Merge master into staging-nixos

2026-08-25 17:55:21 +00:00 · 2026-08-20 12:09:51 +00:00
parent b70b4ff443 7af591c43c
commit 6d1792e9dc
13 changed files with 154 additions and 79 deletions
--- a/pkgs/by-name/ei/eilmeldung/package.nix
+++ b/pkgs/by-name/ei/eilmeldung/package.nix
@@ -41,11 +41,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    sqlite
  ];

-  BINDGEN_EXTRA_CLANG_ARGS = lib.concatStringsSep " " [
-    "-I${lib.getDev glib}/include/glib-2.0"
-    "-I${lib.getLib glib}/lib/glib-2.0/include/"
-  ];
-
  passthru.updateScript = nix-update-script { };

  doInstallCheck = true;
--- a/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
+++ b/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-assistant-matter-hub";
-  version = "2.0.54";
+  version = "2.0.55";

  src = fetchFromGitHub {
    owner = "RiDDiX";
    repo = "home-assistant-matter-hub";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ATEiIlhBLca2eNn6fe9zvg0RBJmzHbjsBTbLZfa8xPg=";
+    hash = "sha256-jVLLJ+1Of3/0qaHKJMqse5NbQo3maSu8J2KasGDkwv8=";
  };

  # The bundled cli.js imports transitive dependencies (e.g. @noble/curves)
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@@ -41,13 +41,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "peergos";
-  version = "1.30.0";
+  version = "1.31.0";

  src = fetchFromGitHub {
    owner = "Peergos";
    repo = "web-ui";
    rev = "v${version}";
-    hash = "sha256-lxxOPS/G+dNcdr0pnF/5KHLb/isrL759YT3tRAOn7Yw=";
+    hash = "sha256-axiedPKId1OmQvYqKiShI7rgWEJ+6zMcTRSuChKuPcw=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/ra/radicale/package.nix
+++ b/pkgs/by-name/ra/radicale/package.nix
@@ -41,6 +41,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    waitress
  ];

+  # skip tests which try to measure how long something takes; makes the build fail sometimes
+  disabledTests = [ "delay" ];
+
  passthru.tests = {
    inherit (nixosTests) radicale;
  };
--- a/pkgs/by-name/wa/wails/package.nix
+++ b/pkgs/by-name/wa/wails/package.nix
@@ -16,13 +16,13 @@

 buildGoModule (finalAttrs: {
  pname = "wails";
-  version = "2.14.0";
+  version = "2.15.0";

  src = fetchFromGitHub {
    owner = "wailsapp";
    repo = "wails";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+aCQgj3m9PnRVAib7fvJuXvZs30GueaVs+17bFMfgGY=";
+    hash = "sha256-/0GJ0RVBxuPTUqSuoZ8pLi1E2dR9n1n3aPlUKjpFVJw=";
  };

  sourceRoot = "${finalAttrs.src.name}/v2";
--- a/pkgs/by-name/ze/zellij-unwrapped/package.nix
+++ b/pkgs/by-name/ze/zellij-unwrapped/package.nix
@@ -11,6 +11,7 @@
  writableTmpDirAsHomeHook,
  versionCheckHook,
  nix-update-script,
+  withWebServer ? true,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
@@ -30,6 +31,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
  postPatch = ''
    substituteInPlace Cargo.toml \
      --replace-fail ', "vendored_curl"' ""
+  ''
+  + lib.optionalString (!withWebServer) ''
+    substituteInPlace Cargo.toml \
+      --replace-fail ', "web_server_capability"' ""
  '';

  cargoHash = "sha256-966FpfSsF9I10SrYe3+YNsfM2kLLv+gd0/Aw8vLp4Lk=";
--- a/pkgs/development/compilers/graalvm/community-edition/graaljs/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graaljs/hashes.nix
@@ -1,18 +1,18 @@
 # Generated by update.sh script
 {
-  "version" = "25.0.3";
+  "version" = "25.2.4";
  "hashes" = {
-    "aarch64-darwin" = {
-      sha256 = "0yga0mkk6mnl8fw8agiazyd4ggyxm48wq18r0garpd46bdgm92s2";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graaljs-community-25.0.3-macos-aarch64.tar.gz";
-    };
    "aarch64-linux" = {
-      sha256 = "0g6hr73zq36wnm0fi03pg6ycad5ccjqav6wjrhzdkkq8x8mjy712";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graaljs-community-25.0.3-linux-aarch64.tar.gz";
+      sha256 = "0xj6h1sxawkg7ypxp7xmc99mzyh28q5wyzjcncr4bk9z47yd2ni3";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graaljs-community-25.2.4-linux-aarch64.tar.gz";
    };
    "x86_64-linux" = {
-      sha256 = "0naxhzwd2ikgxkyhajyqn3cg38y2wf8zcffwyw9ylvvddc167hdz";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graaljs-community-25.0.3-linux-amd64.tar.gz";
+      sha256 = "06lg9dyxxqbi4v1xnisjpy6n4w4als7xq312bm0gx2wz0b9j5d1c";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graaljs-community-25.2.4-linux-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "0kamd97f04n32fjxnhrjz5w3bn2gpai2sszss1682qrj2b3cgm4y";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graaljs-community-25.2.4-macos-aarch64.tar.gz";
    };
  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/graalnodejs/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalnodejs/hashes.nix
@@ -1,18 +1,18 @@
 # Generated by update.sh script
 {
-  "version" = "25.0.3";
+  "version" = "25.2.4";
  "hashes" = {
-    "aarch64-darwin" = {
-      sha256 = "11dwhbjdc683kryfqi2mpr2xc4nlhnx2k0sxgz3f7sgrxnvfpwsk";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graalnodejs-community-25.0.3-macos-aarch64.tar.gz";
-    };
    "aarch64-linux" = {
-      sha256 = "1lywl9qr5dmyjsp51zsk5mr1py7fyy1idlxbqf972a1fz9z35hw3";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graalnodejs-community-25.0.3-linux-aarch64.tar.gz";
+      sha256 = "0y5n2c3pz5fvrdmmi5iply1gk3wmvb7d7i33vrg1x0lbv0fbqjfv";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graalnode24-community-25.2.4-linux-aarch64.tar.gz";
    };
    "x86_64-linux" = {
-      sha256 = "1h3m0vyhfx2dw137czh3afm399idf4i013zg3b3k9zawcab77pwn";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graalnodejs-community-25.0.3-linux-amd64.tar.gz";
+      sha256 = "12jjgc1j51s9l5n0rz5grfh4d1px3gash1w19806mqa8wyxkj3nn";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graalnode24-community-25.2.4-linux-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "1wm7wdim18vaknkxnjgxg981dkpb6zr5qjwaq0i3j0fqlpq48sp8";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graalnode24-community-25.2.4-macos-aarch64.tar.gz";
    };
  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
@@ -1,18 +1,18 @@
 # Generated by update.sh script
 {
-  "version" = "25.0.3";
+  "version" = "25.2.4";
  "hashes" = {
-    "aarch64-darwin" = {
-      sha256 = "02nhy9srky7yasqxqc9pqa3cmsln0ln4k07jr47xdb0zslbyfm10";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-community-25.0.3-macos-aarch64.tar.gz";
-    };
    "aarch64-linux" = {
-      sha256 = "0kqd7a21wxrkmb6yqldz3g84zzdzh7blhda2dln5yligzqc761qy";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-community-25.0.3-linux-aarch64.tar.gz";
+      sha256 = "1xb4z42xc8962sz3ib8dg8h3fyp5xkdav2f1vs28259qidyfk9fx";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.2.4/graalpy3.12-community-25.2.4-linux-aarch64.tar.gz";
    };
    "x86_64-linux" = {
-      sha256 = "1pj9dmk2wpihsakzclmyb5jf4r4dhmdp55p04gyi6xv8ksiv0zz2";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-community-25.0.3-linux-amd64.tar.gz";
+      sha256 = "10mf20gs18v6rca1xmh6xzfj707pahr76m3k0wwxwjvidcx31bwq";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.2.4/graalpy3.12-community-25.2.4-linux-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "0yrmy4wczdf6h2m2x5vsccwmi2pcc4l6qrmr83v6kkk06rqq58bn";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.2.4/graalpy3.12-community-25.2.4-macos-aarch64.tar.gz";
    };
  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
@@ -1,18 +1,18 @@
 # Generated by update.sh script
 {
-  "version" = "25.0.2";
+  "version" = "25.2.4";
  "hashes" = {
-    "aarch64-darwin" = {
-      sha256 = "0pv3c49va6vyvx2lzj305ss39mkaddx8fmfrafifflz6x2w1y82h";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_macos-aarch64_bin.tar.gz";
-    };
    "aarch64-linux" = {
-      sha256 = "0waa7395f53lrg2my43ywr8bj7aczwc8prap2wx4n2ix4aghsn5l";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-aarch64_bin.tar.gz";
+      sha256 = "1drhs99b8jfxycpf34f4xwzbvqb9fiwvzf966bdsxf91rmz6ya12";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-aarch64_bin.tar.gz";
    };
    "x86_64-linux" = {
-      sha256 = "1w3ac0cl9d2ja98klyq5f1hp6j9ixx7q5jx0n2v06kfsiwf7kgp0";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-x64_bin.tar.gz";
+      sha256 = "0bll9f61nk1rnpw3fdddg93dhb47gry9a2bzcznz55maivg8jjiz";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-x64_bin.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "1yivvlxghh2gb62f2394ih6rpylilhhmmj91hqdyazchz3zk0wsh";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_macos-aarch64_bin.tar.gz";
    };
  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@@ -23,6 +23,8 @@ trap 'rm -rf "$tmpfile"' EXIT

 info() { echo "[INFO] $*"; }

+die() { echo "[ERROR] $*" >&2; exit 1; }
+
 echo_file() { echo "$@" >> "$tmpfile"; }

 verlte() {
@@ -35,45 +37,101 @@ readonly nixpkgs=../../../../..

 mkdir -p "$product"

-declare -r -A update_urls=(
-  [graalvm-ce]="https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest"
-  [graaljs]="https://api.github.com/repos/oracle/graaljs/releases/latest"
-  [graalnodejs]="https://api.github.com/repos/oracle/graaljs/releases/latest"
-  [graalpy]="https://api.github.com/repos/oracle/graalpython/releases/latest"
-  [truffleruby]="https://api.github.com/repos/truffleruby/truffleruby/releases/latest"
+declare -r -A repos=(
+  [graalvm-ce]="graalvm/graalvm-ce-builds"
+  [graaljs]="oracle/graaljs"
+  [graalnodejs]="oracle/graaljs"
+  [graalpy]="oracle/graalpython"
+  [truffleruby]="truffleruby/truffleruby"
 )
+readonly repo="${repos[$product]}"
+
+auth_args=()
+if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+  auth_args+=(-u ":${GITHUB_TOKEN}")
+fi
+
+api_url() { echo "https://api.github.com/repos/${repo}/$1"; }
+
+# Unauthenticated requests are capped at 60/hour, so a rate limit is the most
+# likely failure here. `-f` discards the response body, so without an explicit
+# `die` the script would abort under `set -e` printing nothing at all.
+gh_api() {
+  curl -fsS "${auth_args[@]}" "$(api_url "$1")" \
+    || die "GitHub API request for '${repo}/$1' failed. Set GITHUB_TOKEN if you are being rate limited."
+}
+
+gh_status() { curl -sS -o /dev/null -w '%{http_code}' "${auth_args[@]}" "$(api_url "$1")"; }

 current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A "graalvmPackages.${product}.version" --json | jq -r)"
 readonly current_version

+# Releases are tagged `jdk-<version>` up to 25.0.2 and `graal-<version>` from
+# the 25.1 innovation stream on, so an explicit VERSION has to try both. Check
+# the status code rather than curl's exit status, so that a tag which does not
+# exist is not reported the same way as a rate limit.
+resolve_tag() {
+  local candidate code
+  for candidate in "graal-$1" "jdk-$1"; do
+    code="$(gh_status "releases/tags/${candidate}")"
+    case "$code" in
+      200)
+        echo "$candidate"
+        return 0
+        ;;
+      404) ;;
+      *) die "GitHub API returned HTTP $code for tag '$candidate'. Set GITHUB_TOKEN if you are being rate limited." ;;
+    esac
+  done
+  die "Neither 'graal-$1' nor 'jdk-$1' is a release of '$repo'."
+}
+
+# `releases/latest` already carries the asset list, so read the tag out of it
+# instead of asking for the same release a second time.
 if [[ -z "${VERSION:-}" ]]; then
-  gh_version="$(curl \
-      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
-      -s "${update_urls[$product]}" | \
-      jq --raw-output .tag_name)"
-  new_version="${gh_version//jdk-/}"
-  new_version="${new_version//graal-/}"
+  release_json="$(gh_api releases/latest)"
+  tag="$(jq --raw-output .tag_name <<< "$release_json")"
 else
-  new_version="$VERSION"
+  tag="$(resolve_tag "$VERSION")"
+  release_json="$(gh_api "releases/tags/${tag}")"
 fi
+readonly release_json tag
+new_version="${tag//jdk-/}"
+new_version="${new_version//graal-/}"
 readonly new_version

 info "Current version: $current_version"
 info "New version: $new_version"
 if verlte "$new_version" "$current_version"; then
+  if [[ "$new_version" != "$current_version" ]]; then
+    # A `jdk-25.0.x` release published after `graal-25.2.4` sorts lower than the
+    # packaged version, so it would silently look up-to-date. Say so instead.
+    info "WARNING: upstream '$tag' sorts below the packaged $current_version."
+    info "WARNING: upstream may have switched release trains. Check manually."
+  fi
  info "$product $current_version is up-to-date."
-  [[ -z "${FORCE:-}" ]]  && exit 0
+  if [[ -z "${FORCE:-}" ]]; then
+    exit 0
+  fi
 else
  info "$product $current_version is out-of-date. Updating..."
 fi

-# Make sure to get the `-community` versions!
-declare -r -A products_urls=(
-  [graalvm-ce]="https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${new_version}/graalvm-community-jdk-${new_version}_@platform@_bin.tar.gz"
-  [graaljs]="https://github.com/oracle/graaljs/releases/download/graal-${new_version}/graaljs-community-${new_version}-@platform@.tar.gz"
-  [graalnodejs]="https://github.com/oracle/graaljs/releases/download/graal-${new_version}/graalnodejs-community-${new_version}-@platform@.tar.gz"
-  [graalpy]="https://github.com/oracle/graalpython/releases/download/graal-${new_version}/graalpy-community-${new_version}-@platform@.tar.gz"
-  [truffleruby]="https://github.com/truffleruby/truffleruby/releases/download/graal-${new_version}/truffleruby-community-${new_version}-@platform@.tar.gz"
+# Make sure to get the `-community` versions! The file names cannot be built
+# from the GraalVM version alone, because they embed a component version it
+# does not give us: graalvm-community-jdk-25i2-25.0.4, graalnode24,
+# graalpy3.12. Match the release's own asset list instead. Anchoring the
+# version right after `-community-` also excludes the `-jvm-` variants.
+# graalvm-ce cannot be anchored that way, because its file name carries the
+# JDK version and not the GraalVM one, so the match below has to be checked
+# for ambiguity.
+readonly version_re="${new_version//./\\.}"
+declare -r -A asset_patterns=(
+  [graalvm-ce]="^graalvm-community-jdk-.*_@platform@_bin\\.tar\\.gz$"
+  [graaljs]="^graaljs-community-${version_re}-@platform@\\.tar\\.gz$"
+  [graalnodejs]="^graalnode(js|[0-9]+)-community-${version_re}-@platform@\\.tar\\.gz$"
+  [graalpy]="^graalpy[0-9.]*-community-${version_re}-@platform@\\.tar\\.gz$"
+  [truffleruby]="^truffleruby-community-${version_re}-@platform@\\.tar\\.gz$"
 )

 # Argh, this is really inconsistent...
@@ -97,11 +155,26 @@ info "Generating '$hashes_nix' file for '$product' $new_version. This will take
 echo_file "# Generated by $(basename $0) script"
 echo_file "{"
 echo_file "  \"version\" = \"$new_version\";"
-url="${products_urls["${product}"]}"
+readonly pattern="${asset_patterns[$product]}"
 echo_file "  \"hashes\" = {"
 for nix_platform in "${!platforms[@]}"; do
  product_platform="${platforms[$nix_platform]}"
-  args=("${url//@platform@/$product_platform}")
+  asset_re="${pattern//@platform@/$product_platform}"
+  mapfile -t urls < <(jq --raw-output --arg re "$asset_re" \
+    '.assets[] | select(.name | test($re)) | .browser_download_url' \
+    <<< "$release_json")
+  # Never skip a platform, and never guess between candidates. meta.platforms is
+  # derived from the attribute names in hashes.nix, so dropping one here silently
+  # removes it from the package; and vm-22.3.1 shipped java11, java17 and java19
+  # assets side by side, so taking the first match could pin a different JDK per
+  # platform.
+  if ((${#urls[@]} == 0)); then
+    die "No asset matches '$asset_re' in release '$tag'. Upstream naming has probably changed; fix asset_patterns[$product] rather than losing $nix_platform."
+  elif ((${#urls[@]} > 1)); then
+    die "${#urls[@]} assets match '$asset_re' in release '$tag': ${urls[*]}. Make asset_patterns[$product] more specific."
+  fi
+  url="${urls[0]}"
+  args=("$url")
  # Get current hashes to skip derivations already in /nix/store to reuse cache when the version is the same
  # e.g.: when adding a new product and running this script with FORCE=1
  if [[ "$current_version" == "$new_version" ]] && \
@@ -110,14 +183,13 @@ for nix_platform in "${!platforms[@]}"; do
  else
      info "Hash in '$product' for '$nix_platform' not found. Re-downloading it..."
  fi
-  if hash="$(nix-prefetch-url "${args[@]}")"; then
+  if ! hash="$(nix-prefetch-url "${args[@]}")"; then
+    die "Could not download '$url' for '$nix_platform'."
+  fi
 echo_file "    \"$nix_platform\" = {"
 echo_file "      sha256 = \"$hash\";"
-echo_file "      url = \"${url//@platform@/${product_platform}}\";"
+echo_file "      url = \"${url}\";"
 echo_file "    };"
-  else
-      info "Error while downloading '$product' for '$nix_platform'. Skipping it..."
-  fi
 done
 echo_file "  };"
 echo_file "}"
--- a/pkgs/development/haskell-modules/hoogle.nix
+++ b/pkgs/development/haskell-modules/hoogle.nix
@@ -54,8 +54,6 @@ buildPackages.stdenv.mkDerivation (finalAttrs: {
  # thus probably intend to substitute it.
  allowSubstitutes = true;

-  passAsFile = [ "buildCommand" ];
-
  buildCommand = ''
    ${
      let
@@ -123,6 +121,8 @@ buildPackages.stdenv.mkDerivation (finalAttrs: {
    chmod +x $out/bin/hoogle
  '';

+  __structuredAttrs = true;
+
  passthru = {
    isHaskellLibrary = false; # for the filter in ./with-packages-wrapper.nix

--- a/pkgs/development/python-modules/quart/default.nix
+++ b/pkgs/development/python-modules/quart/default.nix
@@ -30,14 +30,14 @@

 buildPythonPackage rec {
  pname = "quart";
-  version = "0.21.0";
+  version = "0.22.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pallets";
    repo = "quart";
    tag = version;
-    hash = "sha256-BrZtknO8Xne5r4CENF0Uz8NVc8Zc+Yu35spvPw7qZ/w=";
+    hash = "sha256-1rwkrxxk79EB8gkeXNvT2hR37it4H6RqewPxYny/VIs=";
  };

  build-system = [ flit-core ];