diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 011e09a0023e..17a103c4ca7d 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -40,6 +40,7 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha }} token: ${{ steps.app-token.outputs.token }} + persist-credentials: false - name: Log current API rate limits env: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 918c82c94bbe..26d71b846369 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -46,6 +46,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: .github/actions - name: Checkout the merge commit uses: ./.github/actions/checkout diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index 0ee1146a4982..f55ff86dfdcf 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -34,6 +34,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false path: trusted sparse-checkout: | ci/github-script @@ -73,6 +74,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: .github/actions - name: Checkout merge and target commits uses: ./.github/actions/checkout diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index dee31e1f5328..97d5c114acb0 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -34,6 +34,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false path: trusted sparse-checkout: | ci/supportedVersions.nix @@ -41,6 +42,7 @@ jobs: - name: Check out the PR at the test merge commit uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false ref: ${{ inputs.mergedSha }} path: untrusted sparse-checkout: | @@ -84,6 +86,7 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: .github/actions - name: Check out the PR at merged and target commits uses: ./.github/actions/checkout @@ -155,6 +158,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: .github/actions - name: Check out the PR at the target commit uses: ./.github/actions/checkout @@ -181,8 +185,9 @@ jobs: - name: Compare against the target branch env: AUTHOR_ID: ${{ github.event.pull_request.user.id }} + TARGET_SHA: ${{ inputs.mergedSha }} run: | - git -C nixpkgs/trusted diff --name-only ${{ inputs.mergedSha }} \ + git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \ | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json # Use the target branch to get accurate maintainer info @@ -318,6 +323,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: .github/actions - name: Checkout the merge commit uses: ./.github/actions/checkout diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index 3e520139bc28..74838ebb52ae 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -46,6 +46,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: | ci/github-script diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index cb7a61edad83..358e090a7b2b 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -26,6 +26,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: .github/actions - name: Checkout the merge commit uses: ./.github/actions/checkout @@ -60,6 +61,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: .github/actions - name: Checkout the merge commit uses: ./.github/actions/checkout @@ -87,6 +89,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: .github/actions - name: Checkout merge and target commits uses: ./.github/actions/checkout diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml index 6ae96f0900f7..24ab1095ea7d 100644 --- a/.github/workflows/merge-group.yml +++ b/.github/workflows/merge-group.yml @@ -24,6 +24,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout: | ci/supportedSystems.json diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml index 63e3dfd13887..481a54191349 100644 --- a/.github/workflows/periodic-merge-24h.yml +++ b/.github/workflows/periodic-merge-24h.yml @@ -43,4 +43,5 @@ jobs: from: ${{ matrix.pairs.from }} into: ${{ matrix.pairs.into }} name: ${{ matrix.pairs.name || format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }} - secrets: inherit + secrets: + NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }} diff --git a/.github/workflows/periodic-merge-6h.yml b/.github/workflows/periodic-merge-6h.yml index 054ac713fe74..edd4cb0b2df6 100644 --- a/.github/workflows/periodic-merge-6h.yml +++ b/.github/workflows/periodic-merge-6h.yml @@ -42,4 +42,5 @@ jobs: from: ${{ matrix.pairs.from }} into: ${{ matrix.pairs.into }} name: ${{ format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }} - secrets: inherit + secrets: + NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }} diff --git a/.github/workflows/periodic-merge.yml b/.github/workflows/periodic-merge.yml index 04c80ae9735c..606c03866e6f 100644 --- a/.github/workflows/periodic-merge.yml +++ b/.github/workflows/periodic-merge.yml @@ -11,6 +11,9 @@ on: description: Target branch to merge into. required: true type: string + secrets: + NIXPKGS_CI_APP_PRIVATE_KEY: + required: true defaults: run: @@ -32,6 +35,8 @@ jobs: permission-pull-requests: write - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false - name: Find merge base between two branches if: contains(inputs.from, ' ') diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index d443d68cdad9..1ba548a4c44e 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -34,6 +34,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout-cone-mode: true # default, for clarity sparse-checkout: | ci/github-script diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml index 245970531477..22ac1bb5bcd4 100644 --- a/.github/workflows/reviewers.yml +++ b/.github/workflows/reviewers.yml @@ -29,6 +29,7 @@ jobs: - name: Check out the PR at the base commit uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false path: trusted sparse-checkout: ci @@ -146,6 +147,7 @@ jobs: if: ${{ steps.app-token.outputs.token }} env: GH_TOKEN: ${{ github.token }} + APP_GH_TOKEN: ${{ steps.app-token.outputs.token }} REPOSITORY: ${{ github.repository }} NUMBER: ${{ github.event.number }} AUTHOR: ${{ github.event.pull_request.user.login }} @@ -156,7 +158,7 @@ jobs: # There appears to be no API to request reviews based on GitHub IDs jq -r 'keys[]' comparison/maintainers.json \ | while read -r id; do gh api /user/"$id" --jq .login; done \ - | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR" + | GH_TOKEN="$APP_GH_TOKEN" result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR" - name: Log current API rate limits (app-token) if: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 4431e89954f3..67b416a6dfb2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -21,6 +21,7 @@ jobs: steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + persist-credentials: false sparse-checkout-cone-mode: true # default, for clarity sparse-checkout: | ci/github-script diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 000000000000..f1b71580ebca --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,12 @@ +# This file defines the ignore rules for zizmor. +# +# For rules that contain a high number of false positives, prefer listing them here +# instead of adding ignore comments. Note that zizmor cannot ignore by line-within-a-string, so +# there are some ignore items that encompass multiple problems within one `run` block. An issue +# tracking this is at https://github.com/woodruffw/zizmor/issues/648. +# +# For more info, see the documentation: https://woodruffw.github.io/zizmor/usage/#ignoring-results + +rules: + dangerous-triggers: + disable: true diff --git a/ci/default.nix b/ci/default.nix index 7b7424f4f5be..972c679a1492 100644 --- a/ci/default.nix +++ b/ci/default.nix @@ -136,6 +136,8 @@ let [ "--config=${config}" ]; includes = [ "*.md" ]; }; + + programs.zizmor.enable = true; }; fs = pkgs.lib.fileset; nixFilesSrc = fs.toSource { diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix index 213ae69d8f86..8da0b046cba1 100644 --- a/pkgs/applications/office/libreoffice/default.nix +++ b/pkgs/applications/office/libreoffice/default.nix @@ -313,18 +313,24 @@ stdenv.mkDerivation (finalAttrs: { # Revert part of https://github.com/LibreOffice/core/commit/6f60670877208612b5ea320b3677480ef6508abb that broke zlib linking ./readd-explicit-zlib-link.patch - + ] + ++ lib.optionals (lib.versionOlder version "25.8.2.1") [ # Backport patch to fix build with Poppler 25.09 (fetchpatch2 { url = "https://github.com/LibreOffice/core/commit/7848e02819c007026952a3fdc9da0961333dc079.patch"; includes = [ "sdext/*" ]; hash = "sha256-Nw6GFmkFy13w/ktCxw5s7SHL34auP1BQ9JvQnQ65aVU="; }) - ] - ++ lib.optionals (lib.versionAtLeast version "25.8") [ # Fix build with Poppler 25.10 (fetchpatch2 { - url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-fresh/-/raw/41e58e117c356af2be83993595caf61f9f30cc89/poppler-25.10.patch"; + url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/f5241554e4a0f6fd95ac4e5cc398a30243407e6a/fix_build_with_poppler_25.10.patch"; + hash = "sha256-lbPOkc1HeT5Qsp6XfVyVJtmvSL68qTrmbd3q9lvKSu8="; + }) + ] + ++ lib.optionals (lib.versionAtLeast version "25.8.2.2") [ + # Fix build with Poppler 25.10 + (fetchpatch2 { + url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-fresh/-/raw/f7b0e4385108b95c134599502a7bccf0a41925c8/poppler-25.10.patch"; hash = "sha256-KMsjDtRRH8Vy/FXaVwxUo0Ww10PCE0sK8+ZL0Ja2kJQ="; }) ] diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-bidi/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-bidi/default.nix index ec2d08862ecd..ff7c1b1a2d7d 100644 --- a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-bidi/default.nix +++ b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-bidi/default.nix @@ -32,5 +32,8 @@ perlPackages.buildPerlPackage rec { homepage = "https://github.com/mkamensky/Text-Bidi"; maintainers = with maintainers; [ doronbehar ]; platforms = with platforms; unix; + # Quote from the README: + # same terms as the Perl 5 programming language system itself + license = perlPackages.perl.meta.license; }; } diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-tabbedex/default.nix b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-tabbedex/default.nix index e1b3ff6233fa..98fb59bf9795 100644 --- a/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-tabbedex/default.nix +++ b/pkgs/applications/terminal-emulators/rxvt-unicode-plugins/urxvt-tabbedex/default.nix @@ -25,5 +25,6 @@ stdenv.mkDerivation rec { homepage = "https://github.com/mina86/urxvt-tabbedex"; maintainers = [ ]; platforms = with platforms; unix; + license = lib.licenses.gpl3Plus; }; } diff --git a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix index a161e9544265..8bd75245da0e 100644 --- a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix +++ b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix @@ -16,7 +16,9 @@ }: let - availablePlugins = lib.filterAttrs (_: v: lib.isDerivation v) rxvt-unicode-plugins; + availablePlugins = lib.filterAttrs ( + _: v: (lib.isDerivation v && (v.meta.license.free or false)) + ) rxvt-unicode-plugins; # Transform the string "self" to the plugin itself. # It's needed for plugins like bidi who depends on the perl diff --git a/pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix b/pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix index b6cbffb51dd9..290f197fd0a2 100644 --- a/pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix +++ b/pkgs/by-name/bi/bign-handheld-thumbnailer/package.nix @@ -11,16 +11,16 @@ rustPlatform.buildRustPackage rec { pname = "bign-handheld-thumbnailer"; - version = "1.1.3"; + version = "1.2.0"; src = fetchFromGitHub { owner = "MateusRodCosta"; repo = "bign-handheld-thumbnailer"; tag = "v${version}"; - hash = "sha256-qS1bKEkZPmNMfiLUZVlx8EAXMMYCcGGTTZFhWwlZ3gQ="; + hash = "sha256-+iWf5ybCUHlZz3Ybw3bwLKzlsmiVwep2alVDvL9bG2A="; }; - cargoHash = "sha256-LyT0HDR51/bYnXtavgtff1nCKuJn41UmZuH/uJmykkk="; + cargoHash = "sha256-vfTbfg1CAbc//UZtI5trw6znqnNGy6AiCSQNE68vch8="; strictDeps = true; diff --git a/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix b/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix index e2e700e9197a..87c66935d2fb 100644 --- a/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix +++ b/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix @@ -9,16 +9,16 @@ }: rustPlatform.buildRustPackage rec { pname = "chirpstack-mqtt-forwarder"; - version = "4.4.0"; + version = "4.4.1"; src = fetchFromGitHub { owner = "chirpstack"; repo = "chirpstack-mqtt-forwarder"; rev = "v${version}"; - hash = "sha256-HopcEwj/WOialvttVJ6bTyRRTqrgfIJ/dYKti5T87Os="; + hash = "sha256-qkktkydg5Xe6q5IFalkxtGjO2zK9mZVMnKOBassiEtk="; }; - cargoHash = "sha256-uR+Y8+/XbIQdbGOoS/tHBo/r7DLiwiRiaXQ7CjaPpoI="; + cargoHash = "sha256-rQPmFmra9Gd8XDP9HuTZZru780RmmqWEKX2iuuRkZQw="; nativeBuildInputs = [ protobuf ]; diff --git a/pkgs/by-name/di/diesel-cli/package.nix b/pkgs/by-name/di/diesel-cli/package.nix index 164b69372ccc..909dd6d31e9c 100644 --- a/pkgs/by-name/di/diesel-cli/package.nix +++ b/pkgs/by-name/di/diesel-cli/package.nix @@ -27,15 +27,15 @@ assert lib.assertMsg (lib.elem true [ rustPlatform.buildRustPackage rec { pname = "diesel-cli"; - version = "2.3.2"; + version = "2.3.3"; src = fetchCrate { inherit version; crateName = "diesel_cli"; - hash = "sha256-JNDFXBNmwCWpk+Lub453wS+7lVMZcdiJBmPoVAedpug="; + hash = "sha256-AgPESgFLnL3jiYBP8DiWb0hLzsx5tJA+gcO/fdV5Cvo="; }; - cargoHash = "sha256-qfXa6DuuhKbXCdOvhuPNx6xlDIouoDVJUMob9Fc5XgI="; + cargoHash = "sha256-yco4l/4UiYnqnZZLYm3EkHmYiQJhMC2xloFg0brDfsg="; nativeBuildInputs = [ installShellFiles diff --git a/pkgs/by-name/gi/github-copilot-cli/package-lock.json b/pkgs/by-name/gi/github-copilot-cli/package-lock.json deleted file mode 100644 index 2d53b9d57986..000000000000 --- a/pkgs/by-name/gi/github-copilot-cli/package-lock.json +++ /dev/null @@ -1,58 +0,0 @@ -{ - "name": "@github/copilot", - "version": "0.0.328", - "lockfileVersion": 3, - "requires": true, - "packages": { - "": { - "name": "@github/copilot", - "version": "0.0.328", - "dependencies": { - "keytar-forked-forked": "^7.10.2", - "node-pty": "npm:@devm33/node-pty@^1.0.8" - }, - "bin": { - "copilot": "index.js" - }, - "engines": { - "node": ">=22" - } - }, - "node_modules/keytar-forked-forked": { - "version": "7.10.3", - "resolved": "https://registry.npmjs.org/keytar-forked-forked/-/keytar-forked-forked-7.10.3.tgz", - "integrity": "sha512-ipErTUO1NPXmngYhnMrda0yOIOPSNbVJ2BRjk3kNozLx3UmGICnzCfEDemuLY6HgP+rV0c9F+Opt+89+Ydbw6w==", - "hasInstallScript": true, - "license": "MIT", - "dependencies": { - "node-addon-api": "^8.3.0" - } - }, - "node_modules/node-addon-api": { - "version": "8.5.0", - "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.5.0.tgz", - "integrity": "sha512-/bRZty2mXUIFY/xU5HLvveNHlswNJej+RnxBjOMkidWfwZzgTbPG1E3K5TOxRLOR+5hX7bSofy8yf1hZevMS8A==", - "license": "MIT", - "engines": { - "node": "^18 || ^20 || >= 21" - } - }, - "node_modules/node-pty": { - "name": "@devm33/node-pty", - "version": "1.0.9", - "resolved": "https://registry.npmjs.org/@devm33/node-pty/-/node-pty-1.0.9.tgz", - "integrity": "sha512-5yzbTTywkaFk1iRwte2aWEpyDfcpDjCofVD1BiOUQI+fsCvp/+RdJnB4jgnULrdlWOEWuBf+bg4/NZKVApPhoQ==", - "hasInstallScript": true, - "license": "MIT", - "dependencies": { - "node-addon-api": "^7.1.0" - } - }, - "node_modules/node-pty/node_modules/node-addon-api": { - "version": "7.1.1", - "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz", - "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==", - "license": "MIT" - } - } -} diff --git a/pkgs/by-name/gi/github-copilot-cli/package.nix b/pkgs/by-name/gi/github-copilot-cli/package.nix index 2006f6db64d3..89d99bd3cd4e 100644 --- a/pkgs/by-name/gi/github-copilot-cli/package.nix +++ b/pkgs/by-name/gi/github-copilot-cli/package.nix @@ -1,11 +1,14 @@ { lib, - buildNpmPackage, + stdenv, fetchzip, + nodejs, + makeBinaryWrapper, + versionCheckHook, nix-update-script, }: -buildNpmPackage (finalAttrs: { +stdenv.mkDerivation (finalAttrs: { pname = "github-copilot-cli"; version = "0.0.328"; @@ -14,15 +17,25 @@ buildNpmPackage (finalAttrs: { hash = "sha256-9oTaVjvwyS8KY8N5kUEiAs+l6vEd/BZ0AGJI0p9Jie0="; }; - npmDepsHash = "sha256-WK6t3IW4uF+MDu7Y5GRinbm8iDcYB8RhJ15GE9VBcjQ="; + nativeBuildInputs = [ makeBinaryWrapper ]; - postPatch = '' - cp ${./package-lock.json} package-lock.json + installPhase = '' + runHook preInstall + + mkdir -p $out/lib/node_modules/@github/copilot + cp -r . $out/lib/node_modules/@github/copilot + + mkdir -p $out/bin + makeBinaryWrapper ${nodejs}/bin/node $out/bin/copilot \ + --add-flags "$out/lib/node_modules/@github/copilot/index.js" + + runHook postInstall ''; - dontNpmBuild = true; + nativeInstallCheckInputs = [ versionCheckHook ]; + doInstallCheck = true; - passthru.updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; }; + passthru.updateScript = nix-update-script { }; meta = { description = "GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal"; diff --git a/pkgs/by-name/go/gofumpt/package.nix b/pkgs/by-name/go/gofumpt/package.nix index e17cab3def16..3568eb7bae23 100644 --- a/pkgs/by-name/go/gofumpt/package.nix +++ b/pkgs/by-name/go/gofumpt/package.nix @@ -8,16 +8,16 @@ buildGoModule (finalAttrs: { pname = "gofumpt"; - version = "0.9.1"; + version = "0.9.2"; src = fetchFromGitHub { owner = "mvdan"; repo = "gofumpt"; rev = "v${finalAttrs.version}"; - hash = "sha256-2JahPQQfiYfctMi7AqNB9Y1dS1Pg8usLtzM2wSlC5E0="; + hash = "sha256-ngqg8YJHqW08hvZp+E+RLLjGArOZJov7/xKCMAWFI1E="; }; - vendorHash = "sha256-ziqhBWkfWQ0T+gLFqv352PtNcpyCTRFHBfV6iilVGLs="; + vendorHash = "sha256-qCXpFxTZIhDDvvwytvftBnMwOHopO6/FkBWcLZhBDp8="; env.CGO_ENABLED = "0"; diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix index 9c018c365756..1af40524d040 100644 --- a/pkgs/by-name/ho/home-manager/package.nix +++ b/pkgs/by-name/ho/home-manager/package.nix @@ -19,14 +19,14 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "home-manager"; - version = "0-unstable-2025-10-18"; + version = "0-unstable-2025-10-25"; src = fetchFromGitHub { name = "home-manager-source"; owner = "nix-community"; repo = "home-manager"; - rev = "870883ba11ba1c84f756c0c1f9fa74cdb2a16c1e"; - hash = "sha256-OxGcFcQdfOK8veZkPdQuqXIotFYiy4sBQB58dMNLeHY="; + rev = "c644cb018f9fdec55f5ac2afb4713a8c7beb757c"; + hash = "sha256-6LNSptFYhiAd0M/maJoixJw7V0Kp5BSoMRtIahcfu3M="; }; nativeBuildInputs = [ diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix index c37a67fdc47f..9b34ffa7890e 100644 --- a/pkgs/by-name/li/limine/package.nix +++ b/pkgs/by-name/li/limine/package.nix @@ -47,14 +47,14 @@ in # as bootloader for various platforms and corresponding binary and helper files. stdenv.mkDerivation (finalAttrs: { pname = "limine"; - version = "10.1.1"; + version = "10.2.0"; # We don't use the Git source but the release tarball, as the source has a # `./bootstrap` script performing network access to download resources. # Packaging that in Nix is very cumbersome. src = fetchurl { url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz"; - hash = "sha256-pDhA8N7a5cTorIW8OgCimOxxfZ2slUhp3K+cb8KIAzc="; + hash = "sha256-eKoKjRJ+JbawucYXNvYrRMtkdybnxB3G1xk/7KR4YSI="; }; enableParallelBuilding = true; diff --git a/pkgs/by-name/pr/procfd/package.nix b/pkgs/by-name/pr/procfd/package.nix index 53f12202e087..16aa478eacdb 100644 --- a/pkgs/by-name/pr/procfd/package.nix +++ b/pkgs/by-name/pr/procfd/package.nix @@ -7,16 +7,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "procfd"; - version = "1.1.0"; + version = "1.2.0"; src = fetchFromGitHub { owner = "deshaw"; repo = "procfd"; tag = "v${finalAttrs.version}"; - hash = "sha256-M2VFy7WqvoxgzEpS0qd7nGLRt2pKGZlfU9uUHlwDC7Y="; + hash = "sha256-KhnSHtPT9H9CWotwQIA9gFvwgm0PKsmDjQS817PxMw0="; }; - cargoHash = "sha256-YmUzcJ8SM3iwjeDZXWBrDcT793ZyF6QdwxuYDh69xZw="; + cargoHash = "sha256-srFXs+h+ZMXeWRwGQUAqMACJG4ZUgztWr2ff6sRfkU8="; nativeInstallCheckInputs = [ versionCheckHook diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/by-name/st/stellarium/package.nix similarity index 80% rename from pkgs/applications/science/astronomy/stellarium/default.nix rename to pkgs/by-name/st/stellarium/package.nix index e883582bdcc8..28b977fc7117 100644 --- a/pkgs/applications/science/astronomy/stellarium/default.nix +++ b/pkgs/by-name/st/stellarium/package.nix @@ -2,22 +2,15 @@ lib, stdenv, fetchFromGitHub, + fetchpatch, cmake, perl, wrapGAppsHook3, - wrapQtAppsHook, - qtbase, - qtcharts, - qtpositioning, - qtmultimedia, - qtserialport, - qtwayland, - qtwebengine, + qt6, + qt6Packages, calcmysky, - qxlsx, indilib, libnova, - qttools, exiv2, nlopt, testers, @@ -37,31 +30,38 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-9uQ6u1+dSszmKG8eY6kSXhqsCPRGw6tulCTCrLByIxc="; }; + patches = [ + (fetchpatch { + url = "https://gitlab.archlinux.org/archlinux/packaging/packages/stellarium/-/raw/ab559b6e9349569278f83c2dfc83990e971a8cb2/qt-6.10.patch"; + hash = "sha256-a7zC9IQOj93VnPy8Bj/fLe4oJux7I4Edgj5OaKI4TZU="; + }) + ]; + postPatch = lib.optionalString stdenv.hostPlatform.isDarwin '' substituteInPlace CMakeLists.txt \ --replace-fail 'SET(CMAKE_INSTALL_PREFIX "''${PROJECT_BINARY_DIR}/Stellarium.app/Contents")' \ 'SET(CMAKE_INSTALL_PREFIX "${placeholder "out"}/Applications/Stellarium.app/Contents")' substituteInPlace src/CMakeLists.txt \ - --replace-fail "\''${_qt_bin_dir}/../" "${qtmultimedia}/lib/qt-6/" + --replace-fail "\''${_qt_bin_dir}/../" "${qt6.qtmultimedia}/lib/qt-6/" ''; nativeBuildInputs = [ cmake perl wrapGAppsHook3 - wrapQtAppsHook - qttools + qt6.wrapQtAppsHook + qt6.qttools ]; buildInputs = [ - qtbase - qtcharts - qtpositioning - qtmultimedia - qtserialport - qtwebengine + qt6.qtbase + qt6.qtcharts + qt6.qtpositioning + qt6.qtmultimedia + qt6.qtserialport + qt6.qtwebengine calcmysky - qxlsx + qt6Packages.qxlsx indilib libnova exiv2 @@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: { nlopt ] ++ lib.optionals stdenv.hostPlatform.isLinux [ - qtwayland + qt6.qtwayland ]; preConfigure = '' @@ -80,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: { ''; # fatal error: 'QtSerialPort/QSerialPortInfo' file not found - env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-F${qtserialport}/lib"; + env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-F${qt6.qtserialport}/lib"; dontWrapGApps = true; diff --git a/pkgs/development/libraries/qxlsx/default.nix b/pkgs/development/libraries/qxlsx/default.nix index a9280ae76f47..59b734382ab6 100644 --- a/pkgs/development/libraries/qxlsx/default.nix +++ b/pkgs/development/libraries/qxlsx/default.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchpatch, cmake, qtbase, }: @@ -17,6 +18,14 @@ stdenv.mkDerivation rec { hash = "sha256-twOlAiLE0v7+9nWo/Gd+oiKT1umL3UnG1Xa0zDG7u7s="; }; + patches = [ + # Fix for Qt 6.10, can likely be removed when version bump passes v1.5.0. + (fetchpatch { + url = "https://github.com/QtExcel/QXlsx/commit/90d762625750c6b2c73f6cd96b633e9158aed72e.patch"; + hash = "sha256-/0xLrkjuJGZRocK1EyBhuaUmg0usueQz2F340DkQhb0="; + }) + ]; + nativeBuildInputs = [ cmake ]; buildInputs = [ qtbase ]; diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix index 4bf5cedaa077..3f7d2cf211f0 100644 --- a/pkgs/development/python-modules/apprise/default.nix +++ b/pkgs/development/python-modules/apprise/default.nix @@ -72,7 +72,7 @@ buildPythonPackage rec { description = "Push Notifications that work with just about every platform"; homepage = "https://github.com/caronc/apprise"; changelog = "https://github.com/caronc/apprise/releases/tag/v${version}"; - license = lib.licenses.bsd3; + license = lib.licenses.bsd2; maintainers = with lib.maintainers; [ getchoo ]; mainProgram = "apprise"; }; diff --git a/pkgs/development/python-modules/dnf4/default.nix b/pkgs/development/python-modules/dnf4/default.nix index 980e49b917b6..f1670daac402 100644 --- a/pkgs/development/python-modules/dnf4/default.nix +++ b/pkgs/development/python-modules/dnf4/default.nix @@ -18,7 +18,7 @@ in buildPythonPackage rec { pname = "dnf4"; - version = "4.23.0"; + version = "4.24.0"; format = "other"; outputs = [ @@ -31,7 +31,7 @@ buildPythonPackage rec { owner = "rpm-software-management"; repo = "dnf"; tag = version; - hash = "sha256-qlOnFtEURhyxfsprhRaYUj141vZJp8qMjLpP1wGxikw="; + hash = "sha256-zzWOc2I9YW5gjsS2Umfx6GGgY4B3pdia0E2KHHtAH2s="; }; patches = [ ./fix-python-install-dir.patch ]; diff --git a/pkgs/kde/gear/calligra/default.nix b/pkgs/kde/gear/calligra/default.nix index 6cbdeb223aa4..b0d1e99c9b0c 100644 --- a/pkgs/kde/gear/calligra/default.nix +++ b/pkgs/kde/gear/calligra/default.nix @@ -1,6 +1,7 @@ { mkKdeDerivation, lib, + fetchpatch, boost, eigen, gsl, @@ -26,6 +27,14 @@ mkKdeDerivation { pname = "calligra"; + patches = [ + # Fix build with Poppler 25.10 + (fetchpatch { + url = "https://invent.kde.org/office/calligra/-/commit/45e8b302bce1d318f310ea13599d7ce84acc477e.patch"; + hash = "sha256-TECB3eo24+gI8TXL8gw9BIdFWqw0JBKCWpoNVqBSan8="; + }) + ]; + extraBuildInputs = [ boost eigen diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix index c3c11fd7cd94..85fb35f38dbf 100644 --- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix +++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix @@ -25,7 +25,7 @@ buildLinux ( src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz"; - sha256 = "17wxs8i8vd5ivv99ra0sri3wmkw5c22wsaw8nf1xcvys2kmpa7hk"; + hash = "sha256-Ex516xTab9aDs4grzYVghc/KR8waqJzS3rG0jSLSnZ8="; }; kernelPatches = @@ -34,7 +34,7 @@ buildLinux ( name = "rt"; patch = fetchurl { url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz"; - sha256 = "1nqdshpcf775cmb1kqcq939b7qx6wsy91pf0l0vsd3rdpixidzyk"; + hash = "sha256-0/8We7wtj6Y3oMDdkLzmpuOz0kiY4RlWZeUcxy7UDds="; }; }; in diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix index 822d06217b1e..a694cf30d818 100644 --- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix +++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix @@ -29,7 +29,7 @@ buildLinux ( src = fetchurl { url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz"; - sha256 = "0hd4p76qv29zlr0iik4j9y9qynyqisk6bgfiqcwkk7gr6bf81l13"; + hash = "sha256-I9CA3DL5nTk5w9G9ZaaO2FuPk0+SzBhBpj+Jjc25pEE="; }; kernelPatches = @@ -38,7 +38,7 @@ buildLinux ( name = "rt"; patch = fetchurl { url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz"; - sha256 = "15n1l3b0yq7hl2zady3s3a3zym82clyycvf5icavvd68758sdp25"; + hash = "sha256-RdymUTnItL0Vi8Vt5j1lAlX/hxp6+Ka+oPBgD9agwZY="; }; }; in diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix index 508da7ec98cd..25ee763a96b2 100644 --- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix +++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix @@ -29,7 +29,7 @@ buildLinux ( src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz"; - sha256 = "13i2l04pmba7dksz2p5kwxgr5bydc5lp7284d4wfsnjf425i9fyl"; + hash = "sha256-1LsUiyBOWu04aQSJc2lhza+SX+ezXPH1bEetegmgIo4="; }; kernelPatches = @@ -38,7 +38,7 @@ buildLinux ( name = "rt"; patch = fetchurl { url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz"; - sha256 = "1smah5wa4lrgb13li025lpj80yxay4g13m7c4i09whxcgxhc294k"; + hash = "sha256-kyTBYH+sQ55AJOzUER7xqnuA5KVFgEhHWC9ToniBquo="; }; }; in diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix index 5ce2e345bc97..d6783e3f3fe4 100644 --- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix +++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix @@ -29,7 +29,7 @@ buildLinux ( src = fetchurl { url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz"; - sha256 = "08la2f8w5w2x0l9nmvzsmbwa951xyshhvdhwwhfyjmka66zr4zbc"; + hash = "sha256-bH2SvzFqVukd5By2DaH2PZSk+Kr672oTBV3wwpETiiI="; }; kernelPatches = @@ -38,7 +38,7 @@ buildLinux ( name = "rt"; patch = fetchurl { url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz"; - sha256 = "01z2dwl54hfqfyc8xmlz6kaw522s55jsdrdw31pjnzkn6rxf7zbf"; + hash = "sha256-bv3jejZ2fitvGLzlpmUpWojC1TSf1o6Yd9hBUihv4gc="; }; }; in diff --git a/pkgs/os-specific/linux/kernel/update-rt.sh b/pkgs/os-specific/linux/kernel/update-rt.sh index a9e0577fae92..38221e97716f 100755 --- a/pkgs/os-specific/linux/kernel/update-rt.sh +++ b/pkgs/os-specific/linux/kernel/update-rt.sh @@ -55,8 +55,8 @@ update-if-needed() { echo "$nixattr: $cur (up-to-date)" return fi - khash=$(nix-prefetch-url "$mirror/v${major}.x/linux-${kversion}.tar.xz") - phash=$(nix-prefetch-url "$mirror/projects/rt/${branch}/older/patch-${new}.patch.xz") + khash=$(nix-prefetch-url "$mirror/v${major}.x/linux-${kversion}.tar.xz" | nix-hash --type sha256 --to-sri) + phash=$(nix-prefetch-url "$mirror/projects/rt/${branch}/older/patch-${new}.patch.xz" | nix-hash --type sha256 --to-sri) if [ "$cur" ]; then msg="$nixattr: $cur -> $new" else @@ -69,8 +69,8 @@ update-if-needed() { sed -i "$file" \ -e "s/$cur/$new/" \ -e "s|kernel/v[0-9]*|kernel/v$major|" \ - -e "1,/.patch.xz/ s/sha256 = .*/sha256 = \"$khash\";/" \ - -e "1,/.patch.xz/! s/sha256 = .*/sha256 = \"$phash\";/" + -e "1,/.patch.xz/ s|hash = .*|hash = \"$khash\";|" \ + -e "1,/.patch.xz/! s|hash = .*|hash = \"$phash\";|" if [ "${COMMIT:-}" ]; then git add "$file" git commit -m "$msg" diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 1e454968038f..9e61510636ce 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -14026,8 +14026,6 @@ with pkgs; spyder = with python3.pkgs; toPythonApplication spyder; - stellarium = qt6Packages.callPackage ../applications/science/astronomy/stellarium { }; - tulip = libsForQt5.callPackage ../applications/science/misc/tulip { python3 = python312; # fails to build otherwise };