqld = { - collation-server = mkDefault "utf8mb4_general_ci"; - init-connect = mkDefault "SET NAMES utf8mb4"; - character-set-server = mkDefault "utf8mb4"; - }; - mysqld_safe = mysqld; - }; - }; - environment = { variables = mkIf cfg.socket.export { MMCTL_LOCAL = "true"; @@ -840,8 +761,7 @@ in wantedBy = [ "multi-user.target" ]; after = mkMerge [ [ "network.target" ] - (mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.target" ]) - (mkIf (cfg.database.driver == "mysql" && cfg.database.create) [ "mysql.service" ]) + (mkIf cfg.database.create [ "postgresql.target" ]) ]; requires = after; @@ -945,8 +865,7 @@ in ]; unitConfig.JoinsNamespaceOf = mkMerge [ - (mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.target" ]) - (mkIf (cfg.database.driver == "mysql" && cfg.database.create) [ "mysql.service" ]) + (mkIf cfg.database.create [ "postgresql.target" ]) ]; }; @@ -966,13 +885,6 @@ in or hostname, and services.mattermost.port to specify the port separately. ''; } - { - # Can't use MySQL on version 11. - assertion = versionAtLeast cfg.package.version "11" -> cfg.database.driver == "postgres"; - message = '' - Only Postgres is supported as the database driver in Mattermost 11 and later. - ''; - } ]; }) (mkIf cfg.matterircd.enable { From bbf6d7a7fe9d28e060992304379e035fa31fd269 Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Sun, 26 Apr 2026 03:40:33 -0700 Subject: [PATCH 15/42] nixos/mattermost: mention v11 change as breaking --- nixos/doc/manual/release-notes/rl-2605.section.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index b57dd6e1fa70..256014b06170 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -182,6 +182,9 @@ - `services.uptime` has been removed because the package it relies on does not exist anymore in nixpkgs. +- `services.mattermost` now defaults to version 11, which has dropped support for MySQL in favor of Postgres. As a result, all support for MySQL has been removed from the module. + See the [migration steps](https://docs.mattermost.com/deployment-guide/manual-postgres-migration.html) if you were not running Postgres. + - `post-resume.target` has been removed. See {manpage}`systemd.special(7)` about `sleep.target` for instructions on ordering a process after resume with `ExecStop=`. - `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a From 019e2017e2c70eeb24bc10c3096f07762f6c41da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?= =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?= =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= Date: Sun, 26 Apr 2026 12:18:54 -0400 Subject: [PATCH 16/42] vega-cli: patched to use direct jq --- pkgs/by-name/ve/vega-cli/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ve/vega-cli/package.nix b/pkgs/by-name/ve/vega-cli/package.nix index d16fb6c64a87..8e639378bdf5 100644 --- a/pkgs/by-name/ve/vega-cli/package.nix +++ b/pkgs/by-name/ve/vega-cli/package.nix @@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: { # Patch lerna.json to not use nx mv lerna.json lerna.old.json - jq '. + {useNx: false}' < lerna.old.json > lerna.json + ${jq}/bin/jq '. + {useNx: false}' < lerna.old.json > lerna.json ''; npmDepsHash = "sha256-mBe1fHnhor7ZR8CuRNs1zD7JzaZXZI5VM7mdAieVKqE="; From 095b50d045130be4231bef34431e7f1ffb820783 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?= =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?= =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= Date: Sun, 26 Apr 2026 12:19:12 -0400 Subject: [PATCH 17/42] vega-cli: simplifed the redirection --- pkgs/by-name/ve/vega-cli/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ve/vega-cli/package.nix b/pkgs/by-name/ve/vega-cli/package.nix index 8e639378bdf5..bb0bae1f8da9 100644 --- a/pkgs/by-name/ve/vega-cli/package.nix +++ b/pkgs/by-name/ve/vega-cli/package.nix @@ -27,8 +27,8 @@ buildNpmPackage (finalAttrs: { --replace-fail "npm run data" "true" # Patch lerna.json to not use nx - mv lerna.json lerna.old.json - ${jq}/bin/jq '. + {useNx: false}' < lerna.old.json > lerna.json + ${jq}/bin/jq '. + {useNx: false}' lerna.json > lerna.json.tmp + mv lerna.json.tmp lerna.json ''; npmDepsHash = "sha256-mBe1fHnhor7ZR8CuRNs1zD7JzaZXZI5VM7mdAieVKqE="; From db4da3263f79445e6413d14fddd65583521a6964 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?= =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?= =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= Date: Sun, 26 Apr 2026 12:19:27 -0400 Subject: [PATCH 18/42] vega-cli: added maintainer --- pkgs/by-name/ve/vega-cli/package.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ve/vega-cli/package.nix b/pkgs/by-name/ve/vega-cli/package.nix index bb0bae1f8da9..d52344184a8e 100644 --- a/pkgs/by-name/ve/vega-cli/package.nix +++ b/pkgs/by-name/ve/vega-cli/package.nix @@ -72,6 +72,9 @@ buildNpmPackage (finalAttrs: { description = "Command line tools for the Vega visualization grammar"; homepage = "https://vega.github.io/vega/"; license = lib.licenses.bsd3; - maintainers = with lib.maintainers; [ pyrox0 ]; + maintainers = with lib.maintainers; [ + pyrox0 + philocalyst + ]; }; }) From 0ed8424ca33155a261aa2f462e82dd2a21aa49af Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 26 Apr 2026 19:15:38 +0100 Subject: [PATCH 19/42] lightway: 0-unstable-2026-04-10 -> 0-unstable-2026-04-24 Bumps the vendored wolfSSL to 5.9.1, thus fixing a bunch of CVEs. Diff: https://github.com/expressvpn/lightway/compare/72a924935df9db641e7f4fe28cbeafaead59014f...8e0940f047ee72db5daa1fb7c3bb82bc89e0f1d9 --- pkgs/by-name/li/lightway/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/li/lightway/package.nix b/pkgs/by-name/li/lightway/package.nix index 26d0ba9082dd..bd48ef60bcff 100644 --- a/pkgs/by-name/li/lightway/package.nix +++ b/pkgs/by-name/li/lightway/package.nix @@ -10,16 +10,16 @@ rustPlatform.buildRustPackage { pname = "lightway"; - version = "0-unstable-2026-04-10"; + version = "0-unstable-2026-04-24"; src = fetchFromGitHub { owner = "expressvpn"; repo = "lightway"; - rev = "72a924935df9db641e7f4fe28cbeafaead59014f"; - hash = "sha256-tygK2CQmbbynJiwGkMvYzt2dHoE17DCJeqD+jlai/m8="; + rev = "8e0940f047ee72db5daa1fb7c3bb82bc89e0f1d9"; + hash = "sha256-OFMAEw613aIGG7N5LBAGbVrpkqMUBi7lUy7jm5tZowc="; }; - cargoHash = "sha256-NdVOphyBW5sflv5jZPV/ShfAJXb3ZOyDRctmn/2JY38="; + cargoHash = "sha256-gY8KokOtdBT7Vq+lGn2sk4/o3A0TypEqv09TVJqaZjc="; cargoBuildFlags = lib.cli.toCommandLineGNU { } { package = [ From 255f7cd2d48d31b04df32494c4b27138be885595 Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 19:14:12 +0000 Subject: [PATCH 20/42] uhttpd: use the default version of `libubox` --- pkgs/by-name/uh/uhttpd/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/uh/uhttpd/package.nix b/pkgs/by-name/uh/uhttpd/package.nix index c5293b422df7..3c02e8ec259a 100644 --- a/pkgs/by-name/uh/uhttpd/package.nix +++ b/pkgs/by-name/uh/uhttpd/package.nix @@ -6,7 +6,7 @@ pkg-config, lua5_1, json_c, - libubox-wolfssl, + libubox, ubus, libxcrypt, unstableGitUpdater, @@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ lua5_1 json_c - libubox-wolfssl + libubox ubus libxcrypt ]; From 7c4031f35c9350468fddc6718f015de414752f01 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 26 Apr 2026 18:53:20 +0100 Subject: [PATCH 21/42] rpcs3: 0.0.39-unstable-2026-02-20 -> 0.0.40-unstable-2026-04-25 --- pkgs/by-name/rp/rpcs3/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix index 567ceffe0f1e..9d1d49ffa158 100644 --- a/pkgs/by-name/rp/rpcs3/package.nix +++ b/pkgs/by-name/rp/rpcs3/package.nix @@ -50,19 +50,19 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "rpcs3"; - version = "0.0.39-unstable-2026-02-20"; + version = "0.0.40-unstable-2026-04-25"; src = fetchFromGitHub { owner = "RPCS3"; repo = "rpcs3"; - rev = "6bfb33279f6989f3ff9ea2dc40ef45d6aeb57ef8"; + rev = "96f73f4497fd6fdafd40dc50f24c95c90cd4acc9"; postCheckout = '' cd $out/3rdparty git submodule update --init \ fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \ feralinteractive/feralinteractive ''; - hash = "sha256-Cu4Zaze0FZ00sRvPtUzUkOiX5ZAHWTtmWa536gNOTNY="; + hash = "sha256-IKRGKUN0SZIxZToP9kimIc+5wn9GS86tM+/oSv76d74="; }; passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; }; From 2581c1fcbe7353d59254f46850a592d0db309b77 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 26 Apr 2026 18:55:52 +0000 Subject: [PATCH 22/42] tree-sitter-grammars.tree-sitter-rescript: 5.0.0-unstable-2025-03-03 -> 6.0.0-unstable-2026-04-26 --- .../tools/parsing/tree-sitter/grammars/grammar-sources.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix index 1a9eeb4a3a40..814c7cf79b50 100644 --- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix +++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix @@ -2246,10 +2246,10 @@ }; rescript = { - version = "5.0.0-unstable-2025-03-03"; + version = "6.0.0-unstable-2026-04-26"; url = "github:rescript-lang/tree-sitter-rescript"; - rev = "d2df8a285fff95de56a91d2f8152aeceb66f40ef"; - hash = "sha256-yNZrihl4BNvLu0Zqr4lSqvdZCeXU3KnCY7ZYC1U42R0="; + rev = "5b90cd4e4138b1231a67977303bda47eb608480a"; + hash = "sha256-f5/z566/Ez8+jzQSXoWkEK3LJGYjWupQw+BFPDyOxsE="; meta = { license = lib.licenses.mit; maintainers = with lib.maintainers; [ From ebb013106f3ce766e83bbdb925e5fb42c579d047 Mon Sep 17 00:00:00 2001 From: Emily Date: Sat, 28 Mar 2026 19:20:14 +0000 Subject: [PATCH 23/42] rpcs3: use vendored wolfSSL and update `meta.license` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Insofar as this works as an exception tightly scoped to RPCS3, the safest way to take advantage of it is to use the copy of wolfSSL directly included as part of RPCS3 and avoid dynamic linking. Insofar as it doesn’t work, `lib.licenses.unfree` keeps it away from the cache. Thankfully, they seem pretty good at keeping their vendored version up to date. --- pkgs/by-name/rp/rpcs3/package.nix | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix index 9d1d49ffa158..b5d5c085f865 100644 --- a/pkgs/by-name/rp/rpcs3/package.nix +++ b/pkgs/by-name/rp/rpcs3/package.nix @@ -18,7 +18,6 @@ libusb1, zlib, curl, - wolfssl, python3, pugixml, protobuf_33, @@ -60,9 +59,9 @@ stdenv.mkDerivation (finalAttrs: { cd $out/3rdparty git submodule update --init \ fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \ - feralinteractive/feralinteractive + feralinteractive/feralinteractive wolfssl/wolfssl ''; - hash = "sha256-IKRGKUN0SZIxZToP9kimIc+5wn9GS86tM+/oSv76d74="; + hash = "sha256-KTF2Oj1p+EplRgWQ/We8mqu60h161/1gniKWjVAvAso="; }; passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; }; @@ -82,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: { (lib.cmakeBool "USE_SYSTEM_LIBPNG" true) (lib.cmakeBool "USE_SYSTEM_FFMPEG" true) (lib.cmakeBool "USE_SYSTEM_CURL" true) - (lib.cmakeBool "USE_SYSTEM_WOLFSSL" true) (lib.cmakeBool "USE_SYSTEM_FAUDIO" true) (lib.cmakeBool "USE_SYSTEM_OPENAL" true) (lib.cmakeBool "USE_SYSTEM_PUGIXML" true) @@ -127,7 +125,6 @@ stdenv.mkDerivation (finalAttrs: { zlib libusb1 curl - wolfssl python3 pugixml sdl3 @@ -168,7 +165,25 @@ stdenv.mkDerivation (finalAttrs: { maintainers = with lib.maintainers; [ ilian ]; - license = lib.licenses.gpl2Only; + license = [ + lib.licenses.gpl2Only + # Vendors wolfSSL, which changed its licence from + # `GPL-2.0-or-later` to `GPL-3.0-or-later`, which is incompatible + # with RPCS3’s `GPL-2.0-only`. They have a “GPLv2 exception list” + # (), + # but this is dubious; either the exception likely negates the + # licence change by letting you take wolfSSL out of a + # `GPL-2.0-only` combination and redistribute it under those + # terms, negating the licence change entirely, or else it doesn’t + # allow distribution of the combination under the `GPL-2.0-only` + # at all and therefore would still constitute a licence + # violation to redistribute. + # + # We use `lib.licenses.unfree` to represent this awkward + # situation and keep Hydra from building the package. + lib.licenses.gpl3Plus + lib.licenses.unfree + ]; platforms = [ "x86_64-linux" "aarch64-linux" From ac722e11b8c5240a350ba5f85d846586d65f7910 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:23:43 +0100 Subject: [PATCH 24/42] libubox-wolfssl: drop --- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 5 ----- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 3eb7c00c46e3..c981d9735f15 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -1114,6 +1114,7 @@ mapAliases { libtorrent = throw "'libtorrent' has been renamed to 'libtorrent-rakshasa' for clearer distinction from 'libtorrent-rasterbar'"; # Added 2025-09-10 libtransmission = throw "libtransmission_3 has been removed in favour of libtransmission_4. Note that upgrade caused data loss for some users so backup is recommended (see NixOS 24.11 release notes for details)"; # Converted to throw 2025-10-26 libtransmission_3 = throw "libtransmission_3 has been removed in favour of libtransmission_4. Note that upgrade caused data loss for some users so backup is recommended (see NixOS 24.11 release notes for details)"; # Converted to throw 2025-10-26 + libubox-wolfssl = throw "'libubox-wolfssl' has been removed, use 'libubox' or 'libubox-mbedtls'"; # Added 2026-03-29 libuinputplus = throw "'libuinputplus' has been removed, as it was unmaintained upstream since 2021, no longer builds, and is no longer used by anything"; # Added 2025-11-02 libviper = throw "'libviper' was removed as it is broken and not maintained upstream"; # Added 2025-05-17 libWindowsWM = libwindowswm; # Added 2026-01-19 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1a32a61868b8..3f6e2ca21da8 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6752,11 +6752,6 @@ with pkgs; libubox = callPackage ../development/libraries/libubox { with_ustream_ssl = true; }; - libubox-wolfssl = callPackage ../development/libraries/libubox { - with_ustream_ssl = true; - ustream-ssl = ustream-ssl-wolfssl; - }; - libubox-mbedtls = callPackage ../development/libraries/libubox { with_ustream_ssl = true; ustream-ssl = ustream-ssl-mbedtls; From f322bbe86c9f842057905460e570668e08cd42f1 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:23:43 +0100 Subject: [PATCH 25/42] ustream-ssl-wolfssl: drop --- pkgs/development/libraries/ustream-ssl/default.nix | 3 +-- pkgs/top-level/aliases.nix | 1 + pkgs/top-level/all-packages.nix | 5 ----- 3 files changed, 2 insertions(+), 7 deletions(-) diff --git a/pkgs/development/libraries/ustream-ssl/default.nix b/pkgs/development/libraries/ustream-ssl/default.nix index 3f24ddce7222..e787cdf8adc5 100644 --- a/pkgs/development/libraries/ustream-ssl/default.nix +++ b/pkgs/development/libraries/ustream-ssl/default.nix @@ -6,7 +6,6 @@ pkg-config, libubox-nossl, ssl_implementation, - additional_buildInputs ? [ ], }: stdenv.mkDerivation { @@ -35,7 +34,7 @@ stdenv.mkDerivation { cmake pkg-config ]; - buildInputs = [ ssl_implementation ] ++ additional_buildInputs; + buildInputs = [ ssl_implementation ]; passthru = { inherit ssl_implementation; diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index c981d9735f15..421eee1720dc 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -2051,6 +2051,7 @@ mapAliases { unixODBCDrivers = warnAlias "'unixODBCDrivers' has been renamed to 'unixodbcDrivers'" unixodbcDrivers; # Added 2026-02-12 unrar_6 = throw "'unrar_6' has been renamed to/replaced by 'unrar'"; # Added 2026-03-11 unzoo = throw "'unzoo' has been removed since it is unmaintained upstream and doesn't compile with newer versions of GCC anymore"; # Removed 2025-05-24 + ustream-ssl-wolfssl = throw "'ustream-ssl-wolfssl' has been removed, use 'ustream-ssl' or 'ustream-ssl-mbedtls'"; # Added 2026-03-29 usync = throw "'usync' has been removed as it is unused and unmaintained upstream"; # Added 2025-12-18 util-linuxCurses = throw "'util-linuxCurses' has been renamed to/replaced by 'util-linux'"; # Converted to throw 2025-10-27 utillinux = warnAlias "'utillinux' has been renamed to/replaced by 'util-linux'" util-linux; # Converted to warning 2025-10-28 diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 3f6e2ca21da8..90a2e1f5500d 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -6134,11 +6134,6 @@ with pkgs; ustream-ssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = openssl; }; - ustream-ssl-wolfssl = callPackage ../development/libraries/ustream-ssl { - ssl_implementation = wolfssl; - additional_buildInputs = [ openssl ]; - }; - ustream-ssl-mbedtls = callPackage ../development/libraries/ustream-ssl { ssl_implementation = mbedtls_2; }; From 89d326f7a52be496953980a2a45d032605f4a8f2 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:25:51 +0100 Subject: [PATCH 26/42] riemann_c_client: drop wolfSSL support --- pkgs/by-name/ri/riemann_c_client/package.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/pkgs/by-name/ri/riemann_c_client/package.nix b/pkgs/by-name/ri/riemann_c_client/package.nix index ec82a124948f..abc0b7308119 100644 --- a/pkgs/by-name/ri/riemann_c_client/package.nix +++ b/pkgs/by-name/ri/riemann_c_client/package.nix @@ -7,8 +7,6 @@ pkg-config, file, protobufc, - withWolfSSL ? false, - wolfssl, withGnuTLS ? false, gnutls, withJSON ? true, @@ -45,12 +43,10 @@ stdenv.mkDerivation (finalAttrs: { file protobufc ] - ++ lib.optional withWolfSSL wolfssl ++ lib.optional withGnuTLS gnutls ++ lib.optional withJSON json_c; - configureFlags = - [ ] ++ lib.optional withWolfSSL "--with-tls=wolfssl" ++ lib.optional withGnuTLS "--with-tls=gnutls"; + configureFlags = [ ] ++ lib.optional withGnuTLS "--with-tls=gnutls"; doCheck = true; enableParallelBuilding = true; From e337b3ae4f603cf82aa4ab16eeaa3692f5cfcec1 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:26:23 +0100 Subject: [PATCH 27/42] curl: drop wolfSSL support --- pkgs/by-name/cu/curlMinimal/package.nix | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix index 1d1c9c0fe0c2..b3bd7cd1d94f 100644 --- a/pkgs/by-name/cu/curlMinimal/package.nix +++ b/pkgs/by-name/cu/curlMinimal/package.nix @@ -48,8 +48,6 @@ rtmpdump, scpSupport ? zlibSupport && !stdenv.hostPlatform.isSunOS && !stdenv.hostPlatform.isCygwin, libssh2, - wolfsslSupport ? false, - wolfssl, rustlsSupport ? false, rustls-ffi, zlibSupport ? true, @@ -80,7 +78,6 @@ assert (lib.count (x: x) [ gnutlsSupport opensslSupport - wolfsslSupport rustlsSupport ]) > 1 ); @@ -160,7 +157,6 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optional pslSupport libpsl ++ lib.optional rtmpSupport rtmpdump ++ lib.optional scpSupport libssh2 - ++ lib.optional wolfsslSupport wolfssl ++ lib.optional rustlsSupport rustls-ffi ++ lib.optional zlibSupport zlib ++ lib.optional zstdSupport zstd; @@ -192,7 +188,8 @@ stdenv.mkDerivation (finalAttrs: { (lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2)) (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl)) (lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2)) - (lib.withFeatureAs wolfsslSupport "wolfssl" (lib.getDev wolfssl)) + # TODO: Clean up on `staging`. + "--without-wolfssl" ] ++ lib.optional gssSupport "--with-gssapi=${lib.getDev libkrb5}" # For the 'urandom', maybe it should be a cross-system option @@ -203,7 +200,7 @@ stdenv.mkDerivation (finalAttrs: { "--without-ca-bundle" "--without-ca-path" ] - ++ lib.optionals (!gnutlsSupport && !opensslSupport && !wolfsslSupport && !rustlsSupport) [ + ++ lib.optionals (!gnutlsSupport && !opensslSupport && !rustlsSupport) [ "--without-ssl" ] ++ lib.optionals (rustlsSupport && !stdenv.hostPlatform.isDarwin) [ From dadb9d4ebc8304ce511b22f2aa8fe33a39e2b3e7 Mon Sep 17 00:00:00 2001 From: Emily Date: Sun, 29 Mar 2026 23:27:00 +0100 Subject: [PATCH 28/42] haproxy: drop wolfSSL support --- pkgs/by-name/ha/haproxy/package.nix | 9 --------- 1 file changed, 9 deletions(-) diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix index 806d008ac75b..cd0f97ea0835 100644 --- a/pkgs/by-name/ha/haproxy/package.nix +++ b/pkgs/by-name/ha/haproxy/package.nix @@ -12,7 +12,6 @@ aws-lc, libressl, openssl, - wolfssl, lua5_4, pcre2, }: @@ -21,7 +20,6 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [ "aws-lc" "libressl" "openssl" - "wolfssl" ]; let sslPkgs = { @@ -30,10 +28,6 @@ let libressl openssl ; - wolfssl = wolfssl.override { - variant = "haproxy"; - extraConfigureFlags = [ "--enable-quic" ]; - }; }; sslPkg = sslPkgs.${sslLibrary}; in @@ -85,9 +79,6 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optionals (sslLibrary == "openssl" && lib.versionOlder openssl.version "3.5.2") [ "USE_QUIC_OPENSSL_COMPAT=yes" ] - ++ lib.optionals (sslLibrary == "wolfssl") [ - "USE_OPENSSL_WOLFSSL=yes" - ] ++ lib.optionals usePcre [ "USE_PCRE2=yes" "USE_PCRE2_JIT=yes" From 82b9c8879be6a7c77cd51b23160e066c40d0b62f Mon Sep 17 00:00:00 2001 From: Emily Date: Fri, 3 Apr 2026 19:46:26 +0100 Subject: [PATCH 29/42] art-standalone: patch out wolfSSL dependency MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The upstream Android runtime doesn’t use wolfSSL but instead Conscrypt, based on BoringSSL. This fork patches out Conscrypt in favour of using wolfSSL for a subset of the functionality. It seems like every demo app using TLS crashes under `android-translation-layer` already, so it’s hard to say if patching it out has a meaningful impact. It should presumably be possible to get another JSSE provider working, but given the lack of ability to meaningfully test it I decided not to sink too much time into it. The most compatible option would of course be to just get Conscrypt + BoringSSL working. --- pkgs/by-name/ar/art-standalone/package.nix | 3 +- .../ar/art-standalone/remove-wolfssljni.patch | 96 +++++++++++++++++++ 2 files changed, 97 insertions(+), 2 deletions(-) create mode 100644 pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch diff --git a/pkgs/by-name/ar/art-standalone/package.nix b/pkgs/by-name/ar/art-standalone/package.nix index 6f0a62d6b9eb..cb7c5904a462 100644 --- a/pkgs/by-name/ar/art-standalone/package.nix +++ b/pkgs/by-name/ar/art-standalone/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchFromGitLab, - wolfssl, bionic-translation, python3, which, @@ -35,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: { patches = [ # Do not hardocde addr2line binary path ./no-hardcode-path-addr2line.patch + ./remove-wolfssljni.patch ]; postPatch = '' @@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: { libpng lz4 openssl - (wolfssl.override { enableJni = true; }) xz zlib ]; diff --git a/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch b/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch new file mode 100644 index 000000000000..f3aac163d0a7 --- /dev/null +++ b/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch @@ -0,0 +1,96 @@ +diff --git a/Makefile b/Makefile +index 3383a64b36..b658f49c23 100644 +--- a/Makefile ++++ b/Makefile +@@ -53,7 +53,7 @@ + + default: ____art_all + +-____art_all: dalvikvm art dex2oat libjavacore libcore libopenjdk libopenjdkjvm core-libart-hostdex core-oj-hostdex apachehttp-hostdex apache-xml-hostdex hamcrest-hostdex core-junit-hostdex junit-runner-hostdex bouncycastle-hostdex wolfssljni-hostdex okhttp-hostdex libandroidfw art-standalone.pc ++____art_all: dalvikvm art dex2oat libjavacore libcore libopenjdk libopenjdkjvm core-libart-hostdex core-oj-hostdex apachehttp-hostdex apache-xml-hostdex hamcrest-hostdex core-junit-hostdex junit-runner-hostdex bouncycastle-hostdex okhttp-hostdex libandroidfw art-standalone.pc + + art-standalone.pc: art-standalone.pc.in + sed -e 's|@prefix@|$(____PREFIX)|g' \ +@@ -68,8 +68,7 @@ + install -Dt $(____INSTALL_LIBDIR)/java/dex/art/natives/ $(____TOPDIR)/out/host/linux-x86/lib64/libjavacore.so \ + $(____TOPDIR)/out/host/linux-x86/lib64/libnativehelper.so \ + $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdk.so \ +- $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdkjvm.so \ +- $(____TOPDIR)/out/host/linux-x86/lib64/libwolfssljni.so ++ $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdkjvm.so + # + # these are mostly internal libs which there's no point in versioning because they don't have any kind of stable ABI - so we just shove them in art/ namespace + # even the libunwind is actually a fork of libunwind 1.1 with added stuff that will likely never be upstreamed, especially since google stopped using libunwind +@@ -108,8 +107,7 @@ + $(____TOPDIR)/out/host/linux-x86/framework/core-oj-hostdex.jar \ + $(____TOPDIR)/out/host/linux-x86/framework/hamcrest-hostdex.jar \ + $(____TOPDIR)/out/host/linux-x86/framework/junit-runner-hostdex.jar \ +- $(____TOPDIR)/out/host/linux-x86/framework/okhttp-hostdex.jar \ +- $(____TOPDIR)/out/host/linux-x86/framework/wolfssljni-hostdex.jar ++ $(____TOPDIR)/out/host/linux-x86/framework/okhttp-hostdex.jar + # + # packaging note: this is needed as bootclasspath when compiling android_translation_layer. Can be in -dev package. + install -D $(____TOPDIR)/out/host/common/obj/JAVA_LIBRARIES/core-all-hostdex_intermediates/classes.jar $(____INSTALL_LIBDIR)/java/core-all_classes.jar +diff --git a/art/runtime/parsed_options.cc b/art/runtime/parsed_options.cc +index 1f8936114a..b8f7566401 100644 +--- a/art/runtime/parsed_options.cc ++++ b/art/runtime/parsed_options.cc +@@ -597,8 +597,7 @@ + bootclasspath_prefix + "/core-libart-hostdex.jar" + ':' + + bootclasspath_prefix + "/hamcrest-hostdex.jar" + ':' + + bootclasspath_prefix + "/junit-runner-hostdex.jar" + ':' + +- bootclasspath_prefix + "/okhttp-hostdex.jar" + ':' + +- bootclasspath_prefix + "/wolfssljni-hostdex.jar"; ++ bootclasspath_prefix + "/okhttp-hostdex.jar"; + free(bootclasspath_prefix); + + if(args.Exists(M::BootClassPath_a)) +diff --git a/libcore/luni/src/main/java/java/security/security.properties b/libcore/luni/src/main/java/java/security/security.properties +index ca55328279..b17437f81e 100644 +--- a/libcore/luni/src/main/java/java/security/security.properties ++++ b/libcore/luni/src/main/java/java/security/security.properties +@@ -18,15 +18,13 @@ + # Providers + # See also: J2SE doc. "How to Implement a Provider for the JavaTM Cryptography Architecture" + # +-# Android's provider of OpenSSL backed implementations +-security.provider.1=com.wolfssl.provider.jsse.WolfSSLProvider + # Android's stripped down BouncyCastle provider +-security.provider.2=com.android.org.bouncycastle.jce.provider.BouncyCastleProvider ++security.provider.1=com.android.org.bouncycastle.jce.provider.BouncyCastleProvider + # provides implementations that would normally be provided by sun.security.provider.Sun + # (CertPathValidator, CertPathBuilder and (ATL added) JKS) +-security.provider.3=sun.security.provider.CertPathProvider ++security.provider.2=sun.security.provider.CertPathProvider + # Remaining Harmony providers +-security.provider.4=org.apache.harmony.security.provider.crypto.CryptoProvider ++security.provider.3=org.apache.harmony.security.provider.crypto.CryptoProvider + + + +@@ -39,13 +37,6 @@ + # javax/net/ssl/SSLSocketFactory.html#getDefault() + # javax/net/ssl/SSLServerSocketFactory.html#getDefault() + +-# For regular SSLSockets, we have two implementations: +-ssl.SocketFactory.provider=com.wolfssl.provider.jsse.WolfSSLSocketFactory +-#ssl.SocketFactory.provider=com.android.org.conscrypt.SSLSocketFactoryImpl +- +-# For SSLServerSockets, there's only the new, OpenSSL-based implementation: +-ssl.ServerSocketFactory.provider=com.wolfssl.provider.jsse.WolfSSLServerSocketFactory +- + # Default KeyStore type. + # See specification for java/security/KeyStore.html#getDefaultType() + keystore.type=BKS +diff --git a/libcore/ojluni/src/main/java/sun/security/jca/Providers.java b/libcore/ojluni/src/main/java/sun/security/jca/Providers.java +index e60c3e3ba8..ec66dcb8f0 100644 +--- a/libcore/ojluni/src/main/java/sun/security/jca/Providers.java ++++ b/libcore/ojluni/src/main/java/sun/security/jca/Providers.java +@@ -103,7 +103,6 @@ + */ + "com.android.org.bouncycastle.jce.provider.BouncyCastleProvider", + "org.apache.harmony.security.provider.crypto.CryptoProvider", // we need SecureRandom +- "com.wolfssl.provider.jsse.WolfSSLProvider", + // END Android-changed: Use Conscrypt and BC, not the sun.security providers. + BACKUP_PROVIDER_CLASSNAME, + }; From 6fd28ab3b0ede0c39ee6b5592163662266128d30 Mon Sep 17 00:00:00 2001 From: Emily Date: Fri, 3 Apr 2026 19:54:31 +0100 Subject: [PATCH 30/42] wolfssl: drop --- pkgs/by-name/wo/wolfssl/package.nix | 135 ---------------------------- pkgs/top-level/aliases.nix | 1 + 2 files changed, 1 insertion(+), 135 deletions(-) delete mode 100644 pkgs/by-name/wo/wolfssl/package.nix diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix deleted file mode 100644 index 6cde924b81f7..000000000000 --- a/pkgs/by-name/wo/wolfssl/package.nix +++ /dev/null @@ -1,135 +0,0 @@ -{ - lib, - stdenv, - fetchFromGitHub, - autoreconfHook, - util-linux, - openssl, - cacert, - # The primary --enable-XXX variant. 'all' enables most features, but causes build-errors for some software, - # requiring to build a special variant for that software. Example: 'haproxy' - variant ? "all", - extraConfigureFlags ? [ ], - enableJni ? false, - enableARMCryptoExtensions ? - stdenv.hostPlatform.isAarch64 - && ((builtins.match "^.*\\+crypto.*$" stdenv.hostPlatform.gcc.arch) != null), - enableLto ? !(stdenv.hostPlatform.isStatic || stdenv.cc.isClang), -}: -stdenv.mkDerivation (finalAttrs: { - pname = "wolfssl-${variant}"; - version = "5.9.1"; - - src = fetchFromGitHub { - owner = "wolfSSL"; - repo = "wolfssl"; - tag = "v${finalAttrs.version}-stable"; - hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE="; - }; - - postPatch = '' - patchShebangs ./scripts - # ensure test detects musl-based systems too - substituteInPlace scripts/ocsp-stapling2.test \ - --replace '"linux-gnu"' '"linux-"' - '' - + lib.optionalString enableJni '' - # Some tests fail when JNI is enabled - sed -i '/TEST_DECL(test_wolfSSL_Tls13_ECH)/d; - /TEST_DECL(test_wolfSSL_Tls13_ECH_HRR)/d; - /TEST_DECL(test_TLSX_CA_NAMES_bad_extension)/d' tests/api.c - sed -i '/quic/d' tests/include.am - sed -i '/WOLFSSL_QUIC/,/#endif/d' tests/unit.c - ''; - - configureFlags = [ - "--enable-${variant}" - "--enable-reproducible-build" - ] - ++ lib.optionals (variant == "all") [ - # Extra feature flags to add while building the 'all' variant. - # Since they conflict while building other variants, only specify them for this one. - "--enable-pkcs11" - "--enable-writedup" - "--enable-base64encode" - ] - ++ [ - # We're not on tiny embedded machines. - # Increase TLS session cache from 33 sessions to 20k. - "--enable-bigcache" - - # Use WolfSSL's Single Precision Math with timing-resistant cryptography. - "--enable-sp=yes${ - lib.optionalString (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isAarch) ",asm" - }" - "--enable-sp-math-all" - "--enable-harden" - ] - ++ lib.optionals (stdenv.hostPlatform.isx86_64) [ - # Enable AVX/AVX2/AES-NI instructions, gated by runtime detection via CPUID. - "--enable-intelasm" - "--enable-aesni" - ] - ++ lib.optionals (stdenv.hostPlatform.isAarch64) [ - # No runtime detection under ARM and no platform function checks like for X86. - (if enableARMCryptoExtensions then "--enable-armasm=inline" else "--disable-armasm") - ] - ++ lib.optionals enableJni [ - "--enable-jni" - ] - ++ extraConfigureFlags; - - # Breaks tls13 tests on aarch64-darwin. - hardeningDisable = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [ - "zerocallusedregs" - ]; - - # LTO should help with the C implementations. - env.NIX_CFLAGS_COMPILE = lib.optionalString enableLto "-flto"; - env.NIX_LDFLAGS_COMPILE = lib.optionalString enableLto "-flto"; - - # Don't attempt connections to external services in the test suite. - env.WOLFSSL_EXTERNAL_TEST = "0"; - - outputs = [ - "dev" - "doc" - "lib" - "out" - ]; - - nativeBuildInputs = [ - autoreconfHook - util-linux - ]; - - # FAILURES: - # 497: test_wolfSSL_EVP_PBE_scrypt - doCheck = !stdenv.hostPlatform.isLoongArch64; - - nativeCheckInputs = [ - openssl - cacert - ]; - - postInstall = '' - # fix recursive cycle: - # wolfssl-config points to dev, dev propagates bin - moveToOutput bin/wolfssl-config "$dev" - # moveToOutput also removes "$out" so recreate it - mkdir -p "$out" - ''; - - meta = { - description = "Small, fast, portable implementation of TLS/SSL for embedded devices"; - mainProgram = "wolfssl-config"; - homepage = "https://www.wolfssl.com/"; - changelog = "https://github.com/wolfSSL/wolfssl/releases/tag/v${finalAttrs.version}-stable"; - platforms = lib.platforms.all; - license = lib.licenses.gpl3Plus; - maintainers = with lib.maintainers; [ - fab - vifino - ]; - }; -}) diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix index 421eee1720dc..286b5bc3c201 100644 --- a/pkgs/top-level/aliases.nix +++ b/pkgs/top-level/aliases.nix @@ -2132,6 +2132,7 @@ mapAliases { wlroots_0_17 = throw "'wlroots_0_17' has been removed in favor of newer versions"; # Added 2026-03-07 wlx-overlay-s = throw "'wlx-overlay-s' and 'wayvr-dashboard' have been merged into a single application. Please switch to 'wayvr'"; # Added 2026-01-09 wmii_hg = throw "'wmii_hg' has been renamed to/replaced by 'wmii'"; # Converted to throw 2025-10-27 + wolfssl = throw "'wolfssl' has been removed because it has an unclear licensing situation and no remaining users in Nixpkgs"; # Added 2026-04-03 woof = throw "'woof' has been removed as it is broken and unmaintained upstream"; # Added 2025-09-04 worldengine-cli = throw "'worldengine-cli' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04 wpa_supplicant_ro_ssids = throw "'wpa_supplicant_ro_ssids' has been renamed to/replaced by 'wpa_supplicant'"; # Converted to throw 2025-10-27 From 00b1ba422859f7be7cd267aa1eb90f88f3d360de Mon Sep 17 00:00:00 2001 From: Yueh-Shun Li Date: Mon, 27 Apr 2026 02:44:48 +0800 Subject: [PATCH 31/42] python3Packages: transition from pytestFlagsArray (round 3) --- pkgs/by-name/kh/khard/package.nix | 2 +- pkgs/by-name/op/openfreebuds/package.nix | 2 +- pkgs/by-name/yb/yb/package.nix | 2 +- pkgs/development/python-modules/connect-box/default.nix | 5 ++--- pkgs/development/python-modules/country-list/default.nix | 2 +- pkgs/development/python-modules/crewai/default.nix | 2 +- pkgs/development/python-modules/django-jinja/default.nix | 2 +- pkgs/development/python-modules/scanpy/default.nix | 2 +- pkgs/development/python-modules/sklearn2pmml/default.nix | 2 +- .../python-modules/tree-sitter-language-pack/default.nix | 2 +- 10 files changed, 11 insertions(+), 12 deletions(-) diff --git a/pkgs/by-name/kh/khard/package.nix b/pkgs/by-name/kh/khard/package.nix index be52eab3c6d2..5adfdb61364e 100644 --- a/pkgs/by-name/kh/khard/package.nix +++ b/pkgs/by-name/kh/khard/package.nix @@ -60,7 +60,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: { python3.pkgs.pytestCheckHook ]; - pytestFlagsArray = [ + pytestFlags = [ # Nixpkgs' default is `--capture=fd`, and with it, 2 command mock tests # fail, see: https://github.com/lucc/khard/issues/353 "--capture=no" diff --git a/pkgs/by-name/op/openfreebuds/package.nix b/pkgs/by-name/op/openfreebuds/package.nix index b0f5c07e8b77..29fd14b2a4e0 100644 --- a/pkgs/by-name/op/openfreebuds/package.nix +++ b/pkgs/by-name/op/openfreebuds/package.nix @@ -38,7 +38,7 @@ python3Packages.buildPythonApplication (finalAttrs: { pytestCheckHook ]; - pytestFlagsArray = [ + enabledTestPaths = [ "openfreebuds/driver/huawei/test/" "openfreebuds/test/test_event_bus.py" ]; diff --git a/pkgs/by-name/yb/yb/package.nix b/pkgs/by-name/yb/yb/package.nix index ad9cbfe8cd81..b96acb2db702 100644 --- a/pkgs/by-name/yb/yb/package.nix +++ b/pkgs/by-name/yb/yb/package.nix @@ -66,7 +66,7 @@ python3Packages.buildPythonApplication (finalAttrs: { # Run subset of tests that don't require YubiKey hardware doCheck = true; - pytestFlagsArray = [ + enabledTestPaths = [ "tests" ]; diff --git a/pkgs/development/python-modules/connect-box/default.nix b/pkgs/development/python-modules/connect-box/default.nix index 3376f3ea67ed..f34d7dbc1ba4 100644 --- a/pkgs/development/python-modules/connect-box/default.nix +++ b/pkgs/development/python-modules/connect-box/default.nix @@ -41,10 +41,9 @@ buildPythonPackage rec { pythonImportsCheck = [ "connect_box" ]; - pytestFlagsArray = [ + pytestFlags = [ "--vcr-record=none" - "-W" - "ignore::DeprecationWarning" + "-Wignore::DeprecationWarning" ]; meta = { diff --git a/pkgs/development/python-modules/country-list/default.nix b/pkgs/development/python-modules/country-list/default.nix index 8e4ee9ab6d95..2a301e1f6c33 100644 --- a/pkgs/development/python-modules/country-list/default.nix +++ b/pkgs/development/python-modules/country-list/default.nix @@ -31,7 +31,7 @@ buildPythonPackage rec { pytestCheckHook ]; - pytestFlagsArray = [ + enabledTestPaths = [ "tests.py" ]; diff --git a/pkgs/development/python-modules/crewai/default.nix b/pkgs/development/python-modules/crewai/default.nix index 55cd5934cc11..307440f10bc7 100644 --- a/pkgs/development/python-modules/crewai/default.nix +++ b/pkgs/development/python-modules/crewai/default.nix @@ -552,7 +552,7 @@ buildPythonPackage (finalAttrs: { writableTmpDirAsHomeHook ]; - pytestFlagsArray = [ + pytestFlags = [ "--override-ini=addopts=" ]; diff --git a/pkgs/development/python-modules/django-jinja/default.nix b/pkgs/development/python-modules/django-jinja/default.nix index 20f88ca5ac2c..b48a32ee4ae8 100644 --- a/pkgs/development/python-modules/django-jinja/default.nix +++ b/pkgs/development/python-modules/django-jinja/default.nix @@ -44,7 +44,7 @@ buildPythonPackage rec { export DJANGO_SETTINGS_MODULE=settings ''; - pytestFlagsArray = [ + enabledTestPaths = [ "testapp/tests.py" ]; diff --git a/pkgs/development/python-modules/scanpy/default.nix b/pkgs/development/python-modules/scanpy/default.nix index 1bb17259226a..cad855c690a3 100644 --- a/pkgs/development/python-modules/scanpy/default.nix +++ b/pkgs/development/python-modules/scanpy/default.nix @@ -180,7 +180,7 @@ buildPythonPackage (finalAttrs: { export NUMBA_CACHE_DIR=$(mktemp -d); ''; - pytestFlagsArray = [ + pytestFlags = [ # UserWarning: 'where' used without 'out', expect unitialized memory in output. # If this is intentional, use out=None. "-Wignore::UserWarning" diff --git a/pkgs/development/python-modules/sklearn2pmml/default.nix b/pkgs/development/python-modules/sklearn2pmml/default.nix index 93e1e83c9485..53dea7d9bfa8 100644 --- a/pkgs/development/python-modules/sklearn2pmml/default.nix +++ b/pkgs/development/python-modules/sklearn2pmml/default.nix @@ -66,7 +66,7 @@ buildPythonPackage (finalAttrs: { statsmodels ]; - pytestFlagsArray = [ + enabledTestPaths = [ # Only run the main test suite; subpackage tests require # sklearn-pandas which is not available in nixpkgs "sklearn2pmml/tests" diff --git a/pkgs/development/python-modules/tree-sitter-language-pack/default.nix b/pkgs/development/python-modules/tree-sitter-language-pack/default.nix index 090b6215651d..20e3c8d6f426 100644 --- a/pkgs/development/python-modules/tree-sitter-language-pack/default.nix +++ b/pkgs/development/python-modules/tree-sitter-language-pack/default.nix @@ -127,7 +127,7 @@ buildPythonPackage (finalAttrs: { EOF ''; - pytestFlagsArray = [ + enabledTestPaths = [ "e2e/python/tests" "tests/test_apps/python/smoke_test.py" ]; From 82da9cf45c21f9b93b48d8ef40ff6005dfc5a53b Mon Sep 17 00:00:00 2001 From: Yueh-Shun Li Date: Mon, 27 Apr 2026 03:13:53 +0800 Subject: [PATCH 32/42] python3Packages.buildPythonPackage: ban pytestFlagsArray --- doc/release-notes/rl-2605.section.md | 4 ++++ .../interpreters/python/mk-python-derivation.nix | 16 ++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md index 40f605b2315d..cb3c0f28d474 100644 --- a/doc/release-notes/rl-2605.section.md +++ b/doc/release-notes/rl-2605.section.md @@ -168,6 +168,10 @@ - the `xorg` package set has been deprecated, packages have moved to the top level. +- `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now throw errors in the presence of `pytestFlagsArray`. + Please use [`pytestFlags` and `(enabled|disabled)(TestPaths|Tests|TestMarks)`](#using-pytestcheckhook) instead. + If modifying the Nix expression is not feasible, users can remediate the error by overriding `pytestFlagsArray` with `null` or `[ ]`. + - `python3Packages.pygame` has been been renamed to `python3Packages.pygame-original`, the attribute `python3Packages.pygame` will from python 3.14 default to the more actively maintained `python3Packages.pygame-ce` - `fastly` has been updated to major version 14. For more information, you can check the [release notes](https://github.com/fastly/cli/releases/tag/v14.0.0) diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix index 5bbde1ab2f97..5f4ac7b84645 100644 --- a/pkgs/development/interpreters/python/mk-python-derivation.nix +++ b/pkgs/development/interpreters/python/mk-python-derivation.nix @@ -112,6 +112,9 @@ lib.extendMkDerivation { "dependencies" "optional-dependencies" "build-system" + + # Deprecated arguments + "pytestFlagsArray" ]; extendDrvArgs = @@ -439,6 +442,19 @@ lib.extendMkDerivation { # Longer-term we should get rid of `checkPhase` and use `installCheckPhase`. installCheckPhase = attrs.checkPhase; } + // ( + let + deprecatedFlagNotEmpty = + attrs ? pytestFlagsArray && attrs.pytestFlagsArray != null && attrs.pytestFlagsArray != [ ]; + pos = builtins.unsafeGetAttrPos "pytestFlagsArray" attrs; + in + { + ${if deprecatedFlagNotEmpty then "pytestFlagsArray" else null} = throw '' + buildPythonPackage: Deprecated flag pytestFlagsArray found at ${pos.file}:${toString pos.line} + Use pytestFlags or (enabled|disabled)(TestPaths|Tests|TestMarks) instead. + ''; + } + ) // lib.mapAttrs ( From fad6a5df8c40e8639eab9a2e82a36901fcf6680c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 26 Apr 2026 22:36:46 +0000 Subject: [PATCH 33/42] android-studio: 2025.3.3.7 -> 2025.3.4.6 --- pkgs/applications/editors/android-studio/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix index 36f4114dacc1..eac46ec4e53a 100644 --- a/pkgs/applications/editors/android-studio/default.nix +++ b/pkgs/applications/editors/android-studio/default.nix @@ -16,9 +16,9 @@ let inherit tiling_wm; }; stableVersion = { - version = "2025.3.3.7"; # "Android Studio Panda 3 | 2025.3.3 Patch 1" - sha256Hash = "sha256-FTAJ9rZPwLgIA/uPKl4d9haBxLL4O2Z+H8sY6RqaeOA="; - url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.3.7/android-studio-panda3-patch1-linux.tar.gz"; + version = "2025.3.4.6"; # "Android Studio Panda 4 | 2025.3.4" + sha256Hash = "sha256-Mqf/CayqOLSNYciIK+5+ITAiqLoNHxbABzOA+stQn9M="; + url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.6/android-studio-panda4-linux.tar.gz"; }; betaVersion = { version = "2025.3.4.5"; # "Android Studio Panda 4 | 2025.3.4 RC 1" From a883139bdabc154d2bc70942a5d8ed9fddcb18a1 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 26 Apr 2026 22:47:15 +0000 Subject: [PATCH 34/42] tempo: 2.10.4 -> 2.10.5 --- pkgs/by-name/te/tempo/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/te/tempo/package.nix b/pkgs/by-name/te/tempo/package.nix index 25cf8cc431e8..4f8005cb77eb 100644 --- a/pkgs/by-name/te/tempo/package.nix +++ b/pkgs/by-name/te/tempo/package.nix @@ -7,14 +7,14 @@ buildGoModule (finalAttrs: { pname = "tempo"; - version = "2.10.4"; + version = "2.10.5"; src = fetchFromGitHub { owner = "grafana"; repo = "tempo"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; - hash = "sha256-0RW77pa6e8+kg7T5z2VLTd0bnJKpf+io7FaHWWQDpcQ="; + hash = "sha256-1eacaqyKyHF/uS0Ja7oq+YKn/3K2QpDmd6jysGVBOjg="; }; vendorHash = null; From 7685a643866bab316d6fdde455a0c44d3702bfa9 Mon Sep 17 00:00:00 2001 From: Michael Daniels Date: Sun, 26 Apr 2026 20:12:43 -0400 Subject: [PATCH 35/42] nixos/unifi: bump default jrePackage for compat with unifi --- nixos/doc/manual/release-notes/rl-2605.section.md | 2 ++ nixos/modules/services/networking/unifi.nix | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 911eb063af97..bd81a0116d72 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -256,6 +256,8 @@ See . - `ceph` has been upgraded to v20. See the [Ceph "tentacle" release notes](https://docs.ceph.com/en/latest/releases/tentacle/#v20-2-0-tentacle) for details and recommended upgrade procedure. Note that **upgrades of server-side components are one-way**, and downgrading e.g. an OSD from *Tentacle* to *Squid* is not just not supported but is known to break. +- `services.unifi`'s `jrePackage` option now defaults to `jdk25_headless` instead of `jdk17_headless`, in order to be compatible with new versions of `unifi`. + - The `networking.wireless` module has been security hardened by default: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system. As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks). diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix index 1e6236e6d47c..eaee405f8bda 100644 --- a/nixos/modules/services/networking/unifi.nix +++ b/nixos/modules/services/networking/unifi.nix @@ -41,7 +41,7 @@ in }; services.unifi.jrePackage = lib.mkPackageOption pkgs "jdk" { - default = "jdk17_headless"; + default = "jdk25_headless"; extraDescription = '' Check the UniFi controller release notes to ensure it is supported. ''; From f46c546efca3cd53e79321572425a88f4f2d6d69 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 27 Apr 2026 03:04:44 +0000 Subject: [PATCH 36/42] terraform-providers.pagerduty_pagerduty: 3.32.2 -> 3.32.3 --- .../networking/cluster/terraform-providers/providers.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json index 3f80e197ffaa..0bd573dced0a 100644 --- a/pkgs/applications/networking/cluster/terraform-providers/providers.json +++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json @@ -1076,11 +1076,11 @@ "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw=" }, "pagerduty_pagerduty": { - "hash": "sha256-w5FNU3HYIrplFyyw3V6RpJ6exW83F+u/CRdr9htbuxs=", + "hash": "sha256-JEV+nNJjEM7RlQ6RKEawftB/OHaf8vcNHDYKhkUJRw0=", "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty", "owner": "PagerDuty", "repo": "terraform-provider-pagerduty", - "rev": "v3.32.2", + "rev": "v3.32.3", "spdx": "MPL-2.0", "vendorHash": null }, From 0c8d7e7944d1553ae7411053f6061111f7cf39f5 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 27 Apr 2026 03:35:47 +0000 Subject: [PATCH 37/42] pt2-clone: 1.87 -> 1.88 --- pkgs/by-name/pt/pt2-clone/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pt/pt2-clone/package.nix b/pkgs/by-name/pt/pt2-clone/package.nix index ca74bd04a5ba..2f5a6facf8c3 100644 --- a/pkgs/by-name/pt/pt2-clone/package.nix +++ b/pkgs/by-name/pt/pt2-clone/package.nix @@ -10,13 +10,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "pt2-clone"; - version = "1.87"; + version = "1.88"; src = fetchFromGitHub { owner = "8bitbubsy"; repo = "pt2-clone"; rev = "v${finalAttrs.version}"; - sha256 = "sha256-Kur9gQEEeGYHKQz6hNIEzohF1mJ9EDKAGycgiKehXhM="; + sha256 = "sha256-PdoncYnl7jD9iM0PDi0O92t9uAlhbrQciIr/+xk3igE="; }; nativeBuildInputs = [ cmake ]; From 964fef6a7902a3c558980b84c9237698e213ff80 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=F0=9D=91=B7=F0=9D=92=89=F0=9D=92=8A=F0=9D=92=8D?= =?UTF-8?q?=F0=9D=92=90=F0=9D=92=84=F0=9D=92=82=F0=9D=92=8D=F0=9D=92=9A?= =?UTF-8?q?=F0=9D=92=94=F0=9D=92=95?= Date: Sun, 26 Apr 2026 23:43:07 -0400 Subject: [PATCH 38/42] vega-cli: removed maintainer --- pkgs/by-name/ve/vega-cli/package.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/by-name/ve/vega-cli/package.nix b/pkgs/by-name/ve/vega-cli/package.nix index d52344184a8e..00b952f147b1 100644 --- a/pkgs/by-name/ve/vega-cli/package.nix +++ b/pkgs/by-name/ve/vega-cli/package.nix @@ -73,7 +73,6 @@ buildNpmPackage (finalAttrs: { homepage = "https://vega.github.io/vega/"; license = lib.licenses.bsd3; maintainers = with lib.maintainers; [ - pyrox0 philocalyst ]; }; From 5b43b78d94bea3ebd8a01d02b29ca02d58b349c0 Mon Sep 17 00:00:00 2001 From: jopejoe1 Date: Mon, 27 Apr 2026 04:00:13 +0000 Subject: [PATCH 39/42] itch-dl: 0.6.1 -> 0.7.2 --- pkgs/by-name/it/itch-dl/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/it/itch-dl/package.nix b/pkgs/by-name/it/itch-dl/package.nix index bb217dc02101..a1076b02eb38 100644 --- a/pkgs/by-name/it/itch-dl/package.nix +++ b/pkgs/by-name/it/itch-dl/package.nix @@ -6,14 +6,14 @@ python3Packages.buildPythonApplication (finalAttrs: { pname = "itch-dl"; - version = "0.6.1"; + version = "0.7.2"; pyproject = true; src = fetchFromGitHub { owner = "DragoonAethis"; repo = "itch-dl"; tag = finalAttrs.version; - hash = "sha256-zwsiG38wOVi3pP0gQWkZqfAmdWKadjB65qiTg68tZWg="; + hash = "sha256-4+Idh76o/VbdQ6hgvQsrz9AGYeOGC2hgN0kMJz+ik2E="; }; nativeBuildInputs = with python3Packages; [ @@ -36,6 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: { "urllib3" "beautifulsoup4" "lxml" + "tqdm" ]; meta = { From 2da27b8c58f189e1249902f0182e4a1cc333c94b Mon Sep 17 00:00:00 2001 From: David Wronek Date: Mon, 6 Apr 2026 21:18:37 +0200 Subject: [PATCH 40/42] dumpyara: init at 1.1.0 Signed-off-by: David Wronek --- pkgs/by-name/du/dumpyara/package.nix | 83 ++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 pkgs/by-name/du/dumpyara/package.nix diff --git a/pkgs/by-name/du/dumpyara/package.nix b/pkgs/by-name/du/dumpyara/package.nix new file mode 100644 index 000000000000..3ace3aafdc9d --- /dev/null +++ b/pkgs/by-name/du/dumpyara/package.nix @@ -0,0 +1,83 @@ +{ + lib, + runCommand, + python3Packages, + fetchFromGitHub, + callPackage, + nix-update-script, + _7zz, + android-tools, + cpio, + dumpyara, + erofs-utils, + squashfsTools, + zip, +}: +python3Packages.buildPythonApplication (finalAttrs: { + pname = "dumpyara"; + version = "1.1.0"; + pyproject = true; + + src = fetchFromGitHub { + owner = "sebaubuntu-python"; + repo = "dumpyara"; + tag = "v${finalAttrs.version}"; + hash = "sha256-V7SX1XR+De3py6B3Fmqn1IehN0sGPxUKJ0YlGpBPHG4="; + }; + + build-system = with python3Packages; [ poetry-core ]; + + dependencies = with python3Packages; [ + brotli + liblp + lz4 + protobuf5 + py7zr + sebaubuntu-libs + zstandard + ]; + + makeWrapperArgs = [ + "--prefix" + "PATH" + ":" + (lib.makeBinPath [ + _7zz + android-tools + cpio + erofs-utils + ]) + ]; + + passthru = { + tests.requiredTools = + runCommand "check-required-tools" + { + nativeBuildInputs = [ + android-tools + dumpyara + squashfsTools + zip + ]; + } + '' + echo foo > bar.txt + mkbootimg --kernel bar.txt -o boot.img + mksquashfs bar.txt system.img + zip system.zip *.img + dumpyara system.zip + touch $out + ''; + updateScript = nix-update-script { }; + }; + + __structuredAttrs = true; + + meta = { + description = "Android firmware dumper"; + homepage = "https://github.com/sebaubuntu-python/dumpyara"; + license = lib.licenses.gpl3Plus; + maintainers = with lib.maintainers; [ ungeskriptet ]; + mainProgram = "dumpyara"; + }; +}) From 29a3279f4d154b104d8ac8300680ad8ea0773856 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 27 Apr 2026 04:40:12 +0000 Subject: [PATCH 41/42] terraform-plugin-docs: 0.24.0 -> 0.25.0 --- pkgs/by-name/te/terraform-plugin-docs/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/te/terraform-plugin-docs/package.nix b/pkgs/by-name/te/terraform-plugin-docs/package.nix index 697ef200fefd..00da0911e7c0 100644 --- a/pkgs/by-name/te/terraform-plugin-docs/package.nix +++ b/pkgs/by-name/te/terraform-plugin-docs/package.nix @@ -11,16 +11,16 @@ buildGoModule (finalAttrs: { pname = "terraform-plugin-docs"; - version = "0.24.0"; + version = "0.25.0"; src = fetchFromGitHub { owner = "hashicorp"; repo = "terraform-plugin-docs"; tag = "v${finalAttrs.version}"; - hash = "sha256-wN85uTZgHasP4EsG/tNkt28tnLRFfosN6N89iwcAX80="; + hash = "sha256-QgN2gcGu9Laq4gQkYBvbE7gadiwzAyERLaKVLI+XiHQ="; }; - vendorHash = "sha256-ZL61b2LAE+GFRtfUBIAoF7O65s7FeQw7cX4Aw2Cfd+k="; + vendorHash = "sha256-+D3JwUpLJ6gZAkTFO0fQAFpl0OCp36HMbWES/+lK+9g="; nativeBuildInputs = [ makeWrapper ]; From daf90ebb0e4bf4b74e957c343bdc32415056a506 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 27 Apr 2026 05:19:50 +0000 Subject: [PATCH 42/42] terraform-providers.cloudflare_cloudflare: 5.18.0 -> 5.19.0 --- .../networking/cluster/terraform-providers/providers.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json index 3f80e197ffaa..19e5573de7b9 100644 --- a/pkgs/applications/networking/cluster/terraform-providers/providers.json +++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json @@ -200,13 +200,13 @@ "vendorHash": "sha256-sagrygtfsZWQUuIuGTUldZYYR5OhQfpZDxDKZAaIR4Y=" }, "cloudflare_cloudflare": { - "hash": "sha256-D5Kk6xCz3CQWbGHjLKU/+SPBzCYFQlphCTMG6+LvFek=", + "hash": "sha256-2hlL7N6jP7or3l0HczbRhnAmMYJ0XQTXl0f+sIFdlZc=", "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare", "owner": "cloudflare", "repo": "terraform-provider-cloudflare", - "rev": "v5.18.0", + "rev": "v5.19.0", "spdx": "Apache-2.0", - "vendorHash": "sha256-8d6cnbdPhfc/9B8JUq1HbReOYBauY6SQf3xKqgK1PeQ=" + "vendorHash": "sha256-Gkb493fesB/jOdvnQrwt4MrNKO+YlR3+9Mu5TiaG084=" }, "cloudfoundry-community_cloudfoundry": { "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",