Merge branch 'staging' into staging-next

2025-08-30 17:06:43 +02:00
parent 136df215b0 c8fefcf833
commit d95b37aeac
304 changed files with 5549 additions and 4530 deletions
@@ -42,12 +42,43 @@ The manpages must have a section suffix, and may optionally be compressed (with
 {
  nativeBuildInputs = [ installShellFiles ];

-  # Sometimes the manpage file has an undesirable name; e.g., it conflicts with
-  # another software with an equal name. It should be renamed before being
-  # installed via installManPage
+  # Sometimes the manpage file has an undersirable name; e.g., it conflicts with
+  # another software with an equal name. To install it with a different name,
+  # the installed name must be provided before the path to the file.
+  #
+  # Below install a manpage "foobar.1" from the source file "./foobar.1", and
+  # also installs the manpage "fromsea.3" from the source file "./delmar.3".
  postInstall = ''
-    mv fromsea.3 delmar.3
-    installManPage foobar.1 delmar.3
+    installManPage \
+        foobar.1 \
+        --name fromsea.3 delmar.3
+  '';
+}
+```
+
+The manpage may be the result of a piped input (e.g. `<(cmd)`), in which
+case the name must be provided before the pipe with the `--name` flag.
+
+```nix
+{
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installManPage --name foobar.1 <($out/bin/foobar --manpage)
+  '';
+}
+```
+
+If no parsing of arguments is desired, pass `--` to opt-out of all subsequent
+arguments.
+
+```nix
+{
+  nativeBuildInputs = [ installShellFiles ];
+
+  # Installs a manpage from a file called "--name"
+  postInstall = ''
+    installManPage -- --name
  '';
 }
 ```
@@ -58,8 +89,8 @@ The `installShellCompletion` function takes one or more paths to shell
 completion files.

 By default it will autodetect the shell type from the completion file extension,
-but you may also specify it by passing one of `--bash`, `--fish`, or
-`--zsh`. These flags apply to all paths listed after them (up until another
+but you may also specify it by passing one of `--bash`, `--fish`, `--zsh`, or
+`--nushell`. These flags apply to all paths listed after them (up until another
 shell flag is given). Each path may also have a custom installation name
 provided by providing a flag `--name NAME` before the path. If this flag is not
 provided, zsh completions will be renamed automatically such that `foobar.zsh`
@@ -77,9 +108,10 @@ zsh).
    # explicit behavior
    installShellCompletion --bash --name foobar.bash share/completions.bash
    installShellCompletion --fish --name foobar.fish share/completions.fish
+    installShellCompletion --nushell --name foobar share/completions.nu
    installShellCompletion --zsh --name _foobar share/completions.zsh
    # implicit behavior
-    installShellCompletion share/completions/foobar.{bash,fish,zsh}
+    installShellCompletion share/completions/foobar.{bash,fish,zsh,nu}
  '';
 }
 ```
@@ -104,6 +136,7 @@ failure. To prevent this, guard the completion generation commands.
    installShellCompletion --cmd foobar \
      --bash <($out/bin/foobar --bash-completion) \
      --fish <($out/bin/foobar --fish-completion) \
+      --nushell <($out/bin/foobar --nushell-completion) \
      --zsh <($out/bin/foobar --zsh-completion)
  '';
 }
@@ -192,6 +192,12 @@ Specifies the contents of the `go.sum` file and triggers rebuilds when it change

 Defaults to `null`

+### `buildTestBinaries` {#var-go-buildTestBinaries}
+
+This option allows to compile test binaries instead of the usual binaries produced by a package.
+Go can [compile test into binaries](https://pkg.go.dev/cmd/go#hdr-Test_packages) using the `go test -c` command.
+These binaries can then be executed at a later point (outside the Nix sandbox) to run the tests.
+This is mostly useful for downstream consumers to run integration or end-to-end tests that won't work in the Nix sandbox, for example because they require network access.

 ## Versioned toolchains and builders {#ssec-go-toolchain-versions}

@@ -574,6 +574,9 @@
  "strictflexarrays3": [
    "index.html#strictflexarrays3"
  ],
+  "glibcxxassertions": [
+    "index.html#glibcxxassertions"
+  ],
  "tester-shfmt": [
    "index.html#tester-shfmt"
  ],
@@ -622,6 +625,9 @@
  "typst-package-scope-and-usage": [
    "index.html#typst-package-scope-and-usage"
  ],
+  ],
+  "var-go-buildTestBinaries": [
+    "index.html#var-go-buildTestBinaries"
  "var-meta-teams": [
    "index.html#var-meta-teams"
  ],
@@ -22,6 +22,8 @@

 - The `offrss` package was removed due to lack of upstream maintenance since 2012. It's recommended for users to migrate to another RSS reader

+- `installShellFiles`: Allow installManPage to take a piped input, add the `--name` flag for renaming the file when installed. Can also append `--` to opt-out of all subsequent parsing.
+
 - GCC 9, 10, 11, and 12 have been removed, as they have reached end‐of‐life upstream and are no longer supported.

 - `base16-builder` node package has been removed due to lack of upstream maintenance.
@@ -40,12 +42,16 @@

 - `kbd` package's `outputs` now include a `man` and `scripts` outputs. The `unicode_start` and `unicode_stop` Bash scripts are now part of the `scripts` output, allowing most usages of the `kbd` package to not pull in `bash`.

+- `spidermonkey_91` has been removed, as it has been EOL since September 2022.
+
 - `cudaPackages.cudatoolkit-legacy-runfile` has been removed.

 - `conduwuit` was removed due to upstream ceasing development and deleting their repository. For existing data, a migration to `matrix-conduit`, `matrix-continuwuity` or `matrix-tuwunel` may be possible.

 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).

+- `python3Full` and its versioned attributes (python3xxFull) have been removed. Bluetooth support is now enabled in the default python3 attributes. The X11 support built the tkinter module, which is available as a dedicated attribute on the package set.
+
 - `stdenv.mkDerivation` and other derivation builders that use it no longer allow the value of `env` to be anything but an attribute set, for the purpose of setting environment variables that are available to the [builder](https://nix.dev/manual/nix/latest/store/derivation/#builder) process. An environment variable called `env` can still be provided by means of `mkDerivation { env.env = ...; }`, though we recommend to use a more specific name than "env".

 - The default Android NDK version has been raised to 27, and the default SDK version to 35.
@@ -120,6 +126,8 @@

 - [`homebox` 0.20.0](https://github.com/sysadminsmedia/homebox/releases/tag/v0.20.0) changed how assets are stored and hashed. It is recommended to back up your database before this update.

+- `installShellCompletion`: now supports Nushell completion files
+
 - New hardening flags, `strictflexarrays1` and `strictflexarrays3` were made available, corresponding to the gcc/clang options `-fstrict-flex-arrays=1` and `-fstrict-flex-arrays=3` respectively.

 - `gramps` has been updated to 6.0.0
@@ -134,6 +142,8 @@
 - `searx` was updated to use `envsubst` instead of `sed` for parsing secrets from environment variables.
  If your previous configuration included a secret reference like `server.secret_key = "@SEARX_SECRET_KEY@"`, you must migrate to the new envsubst syntax: `server.secret_key = "$SEARX_SECRET_KEY"`.

+- A new hardening flag, `glibcxxassertions` was made available, corresponding to the glibc `_GLIBCXX_ASSERTIONS` option.
+
 - `versionCheckHook`: Packages that previously relied solely on `pname` to locate the program used to version check, but have a differing `meta.mainProgram` entry, might now fail.


@@ -1682,6 +1682,12 @@ This should be turned off or fixed for build errors such as:
 sorry, unimplemented: __builtin_clear_padding not supported for variable length aggregates
 ```

+#### `glibcxxassertions` {#glibcxxassertions}
+
+Adds the `-D_GLIBCXX_ASSERTIONS` compiler flag. This flag only has an effect on libstdc++ targets, and when defined, enables extra error checking in the form of precondition assertions, such as bounds checking in c++ strings and null pointer checks when dereferencing c++ smart pointers.
+
+These checks may have an impact on performance in some cases.
+
 #### `pacret` {#pacret}

 This flag adds the `-mbranch-protection=pac-ret` compiler option on aarch64-linux targets. This uses ARM v8.3's Pointer Authentication feature to sign function return pointers before adding them to the stack. The pointer's authenticity is then validated before returning to its destination. This dramatically increases the difficulty of ROP exploitation techniques.
@@ -64,6 +64,11 @@ lib.mapAttrs mkLicense (
      free = false;
    };

+    adobeUtopia = {
+      fullName = "Adobe Utopia Font License";
+      spdxId = "Adobe-Utopia";
+    };
+
    afl20 = {
      spdxId = "AFL-2.0";
      fullName = "Academic Free License v2.0";
@@ -713,6 +718,11 @@ lib.mapAttrs mkLicense (
      spdxId = "HPND-sell-variant";
    };

+    hpndDec = {
+      fullName = "Historical Permission Notice and Disclaimer - DEC variant";
+      spdxId = "HPND-DEC";
+    };
+
    hpndDoc = {
      fullName = "Historical Permission Notice and Disclaimer - documentation variant";
      spdxId = "HPND-doc";
@@ -195,7 +195,6 @@ in
            "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
            "${config.boot.initrd.systemd.package.kbd}/bin/setfont"
            "${config.boot.initrd.systemd.package.kbd}/bin/loadkeys"
-            "${config.boot.initrd.systemd.package.kbd.gzip}/bin/gzip" # Fonts and keyboard layouts are compressed
          ]
          ++ lib.optionals (cfg.font != null && lib.hasPrefix builtins.storeDir cfg.font) [
            "${cfg.font}"
@@ -99,6 +99,7 @@ import ./make-test-python.nix (
              objectClass: posixAccount
              userPassword: ${testPassword}
              homeDirectory: /home/${testUser}
+              loginShell: /run/current-system/sw/bin/bash
              uidNumber: 1234
              gidNumber: 1234
              cn: ""
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;

 stdenv.mkDerivation rec {
  pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.0";
+  version = "1.33.2";

  src = fetchurl {
    url = "mirror://sourceforge/mpg123/mpg123-${version}.tar.bz2";
-    hash = "sha256-IpDjrt5vTRY+GhdFIWWvM8qtS18JSPmUKc+i2Dhfqp0=";
+    hash = "sha256-LFT6u/ppbc6PmxN8jvekKaBh+P5jPNfQpRGAmFXywhk=";
  };

  outputs = [
@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.1566";
+  version = "9.1.1623";

  outputs = [
    "out"
@@ -11,7 +11,7 @@ rec {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    hash = "sha256-/hzyjFGjl8Wu9tHtFgnnHtGbcJ5AIjCMUNCScrdIgwU=";
+    hash = "sha256-T7epi6ex9AU4iV/ClSeKlK3T0V0WajiVxnDVevkqaw8=";
  };

  enableParallelBuilding = true;
@@ -31,6 +31,11 @@ stdenv.mkDerivation rec {
    hash = "sha256-KSS8s6Hti1UfwQH3QLnw/gogKxFQJ2R89phQ1l/YjFI=";
  };

+  patches = [
+    # See: <https://github.com/RsyncProject/rsync/pull/790>
+    ./fix-tests-in-darwin-sandbox.patch
+  ];
+
  nativeBuildInputs = [
    updateAutotoolsGnuConfigScriptsHook
    perl
@@ -75,6 +80,8 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "Fast incremental file transfer utility";
    homepage = "https://rsync.samba.org/";
@@ -0,0 +1,56 @@
+From 9b104ed9859f17b6ed4c4ad01806c75a0c197dd7 Mon Sep 17 00:00:00 2001
+From: Emily <hello@emily.moe>
+Date: Tue, 5 Aug 2025 15:55:24 +0100
+Subject: [PATCH] Allow `ls(1)` to fail in test setup
+
+This can happen when the tests are unable to `stat(2)` some files in
+`/etc`, `/bin`, or `/`, due to Unix permissions or other sandboxing. We
+still guard against serious errors, which use exit code 2.
+---
+ testsuite/longdir.test | 4 ++--
+ testsuite/rsync.fns    | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/testsuite/longdir.test b/testsuite/longdir.test
+index 8d66bb5f..26747292 100644
+--- a/testsuite/longdir.test
+++ b/testsuite/longdir.test
+@@ -16,9 +16,9 @@ makepath "$longdir" || test_skipped "unable to create long directory"
+ touch "$longdir/1" || test_skipped "unable to create files in long directory"
+ date > "$longdir/1"
+ if [ -r /etc ]; then
+-    ls -la /etc >"$longdir/2"
+    ls -la /etc >"$longdir/2" || [ $? -eq 1 ]
+ else
+-    ls -la / >"$longdir/2"
+    ls -la / >"$longdir/2" || [ $? -eq 1 ]
+ fi
+ checkit "$RSYNC --delete -avH '$fromdir/' '$todir'" "$fromdir/" "$todir"
+ 
+diff --git a/testsuite/rsync.fns b/testsuite/rsync.fns
+index 2ab97b69..f7da363f 100644
+--- a/testsuite/rsync.fns
+++ b/testsuite/rsync.fns
+@@ -195,15 +195,15 @@ hands_setup() {
+     echo some data > "$fromdir/dir/subdir/foobar.baz"
+     mkdir "$fromdir/dir/subdir/subsubdir"
+     if [ -r /etc ]; then
+-	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
+	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
+     else
+-	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
+	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
+     fi
+     mkdir "$fromdir/dir/subdir/subsubdir2"
+     if [ -r /bin ]; then
+-	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
+	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
+     else
+-	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
+	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
+     fi
+ 
+ #      echo testing head:
+-- 
+2.50.1
+
@@ -60,7 +60,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.50.1";
+  version = "2.51.0";
  svn = subversionClient.override { perlBindings = perlSupport; };
  gitwebPerlLibs = with perlPackages; [
    CGI
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
        }.tar.xz"
      else
        "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-fj5sNt7L2PHu3RTULbZnS+A2ccIgSGS++ipBdWxcj8Q=";
+    hash = "sha256-YKfCJRzC5YjVzYe65WcmBhfG3gwi3KnNv8TH0riZC2I=";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -120,6 +120,8 @@ stdenv.mkDerivation (finalAttrs: {
    # Fix references to gettext introduced by ./git-sh-i18n.patch
    substituteInPlace git-sh-i18n.sh \
        --subst-var-by gettext ${gettext}
+    substituteInPlace contrib/credential/libsecret/Makefile \
+        --replace-fail 'pkg-config' "$PKG_CONFIG"
  ''
  + lib.optionalString doInstallCheck ''
    # ensure we are using the correct shell when executing the test scripts
@@ -299,12 +301,6 @@ stdenv.mkDerivation (finalAttrs: {
    cp -a contrib $out/share/git/
    mkdir -p $out/share/bash-completion/completions
    ln -s $out/share/git/contrib/completion/git-prompt.sh $out/share/bash-completion/completions/
-    # only readme, developed in another repo
-    rm -r contrib/hooks/multimail
-    mkdir -p $out/share/git-core/contrib
-    cp -a contrib/hooks/ $out/share/git-core/contrib/
-    substituteInPlace $out/share/git-core/contrib/hooks/pre-auto-gc-battery \
-      --replace ' grep' ' ${gnugrep}/bin/grep' \

    # grep is a runtime dependency, need to patch so that it's found
    substituteInPlace $out/libexec/git-core/git-sh-setup \
@@ -1,29 +1,25 @@
 diff --git a/Documentation/git-send-email.adoc b/Documentation/git-send-email.adoc
-index 7f223db42d..7e46a07d31 100644
+index 5d13a856a7..5c9978c1e4 100644
 --- a/Documentation/git-send-email.adoc
 +++ b/Documentation/git-send-email.adoc
-@@ -177,7 +177,7 @@ Sending
+@@ -190,7 +190,7 @@ Sending
 	The command will be executed in the shell if necessary.  Default
 	is the value of `sendemail.sendmailCmd`.  If unspecified, and if
- 	--smtp-server is also unspecified, git-send-email will search
-	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH.
-+	for `sendmail` in $PATH.
+ 	`--smtp-server` is also unspecified, `git send-email` will search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and `$PATH`.
+	for `sendmail` in `$PATH`.
 
 --smtp-encryption=<encryption>::
 	Specify in what way encrypting begins for the SMTP connection.
-@@ -233,9 +233,9 @@ a password is obtained using 'git-credential'.
- --smtp-server=<host>::
+@@ -247,7 +247,7 @@ a password is obtained using linkgit:git-credential[1].
 	If set, specifies the outgoing SMTP server to use (e.g.
 	`smtp.example.com` or a raw IP address).  If unspecified, and if
-	`--sendmail-cmd` is also unspecified, the default is to search
-	for `sendmail` in `/usr/sbin`, `/usr/lib` and $PATH if such a
-	program is available, falling back to `localhost` otherwise.
-+	`--sendmail-cmd` is also unspecified, the default is to search for
-+	`sendmail` in $PATH if such a program is available, falling back to
-+	`localhost` otherwise.
+ 	`--sendmail-cmd` is also unspecified, the default is to search
+-	for `sendmail` in `/usr/sbin`, `/usr/lib` and `$PATH` if such a
+	for `sendmail` in `$PATH` if such a
+ 	program is available, falling back to `localhost` otherwise.
 +
 For backward compatibility, this option can also specify a full pathname
- of a sendmail-like program instead; the program must support the `-i`
 diff --git a/git-send-email.perl b/git-send-email.perl
 index 798d59b84f..69c9cc2a7d 100755
 --- a/git-send-email.perl
@@ -52,7 +52,7 @@ fi


 if (( "${NIX_DEBUG:-0}" >= 1 )); then
-  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pie pic strictoverflow format trivialautovarinit zerocallusedregs)
+  declare -a allHardeningFlags=(fortify fortify3 shadowstack stackprotector stackclashprotection nostrictaliasing pacret strictflexarrays1 strictflexarrays3 pie pic strictoverflow glibcxxassertions format trivialautovarinit zerocallusedregs)
  declare -A hardeningDisableMap=()

  # Determine which flags were effectively disabled so we can report below.
@@ -111,6 +111,10 @@ for flag in "${!hardeningEnableMap[@]}"; do
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling pacret >&2; fi
      hardeningCFlagsBefore+=('-mbranch-protection=pac-ret')
      ;;
+    glibcxxassertions)
+      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling glibcxxassertions >&2; fi
+      hardeningCFlagsBefore+=('-D_GLIBCXX_ASSERTIONS')
+      ;;
    stackprotector)
      if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling stackprotector >&2; fi
      hardeningCFlagsBefore+=('-fstack-protector-strong' '--param' 'ssp-buffer-size=4')
@@ -64,6 +64,12 @@ lib.extendMkDerivation {
      # Go build flags.
      GOFLAGS ? [ ],

+      # Instead of building binary targets with 'go install', build test binaries with 'go test'.
+      # The binaries found in $out/bin can be executed as go tests outside of the sandbox.
+      # This is mostly useful outside of nixpkgs, for example to build integration/e2e tests
+      # that won't run within the sandbox.
+      buildTestBinaries ? false,
+
      ...
    }@args:
    {
@@ -346,8 +352,18 @@ lib.extendMkDerivation {
                  export NIX_BUILD_CORES=1
              fi
              for pkg in $(getGoDirs ""); do
-                echo "Building subPackage $pkg"
-                buildGoDir install "$pkg"
+                ${
+                  if buildTestBinaries then
+                    ''
+                      echo "Building test binary for $pkg"
+                      buildGoDir "test -c -o $GOPATH/bin/" "$pkg"
+                    ''
+                  else
+                    ''
+                      echo "Building subPackage $pkg"
+                      buildGoDir install "$pkg"
+                    ''
+                }
              done
            ''
          + lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@@ -367,7 +383,7 @@ lib.extendMkDerivation {
          ''
        );

-      doCheck = args.doCheck or true;
+      doCheck = args.doCheck or (!buildTestBinaries);
      checkPhase =
        args.checkPhase or ''
          runHook preCheck
@@ -0,0 +1,9 @@
+{
+  lib,
+  callPackage,
+}:
+
+lib.packagesFromDirectoryRecursive {
+  inherit callPackage;
+  directory = ./tests;
+}
@@ -0,0 +1,3 @@
+module build-test-binaries
+
+go 1.24
@@ -0,0 +1,7 @@
+package main
+
+import "testing"
+
+func TestHelloFromTest(t *testing.T) {
+	t.Log("Hello from test")
+}
@@ -0,0 +1,34 @@
+{
+  buildGoModule,
+  runCommandCC,
+}:
+
+let
+  testPackage = buildGoModule {
+    name = "build-test-binaries";
+    src = ./.;
+    vendorHash = null;
+    buildTestBinaries = true;
+  };
+in
+
+runCommandCC "build-test-binaries-check"
+  {
+    nativeBuildInputs = [ testPackage ];
+    passthru = { inherit testPackage; };
+  }
+  ''
+    fail() {
+      echo "Test failed: $1" >&2
+      exit 1
+    }
+
+    command -v build-test-binaries.test ||
+      fail "build-test-binaries.test not found in PATH"
+
+    build-test-binaries.test -test.v | tee $out ||
+      fail "build-test-binaries.test failed"
+
+    grep -q "Hello from test" $out ||
+      fail "Output does not contain expected string"
+  ''
@@ -32,7 +32,7 @@

  `attrs`

-  : An AttrSet with the following definitions. See https://specifications.freedesktop.org/desktop-entry-spec/1.4/recognized-keys.html#id-1.7.6 for definitions.
+  : An AttrSet with the following definitions. See https://specifications.freedesktop.org/desktop-entry-spec/1.5/recognized-keys.html#id-1.7.6 for definitions.

    - `name` (string): The name of the desktop file (excluding the .desktop or .directory file extensions)
    - `destination` (string): The directory that will contain the desktop entry file (Default: "/share/applications")
@@ -57,7 +57,8 @@
    - `startupNotify` (bool): The `StartupNotify` of the desktop entry
    - `startupWMClass` (string): The `StartupWMClass` of the desktop entry
    - `url` (string): The `URL` of the Link-type desktop entry
-    - `prefersNonDefaultGPU` (bool): The `PrefersNonDefaultGPU` (non-standard) of the desktop entry
+    - `prefersNonDefaultGPU` (bool): The `PrefersNonDefaultGPU` of the desktop entry
+    - `singleMainWindow` (bool): The `SingleMainWindow` of the desktop entry
    - `extraConfig` (AttrSet): Additional values to be added literally to the final item, e.g. vendor extensions

  # Output
@@ -66,7 +67,7 @@

  # Developer Note

-  All possible values are as defined by the spec, version 1.4.
+  All possible values are as defined by the spec, version 1.5.
  Please keep in spec order for easier maintenance.
  When adding a new value, don't forget to update the Version field below!
  See https://specifications.freedesktop.org/desktop-entry-spec/latest
@@ -99,8 +100,7 @@ lib.makeOverridable (
    startupWMClass ? null,
    url ? null,
    prefersNonDefaultGPU ? null,
-    # not supported until version 1.5, which is not supported by our desktop-file-utils as of 2022-02-23
-    # singleMainWindow ? null,
+    singleMainWindow ? null,
    extraConfig ? { }, # Additional values to be added literally to the final item, e.g. vendor extensions
  }:
  let
@@ -133,7 +133,7 @@ lib.makeOverridable (
    # Please keep in spec order.
    mainSection = {
      "Type" = type;
-      "Version" = "1.4";
+      "Version" = "1.5";
      "Name" = desktopName;
      "GenericName" = genericName;
      "NoDisplay" = boolOrNullToString noDisplay;
@@ -155,7 +155,7 @@ lib.makeOverridable (
      "StartupWMClass" = startupWMClass;
      "URL" = url;
      "PrefersNonDefaultGPU" = boolOrNullToString prefersNonDefaultGPU;
-      # "SingleMainWindow" = boolOrNullToString singleMainWindow;
+      "SingleMainWindow" = boolOrNullToString singleMainWindow;
    }
    // extraConfig;

@@ -19,7 +19,7 @@ cargoBuildHook() {

    local flagsArray=(
        "-j" "$NIX_BUILD_CORES"
-        "--target" "@rustcTarget@"
+        "--target" "@rustcTargetSpec@"
        "--offline"
    )

@@ -29,7 +29,7 @@ cargoCheckHook() {
    fi

    flagsArray+=(
-        "--target" "@rustcTarget@"
+        "--target" "@rustcTargetSpec@"
        "--offline"
    )

@@ -10,7 +10,7 @@ cargoNextestHook() {
    fi

    local flagsArray=(
-        "--target" "@rustcTarget@"
+        "--target" "@rustcTargetSpec@"
        "--offline"
    )

@@ -20,7 +20,7 @@
  cargoBuildHook = makeSetupHook {
    name = "cargo-build-hook.sh";
    substitutions = {
-      inherit (stdenv.targetPlatform.rust) rustcTarget;
+      inherit (stdenv.targetPlatform.rust) rustcTargetSpec;
      inherit (rust.envVars) setEnv;

    };
@@ -35,7 +35,7 @@
  cargoCheckHook = makeSetupHook {
    name = "cargo-check-hook.sh";
    substitutions = {
-      inherit (stdenv.targetPlatform.rust) rustcTarget;
+      inherit (stdenv.targetPlatform.rust) rustcTargetSpec;
      inherit (rust.envVars) setEnv;
    };
    passthru.tests = {
@@ -63,7 +63,7 @@
    name = "cargo-nextest-hook.sh";
    propagatedBuildInputs = [ cargo-nextest ];
    substitutions = {
-      inherit (stdenv.targetPlatform.rust) rustcTarget;
+      inherit (stdenv.targetPlatform.rust) rustcTargetSpec;
    };
    passthru.tests = {
      test = tests.rust-hooks.cargoNextestHook;
@@ -121,7 +121,7 @@
      pkgsHostTarget.rustc
    ];
    substitutions = {
-      inherit (stdenv.targetPlatform.rust) rustcTarget;
+      inherit (stdenv.targetPlatform.rust) rustcTargetSpec;
      inherit (rust.envVars) setEnv;

    };
@@ -20,7 +20,7 @@ maturinBuildHook() {
    local flagsArray=(
        "--jobs=$NIX_BUILD_CORES"
        "--offline"
-        "--target" "@rustcTarget@"
+        "--target" "@rustcTargetSpec@"
        "--manylinux" "off"
        "--strip"
        "--release"
@@ -11,7 +11,7 @@ compressManPages() {
    # Compress all uncompressed manpages.  Don't follow symlinks, etc.
    # gzip -f is needed to not error out on hard links.
    find "$dir"/share/man/ -type f -a '!' -regex '.*\.\(bz2\|gz\|xz\)$' -print0 \
-        | xargs -0 -n1 -P "$NIX_BUILD_CORES" gzip -f
+        | xargs -0 -n1 -P "$NIX_BUILD_CORES" gzip -n -f

    # Point symlinks to compressed manpages.
    find "$dir"/share/man/ -type l -a '!' -regex '.*\.\(bz2\|gz\|xz\)$' -print0 \
@@ -41,7 +41,7 @@ echo "testBuildFailure: Original builder produced exit code: $r"
 #
 # NOTE: This MUST be done after the original builder has finished!
 #       Otherwise we could pollute its environment.
-if [ -e "${NIX_ATTRS_SH_FILE:-}" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
+if [ -e "${NIX_ATTRS_SH_FILE:-}" ]; then . "$NIX_ATTRS_SH_FILE"; fi

 # Variables injected by replaceVars
 #
@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  buildGo123Module,
+  buildGoModule,
  fetchzip,
  pkg-config,
  copyDesktopItems,
@@ -15,7 +15,7 @@
  buildPackages,
 }:

-buildGo123Module (finalAttrs: {
+buildGoModule (finalAttrs: {
  pname = "anvil-editor";
  version = "0.6";

@@ -30,7 +30,7 @@ buildGo123Module (finalAttrs: {

  vendorHash = "sha256-1oFBV7D7JgOt5yYAxVvC4vL4ccFv3JrNngZbo+5pzrk=";

-  anvilExtras = buildGo123Module {
+  anvilExtras = buildGoModule {
    pname = "anvil-editor-extras";
    inherit (finalAttrs) version src meta;
    vendorHash = "sha256-4pfk5XuwDbCWFZIF+1l+dy8NfnGNjgHmSg9y6/RnTSo=";
@@ -51,6 +51,7 @@ buildGo123Module (finalAttrs: {
    vulkan-headers
    libGL
    xorg.libX11
+    xorg.libxcb
    xorg.libXcursor
    xorg.libXfixes
  ];
@@ -93,5 +94,9 @@ buildGo123Module (finalAttrs: {
    mainProgram = "anvil";
    maintainers = with lib.maintainers; [ aleksana ];
    platforms = with lib.platforms; unix ++ windows;
+    # Doesn't build with >buildGo123Module.
+    # Multiple errors like the following:
+    # '> vendor/gioui.org/internal/vk/vulkan.go:1916:9: cannot define new methods on non-local type SurfaceCapabilities'
+    broken = true;
  };
 })
@@ -178,6 +178,9 @@ stdenv.mkDerivation (finalAttrs: {
    ZSTD_ROOT = zstd.dev;
  };

+  # fails tests on glibc with this enabled
+  hardeningDisable = [ "glibcxxassertions" ];
+
  preConfigure = ''
    patchShebangs build-support/
    substituteInPlace "src/arrow/vendored/datetime/tz.cpp" \
@@ -21,8 +21,8 @@
  libXi,
  libXext,
  gnome,
-  systemd,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdLibs,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
 }:

 stdenv.mkDerivation rec {
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
  ]
  ++ lib.optionals systemdSupport [
    # libsystemd is a needed for dbus-broker support
-    systemd
+    systemdLibs
  ];

  # In atspi-2.pc dbus-1 glib-2.0
@@ -53,6 +53,13 @@ stdenv.mkDerivation (finalAttrs: {
    kyua
  ];

+  # Don’t install the test programs for ATF itself; they’re useless
+  # other than as part of the `installCheckPhase`, and they contain
+  # non‐reproducible references to the build directory.
+  postInstall = ''
+    rm -r $out/tests
+  '';
+
  installCheckPhase = ''
    runHook preInstallCheck
    HOME=$TMPDIR PATH=$out/bin:$PATH kyua test
@@ -16,7 +16,7 @@ let
    }:
    fetchpatch {
      inherit sha256 name;
-      url = "https://salsa.debian.org/multimedia-team/audiofile/raw/debian/0.3.6-4/debian/patches/${debname}";
+      url = "https://salsa.debian.org/multimedia-team/audiofile/raw/debian/0.3.6-7/debian/patches/${debname}";
    };

 in
@@ -97,6 +97,31 @@ stdenv.mkDerivation rec {
      debname = "10_Check-for-division-by-zero-in-BlockCodec-runPull.patch";
      sha256 = "1rlislkjawq98bbcf1dgl741zd508wwsg85r37ca7pfdf6wgl6z7";
    })
+    (fetchDebianPatch {
+      name = "CVE-2018-13440.patch";
+      debname = "11_CVE-2018-13440.patch";
+      sha256 = "sha256-qDfjiBJ4QXgn8588Ra1X0ViH0jBjtFS/+2zEGIUIhuo=";
+    })
+    (fetchDebianPatch {
+      name = "CVE-2018-17095.patch";
+      debname = "12_CVE-2018-17095.patch";
+      sha256 = "sha256-FC89EFZuRLcj5x4wZVqUlitEMTRPSZk+qzQpIoVk9xY=";
+    })
+    (fetchDebianPatch {
+      name = "CVE-2022-24599.patch";
+      debname = "0013-Fix-CVE-2022-24599.patch";
+      sha256 = "sha256-DHJQ4B6cvKfSlXy66ZC5RNaCMDaygj8dWLZZhJnhw1E=";
+    })
+    (fetchDebianPatch {
+      name = "1_CVE-2019-13147.patch";
+      debname = "0014-Partial-fix-of-CVE-2019-13147.patch";
+      sha256 = "sha256-clb/XiIZbmttPr2dT9AZsbQ97W6lwifEwMO4l2ZEh0k=";
+    })
+    (fetchDebianPatch {
+      name = "2_CVE-2019-13147.patch";
+      debname = "0015-Partial-fix-of-CVE-2019-13147.patch";
+      sha256 = "sha256-JOZIw962ae7ynnjJXGO29i8tuU5Dhk67DmB0o5/vSf4=";
+    })
  ];

  meta = with lib; {
@@ -1,11 +1,11 @@
 {
-  buildGo123Module,
+  buildGoModule,
  fetchFromGitHub,
  lib,
  nix-update-script,
 }:

-buildGo123Module (finalAttrs: {
+buildGoModule (finalAttrs: {
  pname = "avalanchego";
  version = "1.13.2";

@@ -119,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
    pipewire
    qt6.qtwayland
    xorg.libX11
+    xorg.libxcb
    xorg.libXext
  ]
  ++ optionals stdenv.hostPlatform.isDarwin [
@@ -22,6 +22,12 @@ stdenv.mkDerivation rec {
    hash = "sha256-M2m9XkGKdfuZCGOSWu1bQgOYrOuzIOxMAwaz6uI/EHo=";
  };

+  postPatch = ''
+    # fix `mount -t` tab completion
+    substituteInPlace bash_completion \
+      --replace-fail "/lib/modules" "/run/booted-system/kernel-modules/lib/modules"
+  '';
+
  strictDeps = true;
  nativeBuildInputs = [ autoreconfHook ];

@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+# This package only provides the bluetooth headers from the bluez package
+# for consumption in Python, which cannot consume bluez.dev due to multiple
+# infinite recursion paths.
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bluez-headers";
+  version = "5.83";
+
+  # This package has the source, because of the emulatorAvailable check in the
+  # bluez function args, that causes an infinite recursion with Python on cross
+  # builds.
+  src = fetchurl {
+    url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
+    hash = "sha256-EIUi2QnSIFgTmb/sk9qrYgNVOc7vPdo+eZcHhcY70kw=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/include/bluetooth
+    cp -v lib/*.h "$out/include/bluetooth/"
+  '';
+
+  meta = {
+    homepage = "https://www.bluez.org/";
+    description = "Official Linux Bluetooth protocol stack";
+    changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
+    license = with lib.licenses; [
+      bsd2
+      gpl2Plus
+      lgpl21Plus
+      mit
+    ];
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.linux;
+  };
+})
@@ -3,6 +3,7 @@
  stdenv,
  alsa-lib,
  autoreconfHook,
+  bluez-headers,
  dbus,
  docutils,
  ell,
@@ -28,12 +29,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bluez";
-  version = "5.83";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EIUi2QnSIFgTmb/sk9qrYgNVOc7vPdo+eZcHhcY70kw=";
-  };
+  inherit (bluez-headers) version src;

  patches = [
    (fetchurl {
@@ -186,18 +182,7 @@ stdenv.mkDerivation (finalAttrs: {
    url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git";
  };

-  meta = {
-    homepage = "https://www.bluez.org/";
-    description = "Official Linux Bluetooth protocol stack";
-    changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
-    license = with lib.licenses; [
-      bsd2
-      gpl2Plus
-      lgpl21Plus
-      mit
-    ];
+  meta = bluez-headers.meta // {
    mainProgram = "btinfo";
-    maintainers = with lib.maintainers; [ ];
-    platforms = lib.platforms.linux;
  };
 })
@@ -11,11 +11,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bmake";
-  version = "20250707";
+  version = "20250804";

  src = fetchurl {
    url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-phJApAZdkMOSXdd0+Po9c97sGnMiiobulfzYIGPSiwg=";
+    hash = "sha256-C0kDdkSyUyBtLnENRuMoWeYt/ixsjnIYrkOfLvUN6K0=";
  };

  patches = [
@@ -0,0 +1,12 @@
+diff '--color=auto' -ruN a/tools/include/uapi/linux/types.h b/tools/include/uapi/linux/types.h
+--- a/tools/include/uapi/linux/types.h	2025-05-18 06:26:10.000000000 +0000
+++ b/tools/include/uapi/linux/types.h	2025-07-04 08:00:39.772748792 +0000
+@@ -2,7 +2,7 @@
+ #ifndef _UAPI_LINUX_TYPES_H
+ #define _UAPI_LINUX_TYPES_H
+ 
+-#include <asm-generic/int-ll64.h>
+#include <asm/types.h>
+ 
+ /* copied from linux:include/uapi/linux/types.h */
+ #define __bitwise
@@ -22,6 +22,12 @@ stdenv.mkDerivation rec {

  separateDebugInfo = true;

+  patches = [
+    # fix unknown type name '__vector128' on powerpc64*
+    # https://www.spinics.net/lists/bpf/msg28613.html
+    ./include-asm-types-for-powerpc64.patch
+  ];
+
  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [
    python3
@@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "btrfs-progs";
-  version = "6.15";
+  version = "6.16";

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-V9pCjdIZn9iNg+zxytBWeM54ZA735S12M76Yh872dLs=";
+    hash = "sha256-Makw+HN8JhioJK1L0f3YP1QQPg6qFaqtxIT/rjNGb8U=";
  };

  nativeBuildInputs = [
@@ -23,6 +23,11 @@ stdenv.mkDerivation rec {
    hash = "sha256-8IDMLQPeO576N1lizVudXUmTV6hNOiowjzRpEWBsZ+U=";
  };

+  outputs = [
+    "out"
+    "dev"
+  ];
+
  postPatch = ''
    substituteInPlace tests/libtest.sh \
      --replace "/var/tmp" "$TMPDIR"
@@ -23,7 +23,7 @@ let
    lib.concatStringsSep "\n\n" extraCertificateStrings
  );

-  srcVersion = "3.114";
+  srcVersion = "3.115";
  version = if nssOverride != null then nssOverride.version else srcVersion;
  meta = with lib; {
    homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -47,7 +47,7 @@ let
          owner = "nss-dev";
          repo = "nss";
          rev = "NSS_${lib.replaceStrings [ "." ] [ "_" ] version}_RTM";
-          hash = "sha256-YVtXk1U9JtqfOH7+m/+bUI/yXJcydqjjGbCy/5xbMe8=";
+          hash = "sha256-8PeFeaIOtjBZJLBx3ONwZlK5SaLnjKEFoZWvVsu/3tA=";
        };

    dontBuild = true;
@@ -12,19 +12,19 @@

 let
  # this version may need to be updated along with package version
-  cargoVersion = "0.89.0";
+  cargoVersion = "0.90.0";
 in
 rustPlatform.buildRustPackage rec {
  pname = "cargo-c";
-  version = "0.10.14";
+  version = "0.10.15";

  src = fetchCrate {
    inherit pname;
    version = "${version}+cargo-${cargoVersion}";
-    hash = "sha256-t6cbufPdpyaFzwEFWt19Nid2S5FXCJCS+SHJ0aJICX0=";
+    hash = "sha256-szqDSHGihE+Oj8L3EBlC5XH4kSBYOptd0Xtk3MhXooQ=";
  };

-  cargoHash = "sha256-nW+akmbpIGZnhJLBdwDAGI4m5eSwdT2Z/iY2RV4zMQY=";
+  cargoHash = "sha256-36ygs/EhCktG1jmBnP9c7EgnfcWnGrqqcW3qAw+Yfy4=";

  nativeBuildInputs = [
    pkg-config
@@ -1,12 +1,12 @@
 {
  stdenv,
  lib,
-  buildGo123Module,
+  buildGoModule,
  fetchFromGitHub,
  libX11,
 }:

-buildGo123Module rec {
+buildGoModule rec {
  pname = "certinfo";
  version = "1.0.24";

@@ -23,9 +23,9 @@
  rebuildMan ? false,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "cryptsetup";
-  version = "2.8.0";
+  version = "2.8.1";

  outputs = [
    "bin"
@@ -36,8 +36,10 @@ stdenv.mkDerivation rec {
  separateDebugInfo = true;

  src = fetchurl {
-    url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-zJ4tN8JahxzqN1ILKNUyIHsMFnD7EPxU1oBx9j9SQ6I=";
+    url =
+      "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/"
+      + "cryptsetup-${finalAttrs.version}.tar.xz";
+    hash = "sha256-LDN563ZZfcq1CRFEmwE+JpfEv/zHFtu/DZsOj7u0b7Q=";
  };

  patches = [
@@ -106,7 +108,7 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = "https://gitlab.com/cryptsetup/cryptsetup/";
    description = "LUKS for dm-crypt";
-    changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${version}/docs/v${version}-ReleaseNotes";
+    changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${finalAttrs.version}/docs/v${finalAttrs.version}-ReleaseNotes";
    license = lib.licenses.gpl2Plus;
    mainProgram = "cryptsetup";
    maintainers = with lib.maintainers; [
@@ -115,4 +117,4 @@ stdenv.mkDerivation rec {
    ];
    platforms = with lib.platforms; linux;
  };
-}
+})
@@ -14,12 +14,16 @@
  e2fsprogs,
  runCommand,
  libarchive,
+  bash,
+  bashNonInteractive,
 }:

 stdenv.mkDerivation rec {
  pname = "e2fsprogs";
  version = "1.47.3";

+  __structuredAttrs = true;
+
  src = fetchurl {
    url = "mirror://kernel/linux/kernel/people/tytso/e2fsprogs/v${version}/e2fsprogs-${version}.tar.xz";
    hash = "sha256-hX5u+AD+qiu0V4+8gQIUvl08iLBy6lPFOEczqWVzcyk=";
@@ -42,9 +46,12 @@ stdenv.mkDerivation rec {
    "out"
    "man"
    "info"
+    "scripts"
  ]
  ++ lib.optionals withFuse [ "fuse2fs" ];

+  strictDeps = true;
+
  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [
    pkg-config
@@ -54,6 +61,7 @@ stdenv.mkDerivation rec {
    libuuid
    gettext
    libarchive
+    bash
  ]
  ++ lib.optionals withFuse [ fuse3 ];

@@ -86,6 +94,11 @@ stdenv.mkDerivation rec {
    if [ -f $out/lib/${pname}/e2scrub_all_cron ]; then
      mv $out/lib/${pname}/e2scrub_all_cron $bin/bin/
    fi
+
+    moveToOutput bin/mk_cmds "$scripts"
+    moveToOutput bin/compile_et "$scripts"
+    moveToOutput sbin/e2scrub "$scripts"
+    moveToOutput sbin/e2scrub_all "$scripts"
  ''
  + lib.optionalString withFuse ''
    mkdir -p $fuse2fs/bin
@@ -94,6 +107,17 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  outputChecks = {
+    bin.disallowedRequisites = [
+      bash
+      bashNonInteractive
+    ];
+    out.disallowedRequisites = [
+      bash
+      bashNonInteractive
+    ];
+  };
+
  passthru.tests = {
    simple-filesystem = runCommand "e2fsprogs-create-fs" { } ''
      mkdir -p $out
@@ -7,6 +7,7 @@
  extra-cmake-modules,
  dbus,
  libX11,
+  libxcb,
  libXi,
  libXtst,
  libnotify,
@@ -80,6 +81,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    libXi
    libXtst
    libX11
+    libxcb
    xclip
    xdotool
  ];
@@ -1,7 +1,7 @@
 {
  cmake,
  doxygen,
-  fetchFromGitHub,
+  fetchurl,
  graphviz,
  lib,
  libogg,
@@ -10,17 +10,17 @@
  pkg-config,
  stdenv,
  versionCheckHook,
-  enableManpages ? buildPackages.pandoc.compiler.bootstrapAvailable,
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "flac";
  version = "1.5.0";

-  src = fetchFromGitHub {
-    owner = "xiph";
-    repo = "flac";
-    tag = finalAttrs.version;
-    hash = "sha256-B6XRai5UOAtY/7JXNbI3YuBgazi1Xd2ZOs6vvLq9LIs=";
+  # Building from tarball instead of GitHub to include pre-built manpages.
+  # This prevents huge numbers of rebuilds for pandoc / haskell-updates.
+  # It also enables manpages for platforms where pandoc is not available.
+  src = fetchurl {
+    url = "http://downloads.xiph.org/releases/flac/flac-${finalAttrs.version}.tar.xz";
+    hash = "sha256-8sHHZZKoL//4QTujxKEpm2x6sGxzTe4D/YhjBIXCuSA=";
  };

  hardeningDisable = [ "trivialautovarinit" ];
@@ -30,18 +30,13 @@ stdenv.mkDerivation (finalAttrs: {
    doxygen
    graphviz
    pkg-config
-  ]
-  ++ lib.optional enableManpages buildPackages.pandoc;
+  ];

  buildInputs = [ libogg ];

-  cmakeFlags =
-    lib.optionals (!stdenv.hostPlatform.isStatic) [
-      "-DBUILD_SHARED_LIBS=ON"
-    ]
-    ++ lib.optionals (!enableManpages) [
-      "-DINSTALL_MANPAGES=OFF"
-    ];
+  cmakeFlags = lib.optionals (!stdenv.hostPlatform.isStatic) [
+    "-DBUILD_SHARED_LIBS=ON"
+  ];

  CFLAGS = [
    "-O3"
@@ -57,8 +52,6 @@ stdenv.mkDerivation (finalAttrs: {
    "dev"
    "doc"
    "out"
-  ]
-  ++ lib.optionals enableManpages [
    "man"
  ];

@@ -14,13 +14,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fluidsynth";
-  version = "2.4.6";
+  version = "2.4.7";

  src = fetchFromGitHub {
    owner = "FluidSynth";
    repo = "fluidsynth";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hy2kWJmvvmItXl05Nw9gWEYpoDg+NtP2veO2vZ00QhI=";
+    hash = "sha256-z7DIX8KpPdtEHEMoxH7ewW32aXm27gfmWPZawwITyRQ=";
  };

  outputs = [
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-100dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-tnr/RF4FYyjVP5cy05iE9V3Y0wP8Ja89u6M6i6NanM8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-100dpi";
+    license = lib.licenses.hpndSellVariant; # plus a trademark that doesn't change the license
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-75dpi";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-EoGmLb7e0WnklcrhpbSH4fM28rTZcdkpEcWcEDmZuRE=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-75dpi";
+    license = lib.licenses.hpndSellVariant; # plus a trademark that doesn't change the license
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-utopia-100dpi";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-utopia-100dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-+4TsKXqQaXNUjKWbfG2uqtISRL7F0/sefJPfXvQ7Aks=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe Utopia 100dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-utopia-100dpi";
+    license = lib.licenses.adobeUtopia;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  font-util,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-utopia-75dpi";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-utopia-75dpi-${finalAttrs.version}.tar.xz";
+    hash = "sha256-pyYkWTLQck+gxTjJkoEdY9WX5fU5KPQEjpyvViN5d2A=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    bdftopcf
+    font-util
+    mkfontscale
+  ];
+
+  buildInputs = [ font-util ];
+
+  configureFlags = [ "--with-fontrootdir=$(out)/share/fonts/X11" ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe Utopia 75dpi pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-utopia-75dpi";
+    license = lib.licenses.adobeUtopia;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-adobe-utopia-type1";
+  version = "1.0.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-adobe-utopia-type1-${finalAttrs.version}.tar.xz";
+    hash = "sha256-TLKAvEdpOwfF4A/Q5a1XIaq+vAVIw/BndOXMPLz3Vpc=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Adobe Utopia PostScript Type 1 fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/adobe-utopia-type1";
+    license = lib.licenses.adobeUtopia;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-ttf";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-ttf-${finalAttrs.version}.tar.xz";
+    hash = "sha256-haX5DQDEjCsG/RJeqK28i47pdCnjB1CByHEJJu/sOlY=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Luxi TrueType fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-ttf";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-bh-type1";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-bh-type1-${finalAttrs.version}.tar.xz";
+    hash = "sha256-Gd7D7Aar3mvt0QCUV56Si+Dw/DvbT76T9MaczkBtcqY=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Luxi PostScript Type 1 fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/bh-type1";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-encodings";
+  version = "1.1.0";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/encodings-${finalAttrs.version}.tar.xz";
+    hash = "sha256-n/E8YhdWz6EulfMrpIpbI4Oej1d9AEi+2mbGfatN6XU=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [ mkfontscale ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname encodings \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Font encoding tables for libfontenc";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/encodings";
+    license = lib.licenses.publicDomain;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  bdftopcf,
+  mkfontscale,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "font-mutt-misc";
+  version = "1.0.4";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/font/font-mutt-misc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-sSNZ9OEsI7z8tEi5GCl+l1+pG+9Sk9iNPCU0PMdouyQ=";
+  };
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    bdftopcf
+    mkfontscale
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/font/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "ClearU pcf fonts";
+    homepage = "https://gitlab.freedesktop.org/xorg/font/mutt-misc";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -135,7 +135,7 @@ python.pkgs.buildPythonApplication rec {
  '';

  nativeCheckInputs = with python.pkgs; [
-    (postgresql.withPackages (p: [ p.postgis ])).out
+    (postgresql.withPackages (p: [ p.postgis ]))
    postgresqlTestHook
    pytest-django
    pytest-playwright
@@ -129,6 +129,7 @@ stdenv.mkDerivation (finalAttrs: {
    pipewire
    hwdata
    xorg.libX11
+    xorg.libxcb
    wayland
    wayland-protocols
    vulkan-loader
@@ -1,6 +1,6 @@
 {
  lib,
-  buildGo123Module,
+  buildGoModule,
  buildNpmPackage,
  fetchFromGitHub,
  nix-update-script,
@@ -37,7 +37,7 @@ let
  };

 in
-buildGo123Module rec {
+buildGoModule rec {
  inherit version;
  pname = "glasskube";

@@ -74,7 +74,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glib";
-  version = "2.84.3";
+  version = "2.84.4";

  outputs = [
    "bin"
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qk+HwyJb9XyoXzIIiPdISQGheTTKNwI8O9hDWnLbhj4=";
+    hash = "sha256-ip6hCUPDb8EX4lP4DJHkd7ZzUlrkV2KUKFiu9XYxu5A=";
  };

  patches =
@@ -17,6 +17,7 @@
  wayland-scanner,
  nix-update-script,
  libX11,
+  libxcb,
  libXcursor,
  libXi,
  libXrandr,
@@ -65,6 +66,7 @@ rustPlatform.buildRustPackage rec {
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    wayland
    libX11
+    libxcb
    libXcursor
    libXi
    libXrandr
@@ -5,6 +5,7 @@
  buildGoModule,
  libGL,
  libX11,
+  libxcb,
  libXcursor,
  libXfixes,
  libxkbcommon,
@@ -42,6 +43,7 @@ buildGoModule rec {
    libxkbcommon
    wayland
    libX11
+    libxcb
    libXcursor
    libXfixes
    libGL
@@ -1,10 +1,11 @@
 {
  lib,
-  buildGo123Module,
+  buildGoModule,
  fetchFromGitHub,
+  versionCheckHook,
 }:

-buildGo123Module rec {
+buildGoModule rec {
  pname = "gowitness";
  version = "3.0.5";

@@ -22,6 +23,10 @@ buildGo123Module rec {
    "-w"
  ];

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
  meta = with lib; {
    description = "Web screenshot utility";
    homepage = "https://github.com/sensepost/gowitness";
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libX11,
+  xorgproto,
+  writeScript,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ico";
+  version = "1.0.6";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/app/ico-${finalAttrs.version}.tar.xz";
+    hash = "sha256-OPNp1DHnUygP3nD6SJzJTOIE+fjqvS9J/H0yr6afRAU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libX11
+    xorgproto
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/app/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+  };
+
+  meta = {
+    description = "Simple animation program that may be used for testing various X11 operations and extensions";
+    homepage = "https://gitlab.freedesktop.org/xorg/app/ico";
+    license = with lib.licenses; [
+      x11
+      hpnd
+      hpndSellVariant
+    ];
+    mainProgram = "ico";
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "imath";
-  version = "3.2.0";
+  version = "3.2.1";

  src = fetchFromGitHub {
    owner = "AcademySoftwareFoundation";
    repo = "imath";
    rev = "v${version}";
-    sha256 = "sha256-tdJh8aRVakdu2zDeGA/0JCCNzdv6s6x55eUpgNJtuI0=";
+    hash = "sha256-O8IpP2MQ7egDbHIiL5TNBygmQCiS6Q/0VSe0LypsM/g=";
  };

  nativeBuildInputs = [ cmake ];
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "inih";
-  version = "60";
+  version = "61";

  src = fetchFromGitHub {
    owner = "benhoyt";
    repo = "inih";
    rev = "r${version}";
-    hash = "sha256-6U6/b7J4dGFwVPw31Vl+BEDrN2ygK43Hb344Uk8NdFs=";
+    hash = "sha256-tSmdd9uAXaRQtnqj0hKuT0wofcZcYjqgPbhtaR+cr84=";
  };

  nativeBuildInputs = [
@@ -16,46 +16,98 @@
 #
 # See comments on each function for more details.

-# installManPage <path> [...<path>]
+# installManPage [--name <path>] <path> [...<path>]
 #
 # Each argument is checked for its man section suffix and installed into the appropriate
 # share/man/man<n>/ directory. The function returns an error if any paths don't have the man
 # section suffix (with optional .gz compression).
+#
+# Optionally accepts pipes as input, which when provided require the `--name` argument to
+# name the output file.
+#
+# installManPage --name foobar.1 <($out/bin/foobar --manpage)
 installManPage() {
-    local path
-    for path in "$@"; do
-        if test -z "$path"; then
+    local arg name='' continueParsing=1
+    while { arg=$1; shift; }; do
+        if (( continueParsing )); then
+            case "$arg" in
+              --name)
+                  name=$1
+                  shift || {
+                      nixErrorLog "${FUNCNAME[0]}: --name flag expected an argument"
+                      return 1
+                  }
+                  continue;;
+              --name=*)
+                  # Treat `--name=foo` that same as `--name foo`
+                  name=${arg#--name=}
+                  continue;;
+              --)
+                  continueParsing=0
+                  continue;;
+            esac
+        fi
+
+        nixInfoLog "${FUNCNAME[0]}: installing $arg${name:+ as $name}"
+        local basename
+
+        # Check if path is empty
+        if test -z "$arg"; then
+            # It is an empty string
            nixErrorLog "${FUNCNAME[0]}: path cannot be empty"
            return 1
        fi
-        nixInfoLog "${FUNCNAME[0]}: installing $path"
-        local basename
-        basename=$(stripHash "$path") # use stripHash in case it's a nix store path
+
+        if test -n "$name"; then
+          # Provided name. Required for pipes, optional for paths
+          basename=$name
+        elif test -p "$arg"; then
+            # Named pipe requires a file name
+            nixErrorLog "${FUNCNAME[0]}: named pipe requires --name argument"
+        else
+            # Normal file without a name
+            basename=$(stripHash "$arg") # use stripHash in case it's a nix store path
+        fi
+
+        # Check that it is well-formed
        local trimmed=${basename%.gz} # don't get fooled by compressed manpages
        local suffix=${trimmed##*.}
        if test -z "$suffix" -o "$suffix" = "$trimmed"; then
-            nixErrorLog "${FUNCNAME[0]}: path missing manpage section suffix: $path"
+            nixErrorLog "${FUNCNAME[0]}: path missing manpage section suffix: $arg"
            return 1
        fi
+
+        # Create the out-path
        local outRoot
        if test "$suffix" = 3; then
            outRoot=${!outputDevman:?}
        else
            outRoot=${!outputMan:?}
        fi
-        local outPath="${outRoot}/share/man/man$suffix/$basename"
-        install -D --mode=644 --no-target-directory "$path" "$outPath"
+        local outPath="${outRoot}/share/man/man$suffix/"
+        nixInfoLog "${FUNCNAME[0]}: installing to $outPath"
+
+        # Install
+        if test -p "$arg"; then
+          # install doesn't work with pipes on Darwin
+          mkdir -p "$outPath" && cat "$arg" > "$outPath/$basename"
+        else
+          install -D --mode=644 --no-target-directory -- "$arg" "$outPath/$basename"
+        fi
+
+        # Reset the name for the next page
+        name=
    done
 }

 # installShellCompletion [--cmd <name>] ([--bash|--fish|--zsh] [--name <name>] <path>)...
 #
 # Each path is installed into the appropriate directory for shell completions for the given shell.
-# If one of `--bash`, `--fish`, or `--zsh` is given the path is assumed to belong to that shell.
-# Otherwise the file extension will be examined to pick a shell. If the shell is unknown a warning
-# will be logged and the command will return a non-zero status code after processing any remaining
-# paths. Any of the shell flags will affect all subsequent paths (unless another shell flag is
-# given).
+# If one of `--bash`, `--fish`, `--zsh`, or `--nushell` is given the path is assumed to belong to
+# that shell. Otherwise the file extension will be examined to pick a shell. If the shell is
+# unknown a warning will be logged and the command will return a non-zero status code after
+# processing any remaining paths. Any of the shell flags will affect all subsequent paths (unless
+# another shell flag is given).
 #
 # If the shell completion needs to be renamed before installing the optional `--name <name>` flag
 # may be given. Any name provided with this flag only applies to the next path.
@@ -84,6 +136,7 @@ installManPage() {
 #
 #   installShellCompletion --bash --name foobar.bash share/completions.bash
 #   installShellCompletion --fish --name foobar.fish share/completions.fish
+#   installShellCompletion --nushell --name foobar share/completions.nu
 #   installShellCompletion --zsh --name _foobar share/completions.zsh
 #
 # Or to use shell newline escaping to split a single invocation across multiple lines:
@@ -91,6 +144,7 @@ installManPage() {
 #   installShellCompletion --cmd foobar \
 #     --bash <($out/bin/foobar --bash-completion) \
 #     --fish <($out/bin/foobar --fish-completion) \
+#     --nushell <($out/bin/foobar --nushell-completion)
 #     --zsh <($out/bin/foobar --zsh-completion)
 #
 # If any argument is `--` the remaining arguments will be treated as paths.
@@ -100,7 +154,7 @@ installShellCompletion() {
        # Parse arguments
        if (( parseArgs )); then
            case "$arg" in
-            --bash|--fish|--zsh)
+            --bash|--fish|--zsh|--nushell)
                shell=${arg#--}
                continue;;
            --name)
@@ -146,7 +200,7 @@ installShellCompletion() {
        elif [[ -p "$arg" ]]; then
            # this is a named fd or fifo
            if [[ -z "$curShell" ]]; then
-                nixErrorLog "${FUNCNAME[0]}: named pipe requires one of --bash, --fish, or --zsh"
+                nixErrorLog "${FUNCNAME[0]}: named pipe requires one of --bash, --fish, --zsh, or --nushell"
                return 1
            elif [[ -z "$name" && -z "$cmdname" ]]; then
                nixErrorLog "${FUNCNAME[0]}: named pipe requires one of --cmd or --name"
@@ -161,6 +215,7 @@ installShellCompletion() {
                case "$argbase" in
                ?*.bash) curShell=bash;;
                ?*.fish) curShell=fish;;
+                ?*.nu) curShell=nushell;;
                ?*.zsh) curShell=zsh;;
                *)
                    if [[ "$argbase" = _* && "$argbase" != *.* ]]; then
@@ -182,6 +237,7 @@ installShellCompletion() {
        elif [[ -n "$cmdname" ]]; then
            case "$curShell" in
            bash|fish) outName=$cmdname.$curShell;;
+            nushell) outName=$cmdname.nu;;
            zsh) outName=_$cmdname;;
            *)
                # Our list of shells is out of sync with the flags we accept or extensions we detect.
@@ -193,6 +249,7 @@ installShellCompletion() {
        case "$curShell" in
        bash) sharePath=bash-completion/completions;;
        fish) sharePath=fish/vendor_completions.d;;
+        nushell) sharePath=nushell/vendor/autoload;;
        zsh)
            sharePath=zsh/site-functions
            # only apply automatic renaming if we didn't have a manual rename
@@ -14,11 +14,17 @@ runCommandLocal "install-shell-files--install-completion-cmd"
    echo bar > bar.zsh
    echo baz > baz.fish
    echo qux > qux.fish
+    echo buzz > buzz.nu

-    installShellCompletion --cmd foobar --bash foo.bash --zsh bar.zsh --fish baz.fish --name qux qux.fish
+    installShellCompletion \
+      --cmd foobar --bash foo.bash \
+      --zsh bar.zsh \
+      --fish baz.fish --name qux qux.fish \
+      --nushell --cmd buzzbar buzz.nu

    cmp foo.bash $out/share/bash-completion/completions/foobar.bash
    cmp bar.zsh $out/share/zsh/site-functions/_foobar
    cmp baz.fish $out/share/fish/vendor_completions.d/foobar.fish
    cmp qux.fish $out/share/fish/vendor_completions.d/qux
+    cmp buzz.nu $out/share/nushell/vendor/autoload/buzzbar.nu
  ''
@@ -13,9 +13,11 @@ runCommandLocal "install-shell-files--install-completion-fifo"
    installShellCompletion \
      --bash --name foo.bash <(echo foo) \
      --zsh --name _foo <(echo bar) \
-      --fish --name foo.fish <(echo baz)
+      --fish --name foo.fish <(echo baz) \
+      --nushell --name foo.nu <(echo bucks)

    [[ $(<$out/share/bash-completion/completions/foo.bash) == foo ]] || { echo "foo.bash comparison failed"; exit 1; }
    [[ $(<$out/share/zsh/site-functions/_foo) == bar ]] || { echo "_foo comparison failed"; exit 1; }
    [[ $(<$out/share/fish/vendor_completions.d/foo.fish) == baz ]] || { echo "foo.fish comparison failed"; exit 1; }
+    [[ $(<$out/share/nushell/vendor/autoload/foo.nu) == bucks ]] || { echo "foo.nu comparison failed"; exit 1; }
  ''
@@ -13,10 +13,12 @@ runCommandLocal "install-shell-files--install-completion-inference"
    echo foo > foo.bash
    echo bar > bar.zsh
    echo baz > baz.fish
+    echo buzz > buzz.nu

-    installShellCompletion foo.bash bar.zsh baz.fish
+    installShellCompletion foo.bash bar.zsh baz.fish buzz.nu

    cmp foo.bash $out/share/bash-completion/completions/foo.bash
    cmp bar.zsh $out/share/zsh/site-functions/_bar
    cmp baz.fish $out/share/fish/vendor_completions.d/baz.fish
+    cmp buzz.nu $out/share/nushell/vendor/autoload/buzz.nu
  ''
@@ -13,10 +13,16 @@ runCommandLocal "install-shell-files--install-completion-name"
    echo foo > foo
    echo bar > bar
    echo baz > baz
+    echo bucks > bucks

-    installShellCompletion --bash --name foobar.bash foo --zsh --name _foobar bar --fish baz
+    installShellCompletion \
+      --bash --name foobar.bash foo \
+      --zsh --name _foobar bar \
+      --fish baz \
+      --nushell --name foobar.nu bucks

    cmp foo $out/share/bash-completion/completions/foobar.bash
    cmp bar $out/share/zsh/site-functions/_foobar
    cmp baz $out/share/fish/vendor_completions.d/baz
+    cmp bucks $out/share/nushell/vendor/autoload/foobar.nu
  ''
@@ -15,12 +15,18 @@ runCommandLocal "install-shell-files--install-completion"
    echo baz > baz
    echo qux > qux.zsh
    echo quux > quux
+    echo quokka > quokka

-    installShellCompletion --bash foo bar --zsh baz qux.zsh --fish quux
+    installShellCompletion \
+      --bash foo bar \
+      --zsh baz qux.zsh \
+      --fish quux \
+      --nushell quokka

    cmp foo $out/share/bash-completion/completions/foo
    cmp bar $out/share/bash-completion/completions/bar
    cmp baz $out/share/zsh/site-functions/_baz
    cmp qux.zsh $out/share/zsh/site-functions/_qux
    cmp quux $out/share/fish/vendor_completions.d/quux
+    cmp quokka $out/share/nushell/vendor/autoload/quokka
  ''
@@ -0,0 +1,23 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-manpage-fifo"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    installManPage doc/*
+
+    installManPage \
+      --name foo.1 <(echo foo) \
+      --name=bar.2 <(echo bar) \
+      --name baz.3 <(echo baz)
+
+    echo "foo" | cmp - $out/share/man/man1/foo.1
+    echo "bar" | cmp - $out/share/man/man2/bar.2
+    echo "baz" | cmp - $out/share/man/man3/baz.3
+  ''
@@ -0,0 +1,18 @@
+{
+  lib,
+  installShellFiles,
+  runCommandLocal,
+}:
+
+runCommandLocal "install-shell-files--install-manpage"
+  {
+    nativeBuildInputs = [ installShellFiles ];
+    meta.platforms = lib.platforms.all;
+  }
+  ''
+    echo foo > foo.1
+
+    installManPage --name bar.1 foo.1
+
+    cmp foo.1 $out/share/man/man1/bar.1
+  ''
@@ -14,10 +14,13 @@ runCommandLocal "install-shell-files--install-manpage"
    echo foo > doc/foo.1
    echo bar > doc/bar.2.gz
    echo baz > doc/baz.3
+    echo buzz > --name.1

    installManPage doc/*
+    installManPage -- --name.1

    cmp doc/foo.1 $out/share/man/man1/foo.1
    cmp doc/bar.2.gz $out/share/man/man2/bar.2.gz
    cmp doc/baz.3 $out/share/man/man3/baz.3
+    cmp -- --name.1 $out/share/man/man1/--name.1
  ''
@@ -19,11 +19,11 @@

 stdenv.mkDerivation rec {
  pname = "iproute2";
-  version = "6.15.0";
+  version = "6.16.0";

  src = fetchurl {
    url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-gEGFSoglg61SY0ZnNsnIxox0saNXVKt3DSM0P5R1KPs=";
+    hash = "sha256-WQDMwV+aw797fq6B3rWTcSPfNemTR6fxGiKBhILwqNA=";
  };

  patches = [
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jasper";
-  version = "4.2.5";
+  version = "4.2.6";

  src = fetchFromGitHub {
    owner = "jasper-software";
    repo = "jasper";
    rev = "version-${finalAttrs.version}";
-    hash = "sha256-PjgglP4mKW1eOJ7QgUmc4KNsp/d9ubJBWr4CLcQAyRA=";
+    hash = "sha256-tq27ANDDRdP224E12UeQnvE6BFZRk7KczH4Dq+yt0nY=";
  };

  outputs = [
@@ -1,30 +1,38 @@
 {
  lib,
  stdenv,
-  fetchurl,
+  fetchgit,
  nixosTests,
  autoreconfHook,
  pkg-config,
  flex,
+  perl,
+  bison,
+  autoPatchelfHook,
  check,
  pam,
  bash,
+  bashNonInteractive,
  coreutils,
-  gzip,
+  zlib,
  bzip2,
  xz,
  zstd,
  gitUpdater,
+  pkgsCross,
  withVlock ? true,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "kbd";
-  version = "2.8.0";
+  version = "2.8.0-unstable-2025-08-12";

-  src = fetchurl {
-    url = "mirror://kernel/linux/utils/kbd/${pname}-${version}.tar.xz";
-    hash = "sha256-AfWAbafR009ZS3sqauGrIyFTRM8QZOjtzTqQ/vl3ahE=";
+  __structuredAttrs = true;
+
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git";
+    rev = "46295167a55643e941c8cdcfd2cb76bd138c851c";
+    hash = "sha256-m1aVfsEme/BnyJogOPvGcOrSJfli8B/TrGxOm4POt0w=";
  };

  # vlock is moved into its own output, since it depends on pam. This
@@ -39,17 +47,6 @@ stdenv.mkDerivation rec {
    "vlock"
  ];

-  configureFlags = [
-    "--enable-optional-progs"
-    "--enable-libkeymap"
-    "--disable-nls"
-    (lib.enableFeature withVlock "vlock")
-  ]
-  ++ lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
-    "ac_cv_func_malloc_0_nonnull=yes"
-    "ac_cv_func_realloc_0_nonnull=yes"
-  ];
-
  patches = [
    ./search-paths.patch
  ];
@@ -66,62 +63,87 @@ stdenv.mkDerivation rec {
    mv fgGIod/trf{,-fgGIod}.map
    mv colemak/{en-latin9,colemak}.map
    popd
-
-    # Fix paths to decompressors. Trailing space to avoid replacing `xz` in `".xz"`.
-    substituteInPlace src/libkbdfile/kbdfile.c \
-      --replace-fail 'gzip '  '${gzip}/bin/gzip ' \
-      --replace-fail 'bzip2 ' '${bzip2.bin}/bin/bzip2 ' \
-      --replace-fail 'xz '    '${xz.bin}/bin/xz ' \
-      --replace-fail 'zstd '  '${zstd.bin}/bin/zstd '
-
-    sed -i '
-      1i prefix:=$(vlock)
-      1i bindir := $(vlock)/bin' \
-      src/vlock/Makefile.in \
-      src/vlock/Makefile.am
  '';

+  preConfigure = ''
+    # Perl and Bash only used during build time
+    patchShebangs --build contrib/
+  '';
+
+  configureFlags = [
+    "--enable-optional-progs"
+    "--enable-libkeymap"
+    "--disable-nls"
+    (lib.enableFeature withVlock "vlock")
+  ]
+  ++ lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ];
+
+  strictDeps = true;
  enableParallelBuilding = true;

-  postInstall = ''
-    for s in unicode_{start,stop}; do
-      substituteInPlace ''${!outputBin}/bin/$s \
-        --replace-fail /usr/bin/tty ${coreutils}/bin/tty
-      moveToOutput "bin/$s" "$scripts"
-    done
-  '';
-
-  buildInputs = [
-    check
-    bash
-  ]
-  ++ lib.optionals withVlock [ pam ];
-
-  NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isStatic "-laudit";
  nativeBuildInputs = [
    autoreconfHook
    pkg-config
    flex
+    perl
+    bison
+    autoPatchelfHook # for patching dlopen()
+  ];
+
+  nativeCheckInputs = [
+    check
+  ];
+
+  buildInputs = [
+    zlib
+    bzip2
+    xz
+    zstd
+    bash
+  ]
+  ++ lib.optionals withVlock [ pam ];
+
+  postInstall = ''
+    substituteInPlace $out/bin/unicode_{start,stop} \
+      --replace-fail /usr/bin/tty ${coreutils}/bin/tty
+
+    moveToOutput bin/unicode_start $scripts
+    moveToOutput bin/unicode_stop $scripts
+  ''
+  + lib.optionalString withVlock ''
+    moveToOutput bin/vlock $vlock
+    moveToOutput etc/pam.d/vlock $vlock
+  '';
+
+  outputChecks.out.disallowedRequisites = [
+    bash
+    bashNonInteractive
  ];
-  strictDeps = true;

-  passthru.tests = {
-    inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
-  };
  passthru = {
-    gzip = gzip;
    updateScript = gitUpdater {
      # No nicer place to find latest release.
      url = "https://github.com/legionus/kbd.git";
      rev-prefix = "v";
    };
+    tests = {
+      cross =
+        let
+          systemString = if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform";
+        in
+        pkgsCross.${systemString}.kbd;
+      inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
+    };
  };

-  meta = with lib; {
+  meta = {
    homepage = "https://kbd-project.org/";
    description = "Linux keyboard tools and keyboard maps";
-    platforms = platforms.linux;
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ davidak ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ davidak ];
  };
 }
@@ -23,7 +23,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libadwaita";
-  version = "1.7.5";
+  version = "1.7.6";

  outputs = [
    "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "GNOME";
    repo = "libadwaita";
    tag = finalAttrs.version;
-    hash = "sha256-KlaRwOWHvzm+VwMygiEh8wqJfEwwA+x7o9T72Qpqnmo=";
+    hash = "sha256-HpjP6VSkEAFeXIFXLbndQzEWJwVvHe6B3aSwCz6KiIM=";
  };

  depsBuildBuild = [
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  pkg-config,
+  autoreconfHook,
+  util-macros,
+  xorgproto,
+  libX11,
+  libXext,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libapplewm";
+  version = "1.4.1-unstable-2021-01-04";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "xorg/lib";
+    repo = "libapplewm";
+    rev = "be972ebc3a97292e7d2b2350eff55ae12df99a42";
+    hash = "sha256-NH9YeOEtnEupqpnsMLC21I+LmCOzT7KnfdzNNWqba/Y=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+    util-macros
+  ];
+
+  buildInputs = [
+    xorgproto
+    libX11
+    libXext
+  ];
+
+  passthru = {
+    # updateScript = # no updatescript since we don't use a tagged release (last one was 14 years ago)
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Xlib-based library for the Apple-WM extension";
+    longDescription = ''
+      AppleWM is a simple library designed to interface with the Apple-WM extension.
+      This extension allows X window managers to better interact with the Mac OS X Aqua user
+      interface when running X11 in a rootless mode.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libapplewm";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [ "applewm" ];
+    platforms = lib.platforms.darwin;
+  };
+})
@@ -74,9 +74,9 @@ stdenv.mkDerivation (finalAttrs: {
        "libarchive/test/test_read_disk_directory_traversals.c"
        "cpio/test/test_option_a.c"
        "cpio/test/test_option_t.c"
-      ]
-      ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
-        # only on some aarch64-linux systems?
+        # fails tests on filesystems with 64-bit inode values:
+        # FAIL: bsdcpio_test
+        #   bsdcpio: linkfile: large inode number truncated: Numerical result out of range
        "cpio/test/test_basic.c"
        "cpio/test/test_format_newc.c"
      ];
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libdmx";
+  version = "1.1.5";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libdmx-${finalAttrs.version}.tar.xz";
+    hash = "sha256-NaTiaosLK0/jZEHcpGNkXD+lLSgqw1IFAaOOqULL908=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    # updateScript = # libdmx it deprecated and thus needs no updatescript
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Xlib-based library for the DMX (Distributed Multihead X) extension";
+    longDescription = ''
+      This library allows X11 clients to use the Distributed Multihead X (DMX) Extension,
+      as previously implemented in the Xdmx server.
+      X.Org removed support for the Xdmx server from the xorg-server releases in the version 21
+      release in 2021. This library is thus now considered deprecated and the version 1.1.5 release
+      is the last release X.Org plans to make of libdmx.
+    '';
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libdmx";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [ "dmx" ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  zlib,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libfontenc";
+  version = "1.1.8";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libfontenc-${finalAttrs.version}.tar.xz";
+    hash = "sha256-ewLD1AUjbg2GgGsd6daGj+YMMTYos4NQsDKRSqT9FMY=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    zlib
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname ${finalAttrs.pname} \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X font encoding library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libfontenc";
+    license = lib.licenses.mit;
+    maintainers = [ ];
+    pkgConfigModules = [ "fontenc" ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  xtrans,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libfs";
+  version = "1.0.10";
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libFS-${finalAttrs.version}.tar.xz";
+    hash = "sha256-m6u9PIYGnJhWPaBEBF/cDs5OwMk9zdLGiqdOs0tPO3c=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    xtrans
+  ];
+
+  configureFlags = lib.optional (
+    stdenv.hostPlatform != stdenv.buildPlatform
+  ) "--enable-malloc0returnsnull";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libFS \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Font Service client library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libfs";
+    license = with lib.licenses; [
+      mitOpenGroup
+      hpndSellVariant
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "libfs" ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  xtrans,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libice";
+  version = "1.1.2";
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libICE-${finalAttrs.version}.tar.xz";
+    hash = "sha256-l05O1BQiXrPHFphd+XCfTajSKmeiiQBmvG38ia0phiU=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    xtrans
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libICE \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Inter-Client Exchange Library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libice";
+    license = lib.licenses.mitOpenGroup;
+    maintainers = [ ];
+    pkgConfigModules = [ "ice" ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -20,7 +20,7 @@

 stdenv.mkDerivation rec {
  pname = "libmbim";
-  version = "1.30.0";
+  version = "1.32.0";

  outputs = [
    "out"
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
    owner = "mobile-broadband";
    repo = "libmbim";
    rev = version;
-    hash = "sha256-sHTpu9WeMZroT+1I18ObEHWSzcyj/Relyz8UNe+WawI=";
+    hash = "sha256-+4INXuH2kbKs9C6t4bOJye7yyfYH/BLukmgDVvXo+u0=";
  };

  mesonFlags = [
@@ -4,6 +4,8 @@
  fetchurl,
  flex,
  bison,
+  bash,
+  bashNonInteractive,
  bluez,
  libnl,
  libxcrypt,
@@ -26,13 +28,25 @@ stdenv.mkDerivation rec {
  pname = "libpcap";
  version = "1.10.5";

+  __structuredAttrs = true;
+
  src = fetchurl {
    url = "https://www.tcpdump.org/release/${pname}-${version}.tar.gz";
    hash = "sha256-N87ZChmjAqfzLkWCJKAMNlwReQXCzTWsVEtogKgUiPA=";
  };

-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ libnl ] ++ lib.optionals withRemote [ libxcrypt ];
+  outputs = [
+    "out"
+    "lib"
+  ];
+
+  strictDeps = true;
+
+  buildInputs = [
+    bash
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ libnl ]
+  ++ lib.optionals withRemote [ libxcrypt ];

  nativeBuildInputs = [
    flex
@@ -62,6 +76,11 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

+  outputChecks.lib.disallowedRequisites = [
+    bash
+    bashNonInteractive
+  ];
+
  passthru.tests = {
    inherit
      ettercap
@@ -1,37 +0,0 @@
-From 904e9dee373eca499e976dce131f0baee06db2d6 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Thu, 13 Feb 2025 12:05:17 +0100
-Subject: [PATCH] api: fix seccomp_export_bpf_mem out-of-bounds read
-
-*len is the length of the destination buffer, but program->blks is
-probably not anywhere near that long.  It's already been checked above
-that BPF_PGM_SIZE(program) is less than or equal to *len, so that's
-the correct value to use here to avoid either reading or writing too
-much.
-
-I noticed this because tests/11-basic-basic_errors started failing on
-musl after e797591 ("all: add seccomp_precompute() functionality").
-
-Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
-Link: https://github.com/seccomp/libseccomp/pull/458
-
- src/api.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/api.c b/src/api.c
-index adccef3..65a277a 100644
--- a/src/api.c
-+++ b/src/api.c
-@@ -786,7 +786,7 @@ API int seccomp_export_bpf_mem(const scmp_filter_ctx ctx, void *buf,
- 		if (BPF_PGM_SIZE(program) > *len)
- 			rc = _rc_filter(-ERANGE);
- 		else
-			memcpy(buf, program->blks, *len);
-+			memcpy(buf, program->blks, BPF_PGM_SIZE(program));
- 	}
- 	*len = BPF_PGM_SIZE(program);
- 
-- 
-2.47.0
-
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchpatch,
  getopt,
  util-linuxMinimal,
  which,
@@ -20,7 +21,21 @@ stdenv.mkDerivation rec {
  };

  patches = [
-    ./oob-read.patch
+    # Remove when version > 2.6.0
+    # Fixes test failures on big-endian archs
+    (fetchpatch {
+      name = "0001-libseccomp-remove-fuzzer-from-test-62-sim-arch_transactions.patch";
+      url = "https://github.com/seccomp/libseccomp/commit/2f0f3b0e9121720108431c5d054164016f476230.patch";
+      hash = "sha256-AKAQyALJlLgxnS23OEoqfyDswp0kU2vmja5ohgvFojw=";
+    })
+
+    # Remove when version > 2.6.0
+    # Fixes OOB reads & tests on musl
+    (fetchpatch {
+      name = "0002-libseccomp-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch";
+      url = "https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec.patch";
+      hash = "sha256-TdfQ5T8FrGE6+P24MIi9rKSC3fQu/Jlr4bsFiJd4yVY=";
+    })
  ];

  outputs = [
@@ -0,0 +1,67 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libice,
+  libuuid,
+  xorgproto,
+  xtrans,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libsm";
+  version = "1.2.6";
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libSM-${finalAttrs.version}.tar.xz";
+    hash = "sha256-vnwKvbFcv9KaxiVzwcguh3+dQEetFTIefql9HkPYNb4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libice
+    libuuid
+    xorgproto
+    xtrans
+  ];
+
+  propagatedBuildInputs = [
+    # needs to be propagated because of header file dependencies
+    libice
+  ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libSM \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Session Management Library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libsm";
+    license = with lib.licenses; [
+      mit
+      mitOpenGroup
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [ "sm" ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitLab,
+  fetchpatch,
  nix-update-script,

  cmake,
@@ -48,9 +49,32 @@ stdenv.mkDerivation (finalAttrs: {
  };

  patches = [
+    # Fix test_directory test on big-endian
+    # https://gitlab.com/libtiff/libtiff/-/issues/652
+    (fetchpatch {
+      name = "0001-Update-test_directory-not-to-fail-on-big-endian-machines";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/e8233c42f2e0a0ea7260c3cc7ebbaec8e5cb5e07.patch";
+      hash = "sha256-z5odG66j4U+WoUjTUuBIhcVUCGK1GYdvW/cVucawNZI=";
+    })
+
    # libc++abi 11 has an `#include <version>`, this picks up files name
    # `version` in the project's include paths
    ./rename-version.patch
+    (fetchpatch {
+      name = "CVE-2024-13978_1.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/7be20ccaab97455f192de0ac561ceda7cd9e12d1.patch";
+      hash = "sha256-cpsQyIvyP6LkGeQTlLX73iNd1AcPkvZ6Xqfns7G3JBc=";
+    })
+    (fetchpatch {
+      name = "CVE-2024-13978_2.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4.patch";
+      hash = "sha256-cZlLTeB7/nvylf5SLzKF7g91aBERhZxpV5fmWEJVrX4=";
+    })
+    (fetchpatch {
+      name = "CVE-2025-9165.patch";
+      url = "https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0.patch";
+      hash = "sha256-DIsk8trbHMMTrj6jP5Ae8ciRjHV4CPHdWCN+VbeFnFo=";
+    })
  ];

  postPatch = ''
@@ -6,6 +6,7 @@
  cmake,
  pkg-config,
  libX11,
+  libxcb,
  libxkbcommon,
  xinput,
  xorg,
@@ -30,6 +31,7 @@ stdenv.mkDerivation rec {
  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) (
    [
      libX11
+      libxcb
      libxkbcommon
      xinput
    ]
@@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "liburing";
-  version = "2.11";
+  version = "2.12";

  src = fetchFromGitHub {
    owner = "axboe";
    repo = "liburing";
    tag = "liburing-${version}";
-    hash = "sha256-V73QP89WMrL2fkPRbo/TSkfO7GeDsCudlw2Ut5baDzA=";
+    hash = "sha256-sEMzkyjrCc49ogfUnzdgNtEXmW0Tz/PUKo99C965428=";
  };

  separateDebugInfo = true;
@@ -41,7 +41,6 @@ stdenv.mkDerivation (finalAttrs: {

  propagatedBuildInputs = [
    xorgproto
-    libxcb
  ];

  configureFlags =
@@ -0,0 +1,82 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  xorgproto,
+  libx11,
+  libxext,
+  libxmu,
+  libxpm,
+  libxt,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxaw";
+  version = "1.0.16";
+
+  outputs = [
+    "out"
+    "dev"
+    "devdoc"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/lib/libXaw-${finalAttrs.version}.tar.xz";
+    hash = "sha256-cx1XK1THCPgeGXpq+oAWkY4uBt/TAl4GbKZCpbjDnI8=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    xorgproto
+    libx11
+    libxext
+    libxmu
+    libxpm
+    libxt
+  ];
+
+  propagatedBuildInputs = [
+    xorgproto
+    libxt
+    # needs to be propagated because of header file dependencies
+    libxmu
+  ];
+
+  postInstall =
+    # remove dangling symlinks to .so files on static
+    lib.optionalString stdenv.hostPlatform.isStatic "rm $out/lib/*.so*";
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname libXaw \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "X Athena Widget Set, based on the X Toolkit Intrinsics (Xt) Library";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxaw";
+    license = with lib.licenses; [
+      mitOpenGroup
+      x11
+      hpndSellVariant
+      hpnd
+    ];
+    maintainers = [ ];
+    pkgConfigModules = [
+      "xaw6"
+      "xaw7"
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  m4,
+  python3,
+  xcbproto,
+  libxcb,
+  writeScript,
+  testers,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libxcb-errors";
+  version = "1.0.1";
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "mirror://xorg/individual/xcb/xcb-util-errors-${finalAttrs.version}.tar.xz";
+    hash = "sha256-VijIe5hCWa2Se6zYpClYMZw2vfSwZYh4A8nYIPuA81c=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    m4
+    python3
+  ];
+
+  buildInputs = [
+    xcbproto
+    libxcb
+  ];
+
+  propagatedBuildInputs = [ libxcb ];
+
+  passthru = {
+    updateScript = writeScript "update-${finalAttrs.pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts
+      version="$(list-directory-versions --pname xcb-util-errors \
+        --url https://xorg.freedesktop.org/releases/individual/lib/ \
+        | sort -V | tail -n1)"
+      update-source-version ${finalAttrs.pname} "$version"
+    '';
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "XCB utility library that gives human readable names to error, event & request codes";
+    homepage = "https://gitlab.freedesktop.org/xorg/lib/libxcb-errors";
+    license = lib.licenses.x11;
+    maintainers = [ ];
+    pkgConfigModules = [ "xcb-errors" ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/Show More
+++ b/Show More