Merge master into staging-next

doc/build-helpers/special/makesetuphook.section.md

@@ -25,8 +25,8 @@ pkgs.makeSetupHook
       pkgs.cowsay
     ];
     substitutions = {
-      shell = "${pkgs.bash}/bin/bash";
-      cowsay = "${pkgs.cowsay}/bin/cowsay";
+      shell = lib.getExe pkgs.bash;
+      cowsay = lib.getExe pkgs.cowsay;
     };
   }
   (

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -15,7 +15,7 @@ Typically both the *attributes* and *script* arguments support this, simultaneou
 # Using `finalAttrs` in a build helper
 
 ```nix
-runCommand "hi" (finalAttrs: { passthru.exe = "${finalAttrs.finalPackage}/bin/hi"; }) ''
+runCommand "hi" (finalAttrs: { passthru.exe = lib.getExe' finalAttrs.finalPackage "hi"; }) ''
   mkdir -p $out/bin
   substitute ${./hi.foo} $out/bin/hi --replace-fail "@foo@" ${lib.getExe foo}
 ''
@@ -414,7 +414,7 @@ writeTextFile {
   executable = true;
   destination = "/some/subpath/my-cool-script";
   checkPhase = ''
-    ${pkgs.shellcheck}/bin/shellcheck $out/some/subpath/my-cool-script
+    ${lib.getExe pkgs.shellcheck} $out/some/subpath/my-cool-script
   '';
   meta = {
     license = pkgs.lib.licenses.cc0;
@@ -836,7 +836,7 @@ Runtime environment variables can be set with the `runtimeEnv` argument.
 ::: {.example #ex-writeShellApplication}
 # Usage of `writeShellApplication`
 
-The following shell application can refer to `curl` directly, rather than needing to write `${curl}/bin/curl`
+The following shell application can refer to `curl` directly, rather than needing to write `${lib.getExe curl}`
 
 ```nix
 writeShellApplication {
@@ -894,7 +894,7 @@ The result is equivalent to the output of `nix-store -q --requisites`.
 For example,
 
 ```nix
-writeClosure [ (writeScriptBin "hi" "${hello}/bin/hello") ]
+writeClosure [ (writeScriptBin "hi" (lib.getExe hello)) ]
 ```
 
 produces an output path `/nix/store/<hash>-runtime-deps` containing
@@ -920,7 +920,7 @@ This produces the equivalent of `nix-store -q --references`.
 For example,
 
 ```nix
-writeDirectReferencesToFile (writeScriptBin "hi" "${hello}/bin/hello")
+writeDirectReferencesToFile (writeScriptBin "hi" (lib.getExe hello))
 ```
 
 produces an output path `/nix/store/<hash>-runtime-references` containing

doc/languages-frameworks/beam.section.md

@@ -299,13 +299,13 @@ in
       # Implied by DynamicUser, but just to emphasize due to RELEASE_TMP
       PrivateTmp = true;
       ExecStart = ''
-        ${release}/bin/${release_name} start
+        ${lib.getExe' release release_name} start
       '';
       ExecStop = ''
-        ${release}/bin/${release_name} stop
+        ${lib.getExe' release release_name} stop
       '';
       ExecReload = ''
-        ${release}/bin/${release_name} restart
+        ${lib.getExe' release release_name} restart
       '';
       Restart = "on-failure";
       RestartSec = 5;

doc/languages-frameworks/emscripten.section.md

@@ -86,7 +86,7 @@ One advantage is that when `pkgs.zlib` is updated, it will automatically update
     libz.so.${old.version} -I . -o example.js
 
     echo "Using node to execute the test"
-    ${pkgs.nodejs}/bin/node ./example.js
+    ${lib.getExe pkgs.nodejs} ./example.js
 
     set +x
     if [ $? -ne 0 ]; then

doc/languages-frameworks/java.section.md

@@ -72,7 +72,7 @@ script to run it using a JRE. You can use `makeWrapper` for this:
     runHook preInstall
 
     mkdir -p $out/bin
-    makeWrapper ${jre}/bin/java $out/bin/foo \
+    makeWrapper ${lib.getExe jre} $out/bin/foo \
       --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
 
     runHook postInstall

doc/languages-frameworks/javascript.section.md

@@ -62,7 +62,7 @@ Exceptions to this rule are:
   ```nix
   {
     patchedPackageJSON = final.runCommand "package.json" { } ''
-      ${jq}/bin/jq '.version = "0.4.0" |
+      ${lib.getExe jq} '.version = "0.4.0" |
         .devDependencies."@jsdoc/cli" = "^0.2.5"
         ${sonar-src}/package.json > $out
     '';

doc/languages-frameworks/lisp.section.md

@@ -59,7 +59,7 @@ Such a Lisp can be now used e.g. to compile your sources:
   buildPhase = ''
     runHook preBuild
 
-    ${sbcl'}/bin/sbcl --load my-build-file.lisp
+    ${lib.getExe sbcl'} --load my-build-file.lisp
 
     runHook postBuild
   '';

doc/languages-frameworks/lua.section.md

@@ -213,7 +213,7 @@ The Nix expressions for the interpreters can be found in `pkgs/development/inter
 
 Each interpreter has the following attributes:
 
-- `interpreter`. Alias for `${pkgs.lua}/bin/lua`.
+- `interpreter`. Alias for `${lib.getExe pkgs.lua}`.
 - `buildEnv`. Function to build lua interpreter environments with extra packages bundled together. See section *lua.buildEnv function* for usage and documentation.
 - `withPackages`. Simpler interface to `buildEnv`.
 - `pkgs`. Set of Lua packages for that specific interpreter. The package set can be modified by overriding the interpreter and passing `packageOverrides`.

doc/languages-frameworks/maven.section.md

@@ -38,7 +38,7 @@ maven.buildMavenPackage (finalAttrs: {
     mkdir -p $out/bin $out/share/jd-cli
     install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli
 
-    makeWrapper ${jre}/bin/java $out/bin/jd-cli \
+    makeWrapper ${lib.getExe jre} $out/bin/jd-cli \
       --add-flags "-jar $out/share/jd-cli/jd-cli.jar"
 
     runHook postInstall
@@ -210,7 +210,7 @@ maven_4.buildMavenPackage (finalAttrs: {
     mkdir -p $out/bin $out/share/jd-cli
     install -Dm644 jd-cli/target/jd-cli.jar $out/share/jd-cli
 
-    makeWrapper ${jre}/bin/java $out/bin/jd-cli \
+    makeWrapper ${lib.getExe jre} $out/bin/jd-cli \
       --add-flags "-jar $out/share/jd-cli/jd-cli.jar"
 
     runHook postInstall
@@ -485,6 +485,7 @@ We make sure to provide this classpath to the `makeWrapper`.
 
 ```nix
 {
+  lib,
   stdenv,
   maven,
   callPackage,
@@ -520,7 +521,7 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm644 target/maven-demo-${finalAttrs.version}.jar $out/share/java
     # create a wrapper that will automatically set the classpath
     # this should be the paths from the dependency derivation
-    makeWrapper ${jre}/bin/java $out/bin/maven-demo \
+    makeWrapper ${lib.getExe jre} $out/bin/maven-demo \
           --add-flags "-classpath $out/share/java/maven-demo-${finalAttrs.version}.jar:''${classpath#:}" \
           --add-flags "Main"
 
@@ -577,6 +578,7 @@ We will modify the derivation above to add a symlink to our repository so that i
 
 ```nix
 {
+  lib,
   stdenv,
   maven,
   callPackage,
@@ -615,7 +617,7 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm644 target/maven-demo-${finalAttrs.version}.jar $out/share/java
     # create a wrapper that will automatically set the classpath
     # this should be the paths from the dependency derivation
-    makeWrapper ${jre}/bin/java $out/bin/maven-demo \
+    makeWrapper ${lib.getExe jre} $out/bin/maven-demo \
           --add-flags "-jar $out/share/java/maven-demo-${finalAttrs.version}.jar"
 
     runHook postInstall

doc/languages-frameworks/ruby.section.md

@@ -173,7 +173,7 @@ let
     defaultGemConfig = pkgs.defaultGemConfig // {
       pg = attrs: {
         buildFlags = [
-          "--with-pg-config=${pkgs."postgresql_${pg_version}".pg_config}/bin/pg_config"
+          "--with-pg-config=${pkgs.lib.getExe' pkgs."postgresql_${pg_version}".pg_config "pg_config"}"
         ];
       };
     };
@@ -196,7 +196,7 @@ let
     gemConfig = pkgs.defaultGemConfig // {
       pg = attrs: {
         buildFlags = [
-          "--with-pg-config=${pkgs."postgresql_${pg_version}".pg_config}/bin/pg_config"
+          "--with-pg-config=${pkgs.lib.getExe' pkgs."postgresql_${pg_version}".pg_config "pg_config"}"
         ];
       };
     };
@@ -223,7 +223,7 @@ let
         defaultGemConfig = super.defaultGemConfig // {
           pg = attrs: {
             buildFlags = [
-              "--with-pg-config=${pkgs."postgresql_${pg_version}".pg_config}/bin/pg_config"
+              "--with-pg-config=${pkgs.lib.getExe' pkgs."postgresql_${pg_version}".pg_config "pg_config"}"
             ];
           };
         };

doc/packages/build-support.md

@@ -12,19 +12,23 @@ It replaces strings in `src` as specified by the `substitutions` argument.
 In a build script, the line:
 
 ```bash
-substitute $infile $outfile --replace-fail @foo@ ${foopkg}/bin/foo
+substitute $infile $outfile --replace-fail @foo@ ${lib.getExe foopkg}
 ```
 
 is equivalent to:
 
 ```nix
-{ substitute, foopkg }:
+{
+  lib,
+  substitute,
+  foopkg,
+}:
 substitute {
   src = ./sourcefile.txt;
   substitutions = [
     "--replace"
     "@foo@"
-    "${foopkg}/bin/foo"
+    (lib.getExe foopkg)
   ];
 }
 ```

doc/packages/darwin-builder.section.md

@@ -196,7 +196,7 @@ running NixOS integration tests on the builder (macOS 15+, M3 or newer).
               ];
 
               launchd.daemons.darwin-builder = {
-                command = "${darwin-builder.config.system.build.macos-builder-installer}/bin/create-builder";
+                command = nixpkgs.lib.getExe darwin-builder.config.system.build.macos-builder-installer;
                 serviceConfig = {
                   KeepAlive = true;
                   RunAtLoad = true;

doc/stdenv/multiple-output.chapter.md

@@ -48,9 +48,9 @@ There is a special handling of the `debug` output, described at [](#stdenv-separ
 
 ### “Binaries first” {#multiple-output-file-binaries-first-convention}
 
-A commonly adopted convention in `nixpkgs` is that executables provided by the package are contained within its first output. This convention allows the dependent packages to reference the executables provided by packages in a uniform manner. For instance, provided with the knowledge that the `perl` package contains a `perl` executable it can be referenced as `${pkgs.perl}/bin/perl` within a Nix derivation that needs to execute a Perl script.
+A commonly adopted convention in `nixpkgs` is that executables provided by the package are contained within its first output. This convention allows the dependent packages to reference the executables provided by packages in a uniform manner. For instance, provided with the knowledge that the `perl` package contains a `perl` executable it can be referenced as `lib.getExe pkgs.perl` (which points to `${pkgs.perl}/bin/perl`) within a Nix derivation that needs to execute a Perl script.
 
-The `glibc` package is a deliberate single exception to the “binaries first” convention. The `glibc` has `libs` as its first output allowing the libraries provided by `glibc` to be referenced directly (e.g. `${glibc}/lib/ld-linux-x86-64.so.2`). The executables provided by `glibc` can be accessed via its `bin` attribute (e.g. `${lib.getBin stdenv.cc.libc}/bin/ldd`).
+The `glibc` package is a deliberate single exception to the “binaries first” convention. The `glibc` has `libs` as its first output allowing the libraries provided by `glibc` to be referenced directly (e.g. `${glibc}/lib/ld-linux-x86-64.so.2`). The executables provided by `glibc` can be accessed via `lib.getExe' stdenv.cc.libc "ldd"` (which points to `${lib.getBin stdenv.cc.libc}/bin/ldd`).
 
 The reason for why `glibc` deviates from the convention is because referencing a library provided by `glibc` is a very common operation among Nix packages. For instance, third-party executables packaged by Nix are typically patched and relinked with the relevant version of `glibc` libraries from Nix packages (please see the documentation on [patchelf](https://github.com/NixOS/patchelf) for more details).
 

lib/types.nix

@@ -916,7 +916,8 @@ rec {
 
   /**
     A path that is contained in the Nix store. This can be a top-level store
-    path like `pkgs.hello` or a descendant like `"${pkgs.hello}/bin/hello"`.
+    path like `pkgs.hello` or a descendant like `"${pkgs.hello}/bin/hello"`,
+    (or, more simply, `lib.getExe pkgs.hello`).
   */
   pathInStore = pathWith {
     inStore = true;

nixos/doc/manual/configuration/sshfs-file-systems.section.md

@@ -70,7 +70,7 @@ For example:
 {
   options = [
     (builtins.replaceStrings [ " " ] [ "\\040" ]
-      "ssh_command=${pkgs.openssh}/bin/ssh -v -L 8080:localhost:80"
+      "ssh_command=${lib.getExe pkgs.openssh} -v -L 8080:localhost:80"
     )
   ];
 

nixos/modules/services/desktop-managers/gnome.md

@@ -82,7 +82,7 @@ The following example uses `xmonad` window manager:
     {
       wmName = "xmonad";
       wmLabel = "XMonad";
-      wmCommand = "${pkgs.haskellPackages.xmonad}/bin/xmonad";
+      wmCommand = lib.getExe pkgs.haskellPackages.xmonad;
       enableGnomePanel = false;
     }
   ];

nixos/modules/services/monitoring/prometheus/exporters.md

@@ -137,7 +137,7 @@ example:
         serviceConfig = {
           DynamicUser = false;
           ExecStart = ''
-            ${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
+            ${lib.getExe pkgs.prometheus-postfix-exporter} \
               --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
               --web.telemetry-path ${cfg.telemetryPath} \
               ${lib.concatStringsSep " \\\n  " cfg.extraFlags}

nixos/modules/services/networking/pangolin.nix

@@ -103,7 +103,7 @@ in
         };
       };
 
-      openFirewall = lib.mkEnableOption "opening TCP ports 80 and 443, and UDP port 51820 in the firewall for the Pangolin service(s)";
+      openFirewall = lib.mkEnableOption "opening TCP ports 80 and 443, and UDP ports 21820 and 51820 in the firewall for the Pangolin service(s)";
 
       baseDomain = lib.mkOption {
         type = with lib.types; nullOr str;
@@ -208,7 +208,10 @@ in
         80
         443
       ];
-      allowedUDPPorts = [ 51820 ];
+      allowedUDPPorts = [
+        21820
+        51820
+      ];
     };
 
     users = {

nixos/modules/system/boot/loader/external/external.md

@@ -7,16 +7,16 @@ Some users may prefer to create advanced workflows around managing the bootloade
 You can replace the built-in bootloader support with your own tooling using the "external" bootloader option.
 
 Imagine you have created a new package called FooBoot.
-FooBoot provides a program at `${pkgs.fooboot}/bin/fooboot-install` which takes the system closure's path as its only argument and configures the system's bootloader.
+FooBoot provides a program at `${lib.getExe' pkgs.fooboot "fooboot-install"}` which takes the system closure's path as its only argument and configures the system's bootloader.
 
 You can enable FooBoot like this:
 
 ```nix
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 {
   boot.loader.external = {
     enable = true;
-    installHook = "${pkgs.fooboot}/bin/fooboot-install";
+    installHook = lib.getExe' pkgs.fooboot "fooboot-install";
   };
 }
 ```

pkgs/README.md

@@ -767,14 +767,14 @@ For very simple tests, they can be written inline:
 
 ```nix
 # ... ,
-{ yq-go }:
+{ lib, yq-go }:
 
 buildGoModule rec {
   # …
 
   passthru.tests = {
     simple = runCommand "${pname}-test" { } ''
-      echo "test: 1" | ${yq-go}/bin/yq eval -j > $out
+      echo "test: 1" | ${lib.getExe yq-go} eval -j > $out
       [ "$(cat $out | tr -d $'\n ')" = '{"test":1}' ]
     '';
   };
@@ -850,7 +850,11 @@ stdenv.mkDerivation {
 Create `tests.nix` in the package directory:
 
 ```nix
-{ runCommand, phoronix-test-suite }:
+{
+  lib,
+  runCommand,
+  phoronix-test-suite,
+}:
 
 let
   inherit (phoronix-test-suite) pname version;
@@ -858,14 +862,14 @@ let
 in
 runCommand "${pname}-tests" { meta.timeout = 60; } ''
   # automatic initial setup to prevent interactive questions
-  ${phoronix-test-suite}/bin/phoronix-test-suite enterprise-setup >/dev/null
+  ${lib.getExe phoronix-test-suite} enterprise-setup >/dev/null
   # get version of installed program and compare with package version
-  if [[ `${phoronix-test-suite}/bin/phoronix-test-suite version` != *"${version}"*  ]]; then
+  if [[ `${lib.getExe phoronix-test-suite} version` != *"${version}"*  ]]; then
     echo "Error: program version does not match package version"
     exit 1
   fi
   # run dummy command
-  ${phoronix-test-suite}/bin/phoronix-test-suite dummy_module.dummy-command >/dev/null
+  ${lib.getExe phoronix-test-suite} dummy_module.dummy-command >/dev/null
   # needed for Nix to register the command as successful
   touch $out
 ''

pkgs/by-name/ca/calendr/package.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  fetchurl,
+  stdenvNoCC,
+  unzip,
+  nix-update-script,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "calendr";
+  version = "1.26.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://github.com/pakerwreah/Calendr/releases/download/v${finalAttrs.version}/Calendr.zip";
+    hash = "sha256-ZCwJVv0PFpgS3zrO0Ny8ireoYfCgF9ohCUAIE/3tDV4=";
+  };
+
+  nativeBuildInputs = [ unzip ];
+
+  sourceRoot = "Calendr.app";
+
+  installPhase = ''
+    mkdir -p "$out/Applications/Calendr.app"
+    cp -R . "$out/Applications/Calendr.app"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/pakerwreah/Calendr/releases/tag/v${finalAttrs.version}";
+    description = "Menu bar calendar for macOS";
+    homepage = "https://github.com/pakerwreah/Calendr";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ philocalyst ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})

pkgs/by-name/cl/clavy/package.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  git,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "clavy";
+  version = "0.1.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "rami3l";
+    repo = "clavy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9EhxUa2z0aBnvFJ/h/5xD0sG7yxEpp5F0XG5Paoj0es=";
+  };
+
+  cargoHash = "sha256-giqr84nuFh94jIQjqAxmxDiBQ68375+6TD9BQSWkYkU=";
+
+  nativeBuildInputs = [
+    git # Git2 support
+  ];
+
+  meta = {
+    description = "Input source switching daemon for macOS";
+    longDescription = ''
+      clavy (formerly claveilleur) is a simple input source switching daemon for macOS.
+      Inspired by a native Windows functionality, clavy can automatically switch the
+      current input source for you according to the current application (rather than
+      the current document). This is especially useful for polyglot users who often
+      need to switch between languages depending on the application they are using.
+    '';
+    homepage = "https://github.com/rami3l/clavy";
+    changelog = "https://github.com/rami3l/clavy/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "clavy";
+    maintainers = with lib.maintainers; [ philocalyst ];
+    platforms = lib.platforms.darwin;
+  };
+})

pkgs/by-name/co/codexbar/package.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "codexbar";
-  version = "0.65.0";
+  version = "0.76.0";
   __structuredAttrs = true;
   strictDeps = true;
 
   src = fetchurl {
     url = "https://github.com/steipete/CodexBar/releases/download/v${finalAttrs.version}/CodexBar-macos-universal-${finalAttrs.version}.zip";
-    hash = "sha256-z4/RfA+1T0h1+qiwndnexwXUIPRn8g01zZP3TMzlOLQ=";
+    hash = "sha256-abKC78odg8FNhK1nzsW55PmM/qHORuAO+QJ5LsWCp6Q=";
   };
 
   sourceRoot = ".";

pkgs/by-name/fn/fnox/package.nix

@@ -15,7 +15,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fnox";
-  version = "1.36.0";
+  version = "1.39.0";
 
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "jdx";
     repo = "fnox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-md01KJsbDxdjjgPLKpwNwfK3LeiY7Ds+lUM1Q8inIxQ=";
+    hash = "sha256-YNOKD9cW1ULn/WedvBF9aS/UKOpnDW74d24YkNO843w=";
   };
 
-  cargoHash = "sha256-m8H4HrWSu9FF3gBDlQ1Ytl3U3UK9zpenXxHIAdlcRgo=";
+  cargoHash = "sha256-8Lbl2e4tqePYjKUXbnTqmzvX1+/ETzSTul554Zddbsw=";
 
   nativeBuildInputs = [
     perl

pkgs/by-name/qu/quickwit/package.nix

@@ -83,7 +83,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   env = {
     RUSTFLAGS = "--cfg tokio_unstable";
 
-    CARGO_PROFILE_RELEASE_LTO = "fat";
     CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
 
     # needed for internal protobuf c wrapper library
@@ -101,7 +100,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Sub-second search & analytics engine on cloud storage";
     homepage = "https://quickwit.io/";
-    license = lib.licenses.agpl3Only;
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ happysalada ];
     platforms = lib.platforms.all;
     mainProgram = "quickwit";

pkgs/by-name/st/stakk/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "stakk";
-  version = "3.0.3";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "glennib";
     repo = "stakk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DG9OaavOpj69ZElCJ3JQcuvRgknPvbbHTGzFDi0xLzg=";
+    hash = "sha256-Wu7qyGF+FY1j6tx24jCs9wi+MtdmZEHOMioWqUXLPek=";
   };
 
-  cargoHash = "sha256-STjpYoOVQDLHtgnwKAJ/xl+yqYNiYO5J/KRs1OBVkAg=";
+  cargoHash = "sha256-Mxd/DVXFP5YarR3HuV8d6eFW9Dma0qdwC1DlD1vLGO4=";
 
   useNextest = true;
   # The forgejo transport tests build a reqwest client, which needs a CA bundle.

pkgs/by-name/um/umbriel/package.nix

@@ -31,7 +31,7 @@
 }:
 stdenv.mkDerivation {
   pname = "umbriel";
-  version = "0-unstable-2026-10-06";
+  version = "0-unstable-2026-10-16";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -40,8 +40,8 @@ stdenv.mkDerivation {
     owner = "noctalia-dev";
     repo = "umbriel";
     # No tagged releases yet
-    rev = "9091e3feb75473f38a6cc300ea99f03ad0b2b6e8";
-    hash = "sha256-YwWujqwEAN2uw+zYeu6G8DQlEq4WjZhTAFFAjRQuALk=";
+    rev = "5cea311e7e7d6eba3ea41f5c4ca826971340f7cc";
+    hash = "sha256-gzJplsRdXQLosa6joO3jFHN18GivNcYHc1zsw/z2bCo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ve/versitygw/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "versitygw";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "versity";
     repo = "versitygw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fnmhA3Et3rF0GgRdV41rdTrBZCh2b8dvRYTATaqDb18=";
+    hash = "sha256-Ike6iFIRAb8ENjNp+jl8joP0bnei7AEaNvZFlosB3n0=";
   };
 
-  vendorHash = "sha256-HyDY6tTDvEDQI85Z4SGb11oDPTicnp8TR1sH7n7Bbcg=";
+  vendorHash = "sha256-/dGRcQr/XgZV2h8Eju2/Reo3W6cBuYS2gDv/FddQ8ow=";
 
   excludedPackages = [
     # depends on cgo/cuda
@@ -47,6 +47,10 @@ buildGoModule (finalAttrs: {
 
         # requires extended attributes
         "^TestObjectPublishLockHonorsContextWhileWaiting$"
+        "^TestFsyncPutObject"
+        "^TestFsyncFailureFailsThePut$"
+        "^TestListObjectsV2ContinuationTokenEcho$"
+        "^TestObjectLockModeNoneRejectsConditionalWrites$"
         "/xattr$"
       ];
     in

pkgs/by-name/ze/zennotes-desktop/package.nix

@@ -13,14 +13,14 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "zennotes-desktop";
-  version = "2.64.0";
-  npmDepsHash = "sha256-y7tEeV9F54LnHWswPyx01zvUxVgNkWWvIXe0qCVh9do=";
+  version = "2.70.0";
+  npmDepsHash = "sha256-tEr7+dWpnVRUhdWEH0d0t36bUs/uxBGkprv6837Fa4c=";
 
   src = fetchFromGitHub {
     owner = "ZenNotes";
     repo = "zennotes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pTUPAzPB2KUzUS7pzxBhwQiVh/rMF5H0nvq3CX4GWfY=";
+    hash = "sha256-aU+Z3KRkqkCRft7bUxscv3UCKtQuTSZQsxViGM3EoT8=";
   };
 
   npmWorkspace = "apps/desktop";

pkgs/development/misc/resholve/README.md

@@ -60,14 +60,14 @@ resholve.mkDerivation rec {
   dontBuild = true;
 
   installPhase = ''
-    sed -i '2i GOSS_PATH=${goss}/bin/goss' extras/dgoss/dgoss
+    sed -i '2i GOSS_PATH=${lib.getExe goss}' extras/dgoss/dgoss
     install -D extras/dgoss/dgoss $out/bin/dgoss
   '';
 
   solutions = {
     default = {
       scripts = [ "bin/dgoss" ];
-      interpreter = "${bash}/bin/bash";
+      interpreter = lib.getExe bash;
       inputs = [
         coreutils
         gnused
@@ -107,7 +107,7 @@ trivial, so I'll also link to some real-world examples:
     resholve.writeScript "name"
       {
         inputs = [ file ];
-        interpreter = "${bash}/bin/bash";
+        interpreter = lib.getExe bash;
       }
       ''
         echo "Hello"
@@ -117,7 +117,7 @@ trivial, so I'll also link to some real-world examples:
     resholve.writeScriptBin "name"
       {
         inputs = [ file ];
-        interpreter = "${bash}/bin/bash";
+        interpreter = lib.getExe bash;
       }
       ''
         echo "Hello"
@@ -134,6 +134,7 @@ trivial for now. If you have a real usage that you find helpful, please PR it.
 
 ```nix
 {
+  lib,
   stdenv,
   resholve,
   module1,
@@ -149,7 +150,7 @@ stdenv.mkDerivation {
     install conjure.sh $out/bin/conjure.sh
     ${resholve.phraseSolution "conjure" {
       scripts = [ "bin/conjure.sh" ];
-      interpreter = "${bash}/bin/bash";
+      interpreter = lib.getExe bash;
       inputs = [ module1 ];
       fake = {
         external = [
@@ -307,26 +308,26 @@ do it piecemeal:
 
 ```nix
 {
-  # --execer 'cannot:${openssl.bin}/bin/openssl can:${openssl.bin}/bin/c_rehash'
+  # --execer 'cannot:${lib.getExe openssl} can:${lib.getExe' openssl "c_rehash"}'
   execer = [
     /*
       This is the same verdict binlore will
       come up with. It's a no-op just to demo
       how to fiddle lore via the Nix API.
     */
-    "cannot:${openssl.bin}/bin/openssl"
+    "cannot:${lib.getExe openssl}"
     # different verdict, but not used
-    "can:${openssl.bin}/bin/c_rehash"
+    "can:${lib.getExe' openssl "c_rehash"}"
   ];
 
-  # --wrapper '${gnugrep}/bin/egrep:${gnugrep}/bin/grep'
+  # --wrapper '${lib.getExe' gnugrep "egrep"}:${lib.getExe gnugrep}'
   wrapper = [
     /*
       This is the same verdict binlore will
       come up with. It's a no-op just to demo
       how to fiddle lore via the Nix API.
     */
-    "${gnugrep}/bin/egrep:${gnugrep}/bin/grep"
+    "${lib.getExe' gnugrep "egrep"}:${lib.getExe gnugrep}"
   ];
 }
 ```

pkgs/development/python-modules/jupyter-server-fileid/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "jupyter-server-fileid";
-  version = "0.9.3";
+  version = "0.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
     repo = "jupyter_server_fileid";
     tag = "v${version}";
-    hash = "sha256-ob7hnqU7GdaDHEPF7+gwkmsboKZgiiLzzwxbBUwYHYo=";
+    hash = "sha256-Kt8CGO09NKTs7I5QJjzRdjeFJ1OJNwEQH2/2lPLPhUA=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/pyreqwest/default.nix

@@ -20,19 +20,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyreqwest";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MarkusSintonen";
     repo = "pyreqwest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RocoYS9neiYaG/Ud6wC7+S6vA6jmtKAGNQlwlbDAouM=";
+    hash = "sha256-vUjjOxNt6Rsjm29wqL0bd9xG9XJ7fzihUpbG6sjcQTE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-tdekIkztrLwOJA3JzoDYqhihtrnjo2Gf6xXZDZQu9fY=";
+    hash = "sha256-ru2xt9EpWFgtT9CtOkPGzG37vaMWDwpg8am5069TUFM=";
   };
 
   build-system = [