Merge branch 'staging' into staging-next

ci/OWNERS

@@ -470,7 +470,7 @@ pkgs/by-name/lx/lxc*                    @adamcstephens
 /pkgs/development/compilers/flutter @RossComputerGuy
 
 # GNU Tar & Zip
-/pkgs/tools/archivers/gnutar        @RossComputerGuy
+/pkgs/by-name/gn/gnutar        @RossComputerGuy
 /pkgs/by-name/zi/zip           @RossComputerGuy
 
 # SELinux

doc/build-helpers/special.md

@@ -3,6 +3,7 @@
 This chapter describes several special build helpers.
 
 ```{=include=} sections
+special/buildenv.section.md
 special/fakenss.section.md
 special/fhs-environments.section.md
 special/makesetuphook.section.md

doc/build-helpers/special/buildenv.section.md

@@ -0,0 +1,101 @@
+# buildEnv {#sec-buildEnv}
+
+`buildEnv` constructs a derivation containing directories and symbolic links, which resembles the profile layout where a list of derivations or store paths are installed.
+
+Unlike [`symlinkJoin`](#trivial-builder-symlinkJoin), `buildEnv` takes special care of the outputs to link and checks for content collisions across the paths by default.
+A common use case for `buildEnv` is constructing environment wrappers, such as an interpreter with modules or a program with extensions.
+For example, [`python.withPackage`](#attributes-on-interpreters-packages) is based on `buildEnv`.
+
+## Arguments {#sec-buildEnv-arguments}
+
+`buildEnv` takes [fixed-point arguments (`buildEnv (finalAttrs: { })`)](#chap-build-helpers-finalAttrs) as well as a plain attribute set.
+
+Unless otherwise noted, arguments can be overridden directly using [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
+
+`buildEnv` enforces [structured attributes (`{ __structuredAttrs = true; }`)](https://nix.dev/manual/nix/2.18/language/advanced-attributes.html#adv-attr-structuredAttrs).
+
+- `name` or `pname` and `version` (required):
+    The name of the environment.
+
+- `paths` (required):
+    The derivations or store paths to symlink ("install").
+
+    The elements can be any path-like object that string-interpolates to a store path.
+    The priority of each path is taken from `<path>.meta.priority` and falls back to `lib.meta.defaultPriority` if not set.
+
+    The argument `paths` is passed as attribute `passthru.paths` to prevent unexpected context pollution.
+    `passthru.paths` can be overridden with `<pkg>.overrideAttrs`.
+
+-   `extraOutputsToInstall` (default to `[ ]`):
+    Package outputs to include in addition to what `meta.outputsToInstall` specifies.
+
+-   `includeClosures` (default to `false`):
+    Whether to include closures of all input paths.
+    The list of the closure paths are constructed with `writeClosure`.
+    They are installed with lower priority and with build-time exceptions silenced.
+
+-   `extraPrefix` (default to `""`):
+    Root the result in directory `"$out${extraPrefix}"`, e.g. `"/share"`.
+
+-   `ignoreCollisions` (default: `false`):
+    Don't fail the build upon content collisions.
+
+-   `checkCollisionContents` (default: `true`):
+    If there is a collision, check whether the contents and permissions match; and only if not, throw a collision error.
+
+-   `ignoreSingleFileOutputs` (default: `false`):
+    Don't fail the build upon single-file outputs.
+
+-   `manifest` (default: `""`):
+    The manifest file (if any). A symlink `$out/manifest` will be created to it.
+
+-   `pathsToLink` (default: `[ "/" ]`):
+    The paths (relative to each element of `paths`) that we want to symlink (e.g., `["/bin"]`).
+    Any file outside the directories in this list won't be symlinked into the produced environment.
+
+-   `postBuild` (default: `""`):
+    Shell commands to run after building the symlink tree.
+
+-   `passthru` and `meta` (default: `{ }`):
+    `stdenv.mkDerivation`-supported attributes not passing down to `builtins.derivation`.
+
+-   `derivationArgs` (default: `{ }`):
+    Additional `stdenv.mkDerivation` arguments, such as `nativeBuildInputs`/`buildInputs` for `postBuild` dependencies and setup hooks.
+
+    `derivationArgs` is not passed down to `stdenv.mkDerivation`.
+    Override its attributes directly via `<pkg>.overrideAttrs` and reference directly via `finalAttrs`.
+
+## Build-time exceptions {#sec-buildEnv-exceptions}
+
+There are situations where the specified `paths` might not produce sensible profile layout.
+By default, the builder fails early upon detecting these exceptions.
+`buildEnv` provides arguments to fine-tune or ignore certain exceptions.
+
+### Path collisions {#ssec-buildEnv-collisions}
+
+Path collisions occur when files provided by two more output paths with the same priority overlap with each other, making the result profile layout potentially affected by the order of elements of `paths`.
+This is undesirable in several use cases, such as when `paths` are determined by merging Nix modules.
+
+If the argument `checkCollisionContents` is `true`, the builder checks whether the overlapping paths share the same content and mode, and fails only if not.
+
+The argument `ignoreCollisions` silence the collision checks and allow the files to be overwritten based on the order of chosen output paths.
+
+In addition to silencing this exception with `ignoreCollisions`, one can also adjust the priority of colliding packages and store paths.
+Store paths can specify priority in the form
+
+```nix
+{
+  outPath = <path>;
+  meta.priority = <priority>;
+}
+```
+
+And [`lib.meta.setPrio`](#function-library-lib.meta.setPrio)-related Nixpkgs Library functions also apply to a string-like attribute set (`{ outPath = <path>; }`).
+
+### Single-file outputs {#ssec-buildEnv-singleFileOutputs}
+
+When an output path provides a single file instead of a directory, it inherently cannot merge into the result layout.
+All discoverable packages should configure their `meta.outputsToInstall` correctly, so that single-file outputs won't be installed into a profile.
+
+Set `ignoreSingleFileOutputs` to `true` to drop all single-file output paths silently.
+This option is useful when the specified paths contain the output paths of package tests.

doc/hooks/npm-config-hook.section.md

@@ -13,7 +13,7 @@ Primarily made for a multi-language environment.
 
 #### `npmDeps` {#npm-config-hook-deps}
 
-Derivation that contains the NPM package dependencies.
+Derivation that contains the npm package dependencies.
 Usually built with `fetchNpmDeps`.
 This attribute is required or the hook will abort the build.
 

doc/languages-frameworks/tcl.section.md

@@ -13,7 +13,8 @@ Tcl packages are typically built with `tclPackages.mkTclDerivation`.
 Tcl dependencies go in `buildInputs`/`nativeBuildInputs`/... like other packages.
 For more complex package definitions, such as packages with mixed languages, use `tcl.tclPackageHook`.
 
-Where possible, make sure to enable stubs for maximum compatibility, usually with the `--enable-stubs` configure flag.
+Where possible, make sure to enable stubs for maximum compatibility.
+If you are using `mkTclDerivation`, `--enable-stubs` will be automatically added to `configureFlags`.
 
 Here is a simple package example to be called with `tclPackages.callPackage`.
 
@@ -33,7 +34,6 @@ mkTclDerivation rec {
 
   configureFlags = [
     "--with-ssl-dir=${openssl.dev}"
-    "--enable-stubs"
   ];
 
   meta = {
@@ -52,3 +52,35 @@ Its use is documented in `pkgs/development/tcl-modules/by-name/README.md`.
 
 All Tcl applications reside elsewhere.
 In case a package is used as both a library and an application (for example `expect`), it should be defined in `tcl-packages.nix`, with an alias elsewhere.
+
+### Using tclRequiresCheck {#using-tclrequirescheck}
+
+Although unit tests are highly preferred to validate correctness of a package, not
+all packages have test suites that can be run easily, and some have none at all.
+To help ensure the package still works, [`tclRequiresCheck`](#using-tclrequirescheck) can attempt to `package require`
+the listed modules.
+
+```nix
+{
+  tclRequiresCheck = [
+    "json"
+    "doctools"
+  ];
+}
+```
+
+roughly translates to:
+
+```nix
+{
+  preDist = ''
+    TCLLIBPATH="$out/lib $TCLLIBPATH"
+    tclsh <<<'exit [catch {package require json; package require doctools}]'
+  '';
+}
+```
+
+However, this is done in its own phase, and not dependent on whether [`doCheck = true;`](#var-stdenv-doCheck).
+
+This can also be useful in verifying that the package doesn't assume commonly
+present packages (e.g. `tcllib`).

doc/redirects.json

@@ -367,6 +367,9 @@
   "sec-build-helper-extendMkDerivation": [
     "index.html#sec-build-helper-extendMkDerivation"
   ],
+  "sec-buildEnv-exceptions": [
+    "index.html#sec-buildEnv-exceptions"
+  ],
   "sec-building-packages-with-llvm": [
     "index.html#sec-building-packages-with-llvm"
   ],
@@ -758,6 +761,12 @@
   "sec-treefmt-options-reference": [
     "index.html#sec-treefmt-options-reference"
   ],
+  "ssec-buildEnv-collisions": [
+    "index.html#ssec-buildEnv-collisions"
+  ],
+  "ssec-buildEnv-singleFileOutputs": [
+    "index.html#ssec-buildEnv-singleFileOutputs"
+  ],
   "ssec-cosmic-common-issues": [
     "index.html#ssec-cosmic-common-issues"
   ],
@@ -866,6 +875,9 @@
   "typst-package-scope-and-usage": [
     "index.html#typst-package-scope-and-usage"
   ],
+  "using-tclrequirescheck": [
+    "index.html#using-tclrequirescheck"
+  ],
   "var-go-buildTestBinaries": [
     "index.html#var-go-buildTestBinaries"
   ],
@@ -2167,6 +2179,12 @@
   "chap-special": [
     "index.html#chap-special"
   ],
+  "sec-buildEnv": [
+    "index.html#sec-buildEnv"
+  ],
+  "sec-buildEnv-arguments": [
+    "index.html#sec-buildEnv-arguments"
+  ],
   "sec-fakeNss": [
     "index.html#sec-fakeNss"
   ],

doc/release-notes/rl-2511.section.md

@@ -324,6 +324,13 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `buildEnv` now takes fixed-point arguments (`finalAttrs: { }`).
+  The custom overrider `<env-pkg>.override` is deprecated but kept in this release. It will be removed in future releases after tree-wide transition.
+  The argument `paths` is passed as `passthru.paths` to avoid bringing in unexpected context.
+
+- `buildEnv` now takes `derivationArgs` for additional arguments to pass to `stdenv.mkDerivation`.
+  A compatibility layer is added for directly-specified arguments `nativeBuildInputs` and `buildInputs`.
+
 - Added `rewriteURL` attribute to the nixpkgs `config`, to allow for rewriting the URLs downloaded by `fetchurl`.
 
 - Added `hashedMirrors` attribute to the nixpkgs `config`, to allow for customization of the hashed mirrors used by `fetchurl`.
@@ -348,7 +355,7 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 - `fetchgit` now accepts a `rootDir` argument to limit the resulting source to one subdirectory of the whole Git repository. Corresponding `--root-dir` option added to `nix-prefetch-git`.
 
-- `fetchNpmDeps` now accepts a `npmRegistryOverridesString` argument to pass NPM registry overrides to the fetcher.
+- `fetchNpmDeps` now accepts a `npmRegistryOverridesString` argument to pass npm registry overrides to the fetcher.
 
 - `ffmpeg_8`, `ffmpeg_8-headless`, and `ffmpeg_8-full` have been added. The default version of FFmpeg is now `ffmpeg_8`. You can install previous versions from package attributes such as `ffmpeg_7`.
 

doc/release-notes/rl-2605.section.md

@@ -80,6 +80,8 @@
 
 - Note that the above `nodePackages` removal also coincides with the removal of `node2nix` and its tooling, which have been deprecated for a long time.
 
+- `buildEnv`-constructed packages now take only [structured attributes (`{ __structuredAttrs = true; }`)](https://nix.dev/manual/nix/2.18/language/advanced-attributes.html#adv-attr-structuredAttrs).
+
 - `xfce.mkXfceDerivation` has been deprecated (i.e. conditioned behind `nixpkgs.config.allowAliases`)
   and will be removed in NixOS 26.11, please use `stdenv.mkDerivation` directly. You can migrate by
   adding `pkg-config`, `xfce4-dev-tools`, and `wrapGAppsHook3` to your `nativeBuildInputs` and

maintainers/scripts/haskell/dependencies.nix

@@ -1,6 +1,6 @@
 # Nix script to calculate the Haskell dependencies of every haskellPackage. Used by ./hydra-report.hs.
 let
-  pkgs = import ../../.. { };
+  pkgs = import ../../.. { config.allowAliases = false; };
   inherit (pkgs) lib;
   getDeps =
     _: pkg:

maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh

@@ -20,6 +20,6 @@ cat > $tmpfile << EOF
 dont-distribute-packages:
 EOF
 
-nix-instantiate --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort --ignore-case >> $tmpfile
+nix-instantiate --show-trace --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort --ignore-case >> $tmpfile
 
 mv $tmpfile $config_file

maintainers/scripts/haskell/transitive-broken-packages.nix

@@ -1,11 +1,16 @@
 let
   nixpkgs = import ../../..;
   inherit (nixpkgs { }) pkgs lib;
+  isVersioned = attr: builtins.match "[A-Za-z0-9-]+(_[0-9]+)+" attr != null;
   getEvaluating =
     x:
-    builtins.attrNames (
+    lib.mapAttrsToList (_: v: v.pname) (
       lib.filterAttrs (
-        _: v: (builtins.tryEval (v.outPath or null)).success && lib.isDerivation v && !v.meta.broken
+        n: v:
+        !(isVersioned n)
+        && (builtins.tryEval (v.outPath or null)).success
+        && lib.isDerivation v
+        && !v.meta.broken
       ) x
     );
   brokenDeps = lib.subtractLists (getEvaluating pkgs.haskellPackages) (

maintainers/scripts/haskell/update-stackage.sh

@@ -111,4 +111,9 @@ sed -r \
 # ShellCheck: latest version of command-line dev tool.
 # Agda: The Agda community is fast-moving; we strive to always include the newest versions of Agda and the Agda packages in nixpkgs.
 
+# Work around Stackage LTS including a bogus version of cassava which has been deprecated on Hackage.
+# See <https://github.com/haskell-hvr/cassava/issues/248>.
+# TODO(@sternenseemann): drop this once the situation has been resolved in Stackage LTS
+sed -e 's/cassava ==0.5.5.0/cassava >= 0.5.4.0 && (> 0.5.5.0 || < 0.5.5.0) && < 0.6.0.0/' -i "$stackage_config"
+
 echo "$old_version -> $version"

nixos/doc/manual/configuration/mattermost.chapter.md

@@ -99,7 +99,7 @@ these assumptions the best it can.
 
 Here is how to build the above Todo plugin. Note that we rely on
 package-lock.json being assembled correctly, so must use a version where it is!
-If there is no lockfile or the lockfile is incorrect, Nix cannot fetch NPM build
+If there is no lockfile or the lockfile is incorrect, Nix cannot fetch npm build
 and runtime dependencies for a sandbox build.
 
 ```nix

nixos/modules/misc/documentation.nix

@@ -136,19 +136,21 @@ let
           libPath = filter (pkgs.path + "/lib");
           pkgsLibPath = filter (pkgs.path + "/pkgs/pkgs-lib");
           nixosPath = filteredModules + "/nixos";
-          NIX_ABORT_ON_WARN = warningsAreErrors;
+          env.NIX_ABORT_ON_WARN = warningsAreErrors;
           modules =
             "[ "
             + concatMapStringsSep " " (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy
             + " ]";
-          passAsFile = [ "modules" ];
           disallowedReferences = [
             filteredModules
             libPath
             pkgsLibPath
           ];
+          __structuredAttrs = true;
         }
         ''
+          modulesPath="$TMPDIR/modules"
+          printf "%s" "$modules" > "$modulesPath"
           export NIX_STORE_DIR=$TMPDIR/store
           export NIX_STATE_DIR=$TMPDIR/state
           ${pkgs.buildPackages.nix}/bin/nix-instantiate \

nixos/modules/services/backup/restic-rest-server.nix

@@ -94,7 +94,7 @@ in
           ${lib.optionalString cfg.appendOnly "--append-only"} \
           ${lib.optionalString cfg.privateRepos "--private-repos"} \
           ${lib.optionalString cfg.prometheus "--prometheus"} \
-          ${lib.escapeShellArgs cfg.extraFlags} \
+          ${lib.escapeShellArgs cfg.extraFlags}
         '';
         Type = "simple";
         User = "restic";

nixos/modules/services/databases/dgraph.nix

@@ -16,7 +16,7 @@ let
       ''
         mkdir -p $out/bin
         makeWrapper ${cfg.package}/bin/dgraph $out/bin/dgraph \
-          --prefix PATH : "${lib.makeBinPath [ pkgs.nodejs ]}" \
+          --prefix PATH : "${lib.makeBinPath [ pkgs.nodejs ]}"
       '';
   securityOptions = {
     NoNewPrivileges = true;

nixos/modules/services/monitoring/prometheus/exporters/collectd.nix

@@ -86,7 +86,7 @@ in
     let
       collectSettingsArgs = optionalString (cfg.collectdBinary.enable) ''
         --collectd.listen-address ${cfg.collectdBinary.listenAddress}:${toString cfg.collectdBinary.port} \
-        --collectd.security-level ${cfg.collectdBinary.securityLevel} \
+        --collectd.security-level ${cfg.collectdBinary.securityLevel}
       '';
     in
     {

nixos/modules/services/networking/teamspeak3.nix

@@ -185,7 +185,7 @@ in
             ${optionalString (cfg.fileTransferIP != null) "filetransfer_ip=${cfg.fileTransferIP}"} \
             ${optionalString (cfg.queryIP != null) "query_ip=${cfg.queryIP}"} \
             ${optionalString (cfg.queryIP != null) "query_ssh_ip=${cfg.queryIP}"} \
-            ${optionalString (cfg.queryIP != null) "query_http_ip=${cfg.queryIP}"} \
+            ${optionalString (cfg.queryIP != null) "query_http_ip=${cfg.queryIP}"}
         '';
         WorkingDirectory = cfg.dataDir;
         User = user;

nixos/modules/services/ttys/getty.nix

@@ -163,6 +163,9 @@ in
       ];
       environment.TTY = "%I";
       restartIfChanged = false;
+      # logind hardcodes spawning autovt@ttyN.service on VT switch. Upstream
+      # declares this alias via [Install] Alias=, which NixOS does not process.
+      aliases = [ "autovt@.service" ];
     };
 
     systemd.services."serial-getty@" = {
@@ -173,14 +176,6 @@ in
       restartIfChanged = false;
     };
 
-    systemd.services."autovt@" = {
-      serviceConfig.ExecStart = [
-        "" # override upstream default with an empty ExecStart
-        (gettyCmd "--noclear %I $TERM")
-      ];
-      restartIfChanged = false;
-    };
-
     systemd.services."container-getty@" = {
       serviceConfig.ExecStart = [
         "" # override upstream default with an empty ExecStart

nixos/modules/services/ttys/kmscon.nix

@@ -172,10 +172,15 @@ in
       ];
 
       restartIfChanged = false;
+      # logind spawns autovt@ttyN.service on VT switch; point it at kmscon
       aliases = [ "autovt@.service" ];
     };
 
-    systemd.suppressedSystemUnits = [ "autovt@.service" ];
+    # tty1 is special: logind does not spawn autovt@tty1, it expects a static
+    # pull-in via getty.target. With getty@ suppressed, we must replace it.
+    systemd.services."kmsconvt@tty1".wantedBy = [ "getty.target" ];
+
+    systemd.suppressedSystemUnits = [ "getty@.service" ];
 
     services.kmscon.extraConfig =
       let

nixos/modules/services/video/epgstation/default.nix

@@ -306,7 +306,7 @@ in
       group = config.users.groups.epgstation.name;
       isSystemUser = true;
 
-      # NPM insists on creating ~/.npm
+      # npm insists on creating ~/.npm
       home = "/var/cache/epgstation";
     };
 

nixos/modules/services/video/mirakurun.nix

@@ -160,7 +160,7 @@ in
       group = "video";
       isSystemUser = true;
 
-      # NPM insists on creating ~/.npm
+      # npm insists on creating ~/.npm
       home = "/var/cache/mirakurun";
     };
 

nixos/modules/services/web-apps/node-red.nix

@@ -29,7 +29,7 @@ in
       type = types.bool;
       default = false;
       description = ''
-        Give Node-RED access to NPM and GCC at runtime, so 'Nodes' can be
+        Give Node-RED access to npm and GCC at runtime, so 'Nodes' can be
         downloaded and managed imperatively via the 'Palette Manager'.
       '';
     };

nixos/modules/services/x11/unclutter-xfixes.nix

@@ -55,7 +55,7 @@ in
         ${cfg.package}/bin/unclutter \
           --timeout ${toString cfg.timeout} \
           --jitter ${toString (cfg.threshold - 1)} \
-          ${concatMapStrings (x: " --" + x) cfg.extraOptions} \
+          ${concatMapStrings (x: " --" + x) cfg.extraOptions}
       '';
       serviceConfig.RestartSec = 3;
       serviceConfig.Restart = "always";

nixos/modules/services/x11/unclutter.nix

@@ -69,7 +69,7 @@ in
           -jitter ${toString (cfg.threshold - 1)} \
           ${optionalString cfg.keystroke "-keystroke"} \
           ${concatMapStrings (x: " -" + x) cfg.extraOptions} \
-          -not ${concatStringsSep " " cfg.excluded} \
+          -not ${concatStringsSep " " cfg.excluded}
       '';
       serviceConfig.PassEnvironment = "DISPLAY";
       serviceConfig.RestartSec = 3;

nixos/modules/system/boot/networkd.nix

@@ -4175,8 +4175,11 @@ let
           "systemd-networkd.service"
           "systemd-networkd.socket"
           "systemd-networkd-persistent-storage.service"
+          "systemd-networkd-varlink-metrics.socket"
         ];
 
+        systemd.sockets.systemd-networkd-varlink-metrics.wantedBy = [ "sockets.target" ];
+
         environment.etc."systemd/networkd.conf" = renderConfig cfg.config;
 
         systemd.services.systemd-networkd =

nixos/modules/system/boot/systemd.nix

@@ -854,16 +854,6 @@ in
       };
     };
 
-    # Remove with systemd 259.4
-    security.polkit.extraConfig = mkIf config.security.polkit.enable ''
-      polkit.addRule(function(action, subject) {
-          if (action.id == "org.freedesktop.machine1.register-machine" &&
-              subject.user != "root") {
-              return polkit.Result.AUTH_ADMIN_KEEP;
-          }
-      });
-    '';
-
     # run0 is supposed to authenticate the user via polkit and then run a command. Without this next
     # part, run0 would fail to run the command even if authentication is successful and the user has
     # permission to run the command. This next part is only enabled if polkit is enabled because the

nixos/modules/system/boot/systemd/journald.nix

@@ -130,6 +130,8 @@ in
       "systemd-journald-sync@.service"
       "systemd-journald-audit.socket"
       "systemd-journald-dev-log.socket"
+      "systemd-journalctl.socket"
+      "systemd-journalctl@.service"
       "syslog.socket"
     ];
 

nixos/modules/system/boot/systemd/logind.nix

@@ -43,7 +43,6 @@
   config = {
     systemd.additionalUpstreamSystemUnits = [
       "systemd-logind.service"
-      "autovt@.service"
       "systemd-user-sessions.service"
     ]
     ++ lib.optionals config.systemd.package.withImportd [

nixos/tests/matrix/mjolnir.nix

@@ -17,7 +17,7 @@ let
   csr = runWithOpenSSL "matrix.csr" ''
     openssl req \
        -new -key ${key} \
-       -out $out -subj "/CN=localhost" \
+       -out $out -subj "/CN=localhost"
   '';
   cert = runWithOpenSSL "matrix_cert.pem" ''
     openssl x509 \

nixos/tests/matrix/pantalaimon.nix

@@ -19,7 +19,7 @@ let
   csr = runWithOpenSSL "matrix.csr" ''
     openssl req \
        -new -key ${key} \
-       -out $out -subj "/CN=localhost" \
+       -out $out -subj "/CN=localhost"
   '';
   cert = runWithOpenSSL "matrix_cert.pem" ''
     openssl x509 \

nixos/tests/systemd-pstore.nix

@@ -1,14 +1,39 @@
 {
   name = "systemd-pstore";
 
-  nodes.machine = { };
+  nodes.machine = {
+    virtualisation.useEFIBoot = true;
+    boot.initrd.systemd.enable = true;
+    testing.initrdBackdoor = true;
+  };
 
   testScript = ''
+    machine.switch_root()
     with subtest("pstore API fs is mounted"):
       machine.succeed("stat /sys/fs/pstore")
 
     with subtest("systemd-pstore.service doesn't run because nothing crashed"):
       output = machine.execute("systemctl status systemd-pstore.service", check_return=False)[1]
       t.assertIn("condition unmet", output)
+      machine.fail("stat /var/lib/systemd/pstore/*/*/dmesg.txt")
+
+    with subtest("systemd-pstore.service saves dmesg.txt files"):
+      machine.execute("echo c > /proc/sysrq-trigger", check_return=False, check_output=False)
+      machine.wait_for_shutdown()
+      machine.switch_root()
+      machine.wait_for_unit("systemd-pstore.service")
+      machine.succeed("stat /var/lib/systemd/pstore/*/*/dmesg.txt")
+
+    with subtest("crashes in initrd can be recovered too"):
+      machine.succeed(
+        "rm -r /var/lib/systemd/pstore/*",
+        "sync",
+      )
+      machine.shutdown()
+      machine.execute("echo c > /proc/sysrq-trigger", check_return=False, check_output=False)
+      machine.wait_for_shutdown()
+      machine.switch_root()
+      machine.wait_for_unit("systemd-pstore.service")
+      machine.succeed("stat /var/lib/systemd/pstore/*/*/dmesg.txt")
   '';
 }

nixos/tests/timezone.nix

@@ -44,6 +44,18 @@
           print(date_result)
           assert date_result == "1970-01-01 09:00:00\n", "Timezone was not adjusted"
 
+          # Stop systemd-timedated.service to clear /etc/localtime read cache
+          node_nulltz.systemctl("stop systemd-timedated.service")
+          timedatectl_result = node_nulltz.succeed("timedatectl status")
+          print(timedatectl_result)
+          assert "Asia/Tokyo" in timedatectl_result, "'timedatectl status' output is missing 'Asia/Tokyo'"
+
+      with subtest("imperative - Ensure /etc/localtime symlink includes '/zoneinfo/' like icu expects"):
+          # https://github.com/unicode-org/icu/blob/release-78.3/icu4c/source/common/putil.cpp#L686-L695
+          readlink_result = node_nulltz.succeed("readlink --no-newline /etc/localtime")
+          print(readlink_result)
+          assert "/zoneinfo/" in readlink_result, f"/etc/localtime symlink is missing '/zoneinfo/': {readlink_result}"
+
       with subtest("imperative - Ensure timezone adjustment persists across reboot"):
           # Adjustment should persist across a reboot
           node_nulltz.shutdown()

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.2.0106";
+  version = "9.2.0272";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-byOf2Gr1vA7xQw3YHV454te1QrVxRy3sXrLdFUp2XRg=";
+    hash = "sha256-9y+dZYbwuIzgseXdg/k8fqZ5JiohgOiK00evMwF9HOM=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/emulators/wine/sources.nix

@@ -92,6 +92,14 @@ let
     })
   ];
 
+  patches-add-dll-accept-device-paths-wine-older-than-11_1 = [
+    (pkgs.fetchpatch {
+      name = "add-dll-accept-device-paths";
+      url = "https://gitlab.winehq.org/wine/wine/-/commit/401910ae25a11032f2da7baa1666d71e8bca2496.patch";
+      hash = "sha256-2726u9/vhhx39Tq7vOw24hslmeyZZEbxRRqe7JMFvCU";
+    })
+  ];
+
   inherit (pkgs) writeShellScript;
 in
 rec {
@@ -123,7 +131,8 @@ rec {
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
       ./cert-path.patch
-    ];
+    ]
+    ++ patches-add-dll-accept-device-paths-wine-older-than-11_1;
 
     updateScript = writeShellScript "update-wine-stable" ''
       ${updateScriptPreamble}

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -15,7 +15,7 @@
   qtwayland,
   kcoreaddons,
   lz4,
-  xxHash,
+  xxhash,
   ffmpeg_6,
   protobuf,
   openal-soft,
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     qtbase
     qtsvg
     lz4
-    xxHash
+    xxhash
     ffmpeg_6
     openal-soft
     minizip-ng

pkgs/applications/networking/sync/rsync/default.nix

@@ -15,7 +15,7 @@
   enableOpenSSL ? true,
   openssl,
   enableXXHash ? true,
-  xxHash,
+  xxhash,
   enableZstd ? true,
   zstd,
   nixosTests,
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   ++ lib.optional enableZstd zstd
   ++ lib.optional enableLZ4 lz4
   ++ lib.optional enableOpenSSL openssl
-  ++ lib.optional enableXXHash xxHash;
+  ++ lib.optional enableXXHash xxhash;
 
   configureFlags = [
     (lib.enableFeature enableLZ4 "lz4")

pkgs/applications/science/logic/hol_light/default.nix

@@ -24,7 +24,7 @@ let
       lib.optionalString (num != null) ''
         -I ${num}/lib/ocaml/${ocaml.version}/site-lib/num \
         -I ${num}/lib/ocaml/${ocaml.version}/site-lib/top-num \
-        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/stublibs \
+        -I ${num}/lib/ocaml/${ocaml.version}/site-lib/stublibs
       '';
 
   start_script = ''

pkgs/applications/virtualization/krunvm/default.nix

@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram $out/bin/krunvm \
-      --prefix PATH : ${lib.makeBinPath [ buildah ]} \
+      --prefix PATH : ${lib.makeBinPath [ buildah ]}
   '';
 
   meta = {

pkgs/build-support/buildenv/builder.pl

@@ -12,10 +12,35 @@ STDOUT->autoflush(1);
 $SIG{__WARN__} = sub { warn "pkgs.buildEnv warning: ", @_ };
 $SIG{__DIE__}  = sub { die "pkgs.buildEnv error: ", @_ };
 
-my $out = $ENV{"out"};
-my $extraPrefix = $ENV{"extraPrefix"};
+my $out;
+my $extraPrefix;
+my @pathsToLink;
+my $ignoreCollisions;
+my $checkCollisionContents;
+my $ignoreSingleFileOutputs;
+my @chosenOutputsRefs;
+my $extraPathsFrom;
+my $manifest;
 
-my @pathsToLink = @{decode_json $ENV{"pathsToLinkJSON"}};
+if ($ENV{"NIX_ATTRS_JSON_FILE"} // "") {
+    open FILE, $ENV{"NIX_ATTRS_JSON_FILE"} or die "cannot open structured attrs JSON file $ENV{NIX_ATTRS_JSON_FILE}: $!";
+    my $json_text = do { local $/; <FILE> };
+    my $attrsFromJSONRef = decode_json $json_text;
+    close FILE;
+
+    my $outputsRef = $attrsFromJSONRef->{"outputs"};
+    $out = $outputsRef->{"out"} // (values %{$outputsRef})[0];
+    $extraPrefix = $attrsFromJSONRef->{"extraPrefix"};
+    @pathsToLink = @{$attrsFromJSONRef->{"pathsToLink"}};
+    $ignoreCollisions = $attrsFromJSONRef->{"ignoreCollisions"};
+    $checkCollisionContents = $attrsFromJSONRef->{"checkCollisionContents"};
+    $ignoreSingleFileOutputs = $attrsFromJSONRef->{"ignoreSingleFileOutputs"};
+    @chosenOutputsRefs = @{$attrsFromJSONRef->{"chosenOutputs"}};
+    $extraPathsFrom = $attrsFromJSONRef->{"extraPathsFrom"};
+    $manifest = $attrsFromJSONRef->{"manifest"};
+} else {
+    die "missing required environment variable NIX_ATTRS_JSON_FILE";
+}
 
 sub isInPathsToLink($path) {
     $path = "/" if $path eq "";
@@ -210,26 +235,15 @@ sub addPkg($pkgDir, $ignoreCollisions, $checkCollisionContents, $priority, $igno
     }
 }
 
-# Read packages list.
-my $pkgs;
-
-if (exists $ENV{"pkgsPath"}) {
-    open FILE, $ENV{"pkgsPath"};
-    $pkgs = <FILE>;
-    close FILE;
-} else {
-    $pkgs = $ENV{"pkgs"}
-}
-
 # Symlink to the packages that have been installed explicitly by the
 # user.
-for my $pkg (@{decode_json $pkgs}) {
+for my $pkg (@chosenOutputsRefs) {
     for my $path (@{$pkg->{paths}}) {
         addPkg($path,
-               $ENV{"ignoreCollisions"} eq "1",
-               $ENV{"checkCollisionContents"} eq "1",
+               $ignoreCollisions,
+               $checkCollisionContents,
                $pkg->{priority},
-               $ENV{"ignoreSingleFileOutputs"} eq "1")
+               $ignoreSingleFileOutputs)
            if -e $path;
     }
 }
@@ -244,21 +258,20 @@ while (scalar(keys %postponed) > 0) {
     my @pkgDirs = keys %postponed;
     %postponed = ();
     foreach my $pkgDir (sort @pkgDirs) {
-        addPkg($pkgDir, 2, $ENV{"checkCollisionContents"} eq "1", $priorityCounter++, $ENV{"ignoreSingleFileOutputs"} eq "1");
+        addPkg($pkgDir, 2, $checkCollisionContents, $priorityCounter++, $ignoreSingleFileOutputs);
     }
 }
 
-my $extraPathsFilePath = $ENV{"extraPathsFrom"};
-if ($extraPathsFilePath) {
-    open FILE, $extraPathsFilePath or die "cannot open extra paths file $extraPathsFilePath: $!";
+if ($extraPathsFrom) {
+    open FILE, $extraPathsFrom or die "cannot open extra paths file $extraPathsFrom: $!";
 
     while(my $line = <FILE>) {
         chomp $line;
         addPkg($line,
-               $ENV{"ignoreCollisions"} eq "1",
-               $ENV{"checkCollisionContents"} eq "1",
+               $ignoreCollisions,
+               $checkCollisionContents,
                1000,
-               $ENV{"ignoreSingleFileOutputs"} eq "1")
+               $ignoreSingleFileOutputs)
             if -d $line;
     }
 
@@ -286,7 +299,6 @@ foreach my $relName (sort keys %symlinks) {
 print STDERR "created $nrLinks symlinks in user environment\n";
 
 
-my $manifest = $ENV{"manifest"};
 if ($manifest) {
     symlink($manifest, "$out/manifest") or die "cannot create manifest";
 }

pkgs/build-support/buildenv/default.nix

@@ -1,9 +1,9 @@
-# buildEnv creates a tree of symlinks to the specified paths.  This is
-# a fork of the hardcoded buildEnv in the Nix distribution.
+# buildEnv creates a tree of symlinks to the specified paths.
+# This is a fork of the hardcoded buildEnv in the Nix distribution.
 
 {
   buildPackages,
-  runCommand,
+  stdenvNoCC,
   lib,
   replaceVars,
   writeClosure,
@@ -15,115 +15,153 @@ let
   };
 in
 
+# Backward compatibility for deprecated custom overrider <env-pkg>.override
+# TODO(@ShamrockLee): Warn, throw and remove after tree-wide transition.
 lib.makeOverridable (
-  {
-    name ? lib.throwIf (
-      pname == null || version == null
-    ) "buildEnv: expect arguments 'pname' and 'version' or 'name'" "${pname}-${version}",
-    pname ? null,
-    version ? null,
+  lib.extendMkDerivation {
+    constructDrv = stdenvNoCC.mkDerivation;
+    excludeDrvArgNames = [
+      # Override these arguments directly
+      "derivationArgs"
 
-    # The manifest file (if any).  A symlink $out/manifest will be
-    # created to it.
-    manifest ? "",
-
-    # The paths to symlink.
-    paths,
-
-    # Whether to ignore collisions or abort.
-    ignoreCollisions ? false,
-
-    # Whether to ignore outputs that are a single file instead of a directory.
-    ignoreSingleFileOutputs ? false,
-
-    # Whether to include closures of all input paths.
-    includeClosures ? false,
-
-    # If there is a collision, check whether the contents and permissions match
-    # and only if not, throw a collision error.
-    checkCollisionContents ? true,
-
-    # The paths (relative to each element of `paths') that we want to
-    # symlink (e.g., ["/bin"]).  Any file not inside any of the
-    # directories in the list is not symlinked.
-    pathsToLink ? [ "/" ],
-
-    # The package outputs to include. By default, only the default
-    # output is included.
-    extraOutputsToInstall ? [ ],
-
-    # Root the result in directory "$out${extraPrefix}", e.g. "/share".
-    extraPrefix ? "",
-
-    # Shell commands to run after building the symlink tree.
-    postBuild ? "",
-
-    # Additional inputs
-    nativeBuildInputs ? [ ], # Handy e.g. if using makeWrapper in `postBuild`.
-    buildInputs ? [ ],
-
-    passthru ? { },
-    meta ? { },
-  }:
-  let
-    chosenOutputs = map (drv: {
-      paths =
-        # First add the usual output(s): respect if user has chosen explicitly,
-        # and otherwise use `meta.outputsToInstall`. The attribute is guaranteed
-        # to exist in mkDerivation-created cases. The other cases (e.g. runCommand)
-        # aren't expected to have multiple outputs.
-        (
-          if
-            (!drv ? outputSpecified || !drv.outputSpecified) && drv.meta.outputsToInstall or null != null
-          then
-            map (outName: drv.${outName}) drv.meta.outputsToInstall
-          else
-            [ drv ]
-        )
-        # Add any extra outputs specified by the caller of `buildEnv`.
-        ++ lib.filter (p: p != null) (map (outName: drv.${outName} or null) extraOutputsToInstall);
-      priority = drv.meta.priority or lib.meta.defaultPriority;
-    }) paths;
-
-    pathsForClosure = lib.pipe chosenOutputs [
-      (map (p: p.paths))
-      lib.flatten
-      (lib.remove null)
+      # `meta.outputsToInstall` and `extraOutputsToInstall` does not necessarily include the first
+      # element of outputs, while the outPath of the latter will be the string-interpolated result.
+      # Exclude to prevent unexpected context.
+      "paths"
     ];
-  in
-  runCommand name
-    (
-      rec {
+
+    extendDrvArgs =
+      finalAttrs:
+      {
+        # The manifest file (if any).  A symlink $out/manifest will be
+        # created to it.
+        manifest ? "",
+
+        # The paths to symlink.
+        paths,
+
+        # Whether to ignore collisions or abort.
+        ignoreCollisions ? false,
+
+        # Whether to ignore outputs that are a single file instead of a directory.
+        ignoreSingleFileOutputs ? false,
+
+        # Whether to include closures of all input paths.
+        includeClosures ? false,
+
+        # If there is a collision, check whether the contents and permissions match
+        # and only if not, throw a collision error.
+        checkCollisionContents ? true,
+
+        # The paths (relative to each element of `paths') that we want to
+        # symlink (e.g., ["/bin"]).  Any file not inside any of the
+        # directories in the list is not symlinked.
+        pathsToLink ? [ "/" ],
+
+        # The package outputs to include. By default, only the default
+        # output is included.
+        extraOutputsToInstall ? [ ],
+
+        # Root the result in directory "$out${extraPrefix}", e.g. "/share".
+        extraPrefix ? "",
+
+        # Shell commands to run after building the symlink tree.
+        postBuild ? "",
+
+        passthru ? { },
+        meta ? { },
+
+        # Additional stdenv.mkDerivation arguments
+        # such as nativeBuildInputs/buildInputs for postBuild dependencies.
+        derivationArgs ? { },
+
+        # Placeholder name arguments.
+        name ? null,
+        pname ? null,
+        version ? null,
+
+        # `stdenv.mkDerivation` args before introducing derivationArgs.
+        nativeBuildInputs ? null,
+        buildInputs ? null,
+      }@args:
+      let
+        compatArgs =
+          lib.optionalAttrs (args ? nativeBuildInputs) {
+            inherit nativeBuildInputs;
+          }
+          // lib.optionalAttrs (args ? buildInputs) {
+            inherit buildInputs;
+          };
+      in
+      compatArgs
+      // derivationArgs
+      // {
+        # Explicitly opt in: builder.pl reads all configuration from file $ENV["NIX_ATTRS_JSON_FILE"].
+        __structuredAttrs = true;
+
         inherit
+          extraOutputsToInstall
           manifest
           ignoreCollisions
           checkCollisionContents
           ignoreSingleFileOutputs
-          passthru
+          includeClosures
           meta
           pathsToLink
           extraPrefix
           postBuild
-          nativeBuildInputs
-          buildInputs
           ;
-        pathsToLinkJSON = builtins.toJSON pathsToLink;
-        pkgs = builtins.toJSON chosenOutputs;
-        extraPathsFrom = lib.optional includeClosures (writeClosure pathsForClosure);
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-        # XXX: The size is somewhat arbitrary
-        passAsFile = if builtins.stringLength pkgs >= 128 * 1024 then [ "pkgs" ] else [ ];
-      }
-      // lib.optionalAttrs (pname != null) {
-        inherit pname;
-      }
-      // lib.optionalAttrs (version != null) {
-        inherit version;
-      }
-    )
-    ''
-      ${buildPackages.perl}/bin/perl -w ${builder}
-      eval "$postBuild"
-    ''
+
+        chosenOutputs = map (drv: {
+          paths =
+            # First add the usual output(s): respect if user has chosen explicitly,
+            # and otherwise use `meta.outputsToInstall`. The attribute is guaranteed
+            # to exist in mkDerivation-created cases. The other cases (e.g. runCommand)
+            # aren't expected to have multiple outputs.
+            (
+              if
+                (!drv ? outputSpecified || !drv.outputSpecified) && drv.meta.outputsToInstall or null != null
+              then
+                map (outName: drv.${outName}) drv.meta.outputsToInstall
+              else
+                [ drv ]
+            )
+            # Add any extra outputs specified by the caller of `buildEnv`.
+            ++ lib.filter (p: p != null) (
+              map (outName: drv.${outName} or null) finalAttrs.extraOutputsToInstall
+            );
+          priority = drv.meta.priority or lib.meta.defaultPriority;
+          # Silently use the original `paths` if `passthru.paths` is missing.
+        }) finalAttrs.passthru.paths or paths;
+
+        extraPathsFrom = lib.optionalString finalAttrs.includeClosures (
+          let
+            pathsForClosure = lib.pipe finalAttrs.chosenOutputs [
+              (map (p: p.paths))
+              lib.flatten
+              (lib.remove null)
+            ];
+          in
+          writeClosure pathsForClosure
+        );
+
+        preferLocalBuild = derivationArgs.preferLocalBuild or true;
+        allowSubstitutes = derivationArgs.allowSubstitutes or false;
+
+        buildCommand = ''
+          ${buildPackages.perl}/bin/perl -w ${builder}
+          eval "$postBuild"
+        '';
+
+        passthru = {
+          # The `paths` attribute is referenced and overridden from passthru
+          inherit paths;
+        }
+        // derivationArgs.passthru or { }
+        // passthru;
+      };
+
+    # Function argument set pattern doesn't have an ellipsis
+    inheritFunctionArgs = false;
+  }
 )

pkgs/build-support/cc-wrapper/default.nix

@@ -786,29 +786,31 @@ stdenvNoCC.mkDerivation {
     # This confuses libtool.  So add it to the compiler tool search
     # path explicitly.
     + optionalString (!nativeTools && !isArocc) ''
+      ccLDFlags=()
+      ccCFlags=()
       if [ -e "${cc_solib}/lib64" -a ! -L "${cc_solib}/lib64" ]; then
-        ccLDFlags+=" -L${cc_solib}/lib64"
-        ccCFlags+=" -B${cc_solib}/lib64"
+        ccLDFlags+=("-L${cc_solib}/lib64")
+        ccCFlags+=("-B${cc_solib}/lib64")
       fi
-      ccLDFlags+=" -L${cc_solib}/lib"
-      ccCFlags+=" -B${cc_solib}/lib"
+      ccLDFlags+=("-L${cc_solib}/lib")
+      ccCFlags+=("-B${cc_solib}/lib")
 
     ''
     + optionalString (cc.langAda or false && !isArocc) ''
       touch "$out/nix-support/gnat-cflags"
       touch "$out/nix-support/gnat-ldflags"
       basePath=$(echo $cc/lib/*/*/*)
-      ccCFlags+=" -B$basePath -I$basePath/adainclude"
+      ccCFlags+=("-B$basePath" "-I$basePath/adainclude")
       gnatCFlags="-I$basePath/adainclude -I$basePath/adalib"
 
       echo "$gnatCFlags" >> $out/nix-support/gnat-cflags
     ''
     + ''
-      echo "$ccLDFlags" >> $out/nix-support/cc-ldflags
-      echo "$ccCFlags" >> $out/nix-support/cc-cflags
+      echo "''${ccLDFlags[*]}" >> $out/nix-support/cc-ldflags
+      echo "''${ccCFlags[*]}" >> $out/nix-support/cc-cflags
     ''
     + optionalString (targetPlatform.isDarwin && (libcxx != null) && (cc.isClang or false)) ''
-      echo " -L${libcxx_solib}" >> $out/nix-support/cc-ldflags
+      echo "-L${libcxx_solib}" >> $out/nix-support/cc-ldflags
     ''
 
     ## Prevent clang from seeing /usr/include. There is a desire to achieve this
@@ -830,7 +832,7 @@ stdenvNoCC.mkDerivation {
           && !targetPlatform.isAndroid
         )
         ''
-          echo " -nostdlibinc" >> $out/nix-support/cc-cflags
+          echo "-nostdlibinc" >> $out/nix-support/cc-cflags
         ''
 
     ##
@@ -867,7 +869,7 @@ stdenvNoCC.mkDerivation {
           );
       in
       optionalString enable_fp ''
-        echo " -fno-omit-frame-pointer ${optionalString enable_leaf_fp "-mno-omit-leaf-frame-pointer "}" >> $out/nix-support/cc-cflags-before
+        echo "-fno-omit-frame-pointer${optionalString enable_leaf_fp " -mno-omit-leaf-frame-pointer"}" >> $out/nix-support/cc-cflags-before
       ''
     )
 

pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh

@@ -95,9 +95,9 @@ npmConfigHook() {
     fi
 
     export CACHE_MAP_PATH="$TMP/MEOW"
-    @prefetchNpmDeps@ --map-cache
+    npmDeps="$npmDeps" @prefetchNpmDeps@ --map-cache
 
-    @prefetchNpmDeps@ --fixup-lockfile "$srcLockfile"
+    npmDeps="$npmDeps" @prefetchNpmDeps@ --fixup-lockfile "$srcLockfile"
 
     local cachePath
 

pkgs/build-support/node/import-npm-lock/default.nix

@@ -12,6 +12,7 @@ let
     match
     elemAt
     toJSON
+    toFile
     removeAttrs
     ;
   inherit (lib) importJSON mapAttrs;
@@ -157,18 +158,15 @@ lib.fix (self: {
       {
         inherit pname version;
 
-        passAsFile = [
-          "package"
-          "packageLock"
-        ];
+        package = toFile (toJSON packageJSON');
+        packageLock = toFile (toJSON packageLock');
 
-        package = toJSON packageJSON';
-        packageLock = toJSON packageLock';
+        __structuredAttrs = true;
       }
       ''
         mkdir $out
-        cp "$packagePath" $out/package.json
-        cp "$packageLockPath" $out/package-lock.json
+        cp "${package}" > $out/package.json
+        cp "${packageLock}" > $out/package-lock.json
       '';
 
   # Build node modules from package.json & package-lock.json
@@ -180,6 +178,11 @@ lib.fix (self: {
       nodejs,
       derivationArgs ? { },
     }:
+    let
+      # Backwards compatibility: if derivationArgs contains passAsFile,
+      # we can't force structuredAttrs here yet.
+      __structuredAttrs = !(derivationArgs ? passAsFile);
+    in
     stdenv.mkDerivation (
       {
         pname = derivationArgs.pname or "${getName package}-node-modules";
@@ -213,17 +216,29 @@ lib.fix (self: {
         ++ lib.optionals stdenv.hostPlatform.isDarwin [ cctools ]
         ++ derivationArgs.nativeBuildInputs or [ ];
 
+        postPatch =
+          (
+            if __structuredAttrs then
+              ''
+                printf "%s" "$package" > package.json
+                printf "%s" "$packageLock" > package-lock.json
+              ''
+            else
+              ''
+                cp --no-preserve=mode "$packagePath" package.json
+                cp --no-preserve=mode "$packageLockPath" package-lock.json
+              ''
+          )
+          + derivationArgs.postPatch or "";
+
+        inherit __structuredAttrs;
+      }
+      // lib.optionalAttrs (!__structuredAttrs) {
         passAsFile = [
           "package"
           "packageLock"
         ]
-        ++ derivationArgs.passAsFile or [ ];
-
-        postPatch = ''
-          cp --no-preserve=mode "$packagePath" package.json
-          cp --no-preserve=mode "$packageLockPath" package-lock.json
-        ''
-        + derivationArgs.postPatch or "";
+        ++ derivationArgs.passAsFile;
       }
     );
 

pkgs/build-support/node/prefetch-npm-deps/default.nix

@@ -263,7 +263,7 @@
             exit 1
           fi
 
-          prefetch-npm-deps $srcLockfile $out
+          outputHash="${hash_.outputHash}" prefetch-npm-deps $srcLockfile $out
 
           runHook postBuild
         '';
@@ -274,29 +274,31 @@
         # `{ "registry.example.com": "example-registry-bearer-token", ... }`
         impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_TOKENS" ];
 
-        NIX_NPM_REGISTRY_OVERRIDES = npmRegistryOverridesString;
+        env = {
+          NIX_NPM_REGISTRY_OVERRIDES = npmRegistryOverridesString;
 
-        # Fetcher version controls which features are enabled in prefetch-npm-deps
-        # Version 2+ enables packument fetching for workspace support
-        NPM_FETCHER_VERSION = toString fetcherVersion;
+          # Fetcher version controls which features are enabled in prefetch-npm-deps
+          # Version 2+ enables packument fetching for workspace support
+          NPM_FETCHER_VERSION = toString fetcherVersion;
 
-        SSL_CERT_FILE =
-          if
-            (
-              hash_.outputHash == ""
-              || hash_.outputHash == lib.fakeSha256
-              || hash_.outputHash == lib.fakeSha512
-              || hash_.outputHash == lib.fakeHash
-            )
-          then
-            "${cacert}/etc/ssl/certs/ca-bundle.crt"
-          else
-            "/no-cert-file.crt";
+          SSL_CERT_FILE =
+            if
+              (
+                hash_.outputHash == ""
+                || hash_.outputHash == lib.fakeSha256
+                || hash_.outputHash == lib.fakeSha512
+                || hash_.outputHash == lib.fakeHash
+              )
+            then
+              "${cacert}/etc/ssl/certs/ca-bundle.crt"
+            else
+              "/no-cert-file.crt";
+        }
+        // forceGitDeps_
+        // forceEmptyCache_;
 
         outputHashMode = "recursive";
       }
       // hash_
-      // forceGitDeps_
-      // forceEmptyCache_
     );
 }

pkgs/build-support/node/prefetch-npm-deps/src/util.rs

@@ -57,7 +57,7 @@ pub fn get_url(url: &Url) -> Result<Body, anyhow::Error> {
         && let Ok(tokens) = serde_json::from_str::<Map<String, Value>>(&npm_tokens)
         && let Some(token) = tokens.get(host).and_then(serde_json::Value::as_str)
     {
-        info!("Found NPM token for {host}. Adding authorization header to request.");
+        info!("Found npm token for {host}. Adding authorization header to request.");
         request = request.header("Authorization", format!("Bearer {token}"));
     }
 

pkgs/build-support/rust/import-cargo-lock.nix

@@ -263,26 +263,32 @@ let
   vendorDir =
     runCommand "cargo-vendor-dir"
       (
-        if lockFile == null then
-          {
-            inherit lockFileContents;
-            passAsFile = [ "lockFileContents" ];
-          }
-        else
-          {
-            passthru = {
-              inherit lockFile;
-            };
-          }
+        {
+          __structuredAttrs = true;
+        }
+        // (
+          if lockFile == null then
+            {
+              inherit lockFileContents;
+            }
+          else
+            {
+              passthru = {
+                inherit lockFile;
+              };
+            }
+        )
       )
       ''
             mkdir -p $out/.cargo
 
             ${
-              if lockFile != null then
-                "ln -s ${lockFile} $out/Cargo.lock"
+              if lockFile == null then
+                ''
+                  printf "%s" "$lockFileContents" > "$out/Cargo.lock"
+                ''
               else
-                "cp $lockFileContentsPath $out/Cargo.lock"
+                "ln -s ${lockFile} $out/Cargo.lock"
             }
 
             cat > $out/.cargo/config.toml <<EOF

pkgs/build-support/rust/lib/default.nix

@@ -77,7 +77,7 @@
       + lib.optionalString (rustTargetPlatform != rustHostPlatform) ''
         "CC_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${ccForTarget}" \
         "CXX_${stdenv.targetPlatform.rust.cargoEnvVarTarget}=${cxxForTarget}" \
-        "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForTarget}" \
+        "CARGO_TARGET_${stdenv.targetPlatform.rust.cargoEnvVarTarget}_LINKER=${ccForTarget}"
       '';
     };
 }

pkgs/build-support/rust/rustc-wrapper/default.nix

@@ -3,38 +3,38 @@
   runCommand,
   rustc-unwrapped,
   sysroot ? null,
+  stdenvNoCC,
+  shell ? stdenvNoCC.shell,
 }:
+let
+  sysrootFlag = lib.optionalString (sysroot != null) "--sysroot ${sysroot}";
 
+  # Upstream rustc still assumes that musl = static[1].  The fix for
+  # this is to disable crt-static by default for non-static musl
+  # targets.
+  #
+  # Even though Cargo will build build.rs files for the build platform,
+  # cross-compiling _from_ musl appears to work fine, so we only need
+  # to do this when rustc's target platform is dynamically linked musl.
+  #
+  # [1]: https://github.com/rust-lang/compiler-team/issues/422
+  #
+  # WARNING: using defaultArgs is dangerous, as it will apply to all
+  # targets used by this compiler (host and target).  This means
+  # that it can't be used to set arguments that should only be
+  # applied to the target.  It's fine to do this for -crt-static,
+  # because rustc does not support +crt-static host platforms
+  # anyway.
+  defaultArgs = lib.optionalString (
+    with rustc-unwrapped.stdenv.targetPlatform; isMusl && !isStatic
+  ) "-C target-feature=-crt-static";
+in
 runCommand "${rustc-unwrapped.pname}-wrapper-${rustc-unwrapped.version}"
   {
     preferLocalBuild = true;
     strictDeps = true;
     inherit (rustc-unwrapped) outputs;
 
-    env = {
-      sysroot = lib.optionalString (sysroot != null) "--sysroot ${sysroot}";
-
-      # Upstream rustc still assumes that musl = static[1].  The fix for
-      # this is to disable crt-static by default for non-static musl
-      # targets.
-      #
-      # Even though Cargo will build build.rs files for the build platform,
-      # cross-compiling _from_ musl appears to work fine, so we only need
-      # to do this when rustc's target platform is dynamically linked musl.
-      #
-      # [1]: https://github.com/rust-lang/compiler-team/issues/422
-      #
-      # WARNING: using defaultArgs is dangerous, as it will apply to all
-      # targets used by this compiler (host and target).  This means
-      # that it can't be used to set arguments that should only be
-      # applied to the target.  It's fine to do this for -crt-static,
-      # because rustc does not support +crt-static host platforms
-      # anyway.
-      defaultArgs = lib.optionalString (
-        with rustc-unwrapped.stdenv.targetPlatform; isMusl && !isStatic
-      ) "-C target-feature=-crt-static";
-    };
-
     passthru = {
       inherit (rustc-unwrapped)
         pname
@@ -58,10 +58,18 @@ runCommand "${rustc-unwrapped.pname}-wrapper-${rustc-unwrapped.version}"
     mkdir -p $out/bin
     ln -s ${rustc-unwrapped}/bin/* $out/bin
     rm $out/bin/{rustc,rustdoc}
-    prog=${rustc-unwrapped}/bin/rustc extraFlagsVar=NIX_RUSTFLAGS \
-        substituteAll ${./rustc-wrapper.sh} $out/bin/rustc
-    prog=${rustc-unwrapped}/bin/rustdoc extraFlagsVar=NIX_RUSTDOCFLAGS \
-        substituteAll ${./rustc-wrapper.sh} $out/bin/rustdoc
+    substitute ${./rustc-wrapper.sh} $out/bin/rustc \
+      --replace-fail "@shell@" ${lib.escapeShellArg shell} \
+      --replace-fail "@sysrootFlag@" ${lib.escapeShellArg sysrootFlag} \
+      --replace-fail "@defaultArgs@" ${lib.escapeShellArg defaultArgs} \
+      --replace-fail "@prog@" ${lib.escapeShellArg rustc-unwrapped}/bin/rustc \
+      --replace-fail "@extraFlagsVar@" "NIX_RUSTFLAGS"
+    substitute ${./rustc-wrapper.sh} $out/bin/rustdoc \
+      --replace-fail "@shell@" ${lib.escapeShellArg shell} \
+      --replace-fail "@sysrootFlag@" ${lib.escapeShellArg sysrootFlag} \
+      --replace-fail "@defaultArgs@" ${lib.escapeShellArg defaultArgs} \
+      --replace-fail "@prog@" ${lib.escapeShellArg rustc-unwrapped}/bin/rustdoc \
+      --replace-fail "@extraFlagsVar@" "NIX_RUSTDOCFLAGS"
     chmod +x $out/bin/{rustc,rustdoc}
     ${lib.concatMapStrings (output: "ln -s ${rustc-unwrapped.${output}} \$${output}\n") (
       lib.remove "out" rustc-unwrapped.outputs

pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh

@@ -1,6 +1,6 @@
 #!@shell@
 
-defaultSysroot=(@sysroot@)
+defaultSysroot=(@sysrootFlag@)
 
 for arg; do
     case "$arg" in

pkgs/by-name/ad/ada/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ada";
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchFromGitHub {
     owner = "ada-url";
     repo = "ada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CSFo5aXxN1jhmD9SUh8XysObEyOvm53XPzbwJyCE0WE=";
+    hash = "sha256-kfUbsqQ+CsqnySKgeL1GFJLcDe1Irivp4CoZG93BZYg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/apt/package.nix

@@ -25,7 +25,7 @@
   triehash,
   udev,
   w3m,
-  xxHash,
+  xxhash,
   xz,
   zstd,
   withDocs ? true,
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
     lz4
     p11-kit
     udev
-    xxHash
+    xxhash
     xz
     zstd
   ]

pkgs/by-name/as/assimp/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   zlib,
   nix-update-script,
@@ -10,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "assimp";
-  version = "6.0.2";
+  version = "6.0.4";
   outputs = [
     "out"
     "lib"
@@ -21,18 +20,15 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "assimp";
     repo = "assimp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ixtqK+3iiL17GEbEVHz5S6+gJDDQP7bVuSfRMJMGEOY=";
+    hash = "sha256-ryTgsN0z9BZBz7i9aUMKuneN5oqfxpduwJlb+Q0q3Mk=";
   };
 
-  patches = [
-    # Fix build with gcc15
-    # https://github.com/assimp/assimp/pull/6283
-    (fetchpatch {
-      name = "assimp-fix-invalid-vector-gcc15.patch";
-      url = "https://github.com/assimp/assimp/commit/59bc03d931270b6354690512d0c881eec8b97678.patch";
-      hash = "sha256-O+JPwcOdyFtmFE7eZojHo1DUavF5EhLYlUyxtYo/KF4=";
-    })
-  ];
+  postPatch = ''
+    # nix build sandbox does not set /var/tmp up:
+    #   https://github.com/assimp/assimp/issues/6270
+    substituteInPlace test/unit/UnitTestFileGenerator.h \
+      --replace-fail 'define TMP_PATH "/var/tmp/"' 'define TMP_PATH "/tmp/"'
+  '';
 
   nativeBuildInputs = [ cmake ];
 

pkgs/by-name/aw/awslogs/package.nix

@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "boto3>=1.34.75" "boto3>=1.34.58" \
+      --replace "boto3>=1.34.75" "boto3>=1.34.58"
   '';
 
   nativeCheckInputs = with python3.pkgs; [

pkgs/by-name/ay/ayatana-indicator-sound/package.nix

@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
       tests/volume-control-test.cc \
       --replace-quiet 'loop(50)' 'loop(500)' \
       --replace-quiet 'loop(100)' 'loop(1000)' \
-      --replace-quiet 'loop(500)' 'loop(5000)' \
+      --replace-quiet 'loop(500)' 'loop(5000)'
   '';
 
   strictDeps = true;

pkgs/by-name/bl/bleep/package.nix

@@ -57,7 +57,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       export PATH=$PATH:$out/bin
       installShellCompletion --cmd bleep \
         --bash <(bleep install-tab-completions-bash --stdout) \
-        --zsh <(bleep install-tab-completions-zsh --stdout) \
+        --zsh <(bleep install-tab-completions-zsh --stdout)
     '';
 
   passthru.tests.version = testers.testVersion {

pkgs/by-name/bl/bluesky-pds/package.nix

@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     cctools.libtool
   ];
 
-  # Required for `sharp` NPM dependency
+  # Required for `sharp` npm dependency
   buildInputs = [ vips ];
 
   pnpmDeps = fetchPnpmDeps {

pkgs/by-name/bl/bluez-headers/package.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez-headers";
-  version = "5.84";
+  version = "5.86";
 
   # This package has the source, because of the emulatorAvailable check in the
   # bluez function args, that causes an infinite recursion with Python on cross
   # builds.
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-W6c9Aw97AAh9Z4ALDjIWAa7A+JKCfHLlosg5DYyIaxE=";
+    hash = "sha256-mfFEVAxgcFkeTFO8uXfrQmZMYrezbLNaKc9y3tM5Yh0=";
   };
 
   dontConfigure = true;

pkgs/by-name/bm/bmake/package.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bmake";
-  version = "20251111";
+  version = "20260313";
 
   src = fetchurl {
     url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-RaP4UVZ3uo85M9ghP0u2EaXDyIOAvi5GIi+kRwlQYGA=";
+    hash = "sha256-dsjzzULuBc/7R7zIElbj1edCb00I5zN4i0WYXe30+XU=";
   };
 
   patches = [

pkgs/by-name/bo/bootiso/package.nix

@@ -60,7 +60,7 @@ stdenvNoCC.mkDerivation rec {
           gnugrep
           busybox
         ]
-      } \
+      }
   '';
 
   meta = {

pkgs/by-name/bo/borgbackup/package.nix

@@ -9,7 +9,7 @@
   openssh,
   openssl,
   python3,
-  xxHash,
+  xxhash,
   zstd,
   installShellFiles,
   nixosTests,
@@ -62,7 +62,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   buildInputs = [
     libb2
     lz4
-    xxHash
+    xxhash
     zstd
     openssl
   ]

pkgs/by-name/bt/btrfs-progs/package.nix

@@ -79,6 +79,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   makeFlags = [ "udevruledir=$(out)/lib/udev/rules.d" ];
 
+  separateDebugInfo = true;
+
   outputs = [
     "out"
     "dev"

pkgs/by-name/bu/bubblewrap/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bubblewrap";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "bubblewrap";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8IDMLQPeO576N1lizVudXUmTV6hNOiowjzRpEWBsZ+U=";
+    hash = "sha256-sp5XYkTuoL778p5xQRDtFbX0ocdJuRbVxJCkKbEUgZs=";
   };
 
   outputs = [

pkgs/by-name/ca/catch2_3/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.13.0";
+  version = "3.14.0";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     tag = "v${version}";
-    hash = "sha256-WKp6/NX1SQJFLijW/fKwbR1FRoboAklDiHT6WqPRBjw=";
+    hash = "sha256-tegAa+cNF7pJcW33B+VZ86ZlDG7dwS3o6QnN/XvTI2A=";
   };
 
   patches = lib.optionals stdenv.cc.isClang [

pkgs/by-name/cb/cbmc/package.nix

@@ -80,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
     mv $out/bin/ls_parse.py $out/share/cbmc/ls_parse.py
     chmod +x $out/share/cbmc/ls_parse.py
     wrapProgram $out/bin/goto-cc \
-      --prefix PATH : "$out/share/cbmc" \
+      --prefix PATH : "$out/share/cbmc"
   '';
 
   env.NIX_CFLAGS_COMPILE = toString (

pkgs/by-name/cc/ccache/package.nix

@@ -9,7 +9,7 @@
   perl,
   fmt,
   hiredis,
-  xxHash,
+  xxhash,
   zstd,
   bashInteractive,
   doctest,
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     fmt
     hiredis
-    xxHash
+    xxhash
     zstd
   ];
 

pkgs/by-name/ch/chiaki-ng/package.nix

@@ -26,7 +26,7 @@
   shaderc,
   lcms2,
   libdovi,
-  xxHash,
+  xxhash,
   kdePackages,
 }:
 
@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     shaderc
     lcms2
     libdovi
-    xxHash
+    xxhash
   ];
 
   env.NIX_CFLAGS_COMPILE = "-std=gnu17";

pkgs/by-name/co/coost/package.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     substituteInPlace cmake/coost.pc.in \
       --replace-fail '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@ \
-      --replace-fail '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@ \
+      --replace-fail '$'{prefix}/@CMAKE_INSTALL_INCLUDEDIR@ @CMAKE_INSTALL_FULL_INCLUDEDIR@
   '';
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/co/corepack/package.nix

@@ -3,7 +3,7 @@
   stdenvNoCC,
   cacert,
   yarn-berry,
-  nodejs-slim, # no need for NPM
+  nodejs-slim, # no need for npm
   fetchFromGitHub,
   nix-update-script,
   versionCheckHook,

pkgs/by-name/cr/cryptsetup/package.nix

@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cryptsetup";
-  version = "2.8.4";
+  version = "2.8.6";
 
   outputs = [
     "bin"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/"
       + "cryptsetup-${finalAttrs.version}.tar.xz";
-    hash = "sha256-RD5G+JZMmsx4D0Va+7jiOqDo7X7FBM/FngT0BvoeioM=";
+    hash = "sha256-gAQmX9mTiF0I97Yz2+BWhR3hohAwdhOk693HQ/zO/lo=";
   };
 
   patches = [

pkgs/by-name/cu/cubelify/package.nix

@@ -25,7 +25,7 @@ appimageTools.wrapType2 rec {
       install -Dm444 ${contents}/cubelify-overlay.desktop -t $out/share/applications/
       install -Dm444 ${contents}/cubelify-overlay.png -t $out/share/pixmaps/
       substituteInPlace $out/share/applications/cubelify-overlay.desktop \
-        --replace-fail 'Exec=AppRun --no-sandbox %U' 'Exec=cubelify' \
+        --replace-fail 'Exec=AppRun --no-sandbox %U' 'Exec=cubelify'
     '';
 
   passthru.updateScript = ./update.sh;

pkgs/by-name/cu/curlMinimal/package.nix

@@ -87,7 +87,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.18.0";
+  version = "8.19.0";
 
   src = fetchurl {
     urls = [
@@ -96,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-QN95Fm50qiAUk2XhHuTHmKRq1Xw05PaP0TEA4smpGUY=";
+    hash = "sha256-TrQUiXkNGeGQ16x+GOgoV83Wivj05mspLO1WLTM/Ed8=";
   };
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion

pkgs/by-name/da/daikhan/package.nix

@@ -15,7 +15,7 @@
   libgee,
   gst_all_1,
   sqlite,
-  xxHash,
+  xxhash,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     gst_all_1.gst-plugins-ugly
     gst_all_1.gst-plugins-rs
     sqlite
-    xxHash
+    xxhash
   ];
 
   mesonFlags = [

pkgs/by-name/da/dash/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.13.1";
+  version = "0.5.13.2";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-2ScbzgnBJ9mGbiXAEVgt3HWrmIlYoEvE2FU6O48w43A=";
+    hash = "sha256-5xNoJrHu1s4xk+iv+i9wsbK5Fo3ZH/p9209G6eYgVP4=";
   };
 
   strictDeps = true;

pkgs/by-name/da/dav1d/package.nix

@@ -6,7 +6,7 @@
   ninja,
   nasm,
   pkg-config,
-  xxHash,
+  xxhash,
   withTools ? false, # "dav1d" binary
   withExamples ? false,
   SDL2, # "dav1dplay" binary
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   # TODO: doxygen (currently only HTML and not build by default).
   buildInputs = [
-    xxHash
+    xxhash
   ]
   ++ lib.optional withExamples SDL2
   ++ lib.optionals useVulkan [

pkgs/by-name/de/debugedit/package.nix

@@ -7,7 +7,7 @@
   autoreconfHook,
   pkg-config,
   elfutils,
-  xxHash,
+  xxhash,
   help2man,
   util-linux,
   cpio,
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     elfutils
-    xxHash
+    xxhash
   ];
 
   nativeCheckInputs = [

pkgs/by-name/de/deckmaster/package.nix

@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
   # Let the app find Roboto-*.ttf files (hard-coded file names).
   postFixup = ''
     wrapProgram $out/bin/deckmaster \
-      --prefix XDG_DATA_DIRS : "${roboto.out}/share/" \
+      --prefix XDG_DATA_DIRS : "${roboto.out}/share/"
   '';
 
   meta = {

pkgs/by-name/do/doctest/package.nix

@@ -2,31 +2,20 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doctest";
-  version = "2.4.12";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Fxs1EWydhqN9whx+Cn4fnZ4fhCEQvFgL5e9TUiXlnq8=";
+    hash = "sha256-7t/eknv7VtHoBgcuJmI07x//HIyqzE9HUuH5u2y7X8A=";
   };
 
-  patches = [
-    # Fix the build with Clang.
-    (fetchpatch {
-      name = "doctest-disable-warnings.patch";
-      url = "https://github.com/doctest/doctest/commit/c8d9ed2398d45aa5425d913bd930f580560df30d.patch";
-      excludes = [ ".github/workflows/main.yml" ];
-      hash = "sha256-kOBy0om6MPM2vLXZjNLXiezZqVgNr/viBI7mXrOZts8=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [
@@ -37,23 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  # Fix the build with LLVM 21 / GCC 15.
-  #
-  # See:
-  #
-  # * <https://github.com/doctest/doctest/issues/928>
-  # * <https://github.com/doctest/doctest/pull/929>
-  # * <https://github.com/doctest/doctest/issues/950>
-  env.NIX_CFLAGS_COMPILE = lib.concatStringsSep " " [
-    "-Wno-error=nrvo"
-    "-Wno-error=missing-noreturn"
-  ];
-
   meta = {
     homepage = "https://github.com/doctest/doctest";
     description = "Fastest feature-rich C++11/14/17/20 single-header testing framework";
     platforms = lib.platforms.all;
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.nim65s ];
   };
 })

pkgs/by-name/do/dolphin-emu/package.nix

@@ -33,7 +33,7 @@
   pugixml,
   sdl3,
   sfml,
-  xxHash,
+  xxhash,
   xz,
   zlib-ng,
   # linux-only
@@ -109,7 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qtsvg
     sdl3
     sfml
-    xxHash
+    xxhash
     xz
     zlib-ng
   ]

pkgs/by-name/dr/dragonflydb/package.nix

@@ -25,7 +25,7 @@
   re2,
   re-flex,
   uni-algo,
-  xxHash,
+  xxhash,
   zstd,
 
   # Build tools
@@ -151,7 +151,7 @@ stdenv.mkDerivation {
     cp -r --no-preserve=mode,ownership ${mimalloc224} build/deps-nixpkgs/mimalloc224
     cp -r --no-preserve=mode,ownership ${pugixml.src} build/deps-nixpkgs/pugixml
     cp -r --no-preserve=mode,ownership ${re-flex.src} build/deps-nixpkgs/reflex
-    cp -r --no-preserve=mode,ownership ${xxHash.src} build/deps-nixpkgs/xxhash
+    cp -r --no-preserve=mode,ownership ${xxhash.src} build/deps-nixpkgs/xxhash
     cp -r --no-preserve=mode,ownership ${zstd.src} build/deps-nixpkgs/zstd
 
     # c-ares is provided as a tarball, extract it

pkgs/by-name/du/duperemove/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   libbsd,
   libgcrypt,
-  xxHash,
+  xxhash,
   pkg-config,
   glib,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     linuxHeaders
     sqlite
     util-linux
-    xxHash
+    xxhash
   ];
 
   makeFlags = [

pkgs/by-name/dw/dwarfs/package.nix

@@ -22,7 +22,7 @@
   python3,
   range-v3,
   ronn,
-  xxHash,
+  xxhash,
   utf8cpp,
   zstd,
   parallel-hashmap,
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     jemalloc
     libarchive
     lz4
-    xxHash
+    xxhash
     utf8cpp
     zstd
 

pkgs/by-name/dw/dwz/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   fetchurl,
   elfutils,
-  xxHash,
+  xxhash,
   dejagnu,
   gdb,
 }:
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ elfutils ];
 
   buildInputs = [
-    xxHash
+    xxhash
     elfutils
   ];
 

pkgs/by-name/el/elfutils/package.nix

@@ -57,6 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://git.alpinelinux.org/aports/plain/main/elfutils/musl-strndupa.patch?id=2e3d4976eeffb4704cf83e2cc3306293b7c7b2e9";
       sha256 = "sha256-7daehJj1t0wPtQzTv+/Rpuqqs5Ng/EYnZzrcf2o/Lb0=";
     })
+    (fetchpatch {
+      name = "fix-aarch64_attributes.patch";
+      url = "https://sourceware.org/git/?p=elfutils.git;a=patch;h=b27adc5262e807f341ca0a4910ce04294144f79a";
+      hash = "sha256-hksO5HXL9Jv5E4o2rI4NAgQp+4z+Lg7Wn/AdW7fpr0c=";
+    })
     # https://patchwork.sourceware.org/project/elfutils/patch/20251205145241.1165646-1-arnout@bzzt.net/
     ./test-run-sysroot-reliability.patch
   ]

pkgs/by-name/el/ell/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ell";
-  version = "0.82";
+  version = "0.83";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = finalAttrs.version;
-    hash = "sha256-6+Aolb0Y50E5ge568je1ZdkATlCRgw8cCaW1qt0FgvE=";
+    hash = "sha256-RhT36DWIdEpe6WmA7spBt/0peBj4cpy1Qe64/SRBmPs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/er/erofs-utils/package.nix

@@ -6,7 +6,7 @@
   pkg-config,
   fuse,
   util-linux,
-  xxHash,
+  xxhash,
   lz4,
   xz,
   zlib,
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [
     util-linux
-    xxHash
+    xxhash
     lz4
     zlib
     xz

pkgs/by-name/et/ethtool/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ethtool";
-  version = "6.15";
+  version = "6.19";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/ethtool-${finalAttrs.version}.tar.xz";
-    hash = "sha256-lHfDZRFNkQEgquxTNqHRYZbIM9hIb3xtpnvt71eICt4=";
+    hash = "sha256-HCEUq24MDSqmfWmZYOsR3080HiQDE5zfKK6dqFimAl8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ex/expat/package.nix

@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.7.4";
+  version = "2.7.5";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-npyrtFfB4J3pHbJwbYNlZFeSY46zvh+U27IUkwEIasA=";
+    hash = "sha256-EDLf70/xf3BGSCfaooNpsg9lhNEIvDbxerFnbh7dL5E=";
   };
 
   strictDeps = true;

pkgs/by-name/fb/fbthrift/package.nix

@@ -16,7 +16,7 @@
   wangle,
   zlib,
   zstd,
-  xxHash,
+  xxhash,
 
   mvfst,
 
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [
     mvfst
-    xxHash
+    xxhash
   ];
 
   cmakeFlags = [

pkgs/by-name/fe/fex/package.nix

@@ -7,7 +7,7 @@
   pkg-config,
   python3,
   nix-update-script,
-  xxHash,
+  xxhash,
   fmt,
   libxml2,
   openssl,
@@ -192,7 +192,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional withQt qt6.wrapQtAppsHook;
 
   buildInputs = [
-    xxHash
+    xxhash
     fmt
     libxml2
     openssl

pkgs/by-name/fl/flyway/package.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper "${jre_headless}/bin/java" $out/bin/flyway \
       --add-flags "-Djava.security.egd=file:/dev/../dev/urandom" \
       --add-flags "-classpath '$out/share/flyway/lib/*:$out/share/flyway/lib/flyway/*:$out/share/flyway/lib/aad/*:$out/share/flyway/lib/netty/*:$out/share/flyway/drivers/*'" \
-      --add-flags "org.flywaydb.commandline.Main" \
+      --add-flags "org.flywaydb.commandline.Main"
   '';
   passthru.tests = {
     version = testers.testVersion { package = finalAttrs.finalPackage; };

pkgs/by-name/fo/fortify-headers/package.nix

@@ -2,18 +2,18 @@
   lib,
   stdenv,
   fetchurl,
+  gitUpdater,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fortify-headers";
-  version = "1.1alpine3";
+  version = "3.0.1";
 
   # upstream only accessible via git - unusable during bootstrap, hence
-  # extract from the alpine package
+  # extract from GitHub release.
   src = fetchurl {
-    url = "https://dl-cdn.alpinelinux.org/alpine/v3.18/main/x86_64/fortify-headers-1.1-r3.apk";
-    name = "fortify-headers.tar.gz"; # ensure it's extracted as a .tar.gz
-    hash = "sha256-8A8JcKHIBgXpUuIP4zs3Q1yBs5jCGd5F3H2E8UN/S2g=";
+    url = "https://github.com/jvoisin/fortify-headers/archive/refs/tags/${finalAttrs.version}.tar.gz";
+    hash = "sha256-V2rB3C25pQPYRYwen0ps6LBDfPw8UHhZ12AaO42KwOY=";
   };
 
   patches = [
@@ -21,15 +21,21 @@ stdenv.mkDerivation {
     ./restore-macros.patch
   ];
 
+  dontBuild = true;
+
   installPhase = ''
     runHook preInstall
 
     mkdir -p $out
-    cp -r include/fortify $out/include
+    cp -r include $out/include
 
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater {
+    url = "git://git.2f30.org/fortify-headers";
+  };
+
   meta = {
     description = "Standalone header-based fortify-source implementation";
     homepage = "https://git.2f30.org/fortify-headers";
@@ -37,4 +43,4 @@ stdenv.mkDerivation {
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ ris ];
   };
-}
+})

pkgs/by-name/fo/fortify-headers/restore-macros.patch

@@ -5,9 +5,9 @@ some programs that define these miss them if removed
 push_macro and pop_macro pragmas allegedly well supported
 by gcc, clang and msvc
 
---- a/include/fortify/poll.h
-+++ b/include/fortify/poll.h
-@@ -29,6 +29,7 @@ __extension__
+--- a/include/poll.h
++++ b/include/poll.h
+@@ -29,30 +29,39 @@ __extension__
  extern "C" {
  #endif
  
@@ -15,17 +15,40 @@ by gcc, clang and msvc
  #undef poll
  
  _FORTIFY_FN(poll) int poll(struct pollfd * _FORTIFY_POS0 __f, nfds_t __n, int __s)
-@@ -40,6 +41,8 @@ _FORTIFY_FN(poll) int poll(struct pollfd * _FORTIFY_POS0 __f, nfds_t __n, int __
+ {
+ 	__typeof__(sizeof 0) __b = __bos(__f, 0);
+ 
+ 	if (__n > __b / sizeof(struct pollfd))
+ 		__builtin_trap();
  	return __orig_poll(__f, __n, __s);
  }
  
+ #if defined(_GNU_SOURCE) && (!defined(_REDIR_TIME64) || !_REDIR_TIME64)
++
++#pragma push_macro("ppoll")
+ #undef ppoll
++
+ _FORTIFY_FN(ppoll) int ppoll(struct pollfd * _FORTIFY_POS0 __f, nfds_t __n,
+                              const struct timespec *__s, const sigset_t *__m)
+ {
+ 	__typeof__(sizeof 0) __b = __bos(__f, 0);
+ 
+ 	if (__n > __b / sizeof(struct pollfd))
+ 		__builtin_trap();
+ 	return __orig_ppoll(__f, __n, __s, __m);
+ }
++
++#pragma pop_macro("ppoll")
++
+ #endif
+ 
 +#pragma pop_macro("poll")
 +
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/stdio.h
-+++ b/include/fortify/stdio.h
+--- a/include/stdio.h
++++ b/include/stdio.h
 @@ -29,12 +29,19 @@ __extension__
  extern "C" {
  #endif
@@ -45,8 +68,8 @@ by gcc, clang and msvc
 +#pragma push_macro("sprintf")
  #undef sprintf
  
- _FORTIFY_FN(fgets) char *fgets(char * _FORTIFY_POS0 __s, int __n, FILE *__f)
-@@ -140,6 +147,14 @@ _FORTIFY_FN(sprintf) int sprintf(char *__s, const char *__f, ...)
+ __fortify_access(read_write, 1, 2)
+@@ -153,6 +160,14 @@ _FORTIFY_FN(sprintf) int sprintf(char *__s, const char *__f, ...)
  #endif /* __has_builtin(__builtin_va_arg_pack) */
  #endif /* defined(__has_builtin) */
  
@@ -61,8 +84,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/stdlib.h
-+++ b/include/fortify/stdlib.h
+--- a/include/stdlib.h
++++ b/include/stdlib.h
 @@ -38,7 +38,10 @@ extern "C" {
  
  /* FIXME clang */
@@ -71,10 +94,10 @@ by gcc, clang and msvc
 +#pragma push_macro("realpath")
  #undef realpath
 +
+ __fortify_warning_if(__p == NULL, "'realpath' called with path set to `NULL`; did you invert the arguments?")
  _FORTIFY_FN(realpath) char *realpath(const char *__p, char *__r)
  {
- #ifndef PATH_MAX
-@@ -60,6 +63,9 @@ _FORTIFY_FN(realpath) char *realpath(const char *__p, char *__r)
+@@ -61,6 +64,9 @@ _FORTIFY_FN(realpath) char *realpath(const char *__p, char *__r)
  	return __orig_realpath(__p, __r);
  #endif
  }
@@ -84,8 +107,8 @@ by gcc, clang and msvc
  #endif
  
  #ifdef __cplusplus
---- a/include/fortify/string.h
-+++ b/include/fortify/string.h
+--- a/include/string.h
++++ b/include/string.h
 @@ -29,12 +29,19 @@ __extension__
  extern "C" {
  #endif
@@ -105,9 +128,90 @@ by gcc, clang and msvc
 +#pragma push_macro("strncpy")
  #undef strncpy
  
- _FORTIFY_FN(memcpy) void *memcpy(void * _FORTIFY_POS0 __od,
-@@ -183,6 +190,14 @@ _FORTIFY_FN(strlcpy) size_t strlcpy(char * _FORTIFY_POS0 __d,
+ __fortify_access(write_only, 1, 3)
+@@ -84,30 +91,39 @@ _FORTIFY_FN(memset) void *memset(void * _FORTIFY_POS0 __d, int __c, size_t __n)
+ #if defined(_POSIX_SOURCE) || defined(_POSIX_C_SOURCE) \
+  || defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) \
+  || defined(_BSD_SOURCE)
++
++#pragma push_macro("stpcpy")
+ #undef stpcpy
++
+ __fortify_access(write_only, 1)
+ __fortify_access(read_only, 2)
+ _FORTIFY_FN(stpcpy) char *stpcpy(char * _FORTIFY_POS0 __d, const char *__s)
+ {
+ 	size_t __b = __bos(__d, 0);
+ 
+ 	if (strlen(__s) + 1 > __b)
+ 		__builtin_trap();
+ 	return __orig_stpcpy(__d, __s);
  }
+ 
++#pragma push_macro("stpncpy")
+ #undef stpncpy
++
+ __fortify_access(write_only, 1)
+ __fortify_access(read_only, 2)
+ _FORTIFY_FN(stpncpy) char *stpncpy(char * _FORTIFY_POS0 __d, const char *__s,
+                                    size_t __n)
+ {
+ 	size_t __b = __bos(__d, 0);
+ 
+ 	if (__n > __b && strlen(__s) + 1 > __b)
+ 		__builtin_trap();
+ 	return __orig_stpncpy(__d, __s, __n);
+ }
++
++#pragma pop_macro("stpcpy")
++#pragma pop_macro("stpncpy")
++
+ #endif
+ 
+ __fortify_access(read_write, 1)
+@@ -164,24 +180,34 @@ _FORTIFY_FN(strncpy) char *strncpy(char * _FORTIFY_POS0 __d,
+ }
+ 
+ #ifdef _GNU_SOURCE
++
++#pragma push_macro("mempcpy")
+ #undef mempcpy
++
+ __fortify_access(write_only, 1, 3)
+ __fortify_access(read_only, 2, 3)
+ _FORTIFY_FN(mempcpy) void *mempcpy(void * _FORTIFY_POS0 __d,
+                                    const void * _FORTIFY_POS0 __s, size_t __n)
+ {
+ 	size_t __bd = __bos(__d, 0);
+ 	size_t __bs = __bos(__s, 0);
+ 
+ 	if (__n > __bd || __n > __bs)
+ 		__builtin_trap();
+ 	return __orig_mempcpy(__d, __s, __n);
+ }
++
++#pragma pop_macro("mempcpy")
++
+ #endif
+ 
+ #if defined(_GNU_SOURCE) || defined(_BSD_SOURCE)
++
++#pragma push_macro("strlcat")
+ #undef strlcat
++#pragma push_macro("strlcpy")
+ #undef strlcpy
++
+ __fortify_access(read_write, 1)
+ __fortify_access(read_only, 2)
+ _FORTIFY_FN(strlcat) size_t strlcat(char * _FORTIFY_POS0 __d,
+@@ -205,8 +231,20 @@ _FORTIFY_FN(strlcpy) size_t strlcpy(char * _FORTIFY_POS0 __d,
+ 		__builtin_trap();
+ 	return __orig_strlcpy(__d, __s, __n);
+ }
++
++#pragma pop_macro("strlcat")
++#pragma pop_macro("strlcpy")
++
  #endif
  
 +#pragma pop_macro("memcpy")
@@ -121,8 +225,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/strings.h
-+++ b/include/fortify/strings.h
+--- a/include/strings.h
++++ b/include/strings.h
 @@ -29,8 +29,12 @@ extern "C" {
  #if defined(_GNU_SOURCE) || defined(_BSD_SOURCE) || defined(_POSIX_SOURCE) \
   || (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE+0 < 200809L) \
@@ -133,10 +237,10 @@ by gcc, clang and msvc
 +#pragma push_macro("bzero")
  #undef bzero
 +
+ __fortify_access(write_only, 2, 3)
+ __fortify_access(read_only, 1, 3)
  _FORTIFY_FN(bcopy) void bcopy(const void * _FORTIFY_POS0 __s,
-                               void * _FORTIFY_POS0 __d, size_t __n)
- {
-@@ -52,6 +56,9 @@ _FORTIFY_FN(bzero) void bzero(void * _FORTIFY_POS0 __s, size_t __n)
+@@ -55,6 +59,9 @@ _FORTIFY_FN(bzero) void bzero(void * _FORTIFY_POS0 __s, size_t __n)
  }
  #endif
  
@@ -146,8 +250,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/sys/socket.h
-+++ b/include/fortify/sys/socket.h
+--- a/include/sys/socket.h
++++ b/include/sys/socket.h
 @@ -29,9 +29,13 @@ __extension__
  extern "C" {
  #endif
@@ -161,8 +265,8 @@ by gcc, clang and msvc
 +#pragma push_macro("sendto")
  #undef sendto
  
- _FORTIFY_FN(recv) ssize_t recv(int __f, void * _FORTIFY_POS0 __s, size_t __n,
-@@ -76,6 +80,11 @@ _FORTIFY_FN(sendto) ssize_t sendto(int __f, const void * _FORTIFY_POS0 __s,
+ __fortify_access(write_only, 2, 3)
+@@ -80,6 +84,11 @@ _FORTIFY_FN(sendto) ssize_t sendto(int __f, const void * _FORTIFY_POS0 __s,
  	return __orig_sendto(__f, __s, __n, __fl, __a, __l);
  }
  
@@ -174,8 +278,8 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/unistd.h
-+++ b/include/fortify/unistd.h
+--- a/include/unistd.h
++++ b/include/unistd.h
 @@ -29,16 +29,27 @@ __extension__
  extern "C" {
  #endif
@@ -203,11 +307,53 @@ by gcc, clang and msvc
 +#pragma push_macro("write")
  #undef write
  
- _FORTIFY_FN(confstr) size_t confstr(int __n, char * _FORTIFY_POS0 __s, size_t __l)
-@@ -158,6 +169,18 @@ _FORTIFY_FN(write) ssize_t write(int __f, const void * _FORTIFY_POS0 __s,
- 	return __orig_write(__f, __s, __n);
+ __fortify_access(write_only, 2, 3)
+@@ -63,16 +74,22 @@ _FORTIFY_FN(getcwd) char *getcwd(char * _FORTIFY_POS0 __s, size_t __l)
  }
  
+ #if defined(_GNU_SOURCE) || defined(_BSD_SOURCE)
++
++#pragma push_macro("getdomainname")
+ #undef getdomainname
++
+ __fortify_access(write_only, 1, 2)
+ _FORTIFY_FN(getdomainname) int getdomainname(char * _FORTIFY_POS0 __s, size_t __l)
+ {
+ 	size_t __b = __bos(__s, 0);
+ 
+ 	if (__l > __b)
+ 		__builtin_trap();
+ 	return __orig_getdomainname(__s, __l);
+ }
++
++#pragma pop_macro("getdomainname")
++
+ #endif
+ 
+ _FORTIFY_FN(getgroups) int getgroups(int __l, gid_t * _FORTIFY_POS0 __s)
+@@ -169,21 +186,37 @@ _FORTIFY_FN(write) ssize_t write(int __f, const void * _FORTIFY_POS0 __s,
+ }
+ 
+ #if defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) || defined(_BSD_SOURCE)
++
++#pragma push_macro("swab")
+ #undef swab
+ 
+ _FORTIFY_FN(swab) void swab(const void * _FORTIFY_POS0 __os,
+                                  void * _FORTIFY_POS0 __od, ssize_t __n)
+ {
+ 	size_t __bs = __bos(__os, 0);
+ 	size_t __bd = __bos(__od, 0);
+ 
+ 	if ((size_t)__n > __bs || (size_t)__n > __bd)
+ 		__builtin_trap();
+ 	return __orig_swab(__os, __od, __n);
+ }
+ 
++#pragma pop_macro("swab")
++
+ #endif
+ 
 +#pragma pop_macro("confstr")
 +#pragma pop_macro("getcwd")
 +#pragma pop_macro("getgroups")
@@ -223,9 +369,9 @@ by gcc, clang and msvc
  #ifdef __cplusplus
  }
  #endif
---- a/include/fortify/wchar.h
-+++ b/include/fortify/wchar.h
-@@ -43,19 +43,33 @@ __extension__
+--- a/include/wchar.h
++++ b/include/wchar.h
+@@ -46,33 +46,49 @@ __extension__
  extern "C" {
  #endif
  
@@ -249,8 +395,6 @@ by gcc, clang and msvc
  #undef wcsrtombs
 +#pragma push_macro("wcstombs")
  #undef wcstombs
-+#pragma push_macro("wctomb")
- #undef wctomb
 +#pragma push_macro("wmemcpy")
  #undef wmemcpy
 +#pragma push_macro("wmemmove")
@@ -259,7 +403,56 @@ by gcc, clang and msvc
  #undef wmemset
  
  _FORTIFY_FN(fgetws) wchar_t *fgetws(wchar_t * _FORTIFY_POS0 __s,
-@@ -269,6 +283,21 @@ _FORTIFY_FN(wmemset) wchar_t *wmemset(wchar_t * _FORTIFY_POS0 __s,
+                                     int __n, FILE *__f)
+ {
+ 	size_t __b = __bos(__s, 0);
+ 
+ 	if ((size_t)__n > __b / sizeof(wchar_t))
+ 		__builtin_trap();
+ 	return __orig_fgetws(__s, __n, __f);
+ }
+ 
+ #if defined(_POSIX_SOURCE) || defined(_POSIX_C_SOURCE) \
+  || defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE)  || defined(_BSD_SOURCE)
++
++#pragma push_macro("mbsnrtowcs")
+ #undef mbsnrtowcs
++
+ _FORTIFY_FN(mbsnrtowcs) size_t mbsnrtowcs(wchar_t * _FORTIFY_POS0 __d,
+                                           const char **__s, size_t __n,
+                                           size_t __wn, mbstate_t *__st)
+@@ -92,6 +108,9 @@ _FORTIFY_FN(mbsnrtowcs) size_t mbsnrtowcs(wchar_t * _FORTIFY_POS0 __d,
+ 	}
+ 	return __r;
+ }
++
++#pragma pop_macro("mbsnrtowcs")
++
+ #endif
+ 
+ _FORTIFY_FN(mbsrtowcs) size_t mbsrtowcs(wchar_t * _FORTIFY_POS0 __d,
+@@ -187,7 +206,10 @@ _FORTIFY_FN(wcsncpy) wchar_t *wcsncpy(wchar_t * _FORTIFY_POS0 __d,
+ 
+ #if defined(_POSIX_SOURCE) || defined(_POSIX_C_SOURCE) \
+  || defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE)  || defined(_BSD_SOURCE)
++
++#pragma push_macro("wcsnrtombs")
+ #undef wcsnrtombs
++
+ _FORTIFY_FN(wcsnrtombs) size_t wcsnrtombs(char * _FORTIFY_POS0 __d,
+                                           const wchar_t **__s, size_t __wn,
+                                           size_t __n, mbstate_t *__st)
+@@ -207,6 +229,9 @@ _FORTIFY_FN(wcsnrtombs) size_t wcsnrtombs(char * _FORTIFY_POS0 __d,
+ 	}
+ 	return __r;
+ }
++
++#pragma pop_macro("wcsnrtombs")
++
+ #endif
+ 
+ _FORTIFY_FN(wcsrtombs) size_t wcsrtombs(char * _FORTIFY_POS0 __d,
+@@ -262,6 +287,20 @@ _FORTIFY_FN(wmemset) wchar_t *wmemset(wchar_t * _FORTIFY_POS0 __s,
  	return __orig_wmemset(__s, __c, __n);
  }
  
@@ -273,7 +466,6 @@ by gcc, clang and msvc
 +#pragma pop_macro("wcsncpy")
 +#pragma pop_macro("wcsrtombs")
 +#pragma pop_macro("wcstombs")
-+#pragma pop_macro("wctomb")
 +#pragma pop_macro("wmemcpy")
 +#pragma pop_macro("wmemmove")
 +#pragma pop_macro("wmemset")

pkgs/by-name/fo/fortify-headers/wchar-imports-skip.patch

@@ -8,13 +8,15 @@ supported/expected by some projects.
 having a way to almost entirely short-circuit these headers (by
 disabling _FORTIFY_SOURCE) is therefore important.
 
---- a/include/fortify/wchar.h
-+++ b/include/fortify/wchar.h
-@@ -20,21 +20,23 @@
- #if !defined(__cplusplus) && !defined(__clang__)
- __extension__
- #endif
--#include_next <limits.h>
+--- a/include/wchar.h
++++ b/include/wchar.h
+@@ -17,6 +17,13 @@
+ #ifndef _FORTIFY_WCHAR_H
+ #define _FORTIFY_WCHAR_H
+ 
++#if !defined(__cplusplus) && !defined(__clang__)
++__extension__
++#endif
 +#include_next <wchar.h>
 +
 +#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0 && defined(__OPTIMIZE__) && __OPTIMIZE__ > 0
@@ -22,18 +24,11 @@ disabling _FORTIFY_SOURCE) is therefore important.
  #if !defined(__cplusplus) && !defined(__clang__)
  __extension__
  #endif
--#include_next <stdlib.h>
-+#include_next <limits.h>
- #if !defined(__cplusplus) && !defined(__clang__)
- __extension__
- #endif
--#include_next <string.h>
-+#include_next <stdlib.h>
+@@ -32,9 +39,7 @@ __extension__
  #if !defined(__cplusplus) && !defined(__clang__)
  __extension__
  #endif
 -#include_next <wchar.h>
-+#include_next <string.h>
  
 -#if defined(_FORTIFY_SOURCE) && _FORTIFY_SOURCE > 0 && defined(__OPTIMIZE__) && __OPTIMIZE__ > 0
  #include "fortify-headers.h"

pkgs/by-name/fr/freetype/package.nix

@@ -39,7 +39,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
-  version = "2.13.3";
+  version = "2.14.2";
 
   src =
     let
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "mirror://savannah/freetype/freetype-${version}.tar.xz";
-      sha256 = "sha256-BVA1BmbUJ8dNrrhdWse7NTrLpfdpVjlZlTEanG8GMok=";
+      sha256 = "sha256-S2Lcq0ySChqGA2mTMiGBQ2LmmeJvVXklFtZx5v9VteE=";
     };
 
   propagatedBuildInputs = [

pkgs/by-name/fs/fsautocomplete/package.nix

@@ -24,7 +24,7 @@ buildDotnetModule (finalAttrs: {
     rm global.json
 
     substituteInPlace src/FsAutoComplete/FsAutoComplete.fsproj \
-      --replace-fail TargetFrameworks TargetFramework \
+      --replace-fail TargetFrameworks TargetFramework
   '';
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;

pkgs/by-name/fw/fwupd/package.nix

@@ -310,7 +310,7 @@ stdenv.mkDerivation (finalAttrs: {
     addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
 
     echo "12345678901234567890123456789012" > machine-id
-    export NIX_REDIRECTS=/etc/machine-id=$(realpath machine-id) \
+    export NIX_REDIRECTS=/etc/machine-id=$(realpath machine-id)
   '';
 
   postInstall = ''

pkgs/by-name/gd/gdb/package.nix

@@ -5,6 +5,7 @@
 
   # Build time
   fetchurl,
+  fetchpatch,
   pkg-config,
   perl,
   texinfo,
@@ -21,7 +22,7 @@
   dejagnu,
   sourceHighlight,
   libiconv,
-  xxHash,
+  xxhash,
 
   withTui ? true,
   ncurses,
@@ -86,6 +87,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./debug-info-from-env.patch
+
+    (fetchurl {
+      name = "musl.patch";
+      url = "https://inbox.sourceware.org/gdb-patches/20260324164527.1446549-2-sunilkumar.dora@windriver.com/raw";
+      hash = "sha256-FC4DDVS4wtE/HXtbUqvkxu9+e7nE3DYi1zIuQP9yQO8=";
+    })
+    (fetchpatch {
+      name = "musl-aarch64.patch";
+      url = "https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=1ccc3f6a2e28fa1f3357826374cba165b3ba3ff7";
+      hash = "sha256-Q2oTo2b+9yNN3PSsxqgxV4/9/05uFE/JMLe1CPs9Y7I=";
+    })
   ]
   ++ optionals stdenv.hostPlatform.isDarwin [
     ./darwin-target-match.patch
@@ -107,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     zstd
     xz
     sourceHighlight
-    xxHash
+    xxhash
     dejagnu # for tests
   ]
   ++ optional withTui ncurses
@@ -181,10 +193,8 @@ stdenv.mkDerivation (finalAttrs: {
     (withFeatureAs true "auto-load-safe-path" (builtins.concatStringsSep ":" safePaths))
     (withFeature enableDebuginfod "debuginfod")
     (enableFeature (!stdenv.hostPlatform.isMusl) "nls")
-    (enableFeature (
-      !stdenv.hostPlatform.isStatic && !stdenv.hostPlatform.isLoongArch64
-    ) "inprocess-agent")
   ]
+  ++ optional stdenv.hostPlatform.isStatic "--disable-inprocess-agent"
   ++ optional (!hostCpuOnly) "--enable-targets=all"
   # Workaround for Apple Silicon, "--target" must be "faked", see eg: https://github.com/Homebrew/homebrew-core/pull/209753
   ++ optional (

pkgs/by-name/gn/gn/package.nix

@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2026-01-07";
+      _version = "0-unstable-2026-02-05";
     in
     _version,
-  rev ? "5550ba0f4053c3cbb0bff3d60ded9d867b6fa371",
-  hash ? "sha256-SoXVnpCuNee80N4YdsTEHQd3jZNoHOwKVP6O8a67Ym0=",
+  rev ? "304bbef6c7e9a86630c12986b99c8654eb7fe648",
+  hash ? "sha256-wFCuu4GR0N7QZCwT8UAhqH5moicYQjZ4ZLI58AM4pJ0=",
 }:
 
 stdenv.mkDerivation {

pkgs/by-name/gn/gnum4/package.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnum4";
-  version = "1.4.20";
+  version = "1.4.21";
 
   src = fetchurl {
     url = "mirror://gnu/m4/m4-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-rGmJ7l0q7YFzl4BjDMLOCX4qZUb+uWpKVNs31GoUUuQ=";
+    hash = "sha256-3Eh+EdLwyeAVVbsa8mvk6umD7I8HJnRlBbQycYbrIfw=";
   };
 
   patches = lib.optional stdenv.hostPlatform.isCygwin gnulib.patches.memcpy-fix-backport-250512;