Merge master into staging-nixos

ci/OWNERS

@@ -39,6 +39,7 @@
 /lib/derivations.nix        @NixOS/stdenv
 /lib/fetchers.nix           @alyssais @NixOS/stdenv
 /lib/meta.nix               @alyssais @NixOS/stdenv
+/lib/meta-types.nix         @infinisil @adisbladis @NixOS/stdenv
 /lib/source-types.nix       @alyssais @NixOS/stdenv
 /lib/systems                @alyssais @NixOS/stdenv
 ## Libraries / Module system
@@ -67,7 +68,6 @@
 /pkgs/stdenv/generic/problems.nix                @infinisil
 /pkgs/test/problems                              @infinisil
 /pkgs/stdenv/generic/check-meta.nix              @infinisil @Ericson2314 @adisbladis @NixOS/stdenv
-/pkgs/stdenv/generic/meta-types.nix              @infinisil @adisbladis @NixOS/stdenv
 /pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
 /pkgs/build-support                              @philiptaron
 /pkgs/build-support/cc-wrapper                   @Ericson2314

ci/default.nix

@@ -26,11 +26,7 @@ let
 
   fmt =
     let
-      treefmtNixSrc = fetchTarball {
-        inherit (pinned.treefmt-nix) url;
-        sha256 = pinned.treefmt-nix.hash;
-      };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs ./treefmt.nix;
+      treefmt = pkgs.treefmt.withConfig ./treefmt.nix;
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {
         root = ../.;
@@ -38,9 +34,8 @@ let
       };
     in
     {
-      shell = treefmtEval.config.build.devShell;
-      pkg = treefmtEval.config.build.wrapper;
-      check = treefmtEval.config.build.check nixFilesSrc;
+      pkg = treefmt;
+      check = treefmt.check nixFilesSrc;
     };
 
 in

ci/pinned.json

@@ -12,19 +12,6 @@
       "revision": "8c91a71d13451abc40eb9dae8910f972f979852f",
       "url": "https://github.com/NixOS/nixpkgs/archive/8c91a71d13451abc40eb9dae8910f972f979852f.tar.gz",
       "hash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE="
-    },
-    "treefmt-nix": {
-      "type": "Git",
-      "repository": {
-        "type": "GitHub",
-        "owner": "numtide",
-        "repo": "treefmt-nix"
-      },
-      "branch": "main",
-      "submodules": false,
-      "revision": "db947814a175b7ca6ded66e21383d938df01c227",
-      "url": "https://github.com/numtide/treefmt-nix/archive/db947814a175b7ca6ded66e21383d938df01c227.tar.gz",
-      "hash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM="
     }
   },
   "version": 8

ci/treefmt.nix

@@ -1,122 +1,172 @@
-{ pkgs, ... }: {
-  # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-  # which creates trees within the Git repository under `.git-rewrite/t`,
-  # notably without having a `.git` themselves.
-  # So if this projectRootFile were the default `.git/config`,
-  # having the auto-rebase script use treefmt on such a tree would make it
-  # format all files in the _parent_ Git tree as well.
-  projectRootFile = ".git-blame-ignore-revs";
-
-  # Be a bit more verbose by default, so we can see progress happening
-  settings.verbose = 1;
-
-  # By default it's info, which is too noisy since we have many unmatched files
-  settings.on-unmatched = "debug";
-
-  programs.actionlint.enable = true;
-
-  programs.biome = {
-    enable = true;
-    # Disable settings validation because its inputs are liable to hash mismatch
-    validate.enable = false;
-    settings.formatter = {
-      useEditorconfig = true;
-    };
-    settings.javascript.formatter = {
-      quoteStyle = "single";
-      semicolons = "asNeeded";
-    };
-    settings.json.formatter.enabled = false;
-  };
-  settings.formatter.biome.excludes = [
-    "*.min.js"
-    "pkgs/*"
-  ];
-
-  programs.keep-sorted.enable = true;
-
-  # This uses nixfmt underneath, the default formatter for Nix code.
-  # See https://github.com/NixOS/nixfmt
-  programs.nixfmt = {
-    enable = true;
-    package = pkgs.nixfmt;
-  };
-
-  programs.yamlfmt = {
-    enable = true;
-    settings.formatter = {
-      retain_line_breaks = true;
-    };
-  };
-  settings.formatter.yamlfmt.excludes = [
-    # Aligns comments with whitespace
-    "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-    # TODO: Fix formatting for auto-generated file
-    "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-  ];
-
-  programs.nixf-diagnose = {
-    enable = true;
-    ignore = [
-      # Rule names can currently be looked up here:
-      # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-      # TODO: Remove the following and fix things.
-      "sema-unused-def-lambda-noarg-formal"
-      "sema-unused-def-lambda-witharg-arg"
-      "sema-unused-def-lambda-witharg-formal"
-      "sema-unused-def-let"
-      # Keep this rule, because we have `lib.or`.
-      "or-identifier"
-      # TODO: remove after outstanding prelude diagnostics issues are fixed:
-      # https://github.com/nix-community/nixd/issues/761
-      # https://github.com/nix-community/nixd/issues/762
-      "sema-primop-removed-prefix"
-      "sema-primop-overridden"
-      "sema-constant-overridden"
-      "sema-primop-unknown"
-    ];
-  };
-  settings.formatter.nixf-diagnose = {
-    # Ensure nixfmt cleans up after nixf-diagnose.
-    priority = -1;
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  settings = {
+    # numtide/treefmt-nix defaults
     excludes = [
-      # Auto-generated; violates sema-extra-with
-      # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-      # https://github.com/inclyc/nixf-diagnose/issues/13
-      "pkgs/servers/home-assistant/component-packages.nix"
-      # https://github.com/nix-community/nixd/issues/708
-      "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+      "*.lock"
+      "*.patch"
+      "*.diff"
+      "package-lock.json"
+      "go.mod"
+      "go.sum"
+      ".gitattributes"
+      ".gitignore"
+      ".gitmodules"
+      "COPYING"
+      "LICENSE"
     ];
-  };
 
-  settings.formatter.editorconfig-checker = {
-    command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-    options = [
-      "-disable-indent-size"
-      # TODO: Remove this once this upstream issue is fixed:
-      #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-      "-disable-charset"
-    ];
-    includes = [ "*" ];
-    priority = 1;
-  };
+    # Be a bit more verbose by default, so we can see progress happening
+    verbose = 1;
 
-  # TODO: Upstream this into treefmt-nix eventually:
-  #   https://github.com/numtide/treefmt-nix/issues/387
-  settings.formatter.markdown-code-runner = {
-    command = pkgs.lib.getExe pkgs.markdown-code-runner;
-    options =
-      let
-        config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-          presets.nixfmt = {
-            language = "nix";
-            command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
-          };
-        };
-      in
-      [ "--config=${config}" ];
-    includes = [ "*.md" ];
-  };
+    # By default it's info, which is too noisy since we have many unmatched files
+    on-unmatched = "debug";
 
-  programs.zizmor.enable = true;
+    formatter = {
+      # keep-sorted start block=yes newline_separated=yes
+      actionlint = {
+        command = lib.getExe pkgs.actionlint;
+        includes = [
+          ".github/workflows/*.yml"
+          ".github/workflows/*.yaml"
+        ];
+      };
+
+      biome = {
+        command = lib.getExe pkgs.biome;
+        excludes = [
+          "*.min.js"
+          "pkgs/*"
+        ];
+        includes = [
+          "*.js"
+          "*.ts"
+          "*.mjs"
+          "*.mts"
+          "*.cjs"
+          "*.cts"
+          "*.jsx"
+          "*.tsx"
+          "*.d.ts"
+          "*.d.cts"
+          "*.d.mts"
+          "*.css"
+        ];
+        options = [
+          "check"
+          "--write"
+          "--no-errors-on-unmatched"
+          "--use-editorconfig=true"
+          "--javascript-formatter-quote-style=single"
+          "--semicolons=as-needed"
+        ];
+      };
+
+      editorconfig-checker = {
+        command = lib.getExe pkgs.editorconfig-checker;
+        options = [
+          "-disable-indent-size"
+          # TODO: Remove this once this upstream issue is fixed:
+          #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
+          "-disable-charset"
+        ];
+        includes = [ "*" ];
+        priority = 1;
+      };
+
+      keep-sorted = {
+        command = lib.getExe pkgs.keep-sorted;
+        includes = [ "*" ];
+      };
+
+      markdown-code-runner = {
+        command = lib.getExe pkgs.markdown-code-runner;
+        options =
+          let
+            config = pkgs.writers.writeTOML "markdown-code-runner-config" {
+              presets.nixfmt = {
+                language = "nix";
+                command = [ (lib.getExe pkgs.nixfmt) ];
+              };
+            };
+          in
+          [ "--config=${config}" ];
+        includes = [ "*.md" ];
+      };
+
+      nixf-diagnose = {
+        command = lib.getExe pkgs.nixf-diagnose;
+        excludes = [
+          # Auto-generated; violates sema-extra-with
+          # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
+          # https://github.com/inclyc/nixf-diagnose/issues/13
+          "pkgs/servers/home-assistant/component-packages.nix"
+          # https://github.com/nix-community/nixd/issues/708
+          "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
+        ];
+        includes = [ "*.nix" ];
+        options = [
+          "--auto-fix"
+          # Rule names can currently be looked up here:
+          # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
+          # TODO: Remove the following and fix things.
+          "--ignore=sema-unused-def-lambda-noarg-formal"
+          "--ignore=sema-unused-def-lambda-witharg-arg"
+          "--ignore=sema-unused-def-lambda-witharg-formal"
+          "--ignore=sema-unused-def-let"
+          # Keep this rule, because we have `lib.or`.
+          "--ignore=or-identifier"
+          # TODO: remove after outstanding prelude diagnostics issues are fixed:
+          # https://github.com/nix-community/nixd/issues/761
+          # https://github.com/nix-community/nixd/issues/762
+          "--ignore=sema-primop-removed-prefix"
+          "--ignore=sema-primop-overridden"
+          "--ignore=sema-constant-overridden"
+          "--ignore=sema-primop-unknown"
+        ];
+        # Ensure nixfmt cleans up after nixf-diagnose.
+        priority = -1;
+      };
+
+      # This uses nixfmt underneath, the default formatter for Nix code.
+      # See https://github.com/NixOS/nixfmt
+      nixfmt = {
+        command = lib.getExe pkgs.nixfmt;
+        includes = [ "*.nix" ];
+      };
+
+      yamlfmt = {
+        command = lib.getExe pkgs.yamlfmt;
+        excludes = [
+          # Aligns comments with whitespace
+          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
+          # TODO: Fix formatting for auto-generated file
+          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
+        ];
+        includes = [
+          "*.yaml"
+          "*.yml"
+        ];
+        options = [
+          "-formatter"
+          "retain_line_breaks=true"
+        ];
+      };
+
+      zizmor = {
+        command = lib.getExe pkgs.zizmor;
+        includes = [
+          ".github/workflows/*.yml"
+          ".github/workflows/*.yaml"
+          ".github/actions/**/*.yml"
+          ".github/actions/**/*.yaml"
+        ];
+      };
+      # keep-sorted end
+    };
+  };
 }

lib/attrsets.nix

@@ -1800,22 +1800,28 @@ rec {
     :::
   */
   matchAttrs =
-    pattern: attrs:
+    let
+      recurse =
+        pattern: attrs:
+        all (
+          # Compare equality between `pattern` & `attrs`.
+          attr:
+          # Missing attr, not equal.
+          attrs ? ${attr}
+          && (
+            let
+              lhs = pattern.${attr};
+              rhs = attrs.${attr};
+            in
+            # Simple equality check is primarily for non-attrsets, but we run it
+            # on attrsets too, since it may let us avoid recursing
+            lhs == rhs || isAttrs lhs && isAttrs rhs && recurse lhs rhs
+          )
+        ) (attrNames pattern);
+    in
+    pattern:
     assert isAttrs pattern;
-    all (
-      # Compare equality between `pattern` & `attrs`.
-      attr:
-      # Missing attr, not equal.
-      attrs ? ${attr}
-      && (
-        let
-          lhs = pattern.${attr};
-          rhs = attrs.${attr};
-        in
-        # If attrset check recursively
-        if isAttrs lhs then isAttrs rhs && matchAttrs lhs rhs else lhs == rhs
-      )
-    ) (attrNames pattern);
+    recurse pattern;
 
   /**
     Override only the attributes that are already present in the old set

lib/meta-types.nix

@@ -1,6 +1,7 @@
 { lib }:
 # Simple internal type checks for meta.
-# This file is not a stable interface and may be changed arbitrarily.
+# This file is only intended for internal nixpkgs use.
+# It is not a stable interface and may be changed arbitrarily.
 #
 # TODO: add a method to the module system types
 #       see https://github.com/NixOS/nixpkgs/pull/273935#issuecomment-1854173100
@@ -172,10 +173,10 @@ lib.fix (self: {
 
   enum =
     values:
-    assert isList values && all isString values;
+    assert isList values;
     {
-      name = "enum<${concatStringsSep "," values}>";
-      verify = v: isString v && elem v values;
+      name = if all isString values then "enum<${concatStringsSep "," values}>" else "enum";
+      verify = v: elem v values;
     };
 
   record =

lib/systems/doubles.nix

@@ -1,7 +1,15 @@
 { lib }:
 let
-  inherit (lib) lists;
+  inherit (lib)
+    lists
+    splitString
+    ;
   inherit (lib.systems) parse;
+  inherit (parse)
+    mkSystemFromSkeleton
+    mkSkeletonFromList
+    doubleFromSystem
+    ;
   inherit (lib.systems.inspect) predicates;
   inherit (lib.attrsets) matchAttrs;
 
@@ -117,9 +125,17 @@ let
     "x86_64-uefi"
   ];
 
-  allParsed = map parse.mkSystemFromString all;
+  uncheckedSystemFromString =
+    let
+      systemType = {
+        _type = "system";
+      };
+    in
+    s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s)) // systemType;
 
-  filterDoubles = f: map parse.doubleFromSystem (lists.filter f allParsed);
+  allParsed = map uncheckedSystemFromString all;
+
+  filterDoubles = f: map doubleFromSystem (lists.filter f allParsed);
 
 in
 {

lib/systems/inspect.nix

@@ -2,14 +2,17 @@
 
 let
   inherit (lib)
+    all
     any
+    attrNames
     attrValues
     concatMap
     filter
+    flip
     hasPrefix
+    isAttrs
     isList
     mapAttrs
-    matchAttrs
     recursiveUpdateUntil
     toList
     ;
@@ -24,19 +27,49 @@ let
     execFormats
     ;
 
-  abis = mapAttrs (_: abi: removeAttrs abi [ "assertions" ]) lib.systems.parse.abis;
+  # Based on lib.attrsets.matchAttrs, but with:
+  # - the initial isAttrs assertion removed, since this function is only ever
+  # called with attrsets
+  # - isAttrs only performed on one side when recursing, since our input data
+  # will always share a structure
+  matchAttrsUnchecked =
+    pattern: attrs:
+    all (
+      # Compare equality between `pattern` & `attrs`.
+      attr:
+      # Missing attr, not equal.
+      attrs ? ${attr}
+      && (
+        let
+          lhs = pattern.${attr};
+          rhs = attrs.${attr};
+        in
+        # Simple equality check is primarily for non-attrsets, but we run it
+        # on attrsets too, since it may let us avoid recursing
+        lhs == rhs || isAttrs lhs && matchAttrsUnchecked lhs rhs
+      )
+    ) (attrNames pattern);
+
+  removeAssertions = flip removeAttrs [ "assertions" ];
+  abis = mapAttrs (
+    _: abi: if abi ? assertions then removeAssertions abi else abi
+  ) lib.systems.parse.abis;
 in
 
 rec {
   # these patterns are to be matched against {host,build,target}Platform.parsed
+  #
+  # Note: All toplevel attributes within a pattern are expected to be attrsets.
+  # matchAttrsUnchecked should be changed if a pattern is ever added that
+  # doesn't follow this axiom
   patterns = rec {
     # The patterns below are lists in sum-of-products form.
     #
     # Each attribute is list of product conditions; non-list values are treated
     # as a singleton list.  If *any* product condition in the list matches then
     # the predicate matches.  Each product condition is tested by
-    # `lib.attrsets.matchAttrs`, which requires a match on *all* attributes of
-    # the product.
+    # `matchAttrsUnchecked`, which requires a match on *all* attributes of the
+    # product.
 
     isi686 = {
       cpu = cpuTypes.i686;
@@ -489,14 +522,40 @@ rec {
       ) pat2
     ) pat1;
 
-  matchAnyAttrs =
-    patterns:
-    if isList patterns then
-      attrs: any (pattern: matchAttrs pattern attrs) patterns
-    else
-      matchAttrs patterns;
+  matchAnyPattern =
+    let
+      # same as matchAttrsUnchecked definition at the top of the file, but:
+      # - pattern names are cached and reused for multiple attrset calls
+      # - avoid running isAttrs since all patterns are nested attrsets
+      matchPattern =
+        pattern:
+        let
+          names = attrNames pattern;
+        in
+        attrs:
+        all (
+          attr:
+          attrs ? ${attr}
+          && (
+            let
+              lhs = pattern.${attr};
+              rhs = attrs.${attr};
+            in
+            lhs == rhs || matchAttrsUnchecked lhs rhs
+          )
+        ) names;
 
-  predicates = mapAttrs (_: matchAnyAttrs) patterns;
+    in
+    pattern:
+    if isList pattern then
+      let
+        cachedPatterns = map matchPattern pattern;
+      in
+      attrs: any (pattern: pattern attrs) cachedPatterns
+    else
+      matchPattern pattern;
+
+  predicates = mapAttrs (_: matchAnyPattern) patterns;
 
   # these patterns are to be matched against the entire
   # {host,build,target}Platform structure; they include a `parsed={}` marker so

lib/systems/parse.nix

@@ -17,6 +17,9 @@
 { lib }:
 
 let
+  inherit (import ../meta-types.nix { inherit lib; })
+    enum
+    ;
   inherit (lib)
     all
     any
@@ -28,7 +31,6 @@ let
     id
     length
     mapAttrs
-    mergeOneOption
     optionalString
     splitString
     versionAtLeast
@@ -46,20 +48,19 @@ let
     isCygwin
     ;
 
-  inherit (lib.types)
-    enum
-    isType
-    mkOptionType
-    setType
-    ;
-
   setTypes =
     type:
-    mapAttrs (
-      name: value:
-      assert type.check value;
-      setType type.name ({ inherit name; } // value)
-    );
+    if type ? verify then
+      let
+        inherit (type) verify;
+      in
+      mapAttrs (
+        name: value:
+        assert verify value;
+        { inherit name; } // value
+      )
+    else
+      mapAttrs (name: value: { inherit name; } // value);
 
   # gnu-config will ignore the portion of a triple matching the
   # regex `e?abi.*$` when determining the validity of a triple.  In
@@ -76,11 +77,9 @@ in
 rec {
 
   ################################################################################
-
-  types.openSignificantByte = mkOptionType {
+  types.openSignificantByte = {
     name = "significant-byte";
     description = "Endianness";
-    merge = mergeOneOption;
   };
 
   types.significantByte = enum (attrValues significantBytes);
@@ -103,21 +102,24 @@ rec {
 
   ################################################################################
 
-  types.openCpuType = mkOptionType {
+  types.openCpuType = {
     name = "cpu-type";
     description = "instruction set architecture name and information";
-    merge = mergeOneOption;
-    check =
-      x:
-      types.bitWidth.check x.bits
-      && (if 8 < x.bits then types.significantByte.check x.significantByte else !(x ? significantByte));
+    verify =
+      let
+        verifyBitWidth = types.bitWidth.verify;
+        verifySignificantByte = types.significantByte.verify;
+      in
+      v:
+      verifyBitWidth v.bits
+      && (if 8 < v.bits then verifySignificantByte v.significantByte else !(v ? significantByte));
   };
 
   types.cpuType = enum (attrValues cpuTypes);
 
   cpuTypes =
     let
-      inherit (significantBytes) bigEndian littleEndian;
+      inherit (significantBytes) littleEndian bigEndian;
     in
     setTypes types.openCpuType {
       arm = {
@@ -487,10 +489,9 @@ rec {
 
   ################################################################################
 
-  types.openVendor = mkOptionType {
+  types.openVendor = {
     name = "vendor";
     description = "vendor for the platform";
-    merge = mergeOneOption;
   };
 
   types.vendor = enum (attrValues vendors);
@@ -499,23 +500,19 @@ rec {
     apple = { };
     pc = { };
     knuth = { };
-
     # Actually matters, unlocking some MinGW-w64-specific options in GCC. See
     # bottom of https://sourceforge.net/p/mingw-w64/wiki2/Unicode%20apps/
     w64 = { };
-
     none = { };
     unknown = { };
   };
 
   ################################################################################
 
-  types.openExecFormat = mkOptionType {
+  types.openExecFormat = {
     name = "exec-format";
     description = "executable container used by the kernel";
-    merge = mergeOneOption;
   };
-
   types.execFormat = enum (attrValues execFormats);
 
   execFormats = setTypes types.openExecFormat {
@@ -524,16 +521,14 @@ rec {
     macho = { };
     pe = { };
     wasm = { };
-
     unknown = { };
   };
 
   ################################################################################
 
-  types.openKernelFamily = mkOptionType {
+  types.openKernelFamily = {
     name = "exec-format";
     description = "executable container used by the kernel";
-    merge = mergeOneOption;
   };
 
   types.kernelFamily = enum (attrValues kernelFamilies);
@@ -545,12 +540,15 @@ rec {
 
   ################################################################################
 
-  types.openKernel = mkOptionType {
-    name = "kernel";
+  types.openKernel = {
+    name = "open-kernel";
     description = "kernel name and information";
-    merge = mergeOneOption;
-    check =
-      x: types.execFormat.check x.execFormat && all types.kernelFamily.check (attrValues x.families);
+    verify =
+      let
+        verifyExecFormat = types.execFormat.verify;
+        verifyKernelFamily = types.kernelFamily.verify;
+      in
+      v: verifyExecFormat v.execFormat && all verifyKernelFamily (attrValues v.families);
   };
 
   types.kernel = enum (attrValues kernels);
@@ -647,10 +645,9 @@ rec {
 
   ################################################################################
 
-  types.openAbi = mkOptionType {
+  types.openAbi = {
     name = "abi";
     description = "binary interface for compiled code and syscalls";
-    merge = mergeOneOption;
   };
 
   types.abi = enum (attrValues abis);
@@ -760,119 +757,138 @@ rec {
 
   ################################################################################
 
-  types.parsedPlatform = mkOptionType {
+  types.parsedPlatform = {
     name = "system";
     description = "fully parsed representation of llvm- or nix-style platform tuple";
-    merge = mergeOneOption;
-    check =
+    verify =
+      let
+        verifyCpu = types.cpuType.verify;
+        verifyVendor = types.vendor.verify;
+        verifyKernel = types.kernel.verify;
+        verifyAbi = types.abi.verify;
+      in
       {
         cpu,
         vendor,
         kernel,
         abi,
       }:
-      types.cpuType.check cpu
-      && types.vendor.check vendor
-      && types.kernel.check kernel
-      && types.abi.check abi;
+      verifyCpu cpu && verifyVendor vendor && verifyKernel kernel && verifyAbi abi;
   };
 
-  isSystem = isType "system";
+  isSystem = v: v._type or null == "system";
 
   mkSystem =
+    let
+      inherit (types.parsedPlatform) verify;
+    in
     components:
-    assert types.parsedPlatform.check components;
-    setType "system" components;
+    assert verify components;
+    components
+    // {
+      _type = "system";
+    };
 
   mkSkeletonFromList =
+    let
+      linuxComponents = [
+        "eabi"
+        "eabihf"
+        "elf"
+        "gnu"
+      ];
+      appleComponents = [
+        "redox"
+        "mmixware"
+        "ghcjs"
+        "mingw32"
+        "uefi"
+      ];
+    in
     l:
     {
       "1" =
-        if head l == "avr" then
+        let
+          firstComponent = head l;
+        in
+        if firstComponent == "avr" then
           {
-            cpu = head l;
+            cpu = firstComponent;
             kernel = "none";
             abi = "unknown";
           }
         else
           throw "system string '${lib.concatStringsSep "-" l}' with 1 component is ambiguous";
       "2" = # We only do 2-part hacks for things Nix already supports
-        if elemAt l 1 == "cygwin" then
+        let
+          secondComponent = elemAt l 1;
+        in
+        if secondComponent == "cygwin" then
           mkSkeletonFromList [
             (head l)
             "pc"
-            "cygwin"
+            secondComponent
           ]
         # MSVC ought to be the default ABI so this case isn't needed. But then it
         # becomes difficult to handle the gnu* variants for Aarch32 correctly for
         # minGW. So it's easier to make gnu* the default for the MinGW, but
         # hack-in MSVC for the non-MinGW case right here.
-        else if elemAt l 1 == "windows" then
+        else if secondComponent == "windows" then
           {
             cpu = head l;
-            kernel = "windows";
+            kernel = secondComponent;
             abi = "msvc";
           }
-        else if (elemAt l 1) == "elf" then
+        else if secondComponent == "elf" then
           {
             cpu = head l;
             vendor = "unknown";
             kernel = "none";
-            abi = elemAt l 1;
+            abi = secondComponent;
           }
         else
           {
             cpu = head l;
-            kernel = elemAt l 1;
+            kernel = secondComponent;
           };
       "3" =
+        let
+          secondComponent = elemAt l 1;
+          thirdComponent = elemAt l 2;
+        in
         # cpu-kernel-environment
-        if
-          elemAt l 1 == "linux"
-          || elem (elemAt l 2) [
-            "eabi"
-            "eabihf"
-            "elf"
-            "gnu"
-          ]
-        then
+        if secondComponent == "linux" || elem thirdComponent linuxComponents then
           {
             cpu = head l;
-            kernel = elemAt l 1;
-            abi = elemAt l 2;
+            kernel = secondComponent;
+            abi = thirdComponent;
             vendor = "unknown";
           }
         # cpu-vendor-os
         else if
-          elemAt l 1 == "apple"
-          || elem (elemAt l 2) [
-            "redox"
-            "mmixware"
-            "ghcjs"
-            "mingw32"
-            "uefi"
-          ]
-          || hasPrefix "freebsd" (elemAt l 2)
-          || hasPrefix "netbsd" (elemAt l 2)
-          || hasPrefix "openbsd" (elemAt l 2)
-          || hasPrefix "genode" (elemAt l 2)
-          || hasPrefix "wasm32" (elemAt l 0)
+          secondComponent == "apple"
+          || elem thirdComponent appleComponents
+          || hasPrefix "freebsd" thirdComponent
+          || hasPrefix "netbsd" thirdComponent
+          || hasPrefix "openbsd" thirdComponent
+          || hasPrefix "genode" thirdComponent
+          || hasPrefix "wasm32" (head l)
         then
           {
             cpu = head l;
-            vendor = elemAt l 1;
+            vendor = secondComponent;
             kernel =
-              if elemAt l 2 == "mingw32" then
+              if thirdComponent == "mingw32" then
                 "windows" # autotools breaks on -gnu for window
               else
-                elemAt l 2;
+                thirdComponent;
           }
         # lots of tools expect a triplet for Cygwin, even though the vendor is just "pc"
-        else if elemAt l 2 == "cygwin" then
+        else if thirdComponent == "cygwin" then
           {
             cpu = head l;
-            vendor = elemAt l 1;
-            kernel = "cygwin";
+            vendor = secondComponent;
+            kernel = thirdComponent;
           }
         else
           throw "system string '${lib.concatStringsSep "-" l}' with 3 components is ambiguous";
@@ -887,7 +903,17 @@ rec {
     or (throw "system string '${lib.concatStringsSep "-" l}' has invalid number of hyphen-separated components");
 
   # This should revert the job done by config.guess from the gcc compiler.
+  # Note: this does _not_ verify that the system is valid
+  # `mkSystemFromString` is recommended for external use
   mkSystemFromSkeleton =
+    let
+      getCpu = name: cpuTypes.${name} or (throw "Unknown CPU type: ${name}");
+      getVendor = name: vendors.${name} or (throw "Unknown vendor: ${name}");
+      getKernel = name: kernels.${name} or (throw "Unknown kernel: ${name}");
+      getAbi = name: abis.${name} or (throw "Unknown ABI: ${name}");
+      hasDarwinPrefix = hasPrefix "darwin";
+      hasBsdPrefix = hasPrefix "netbsd";
+    in
     {
       cpu,
       # Optional, but fallback too complex for here.
@@ -902,11 +928,6 @@ rec {
         null,
     }@args:
     let
-      getCpu = name: cpuTypes.${name} or (throw "Unknown CPU type: ${name}");
-      getVendor = name: vendors.${name} or (throw "Unknown vendor: ${name}");
-      getKernel = name: kernels.${name} or (throw "Unknown kernel: ${name}");
-      getAbi = name: abis.${name} or (throw "Unknown ABI: ${name}");
-
       parsed = {
         cpu = getCpu args.cpu;
         vendor =
@@ -919,10 +940,10 @@ rec {
           else
             vendors.unknown;
         kernel =
-          if hasPrefix "darwin" args.kernel then
-            getKernel "darwin"
-          else if hasPrefix "netbsd" args.kernel then
-            getKernel "netbsd"
+          if hasDarwinPrefix args.kernel then
+            kernels.darwin
+          else if hasBsdPrefix args.kernel then
+            kernels.netbsd
           else
             getKernel (removeAbiSuffix args.kernel);
         abi =
@@ -941,11 +962,12 @@ rec {
       };
 
     in
-    mkSystem parsed;
+    parsed;
 
-  mkSystemFromString = s: mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s));
+  mkSystemFromString = s: mkSystem (mkSystemFromSkeleton (mkSkeletonFromList (splitString "-" s)));
 
-  kernelName = kernel: kernel.name + toString (kernel.version or "");
+  kernelName =
+    kernel: if kernel ? version then kernel.name + toString kernel.version else kernel.name;
 
   darwinArch = cpu: if cpu.name == "aarch64" then "arm64" else cpu.name;
 

lib/tests/systems.nix

@@ -215,6 +215,22 @@ lib.runTests (
   })
 
   // {
+    test_platforms_pass_typecheck = {
+      # To improve performance, the result of parsing all 70+ systems in
+      # `lib.platforms` into their attrset representations aren't typechecked.
+      # The results are expected to be constant, and avoiding the slow
+      # validation gives a meaningful improvement to evaluation speed. We ensure
+      # that all systems pass validation here
+      expr = builtins.filter (
+        system:
+        let
+          evalResult = builtins.tryEval (lib.systems.parse.mkSystemFromString system);
+        in
+        evalResult.success == false
+      ) lib.platforms.all;
+
+      expected = [ ];
+    };
     test_equals_example_x86_64-linux = {
       expr = lib.systems.equals (lib.systems.elaborate "x86_64-linux") (
         lib.systems.elaborate "x86_64-linux"

maintainers/github-teams.json

@@ -43,12 +43,9 @@
     "id": 5468470,
     "maintainers": {},
     "members": {
-      "aherrmann": 732652,
       "avdv": 3471749,
-      "ethercrow": 222467,
       "groodt": 343415,
-      "kalbasit": 87115,
-      "mboes": 51356
+      "kalbasit": 87115
     },
     "name": "Bazel"
   },

maintainers/maintainer-list.nix

@@ -3141,7 +3141,10 @@
     email = "bastian@asmussen.tech";
     github = "BastianAsmussen";
     githubId = 76102128;
-    keys = [ { fingerprint = "3B11 7469 0893 85E7 16C2  7CD9 0FE5 A355 DBC9 2568"; } ];
+    keys = [
+      { fingerprint = "3B11 7469 0893 85E7 16C2  7CD9 0FE5 A355 DBC9 2568"; }
+      { fingerprint = "220D 68EC DF94 20EE 1E6C  B215 D92D 668B 77A2 9897"; }
+    ];
   };
   basvandijk = {
     email = "v.dijk.bas@gmail.com";
@@ -15145,6 +15148,11 @@
     githubId = 27364685;
     name = "Lorenzo Pasqui";
   };
+  l1n = {
+    github = "l1n";
+    githubId = 1367322;
+    name = "Nova DasSarma";
+  };
   l1npengtul = {
     email = "l1npengtul@l1npengtul.lol";
     github = "l1npengtul";
@@ -17212,6 +17220,12 @@
     github = "matrss";
     githubId = 9308656;
   };
+  matshch = {
+    name = "Artem Leshchev";
+    github = "matshch";
+    githubId = 2412121;
+    email = "matshch@gmail.com";
+  };
   matt-snider = {
     email = "matt.snider@protonmail.com";
     github = "matt-snider";
@@ -23029,12 +23043,6 @@
     githubId = 1246959;
     name = "Raquel García";
   };
-  rardiol = {
-    email = "ricardo.ardissone@gmail.com";
-    github = "rardiol";
-    githubId = 11351304;
-    name = "Ricardo Ardissone";
-  };
   raskin = {
     email = "7c6f434c@mail.ru";
     github = "7c6f434c";

maintainers/team-list.nix

@@ -688,6 +688,10 @@ with lib.maintainers;
     github = "radicle";
   };
 
+  redis = {
+    github = "redis";
+  };
+
   rocm = {
     github = "rocm";
   };

nixos/modules/services/databases/redis.nix

@@ -30,6 +30,8 @@ let
 
 in
 {
+  meta.teams = [ lib.teams.redis ];
+
   imports = [
     (lib.mkRemovedOptionModule [
       "services"

nixos/modules/services/home-automation/zigbee2mqtt.nix

@@ -113,6 +113,7 @@ in
           "AF_INET"
           "AF_INET6"
           "AF_NETLINK"
+          "AF_UNIX"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;

nixos/tests/redis.nix

@@ -19,11 +19,7 @@ let
     }:
     makeTest {
       inherit name;
-      meta.maintainers = [
-        lib.maintainers.das_j
-        lib.maintainers.flokli
-        lib.maintainers.helsinki-Jo
-      ];
+      meta.maintainers = lib.teams.redis.members;
 
       nodes = {
         machine =

pkgs/applications/editors/emacs/sources.nix

@@ -146,14 +146,9 @@ in
     pname = "emacs-mac";
     version = "30.2.50";
     variant = "macport";
-    rev = "emacs-mac-30.2";
-    hash = "sha256-i/W2Xa6Vk1+T1fs6fa4wJVMLLB6BK8QAPcdmPrU8NwM=";
+    rev = "emacs-mac-30.2.1";
+    hash = "sha256-KFgQZBW0QRX0k4k8gkVuGhNTfxArOH1+rwUzsmyEuss=";
     patches = fetchpatch: [
-      (fetchpatch {
-        name = "fix-off-by-one-mistake-80851-CVE-2026-6861.patch";
-        url = "https://cgit.git.savannah.gnu.org/cgit/emacs.git/patch/?id=8f535370b9efbc91673b20c6987a5cae4f6dc562";
-        hash = "sha256-ny44eIi8DUa9pQhVGzhGz4H6FXU4+ki86SITLXhkwpw=";
-      })
       (fetchpatch {
         # tree-sitter 0.26 compatibility fix, see https://bugs.gentoo.org/970856
         url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/01_all_treesit-0.26.patch?id=d0f47979806d9be5a190fdb4ffa1bde439b2d616";

pkgs/applications/emulators/libretro/cores/np2kai.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "np2kai";
-  version = "0-unstable-2026-05-09";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "AZO234";
     repo = "NP2kai";
-    rev = "eebb95c060f82df45a5615be676c3fa4b7bb7ae0";
-    hash = "sha256-KBvxqxCeYyIKCTHdcczwpgHBIZds6xMfHt6LblRRoFc=";
+    rev = "e2dc9046aa5c786fcfbfb87e883457e421026e31";
+    hash = "sha256-35LWLk4U1B1NjXN94QN5nsMMXCmo+VKOVWhzFdZ79oc=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2026-05-15";
+  version = "0-unstable-2026-06-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "c88070df8e0e84106ecc4b6394860a413a7bc046";
-    hash = "sha256-ZngYExWmL4NlmSfaRbTpSthNY1QRwKXtSiSX8zS/teo=";
+    rev = "d26eaee5c8fb47c1832b8bf32c1358d625da8a02";
+    hash = "sha256-p8sPQDnxIBMuFD9nCtdFp1DEJwRuifgUrOFYdY1EfME=";
   };
 
   dontConfigure = true;

pkgs/applications/emulators/libretro/cores/stella.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella";
-  version = "0-unstable-2026-06-09";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
-    rev = "3e3061809913e59a4378737127ce0ae95b36e889";
-    hash = "sha256-fKivb4sFR4F0ub1NLpazLg3i3M9LOely08M8kBEczmo=";
+    rev = "65fc7d66abfc8dfba5033d88523437b83664ea2b";
+    hash = "sha256-hYYZyHtWjo3BgX73Vxj8JG/2vQ7JtqT+4jPWLN+zZHw=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -128,11 +128,11 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite_buildkite": {
-    "hash": "sha256-MoucQgeikKMh4P8nRWIJ5SkLFGeVfDutsSBUSowz6VM=",
+    "hash": "sha256-CfipoNGW0VofHfgXlbfcjIGYpkuE0UXewDM6UCutg9g=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.34.0",
+    "rev": "v1.34.2",
     "spdx": "MIT",
     "vendorHash": "sha256-uYyj6GSV5bWEfRTOODMuReEHe9wnF4cVoHM9rBMpgmM="
   },
@@ -409,13 +409,13 @@
     "vendorHash": null
   },
   "fastly_fastly": {
-    "hash": "sha256-S6VIwqwTPr276TTqgEFTxhE5c97lCd8/5dJnDGori4s=",
+    "hash": "sha256-I1a2wus61as24DMBZEZsl2C6YJ5B0CaIST/FM+8KMLc=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v9.2.1",
+    "rev": "v9.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8QF9gOuvuZwAoFWePjti4h6VzmA+TGiFaC/ShuEAZqA="
+    "vendorHash": "sha256-TDU8T91em1+Y+0LN6FQSGEKJ4T9dIUxyuOTvx6HBYjg="
   },
   "flexibleenginecloud_flexibleengine": {
     "hash": "sha256-yEZ9JiUSqFFbfqzOOD59ZBv4yFCeUBBKlp6aiUqDqiM=",
@@ -724,11 +724,11 @@
     "vendorHash": "sha256-f49amYWzWSG9tzY6wvpxtTFiyJ8zC/Lc1hIQtzdgJRs="
   },
   "huaweicloud_huaweicloud": {
-    "hash": "sha256-4KRJhLnpKZwmL5aQqva8JZGDCYBzlGepE7zP6hwP+KY=",
+    "hash": "sha256-Ao3CkaQBe172Ookcgl+ugeHH5ClbyOsSpLb4+j9DAZQ=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.92.0",
+    "rev": "v1.93.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1247,11 +1247,11 @@
     "vendorHash": "sha256-C8TE7uxMf6LOTS6v22mXwUdk2eqQRinwrCH4ZVUCx4k="
   },
   "splunk-terraform_signalfx": {
-    "hash": "sha256-bX6CtNP7uB50kk3ddu52YfKE04PsEJw6DXl6yQxOeVI=",
+    "hash": "sha256-zwq7jCST2EkNk+UlKgLY2r3rCm5D009HYMru9KSVmuc=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v9.30.1",
+    "rev": "v9.30.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-27mA2OAApUtPawZZk7Wxme9TfQY19TraIJSqHh8MFZg="
   },

pkgs/build-support/make-startupitem/default.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation {
       target=${name}.desktop
       cp ${package}/share/applications/${srcPrefix}${name}.desktop $target
       ${lib.optionalString (prependExtraArgs != [ ] || appendExtraArgs != [ ]) ''
-        sed -i -r "s/(Exec=)([^ \n]*) *(.*)/\1\2 ${prependArgs}\3${appendArgs}/" $target
+        sed -i -r "s/^(Exec=)([^ \n]*) *(.*)/\1\2 ${prependArgs}\3${appendArgs}/" $target
       ''}
       chmod +rw $target
       echo "X-KDE-autostart-phase=${phase}" >> $target

pkgs/by-name/ay/ayatana-indicator-session/package.nix

@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ayatana-indicator-session";
-  version = "24.5.1";
+  version = "26.6.1";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = "ayatana-indicator-session";
     tag = finalAttrs.version;
-    hash = "sha256-jqcgQTsC4VBit3wwtKKTdEG71CUPJpeMtpzikE4IGhE=";
+    hash = "sha256-rrjtLiZ+qaqB1QowGqp3SfWsgzqIYHYEzEzAERiLLBs=";
   };
 
   postPatch = ''

pkgs/by-name/de/desync/package.nix

@@ -62,6 +62,9 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/folbricht/desync";
     changelog = "https://github.com/folbricht/desync/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ chaduffy ];
+    maintainers = with lib.maintainers; [
+      chaduffy
+      matshch
+    ];
   };
 })

pkgs/by-name/di/diffoscope/package.nix

@@ -232,6 +232,7 @@ python.pkgs.buildPythonApplication rec {
         mono
         ocaml
         odt2txt
+        oggvideotools
         openssh
         pdftk
         perl
@@ -255,8 +256,6 @@ python.pkgs.buildPythonApplication rec {
         r2pipe
         # docx2txt, nixpkgs packages another project named the same, which does not work
       ])
-      # oggvideotools is broken on Darwin, please put it back when it will be fixed?
-      ++ lib.optionals stdenv.hostPlatform.isLinux [ oggvideotools ]
       # Causes an eval failure
       # See https://github.com/NixOS/nixpkgs/issues/463873
       ++ lib.optionals (!stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isAarch64) [

pkgs/by-name/dn/dnscontrol/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dnscontrol";
-  version = "4.41.0";
+  version = "4.42.0";
 
   src = fetchFromGitHub {
     owner = "DNSControl";
     repo = "dnscontrol";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oz4hF3W6QKjPda/6AZ7djeZr32oFMqdMD34gWLMnFRQ=";
+    hash = "sha256-iB2PFPvcASRwpBkFJQ3Vi2r89H3a9BBbC1moAymWDOI=";
   };
 
-  vendorHash = "sha256-DQmfwSPdUnoSmVDiKlwrHifKR59KuMe+0DGJtavpmLc=";
+  vendorHash = "sha256-8rL5v/0Vb+gxmbDaEB57UsQEnKCJtbZh0lFUyKYMZgs=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/fa/fast-float/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fast-float";
-  version = "8.2.8";
+  version = "8.2.10";
 
   src = fetchFromGitHub {
     owner = "fastfloat";
     repo = "fast_float";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wnWZyQJzg6vzaRi3hbNHCAZre+NrI7KMoJwJp94fy70=";
+    hash = "sha256-DOwDLnMwlXAP5SfDJuxhkmLmcBZ1wBvXEJr5RuHepp4=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/gh/gh-gei/package.nix

@@ -7,13 +7,13 @@
 
 buildDotnetModule rec {
   pname = "gh-gei";
-  version = "1.30.1";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "gh-gei";
     rev = "v${version}";
-    hash = "sha256-eccHFngmP0uUsbtlFSIT1agRMx3OCNyqPMHG8/mj5P8=";
+    hash = "sha256-z3eBORwrccIgTijdHcK7en4DvRY0fE3807Amn0MCuA8=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0_4xx;

pkgs/by-name/gt/gtree/package.nix

@@ -11,16 +11,16 @@
 # it's updated.
 buildGo126Module (finalAttrs: {
   pname = "gtree";
-  version = "1.13.6";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "ddddddO";
     repo = "gtree";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E3Nri8kFMh6NYp29vFFNAlJxdfOvLR1inbD+KALXZms=";
+    hash = "sha256-LMVXC22fTrPt4S5HkErMrpZwwanN5blY/TPUE8bg95s=";
   };
 
-  vendorHash = "sha256-Pkc2UV/77YdKm5ZWKCSKE0dljUzC5dw1f08T+3MvFTE=";
+  vendorHash = "sha256-Vd5VKKl79Qu5R7jOYS1CTtQuAis9vWUbpBWnEI7sgpk=";
 
   subPackages = [
     "cmd/gtree"

pkgs/by-name/hi/hiredis/package.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/redis/hiredis";
     description = "Minimalistic C client for Redis >= 1.2";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ hythera ];
     platforms = lib.platforms.all;
+    teams = [ lib.teams.redis ];
   };
 })

pkgs/by-name/hy/hyperrogue/package.nix

@@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.roguetemple.com/z/hyper/";
     changelog = "https://github.com/zenorogue/hyperrogue/releases/tag/v${finalAttrs.version}";
     mainProgram = "hyperrogue";
-    maintainers = with lib.maintainers; [ rardiol ];
+    maintainers = [ ];
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
   };

pkgs/by-name/ju/just-lsp/package.nix

@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.4.6";
+  version = "0.4.7";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-x58iZ1TSwMZSPQsxlXeMgBxBMezCLJkbGFMWE4gV2PE=";
+    hash = "sha256-Z35pRJDDUdyjz9Tw66wgBYjYicJCO87EI/J3Nux8udE=";
   };
 
-  cargoHash = "sha256-XSXzCTbacnxuK9rjuRhnNu9uglK+H1Ixfm00A+6O5MM=";
+  cargoHash = "sha256-qAeUk+1WmQ5TPdfJcoM+mrFVOfhhdVZnyBhxfzyh1Tc=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/li/liberal-crime-squad/package.nix

@@ -36,7 +36,7 @@ stdenv.mkDerivation {
       Welcome to Liberal Crime Squad! The Conservatives have taken the Executive, Legislative, and Judicial branches of government. Over time, the Liberal laws of this nation will erode and turn the country into a BACKWOODS YET CORPORATE NIGHTMARE. To prevent this from happening, the Liberal Crime Squad was established. The mood of the country is shifting, and we need to turn things around. Go out on the streets and indoctrinate Conservative automatons. That is, let them see their True Liberal Nature. Then arm them and send them forth to Stop Evil.
     '';
     homepage = "https://github.com/Kamal-Sadek/Liberal-Crime-Squad";
-    maintainers = [ lib.maintainers.rardiol ];
+    maintainers = [ ];
     mainProgram = "crimesquad";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;

pkgs/by-name/li/libtree/package.nix

@@ -53,7 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
       prusnak
-      rardiol
     ];
   };
 })

pkgs/by-name/ls/lstk/package.nix

@@ -7,7 +7,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lstk";
-  version = "0.11.0";
+  version = "0.13.0";
 
   __structuredAttrs = true;
 
@@ -15,10 +15,10 @@ buildGoModule (finalAttrs: {
     owner = "localstack";
     repo = "lstk";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-2PViyzcJ2AGigfxLwQ5FnULV4zF0FPQIr6nqg5d90S4=";
+    sha256 = "sha256-UF+ySjw3fdb9aTA/tRDmFR3EXYA7nvbuv/esT/3Rsv4=";
   };
 
-  vendorHash = "sha256-y/QlgdYS4IeU9Xf/2trHRvjB5QOHDbFDrF57y9B6jxI=";
+  vendorHash = "sha256-zKEUGn9eKYdxSinS+NXc7PrgZkrQRZnIxTNH3yNL4GE=";
 
   excludedPackages = "test/integration";
 

pkgs/by-name/lx/lxmf-rs/package.nix

@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lxmf-rs";
-  version = "0.4.1";
+  version = "0.5.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "FreeTAKTeam";
     repo = "LXMF-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GCN4HpqbCM2xCBpBRpUALmHGfhOm1qZScdYgBqJqLQU=";
+    hash = "sha256-9yTteJCH/5/LGvp6AH74oKYcnue1NetD7DG3fMz+D2Y=";
   };
 
   cargoHash = "sha256-a6O1VslizDom6AuJKF5xZgKNSgrw1EfvJRWpG9J7Le8=";

pkgs/by-name/me/memtier-benchmark/package.nix

@@ -37,10 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/redis/memtier_benchmark";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [
-      thoughtpolice
-      hythera
-    ];
+    maintainers = with lib.maintainers; [ thoughtpolice ];
     mainProgram = "memtier_benchmark";
+    teams = [ lib.teams.redis ];
   };
 })

pkgs/by-name/ni/niks3/package.nix

@@ -21,6 +21,7 @@ buildGoModule (finalAttrs: {
 
   subPackages = [
     "cmd/niks3"
+    "cmd/niks3-hook"
     "cmd/niks3-server"
   ];
 

pkgs/by-name/og/oggvideotools/package.nix

@@ -3,6 +3,8 @@
   stdenv,
   fetchurl,
   fetchpatch,
+  fetchDebianPatch,
+  libresample,
   cmake,
   pkg-config,
   boost,
@@ -22,29 +24,71 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    # Fix pending upstream inclusion for missing includes:
-    #  https://sourceforge.net/p/oggvideotools/bugs/12/
-    (fetchpatch {
-      name = "gcc-10.patch";
-      url = "https://sourceforge.net/p/oggvideotools/bugs/12/attachment/fix-compile.patch";
-      hash = "sha256-mJttoC3jCLM3vmPhlyqh+W0ryp2RjJGIBXd6sJfLJA4=";
+    # Avoid crashing in oggjoin on bogus input
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "7";
+      patch = "mayhem-crash-oggjoin.patch";
+      hash = "sha256-0D22P+Qdf9Sfp6vptSnL4E33NVUL/XL72gNE36BF6QI=";
     })
-
-    # Fix pending upstream inclusion for build failure on gcc-12:
-    #  https://sourceforge.net/p/oggvideotools/bugs/13/
+    # Fix typos in manpages
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "7";
+      patch = "manual-typos.patch";
+      hash = "sha256-yGzHGEADlSRnWZIN8x6xfg9ChAn8WKFQgZAJmbKtKq8=";
+    })
+    # Avoid crash on unknown command-line arguments
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "7";
+      patch = "oggThumb-zero-getopt-long.patch";
+      hash = "sha256-LBgmpyyxmeAFE3zpeHRryuxboMBdBztUEGxbs0Ay+HU=";
+    })
+    # Prevent uninitialized read
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "7";
+      patch = "init-for-valgrind.patch";
+      hash = "sha256-7BtdAGHHW860hFZYlRWDVfEw6CDkb18HfFROZHl+guY=";
+    })
+    # Fix compilation due to missing include
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      debianRevision = "7";
+      patch = "import-cstring.patch";
+      hash = "sha256-KMs4nyILveKY+ZmcSONmtS5+sAPPB+ypNUi9yzxBsXQ=";
+    })
+    # Fix out-of-bounds read
     (fetchpatch {
-      name = "gcc-12.patch";
-      url = "https://sourceforge.net/p/oggvideotools/bugs/13/attachment/fix-gcc-12.patch";
-      hash = "sha256-zuDXe86djWkR8SgYZHkuAJJ7Lf2VYsVRBrlEaODtMKE=";
-      # svn patch, rely on prefix added by fetchpatch:
-      extraPrefix = "";
+      url = "https://salsa.debian.org/multimedia-team/oggvideotools/-/raw/ed006e5d78f9509508dbc72277de8ab3c06d2362/debian/patches/1010-kate-header-buffer-read-past-end.patch";
+      hash = "sha256-CEkNG9tHZIggCvKRPj2pKI855pVWQUdudLfpda/ZVME=";
+    })
+    # Fix null pointer crash (CVE-2020-21723)
+    (fetchpatch {
+      url = "https://salsa.debian.org/multimedia-team/oggvideotools/-/raw/122047a7cf644e282906370f277ae83b4672e5e4/debian/patches/1020-CVE-2020-21723-null-pointer-crash.patch";
+      hash = "sha256-dUkMfEaB5Hn9I5+QbE/002X6ij+xIzzqjc8QTom1ITk=";
+    })
+    # Unbundle libresample
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/oggvideotools/raw/23f918f39278d87adb5a5ab2e57d5cc1816e1e8a/f/0005-unbundle-libresample.patch";
+      hash = "sha256-JSuH8ScYBi6zAgEhrFdPOGCSXzDk+lEnSHX9wuctAsg=";
+    })
+    # Fix buffer overflow (CVE-2020-21724)
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/oggvideotools/raw/2dd078ea81773a34cc0c4817ebbf3c4038b8098c/f/stream-serializer.diff";
+      hash = "sha256-3HkAuCBaNjKoTN8Q3oW89e3zXo13Ev5g7VJ/RPO3zRA=";
     })
   ];
 
   postPatch = ''
     # Don't disable optimisations
-    substituteInPlace CMakeLists.txt --replace " -O0 " ""
-  '';
+    substituteInPlace CMakeLists.txt --replace-fail " -O0 " ""
+  ''
+  # Fix "src/effect/pictureBlend.cpp:28:11: error: no matching conversion for functional-style cast from 'const char[39]' to 'OggException'"
+  + (lib.optionalString stdenv.hostPlatform.isDarwin ''
+    sed -i '1i #include <string>' src/effect/pictureBlend.cpp
+  '');
 
   nativeBuildInputs = [
     cmake
@@ -55,6 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     gd
     libogg
+    libresample
     libtheora
     libvorbis
   ];
@@ -69,9 +114,5 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://sourceforge.net/projects/oggvideotools/";
     license = lib.licenses.gpl2Only;
     maintainers = [ ];
-    # Compilation error on Darwin:
-    # error: invalid argument '--std=c++0x' not allowed with 'C'
-    # make[2]: *** [src/libresample/CMakeFiles/resample.dir/build.make:76: src/libresample/CMakeFiles/resample.dir/filterkit.c.o] Error 1
-    broken = stdenv.hostPlatform.isDarwin;
   };
 })

pkgs/by-name/pa/par-lang/package.nix

@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "par-lang";
-  version = "0-unstable-2026-06-08";
+  version = "0-unstable-2026-06-11";
 
   src = fetchFromGitHub {
     owner = "par-team";
     repo = "par-lang";
-    rev = "00bc7dc279ec622c68dac81ff226dbb189f42cc4";
-    hash = "sha256-a5uqmtTj+zS1C6ARu/y3aYykeBVINKSlh7p9fmAlsIs=";
+    rev = "0d763e90deb6bdd7888686a944efa8e1f813ded6";
+    hash = "sha256-7UJwbusV+F/KI8Xvau/thRY60xRDfBc6xUdo5QhVayE=";
   };
 
-  cargoHash = "sha256-IoZbNvCzeuOMVjfbTUGr+qs73IvFmPTK9rn6x40SYBQ=";
+  cargoHash = "sha256-8lG+cKN3/W+LYWhmOfDwGiq6u3nlLJaD5uNABaY0zRY=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/re/redis/package.nix

@@ -137,7 +137,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.all;
     changelog = "https://github.com/redis/redis/releases/tag/${finalAttrs.version}";
-    maintainers = with lib.maintainers; [ hythera ];
     mainProgram = "redis-cli";
+    teams = [ lib.teams.redis ];
   };
 })

pkgs/by-name/re/redisTestHook/package.nix

@@ -16,5 +16,8 @@ makeSetupHook {
     simple = callPackage ./test.nix { };
     python3-valkey = python3Packages.valkey;
   };
-  meta.license = lib.licenses.mit;
+  meta = {
+    license = lib.licenses.mit;
+    teams = [ lib.teams.redis ];
+  };
 } ./redis-test-hook.sh

pkgs/by-name/re/redisinsight/package.nix

@@ -177,5 +177,6 @@ stdenv.mkDerivation (finalAttrs: {
       tomasajt
     ];
     platforms = lib.platforms.linux;
+    teams = [ lib.teams.redis ];
   };
 })

pkgs/by-name/ri/riot-redis/package.nix

@@ -39,5 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.asl20;
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     maintainers = with lib.maintainers; [ wesnel ];
+    teams = [ lib.teams.redis ];
   };
 })

pkgs/by-name/sd/SDL2_Pango/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/markuskimius/SDL2_Pango";
     description = "Library for graphically rendering internationalized and tagged text in SDL2 using TrueType fonts";
     license = lib.licenses.lgpl21Plus;
-    maintainers = with lib.maintainers; [ rardiol ];
+    maintainers = [ ];
     teams = [ lib.teams.sdl ];
     inherit (SDL2.meta) platforms;
   };

pkgs/by-name/sl/slurm/package.nix

@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slurm";
-  version = "26.05.0.1";
+  version = "26.05.1.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -50,8 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "SchedMD";
     repo = "slurm";
     # The release tags use - instead of .
-    rev = "slurm-${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-pEgSPaLGqPeNsw0DkxnZP4n6jx5fy+wTgAu0LZmxmW0=";
+    tag = "slurm-${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
+    hash = "sha256-ZH80Ws/9+7pjDe7aZyyDHXFbNvmw8C7OJXiw5+/3jkA=";
   };
 
   outputs = [

pkgs/by-name/st/stoat-desktop/package.nix

@@ -13,6 +13,7 @@
   nodejs,
   electron_38,
   zip,
+  nix-update-script,
 }:
 let
   electron = electron_38;
@@ -139,6 +140,8 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Open source user-first chat platform";
     homepage = "https://stoat.chat/";

pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs

@@ -1077,14 +1077,17 @@ fn login1_proxy(conn: &LocalConnection) -> Proxy<'_, &LocalConnection> {
 fn block_on_jobs(
     conn: &LocalConnection,
     submitted_jobs: &Rc<RefCell<HashMap<dbus::Path<'static>, Job>>>,
-) {
+) -> anyhow::Result<()> {
     while !submitted_jobs.borrow().is_empty() {
         log::debug!(
             "waiting for submitted jobs to finish, still have {} job(s)",
             submitted_jobs.borrow().len()
         );
-        _ = conn.process(DBUS_PROCESS_TIME);
+        _ = conn
+            .process(DBUS_PROCESS_TIME)
+            .context("Failed to process dbus messages while waiting for jobs")?;
     }
+    Ok(())
 }
 
 fn remove_file_if_exists(p: impl AsRef<Path>) -> std::io::Result<()> {
@@ -1525,7 +1528,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
             submitted_jobs.borrow_mut().insert(job_path, Job::Stop);
         }
     }
-    block_on_jobs(&dbus_conn, &submitted_jobs);
+    block_on_jobs(&dbus_conn, &submitted_jobs)?;
 
     if !units_to_skip.is_empty() {
         print_units("NOT restarting", &units_to_skip);
@@ -1551,7 +1554,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
             }
         }
     }
-    block_on_jobs(&dbus_conn, &submitted_jobs);
+    block_on_jobs(&dbus_conn, &submitted_jobs)?;
     remove_file_if_exists(&reload_list)
         .with_context(|| format!("Failed to remove {}", reload_list.display()))?;
 
@@ -1567,7 +1570,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
             }
         }
     }
-    block_on_jobs(&dbus_conn, &submitted_jobs);
+    block_on_jobs(&dbus_conn, &submitted_jobs)?;
     remove_file_if_exists(&restart_list)
         .with_context(|| format!("Failed to remove {}", restart_list.display()))?;
 
@@ -1584,7 +1587,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
             }
         }
     }
-    block_on_jobs(&dbus_conn, &submitted_jobs);
+    block_on_jobs(&dbus_conn, &submitted_jobs)?;
     remove_file_if_exists(&start_list)
         .with_context(|| format!("Failed to remove {}", start_list.display()))?;
 
@@ -1681,7 +1684,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
                 }
             }
         }
-        block_on_jobs(&dbus_conn, &submitted_jobs);
+        block_on_jobs(&dbus_conn, &submitted_jobs)?;
 
         print_units("restarting (post-activation)", &to_restart);
         for unit in to_restart.keys() {
@@ -1695,7 +1698,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
                 }
             }
         }
-        block_on_jobs(&dbus_conn, &submitted_jobs);
+        block_on_jobs(&dbus_conn, &submitted_jobs)?;
 
         let to_start_filtered = filter_units(&units_to_filter, &to_start);
         print_units("starting (post-activation)", &to_start_filtered);
@@ -1710,7 +1713,7 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
                 }
             }
         }
-        block_on_jobs(&dbus_conn, &submitted_jobs);
+        block_on_jobs(&dbus_conn, &submitted_jobs)?;
     }
 
     let finished = finished_jobs.borrow();
@@ -2202,7 +2205,7 @@ won't take effect until you reboot the system.
             };
         }
 
-        block_on_jobs(&dbus_conn, &submitted_jobs);
+        block_on_jobs(&dbus_conn, &submitted_jobs)?;
     }
 
     if !units_to_skip.is_empty() {
@@ -2218,7 +2221,7 @@ won't take effect until you reboot the system.
     }
 
     // Wait for all stop jobs to finish
-    block_on_jobs(&dbus_conn, &submitted_jobs);
+    block_on_jobs(&dbus_conn, &submitted_jobs)?;
 
     let mut exit_code = 0;
 
@@ -2441,7 +2444,7 @@ won't take effect until you reboot the system.
     }
 
     // Wait for the restart job of sysinit-reactivation.service to finish
-    block_on_jobs(&dbus_conn, &submitted_jobs);
+    block_on_jobs(&dbus_conn, &submitted_jobs)?;
 
     // Before reloading we need to ensure that the units are still active. They may have been
     // deactivated because one of their requirements got stopped. If they are inactive but should
@@ -2496,7 +2499,7 @@ won't take effect until you reboot the system.
             }
         }
 
-        block_on_jobs(&dbus_conn, &submitted_jobs);
+        block_on_jobs(&dbus_conn, &submitted_jobs)?;
 
         remove_file_if_exists(RELOAD_LIST_FILE)
             .with_context(|| format!("Failed to remove {RELOAD_LIST_FILE}"))?;
@@ -2524,7 +2527,7 @@ won't take effect until you reboot the system.
             }
         }
 
-        block_on_jobs(&dbus_conn, &submitted_jobs);
+        block_on_jobs(&dbus_conn, &submitted_jobs)?;
 
         remove_file_if_exists(RESTART_LIST_FILE)
             .with_context(|| format!("Failed to remove {RESTART_LIST_FILE}"))?;
@@ -2557,7 +2560,7 @@ won't take effect until you reboot the system.
         }
     }
 
-    block_on_jobs(&dbus_conn, &submitted_jobs);
+    block_on_jobs(&dbus_conn, &submitted_jobs)?;
 
     remove_file_if_exists(START_LIST_FILE)
         .with_context(|| format!("Failed to remove {START_LIST_FILE}"))?;

pkgs/by-name/va/valkey/package.nix

@@ -117,9 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "High-performance data structure server that primarily serves key/value workloads";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [
-      debtquity
-    ];
+    teams = [ lib.teams.redis ];
     changelog = "https://github.com/valkey-io/valkey/releases/tag/${finalAttrs.version}";
     mainProgram = "valkey-cli";
   };

pkgs/by-name/wa/waywall/package.nix

@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "waywall";
-  version = "0.2026.02.06";
+  version = "0.2026.06.13";
 
   src = fetchFromGitHub {
     owner = "tesselslate";
     repo = "waywall";
     tag = finalAttrs.version;
-    hash = "sha256-SlT7B01sAKE3n9HVnE+t9hcbQnr5qcCBsBAy4btN0mw=";
+    hash = "sha256-y4haKw4Z8wqtOT5eTEt/tUqbr4FoYf5EbH63uyTGDow=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/xa/xaos/package.nix

@@ -11,7 +11,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "xaos";
-  version = "4.3.4";
+  version = "4.3.5";
   outputs = [
     "out"
     "man"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "xaos-project";
     repo = "XaoS";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-vOFwZbdbcrcJLHUa1QzxzadPcx5GF5uNPg+MZ7NbAPc=";
+    hash = "sha256-dGfmX55bm2BCFl7mRit88ULAcJ0VP15yVGI7nhRH0Ig=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lomiri/development/cmake-extras/default.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cmake-extras";
-  version = "1.9";
+  version = "1.10";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/cmake-extras";
     tag = finalAttrs.version;
-    hash = "sha256-7dIuQ2SdtpG93cPZTmoxXUCwFhsq11gmg4OJlGTQ3VY=";
+    hash = "sha256-8WGbfvHFd8Z8wLVBfRYiOTGE9GpvjDT4pelE6N+xhmk=";
   };
 
   postPatch = ''

pkgs/development/compilers/elm/packages/elm-test-rs/default.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "elm-test-rs";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "mpizenberg";
     repo = "elm-test-rs";
     tag = "v${version}";
-    hash = "sha256-NGonWCOLxON1lxsgRlWgY67TtIJYsLPXi96NcxF4Tso=";
+    hash = "sha256-H9InR28T0PQjxqT99ojw8ey29tk79BPeXpkHL3VNnkU=";
   };
 
   buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ openssl ];
 
-  cargoHash = "sha256-qs6ujXl4j9gCEDQV5i47oa0eaqWZf4NqsVbNDsao5fI=";
+  cargoHash = "sha256-Y3hqSw8SyU9uVE9jBsLV9bL5KzaB9pw96Yqy3Dvh4QA=";
 
   # Tests perform networking and therefore can't work in sandbox
   doCheck = false;
@@ -32,6 +32,7 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [
       jpagex
       zupo
+      turbomack
     ];
   };
 }

pkgs/development/libraries/gstreamer/icamerasrc/default.nix

@@ -46,7 +46,7 @@ stdenv.mkDerivation {
     apple-sdk_gstreamer
   ];
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error"
     # gstcameradeinterlace.cpp:55:10: fatal error: gst/video/video.h: No such file or directory
     "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0"

pkgs/development/python-modules/blinkstick/default.nix

@@ -2,13 +2,16 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pyusb,
 }:
 
 buildPythonPackage {
   pname = "blinkstick";
-  version = "unstable-2023-05-04";
-  format = "setuptools";
+  version = "1.2.0-unstable-2023-05-04";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "arvydas";
@@ -17,7 +20,9 @@ buildPythonPackage {
     hash = "sha256-9bc7TD/Ilc952ywLauFd0+3Lh64lQlYuDC1KG9eWDgs=";
   };
 
-  propagatedBuildInputs = [ pyusb ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pyusb ];
 
   # Project has no tests
   doCheck = false;

pkgs/development/python-modules/compressed-tensors/default.nix

@@ -17,14 +17,16 @@
   transformers,
 
   # tests
+  accelerate,
   nbconvert,
   nbformat,
   pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "compressed-tensors";
-  version = "0.15.0.1";
+  version = "0.17.1";
   pyproject = true;
 
   # Release on PyPI is missing the `utils` directory, which `setup.py` wants to import
@@ -32,7 +34,7 @@ buildPythonPackage (finalAttrs: {
     owner = "neuralmagic";
     repo = "compressed-tensors";
     tag = finalAttrs.version;
-    hash = "sha256-iiYo3Vne2CYlj+wMHxQFTTU7gb8oNwPtCe873nX5KgA=";
+    hash = "sha256-14AHbokDlN5iXy/fvOq7Xp1OS8N1b+Xpxd33KOylWiU=";
   };
 
   postPatch = ''
@@ -60,9 +62,11 @@ buildPythonPackage (finalAttrs: {
   pythonImportsCheck = [ "compressed_tensors" ];
 
   nativeCheckInputs = [
+    accelerate
     nbconvert
     nbformat
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   disabledTests = [
@@ -87,10 +91,44 @@ buildPythonPackage (finalAttrs: {
     "test_set_item_buffers"
     "test_update_offload_parameter_with_grad"
   ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_mxfp4_scales_e2e"
+    "test_mxfp8_scales_e2e"
+  ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # torch._inductor.exc.InductorError: ImportError: dlopen(/nix/var/nix/builds/nix-25002-542173852/torchinductor__nixbld1/xo/cxovsevcfanmw7lgoddbnyhoxes3nzlu7ecugxedaq2zr4f6b2qh.main.so, 0x0002):
     # symbol not found in flat namespace '___kmpc_barrier'
     "test_compress_decompress_module"
+
+    # AssertionError: Torch not compiled with CUDA enabled
+    "test_match_quantizable_tensors"
+    "test_narrow_match_true_child_only"
+    "test_narrow_match_false_when_parent_also_matches"
+    "test_narrow_match_false_when_neither_matches"
+    "test_narrow_match_iterable_targets_any_true"
+    "test_narrow_match_with_explicit_module_argument"
+    "test_narrow_match_top_level_behavior_documented"
+    "test_complex_model_matching"
+    "test_parameter_and_module_consistency"
+    "test_all_functions_with_regex"
+    "test_match_quantizable_tensors"
+    "test_mtp_tensors_saved_correctly"
+    "test_index_updated"
+    "test_single_shard_dest_creates_index"
+    "test_no_mtp_tensors_raises"
+    "test_missing_dest_files_raises"
+    "test_custom_mtp_prefix"
+    "test_apply_config_detects_deepseekv3_attention_and_hooks"
+    "test_initialize_module_for_quantization_offloaded"
+    "test_correctness_model"
+    "test_random_matrix_device_handling"
+    "test_memory_sharing"
+    "test_attention_cache"
+
+    # TypeError: Trying to convert Float8_e4m3fn to the MPS backend but it does not have support for that dtype.
+    "test_compressed_model_inference_with_hook"
   ];
 
   disabledTestPaths = [
@@ -111,6 +149,17 @@ buildPythonPackage (finalAttrs: {
     "tests/test_transform/factory/test_serialization.py::test_serialization[True-True-random-hadamard]"
     "tests/test_transform/factory/test_serialization.py::test_serialization[True-False-hadamard]"
     "tests/test_transform/factory/test_serialization.py::test_serialization[True-False-random-hadamard]"
+
+    # AttributeError: 'NoneType' object has no attribute 'type'
+    "tests/test_compressors/distributed/test_distributed_compression.py"
+    "tests/test_compressors/distributed/test_module_parallel.py"
+    "tests/test_compressors/model_compressors/test_model_compressor_distributed.py"
+    "tests/test_offload"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # AssertionError: Torch not compiled with CUDA enabled
+    "tests/test_transform/utils/test_hadamard.py"
+    "tests/test_utils/test_match.py"
   ];
 
   meta = {

pkgs/development/python-modules/databricks-sdk/default.nix

@@ -22,7 +22,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "databricks-sdk";
-  version = "0.116.0";
+  version = "0.118.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o9QVw0x2FFNT+cgdGELH7f2DEmzq2xeyisjyY0FNTaE=";
+    hash = "sha256-ukb5Sit+BRJd7DipvGMqXbFrC8jXsLDJjCbJdIO5G0U=";
   };
 
   build-system = [

pkgs/development/python-modules/elevenlabs/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "elevenlabs";
-  version = "2.52.0";
+  version = "2.53.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Acqwa1zmDV4+xedGtabtB/utU4D5WkgbLyYCrmZiwFo=";
+    hash = "sha256-V/6zky0jekajrFZh+D6jlK3GSDN4Ms0mByi9CHceGo8=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/hiredis/default.nix

@@ -38,6 +38,6 @@ buildPythonPackage (finalAttrs: {
     homepage = "https://github.com/redis/hiredis-py";
     changelog = "https://github.com/redis/hiredis-py/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ hythera ];
+    teams = [ lib.teams.redis ];
   };
 })

pkgs/development/python-modules/nutpie/default.nix

@@ -35,7 +35,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nutpie";
-  version = "0.16.10";
+  version = "0.16.11";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -43,12 +43,12 @@ buildPythonPackage (finalAttrs: {
     owner = "pymc-devs";
     repo = "nutpie";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Cqi4vhvu6Gvy0gOcgrpKCHbuVIyY5L9+y5nafzksPwg=";
+    hash = "sha256-ZakNyVW06QONdBSZFonOc585ZPLHsIjbFlBnX+Kg2kc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-cJixyzzt2vwdT2B/XbOLbG6XfWVeYAJg5YWT18GqMDw=";
+    hash = "sha256-n61ZrJtJFQ0G/7X59pKI8QNnOZPvDWiPmGC3tW3NQkk=";
   };
 
   build-system = [

pkgs/development/python-modules/oelint-parser/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-parser";
-  version = "8.11.2";
+  version = "8.11.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-parser";
     tag = finalAttrs.version;
-    hash = "sha256-wzC9tXhPuGtyD2pQ2hO4sfERNOH8+sCNvXUcrqqlEAM=";
+    hash = "sha256-l2An1JQrDA8Sf0R3Xu0qp84fksUQu/3aPkwHGmfv6AY=";
   };
 
   pythonRelaxDeps = [ "regex" ];

pkgs/development/python-modules/pynput/default.nix

@@ -14,6 +14,8 @@
   xlib,
   evdev,
   six,
+  pyobjc-framework-ApplicationServices,
+  pyobjc-framework-Quartz,
 
   # tests
   unittestCheckHook,
@@ -52,6 +54,11 @@ buildPythonPackage rec {
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     evdev
     xlib
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # the darwin backend imports HIServices (ApplicationServices) and Quartz
+    pyobjc-framework-ApplicationServices
+    pyobjc-framework-Quartz
   ];
 
   doCheck = false; # requires running X server
@@ -59,7 +66,6 @@ buildPythonPackage rec {
   nativeCheckInputs = [ unittestCheckHook ];
 
   meta = {
-    broken = stdenv.hostPlatform.isDarwin;
     description = "Library to control and monitor input devices";
     homepage = "https://github.com/moses-palmer/pynput";
     license = lib.licenses.lgpl3;

pkgs/development/python-modules/pyobjc-framework-ApplicationServices/default.nix

@@ -0,0 +1,62 @@
+{
+  buildPythonPackage,
+  setuptools,
+  darwin,
+  pyobjc-core,
+  pyobjc-framework-Cocoa,
+  pyobjc-framework-Quartz,
+  pyobjc-framework-CoreText,
+  lib,
+}:
+
+buildPythonPackage rec {
+  pname = "pyobjc-framework-ApplicationServices";
+  pyproject = true;
+
+  inherit (pyobjc-core) version src;
+
+  sourceRoot = "${src.name}/pyobjc-framework-ApplicationServices";
+
+  build-system = [ setuptools ];
+
+  buildInputs = [ darwin.libffi ];
+
+  nativeBuildInputs = [
+    darwin.DarwinTools # sw_vers
+  ];
+
+  # Same workaround as pyobjc-framework-Quartz; see
+  # https://github.com/ronaldoussoren/pyobjc/pull/641.
+  postPatch = ''
+    substituteInPlace pyobjc_setup.py \
+      --replace-fail "-buildversion" "-buildVersion" \
+      --replace-fail "-productversion" "-productVersion" \
+      --replace-fail "/usr/bin/sw_vers" "sw_vers" \
+      --replace-fail "/usr/bin/xcrun" "xcrun"
+  '';
+
+  dependencies = [
+    pyobjc-core
+    pyobjc-framework-Cocoa
+    pyobjc-framework-Quartz
+    pyobjc-framework-CoreText
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-I${darwin.libffi.dev}/include"
+    "-Wno-error=unused-command-line-argument"
+  ];
+
+  pythonImportsCheck = [
+    "ApplicationServices"
+    "HIServices"
+  ];
+
+  meta = {
+    description = "PyObjC wrappers for the ApplicationServices framework on macOS";
+    homepage = "https://github.com/ronaldoussoren/pyobjc";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ l1n ];
+  };
+}

pkgs/development/python-modules/pyobjc-framework-CoreText/default.nix

@@ -0,0 +1,59 @@
+{
+  buildPythonPackage,
+  setuptools,
+  darwin,
+  pyobjc-core,
+  pyobjc-framework-Cocoa,
+  pyobjc-framework-Quartz,
+  lib,
+}:
+
+buildPythonPackage rec {
+  pname = "pyobjc-framework-CoreText";
+  pyproject = true;
+
+  inherit (pyobjc-core) version src;
+
+  sourceRoot = "${src.name}/pyobjc-framework-CoreText";
+
+  build-system = [ setuptools ];
+
+  buildInputs = [ darwin.libffi ];
+
+  nativeBuildInputs = [
+    darwin.DarwinTools # sw_vers
+  ];
+
+  # Same workaround as pyobjc-framework-Quartz; see
+  # https://github.com/ronaldoussoren/pyobjc/pull/641.
+  postPatch = ''
+    substituteInPlace pyobjc_setup.py \
+      --replace-fail "-buildversion" "-buildVersion" \
+      --replace-fail "-productversion" "-productVersion" \
+      --replace-fail "/usr/bin/sw_vers" "sw_vers" \
+      --replace-fail "/usr/bin/xcrun" "xcrun"
+  '';
+
+  dependencies = [
+    pyobjc-core
+    pyobjc-framework-Cocoa
+    pyobjc-framework-Quartz
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-I${darwin.libffi.dev}/include"
+    "-Wno-error=unused-command-line-argument"
+  ];
+
+  pythonImportsCheck = [
+    "CoreText"
+  ];
+
+  meta = {
+    description = "PyObjC wrappers for the CoreText framework on macOS";
+    homepage = "https://github.com/ronaldoussoren/pyobjc";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ l1n ];
+  };
+}

pkgs/development/python-modules/redis-om/default.nix

@@ -87,5 +87,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/redis/redis-om-python/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ natsukium ];
+    teams = [ lib.teams.redis ];
   };
 }

pkgs/development/python-modules/redis/default.nix

@@ -73,5 +73,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/redis/redis-py/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.dotlambda ];
+    teams = [ lib.teams.redis ];
   };
 }

pkgs/development/python-modules/redisvl/default.nix

@@ -49,9 +49,7 @@ buildPythonPackage (finalAttrs: {
     changelog = "https://github.com/redis/redis-vl-python/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     mainProgram = "rvl";
-    maintainers = with lib.maintainers; [
-      codgician
-      hythera
-    ];
+    maintainers = with lib.maintainers; [ codgician ];
+    teams = [ lib.teams.redis ];
   };
 })

pkgs/games/cataclysm-dda/git.nix

@@ -37,7 +37,7 @@ let
     ];
 
     meta = common.meta // {
-      maintainers = with lib.maintainers; common.meta.maintainers ++ [ rardiol ];
+      maintainers = common.meta.maintainers ++ [ ];
     };
   });
 in

pkgs/servers/sql/postgresql/ext/pg_squeeze.nix

@@ -9,13 +9,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_squeeze";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "cybertec-postgresql";
     repo = "pg_squeeze";
     tag = "REL${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-gzep34mxV9D9xk/J7JfSTWg8EaM/BJezpM3tt/tlxmM=";
+    hash = "sha256-lwjiRWbz+MzfodcP3jgaLdOcZ2/UheZn10iXabdfxh0=";
   };
 
   passthru.updateScript = nix-update-script {

pkgs/servers/sql/postgresql/ext/pgsql-http.nix

@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pgsql-http";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "pramsey";
     repo = "pgsql-http";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tgmty8ZYpSEccwQouI/Ho2M495k6DizbMaaJ0+aW03Q=";
+    hash = "sha256-vTOLAv0TYks8ubQa/y7+XjaIZuHEfh2wi2I38UNJ7NM=";
   };
 
   buildInputs = [ curl ];

pkgs/stdenv/generic/check-meta.nix

@@ -300,7 +300,7 @@ let
 
   metaType =
     let
-      types = import ./meta-types.nix { inherit lib; };
+      types = import ../../../lib/meta-types.nix { inherit lib; };
       inherit (types)
         str
         union

pkgs/stdenv/generic/problems.nix

@@ -242,7 +242,7 @@ rec {
   # The type for meta.problems
   problemsType =
     let
-      types = import ./meta-types.nix { inherit lib; };
+      types = import ../../../lib/meta-types.nix { inherit lib; };
       inherit (types)
         str
         listOf

pkgs/top-level/python-packages.nix

@@ -14804,6 +14804,10 @@ self: super: with self; {
 
   pyobjc-core = callPackage ../development/python-modules/pyobjc-core { };
 
+  pyobjc-framework-ApplicationServices =
+    callPackage ../development/python-modules/pyobjc-framework-ApplicationServices
+      { };
+
   pyobjc-framework-Cocoa = callPackage ../development/python-modules/pyobjc-framework-Cocoa { };
 
   pyobjc-framework-CoreAudio =
@@ -14814,6 +14818,8 @@ self: super: with self; {
     callPackage ../development/python-modules/pyobjc-framework-CoreBluetooth
       { };
 
+  pyobjc-framework-CoreText = callPackage ../development/python-modules/pyobjc-framework-CoreText { };
+
   pyobjc-framework-Quartz = callPackage ../development/python-modules/pyobjc-framework-Quartz { };
 
   pyobjc-framework-Security = callPackage ../development/python-modules/pyobjc-framework-Security { };

shell.nix

@@ -28,15 +28,14 @@ let
 in
 curPkgs
 // pkgs.mkShellNoCC {
-  inputsFrom = [
-    fmt.shell
-  ];
-  packages = with pkgs; [
+  packages = [
     # Helper to review Nixpkgs PRs
     # See CONTRIBUTING.md
-    nixpkgs-reviewFull
+    pkgs.nixpkgs-reviewFull
     # Command-line utility for working with GitHub
     # Used by nixpkgs-review to fetch eval results
-    gh
+    pkgs.gh
+    # treefmt wrapper
+    fmt.pkg
   ];
 }