From a4430e9c7af4e5c18847940d420f764a132563dc Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 8 Jul 2026 23:55:40 +0000 Subject: [PATCH 1/9] ast-grep: 0.44.0 -> 0.44.1 --- pkgs/by-name/as/ast-grep/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix index 0f078898f2b0..18ac78422a2c 100644 --- a/pkgs/by-name/as/ast-grep/package.nix +++ b/pkgs/by-name/as/ast-grep/package.nix @@ -11,13 +11,13 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ast-grep"; - version = "0.44.0"; + version = "0.44.1"; src = fetchFromGitHub { owner = "ast-grep"; repo = "ast-grep"; tag = finalAttrs.version; - hash = "sha256-KTVyG2z2Vx4mLmkiwou4X04Z6qzpQxmwRCtcmG4euVA="; + hash = "sha256-C6JwLx6z+/xSm9kMF48hfd3WTRax8Bdy3zgGeYxGyg8="; }; # error: linker `aarch64-linux-gnu-gcc` not found @@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: { rm .cargo/config.toml ''; - cargoHash = "sha256-slFovLzLaK6DlTF/LKI74PUWXi9xkpy9hC9WWGmypcM="; + cargoHash = "sha256-waeAXcxnvTWbuAhVWdA5wPdWvS1aSSptGerFoGEtFUE="; nativeBuildInputs = [ installShellFiles ]; From 8214bd597e7f669b7fa8d0cad1e2f2bc3c381455 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 9 Jul 2026 08:01:36 +0000 Subject: [PATCH 2/9] vunnel: 0.61.1 -> 0.62.1 --- pkgs/by-name/vu/vunnel/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/vu/vunnel/package.nix b/pkgs/by-name/vu/vunnel/package.nix index ad000583b879..fb3036d4a704 100644 --- a/pkgs/by-name/vu/vunnel/package.nix +++ b/pkgs/by-name/vu/vunnel/package.nix @@ -7,14 +7,14 @@ python3.pkgs.buildPythonApplication (finalAttrs: { pname = "vunnel"; - version = "0.61.1"; + version = "0.62.1"; pyproject = true; src = fetchFromGitHub { owner = "anchore"; repo = "vunnel"; tag = "v${finalAttrs.version}"; - hash = "sha256-rxA+BVu+TkegZ6RXirzlxPxpURXdFT6KvSNSPPlef7U="; + hash = "sha256-Np80Yj8zazMBgeHu27N97K543GmKw8gf9Muixu4WBVQ="; leaveDotGit = true; }; From 34923d91a9e2397e596f8119c4943beb02790979 Mon Sep 17 00:00:00 2001 From: Niklas Korz Date: Thu, 9 Jul 2026 10:19:13 +0200 Subject: [PATCH 3/9] livekit-libwebrtc: fix compiler warnings --- pkgs/by-name/li/livekit-libwebrtc/package.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/by-name/li/livekit-libwebrtc/package.nix b/pkgs/by-name/li/livekit-libwebrtc/package.nix index 7ea48483a9df..f7e1fd2e88b3 100644 --- a/pkgs/by-name/li/livekit-libwebrtc/package.nix +++ b/pkgs/by-name/li/livekit-libwebrtc/package.nix @@ -139,6 +139,10 @@ stdenv.mkDerivation { --replace-fail "rtc_static_library" "rtc_shared_library" \ --replace-fail "complete_static_lib = true" "" + # Remove the libcxx hardening config to avoid clashes with nixpkgs' own compiler wrapper, + # which already defines the hardening macros. + sed -i '/config("libcxx_hardening") {/,/^}/c\config("libcxx_hardening") {}' build/config/compiler/BUILD.gn + substituteInPlace webrtc.gni \ --replace-fail "!build_with_chromium && is_component_build" "false" @@ -179,6 +183,11 @@ stdenv.mkDerivation { chmod +x build/toolchain/apple/linker_driver.py patchShebangs build/toolchain/apple/linker_driver.py substituteInPlace build/toolchain/apple/toolchain.gni --replace-fail "/bin/cp -Rc" "cp -a" + + # nixpkgs calls the target "darwin" instead of "macos", and passing a different target + # results in warnings by the nixpkgs compiler wrapper + substituteInPlace build/config/mac/BUILD.gn \ + --replace-fail '$clang_arch-apple-macos' '$clang_arch-apple-darwin' ''; outputs = [ From 7149c9fa371b483948da77550d66f70c265ac396 Mon Sep 17 00:00:00 2001 From: Niklas Korz Date: Thu, 9 Jul 2026 09:06:33 +0200 Subject: [PATCH 4/9] livekit-libwebrtc: link with lld on darwin ld64 traps during linking because of hardening issues --- pkgs/by-name/li/livekit-libwebrtc/package.nix | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/li/livekit-libwebrtc/package.nix b/pkgs/by-name/li/livekit-libwebrtc/package.nix index f7e1fd2e88b3..b4cebbf58efd 100644 --- a/pkgs/by-name/li/livekit-libwebrtc/package.nix +++ b/pkgs/by-name/li/livekit-libwebrtc/package.nix @@ -7,6 +7,8 @@ fetchurl, fetchpatch, xcbuild, + lld, + llvm, python3, ninja, git, @@ -182,7 +184,13 @@ stdenv.mkDerivation { ln -sf ${lib.getExe gn} buildtools/mac/gn chmod +x build/toolchain/apple/linker_driver.py patchShebangs build/toolchain/apple/linker_driver.py - substituteInPlace build/toolchain/apple/toolchain.gni --replace-fail "/bin/cp -Rc" "cp -a" + + # When 'use_lld=true' is set, llvm-ar is used instead of ar. + # The build config expects llvm-ar to be inside the provided clang base path, + # but this is not the case in nixpkgs. + substituteInPlace build/toolchain/apple/toolchain.gni \ + --replace-fail "/bin/cp -Rc" "cp -a" \ + --replace-fail '${"$"}{prefix}llvm-ar' '${lib.getExe' llvm "llvm-ar"}' # nixpkgs calls the target "darwin" instead of "macos", and passing a different target # results in warnings by the nixpkgs compiler wrapper @@ -210,7 +218,10 @@ stdenv.mkDerivation { cpio pkg-config ] - ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ]; + ++ lib.optionals stdenv.hostPlatform.isDarwin [ + xcbuild + lld + ]; buildInputs = [ nasm @@ -279,7 +290,8 @@ stdenv.mkDerivation { "rtc_enable_objc_symbol_export=true" "rtc_include_dav1d_in_internal_decoder_factory=true" "clang_use_chrome_plugins=false" - "use_lld=false" + # ld64 traps on linking because of C++ hardening + "use_lld=true" ''clang_base_path="${clang}"'' ]); @@ -297,6 +309,12 @@ stdenv.mkDerivation { "desktop_capture_objc" ]; + env = { + # ensure install_name_tool has enough space in binary headers + # to replace rpaths with very long nix store paths + NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-headerpad_max_install_names"; + }; + postBuild = lib.optionalString stdenv.hostPlatform.isLinux '' objcopy --redefine-syms="${boringSslSymbols}" "libwebrtc.so" From 27b37b86416972a5ea4ccd43289f08941334dcda Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 9 Jul 2026 12:02:54 +0000 Subject: [PATCH 5/9] dashy-ui: 4.3.11 -> 4.4.2 --- pkgs/by-name/da/dashy-ui/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/da/dashy-ui/package.nix b/pkgs/by-name/da/dashy-ui/package.nix index d56135c080d5..822539b23b6d 100644 --- a/pkgs/by-name/da/dashy-ui/package.nix +++ b/pkgs/by-name/da/dashy-ui/package.nix @@ -17,16 +17,16 @@ }: stdenv.mkDerivation (finalAttrs: { pname = "dashy-ui"; - version = "4.3.11"; + version = "4.4.2"; src = fetchFromGitHub { owner = "lissy93"; repo = "dashy"; tag = finalAttrs.version; - hash = "sha256-BAzeS484udZ4Llgyx1pruKsgPOpI3i3XMTWy5cf2I1Q="; + hash = "sha256-4AJx/BoRVYA8dU6HrIvGYWflvppxNsi2PWSpnJLWR0w="; }; yarnOfflineCache = fetchYarnDeps { yarnLock = finalAttrs.src + "/yarn.lock"; - hash = "sha256-PCJxn3qXOZBHVJifa6xTYu1quW6zelt162fIgyH9g8g="; + hash = "sha256-oxVxzdap3dWi1ORP+eviFabO+G8GcFd0ZM3/a20Qbog="; }; passthru = { From f82fd234874c3acdd8f5cf77787a9780a5f88958 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 9 Jul 2026 13:02:03 +0000 Subject: [PATCH 6/9] lighttpd: 1.4.84 -> 1.4.85 --- pkgs/by-name/li/lighttpd/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/lighttpd/package.nix b/pkgs/by-name/li/lighttpd/package.nix index d049a733b12a..4ff292424943 100644 --- a/pkgs/by-name/li/lighttpd/package.nix +++ b/pkgs/by-name/li/lighttpd/package.nix @@ -34,11 +34,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "lighttpd"; - version = "1.4.84"; + version = "1.4.85"; src = fetchurl { url = "https://download.lighttpd.net/lighttpd/releases-${lib.versions.majorMinor finalAttrs.version}.x/lighttpd-${finalAttrs.version}.tar.xz"; - sha256 = "sha256-B23UO+yPK6nObbfnyn6K1yJxzVKYBerSQAtW76oCb3A="; + sha256 = "sha256-GN5Rs5O6xKaCeHnhp/83fBaeQUuuks0kUJHYD8JgHRM="; }; separateDebugInfo = true; From 27d17f3b98046061d608da4a4efce672061304d1 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Thu, 9 Jul 2026 16:08:34 +0200 Subject: [PATCH 7/9] nerva: 1.39.0 -> 1.40.0 Diff: https://github.com/praetorian-inc/nerva/compare/v1.39.0...v1.40.0 Changelog: https://github.com/praetorian-inc/nerva/blob/v1.40.0/CHANGELOG.md --- pkgs/by-name/ne/nerva/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix index 0f1e8936a2b2..b43ffaea424d 100644 --- a/pkgs/by-name/ne/nerva/package.nix +++ b/pkgs/by-name/ne/nerva/package.nix @@ -6,13 +6,13 @@ buildGoModule (finalAttrs: { pname = "nerva"; - version = "1.39.0"; + version = "1.40.0"; src = fetchFromGitHub { owner = "praetorian-inc"; repo = "nerva"; tag = "v${finalAttrs.version}"; - hash = "sha256-SdSgBjbxsrnFuHVVa3yewzT9LTh6E2lW1rmZoWftVyg="; + hash = "sha256-7KN8RlQyfKF55AX9xzdNnUiDoTWHlEb9dMoyT38PU4M="; }; vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8="; From c6ff2a8cc7986fe4c37c440f090d36ca1f207712 Mon Sep 17 00:00:00 2001 From: Lennart Kolmodin Date: Sun, 8 Jun 2025 22:12:18 +0200 Subject: [PATCH 8/9] evcc: 0.309.1 -> 0.311.1 https://github.com/evcc-io/evcc/releases/tag/0.311.1 Also remove tag "test" which otherwise breaks the build of the ship-go dependency: > vendor/github.com/enbility/ship-go/ship/handshake.go:63:72: undefined: getHelloInitTimeout The 'test' tag prevented the production timeouts from being included, and the test definitions are only available in test. https://github.com/enbility/ship-go/blob/dev/README.md#fast-test-execution-with-test-build-tags Generally, the 'test' tag is not something you need to manually add, and indeed no other go package in nixpkgs has such a flag enabled. --- pkgs/by-name/ev/evcc/package.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix index 90dce900917b..89a475328079 100644 --- a/pkgs/by-name/ev/evcc/package.nix +++ b/pkgs/by-name/ev/evcc/package.nix @@ -17,16 +17,16 @@ }: let - version = "0.309.1"; + version = "0.311.1"; src = fetchFromGitHub { owner = "evcc-io"; repo = "evcc"; tag = version; - hash = "sha256-fMWLr8UrwejLlPiPdcs5lLd//81iqvuE5Ia9Ne0d3l4="; + hash = "sha256-dxP28NPW+V30XIzh2w++Glrb2xfZ0tpp4H+qOM13yt8="; }; - vendorHash = "sha256-lCXIgJuUg5NG8E/iYobGxtvxfTk77Y8ZzVi0GsjbbHw="; + vendorHash = "sha256-Eh07T9FAoeoUfhJsK6DPmwE2rJX55Ijzp4ydxJc8/bQ="; commonMeta = { license = lib.licenses.mit; @@ -40,7 +40,7 @@ buildGo126Module rec { npmDeps = fetchNpmDeps { inherit src; - hash = "sha256-ypBg2TQ3qbc8cIBfFqICbNSCsIdokOtaFOqFD9bnMQM="; + hash = "sha256-MhLc5RUjn8FYXiFQbGchRnf132QXwG0kSyyPsRRzu1A="; }; nativeBuildInputs = [ @@ -65,7 +65,6 @@ buildGo126Module rec { tags = [ "release" - "test" ]; ldflags = [ @@ -88,6 +87,10 @@ buildGo126Module rec { "TestOctopusConfigParse" "TestSessionHandlerTimezoneFilter" "TestTemplates" + # network access: mdns fails to start Avahi provider + "TestControlBoxGridGuardHeartbeat" + "TestEEBus" + "TestShipPairing" ]; in [ "-skip=^${lib.concatStringsSep "$|^" skippedTests}$" ]; From 3347d985f201c32b8093a8701f07f34cab18e6e3 Mon Sep 17 00:00:00 2001 From: whispers Date: Thu, 9 Jul 2026 15:23:19 -0400 Subject: [PATCH 9/9] Revert "hdrhistogram_c: 0.11.9 -> 0.11.10" --- pkgs/by-name/hd/hdrhistogram_c/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/hd/hdrhistogram_c/package.nix b/pkgs/by-name/hd/hdrhistogram_c/package.nix index 83aa93951d8e..f05ebfe5f357 100644 --- a/pkgs/by-name/hd/hdrhistogram_c/package.nix +++ b/pkgs/by-name/hd/hdrhistogram_c/package.nix @@ -11,13 +11,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "hdrhistogram_c"; - version = "0.11.10"; + version = "0.11.9"; src = fetchFromGitHub { owner = "HdrHistogram"; repo = "HdrHistogram_c"; tag = finalAttrs.version; - hash = "sha256-LMZj7vuxOA1bgU/J10IKnyNe3R0dk2AA1ydLTHun4vg="; + hash = "sha256-9Xp+gPqJpB7xZr5dzyc9Via9gxG9q/EriCx3cm++0kU="; }; buildInputs = [ zlib ];