staging-next 2026-08-07 (#550199)

2026-08-25 17:55:21 +00:00 · 2026-08-12 06:04:51 +00:00
parent b2058d21fb 88bf7d2dff
commit 867dcbc30b
141 changed files with 1987 additions and 735 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11289,6 +11289,11 @@
    github = "HigherOrderLogic";
    githubId = 73709188;
  };
+  highghlow = {
+    name = "Alex Kravchenko";
+    github = "unhighghlow";
+    githubId = 132668972;
+  };
  hirenashah = {
    email = "hiren@hiren.io";
    github = "hirenashah";
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -259,27 +259,7 @@ in

  options.systemd = {

-    package = mkPackageOption pkgs "systemd" { } // {
-      # audit 4.2 rejects overlong values (max 15 bytes) for the kernel comm.
-      # systemd attempts to send the full 19 bytes of "systemd-update-utmp",
-      # and the systemd-update-utmp service fails to start. this patch shortens
-      # the kernel comm entry to "update-utmp".
-      # TODO: revert on staging when updating to audit 4.2.1
-      # original commit: https://github.com/linux-audit/audit-userspace/commit/d7ea98263ebdb974b383a4057856a5ec339776fc
-      # switch to truncate: https://github.com/linux-audit/audit-userspace/commit/d7ea98263ebdb974b383a4057856a5ec339776fc
-      # systemd pr: https://github.com/systemd/systemd/pull/43144
-      apply =
-        pkg:
-        pkg.overrideAttrs (prevAttrs: {
-          patches = prevAttrs.patches or [ ] ++ [
-            (pkgs.fetchpatch {
-              name = "systemd-update-utmp-shorten-comm.patch";
-              url = "https://github.com/systemd/systemd/commit/b8968c492108506952ab2748c4a44ce32fc9477c.patch";
-              hash = "sha256-d0rMssj1+cDw3+KOk8ecjqIIuBhjDixIH+7MJfC+I+M=";
-            })
-          ];
-        });
-    };
+    package = mkPackageOption pkgs "systemd" { };

    enableStrictShellChecks = mkEnableOption "" // {
      description = ''
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1840,6 +1840,7 @@ in
  userborn-static = runTest ./userborn-static.nix;
  ustreamer = runTest ./ustreamer.nix;
  utils = import ./utils { inherit runTest; };
+  utmp = runTest ./utmp.nix;
  uwsgi = runTest ./uwsgi.nix;
  v2ray = runTest ./v2ray.nix;
  varnish80 = runTest {
--- a/nixos/tests/shadow/system.nix
+++ b/nixos/tests/shadow/system.nix
@@ -4,6 +4,7 @@ let
  controllerPython = pkgs.python3.withPackages (ps: [
    ps.flaky
    ps.jc
+    ps.passlib
    ps.pytest
    ps.pytest-mh
    ps.pytest-ticket
@@ -35,6 +36,7 @@ in
        environment.systemPackages = with pkgs; [
          shadow
          expect
+          vim
        ];

        users.defaultUserShell = "/bin/sh";
--- a/nixos/tests/utmp.nix
+++ b/nixos/tests/utmp.nix
@@ -0,0 +1,65 @@
+{ lib, ... }:
+{
+
+  name = "utmp";
+
+  meta = {
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+
+  nodes = {
+    machine = {
+      imports = [ ./common/user-account.nix ];
+      security.audit.enable = true;
+      security.auditd.enable = true;
+    };
+  };
+
+  testScript = ''
+    import re
+
+    def extract_utmp_fields(line: str) -> tuple[str, str] | None:
+      m = re.match(r"^\[\d*\]\s*\[\d*\]\s*\[([^\]\s]*)\s*]\s*\[([^\]\s]*)\s*]", line)
+      if not m:
+          return None
+      return m.group(1), m.group(2)
+
+    machine.wait_for_unit("auditd.service")
+    machine.wait_for_unit("systemd-update-utmp.service")
+    machine.wait_for_file("/run/utmp")
+
+    with subtest("systemd updated utmp"):
+      utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
+      print(utmp)
+      assert extract_utmp_fields(utmp[0]) == ("~~", "reboot") # first entry is the reboot
+
+    with subtest("Test utmp entries are created by logins"):
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_until_tty_matches("1", "login: ")
+      machine.send_chars("alice\n")
+      machine.wait_until_tty_matches("1", "Password: ")
+      machine.send_chars("foobar\n")
+      machine.wait_until_succeeds("pgrep -u alice bash")
+      utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
+      print(utmp)
+      assert extract_utmp_fields(utmp[1]) == ("tty1", "alice") # second entry is alice login
+      machine.send_chars("exit\n")
+      machine.wait_until_fails("pgrep -u alice bash")
+
+    with subtest("Test utmp entries are cleaned after logout"):
+      utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
+      print(utmp)
+      assert extract_utmp_fields(utmp[1]) in [("tty1", ""), ("tty1", "LOGIN")] # tty1 previously in use by alice is now clear
+
+    with subtest("audit logs utmp system boot"):
+      audit_log = machine.succeed("ausearch -m SYSTEM_BOOT")
+      print(audit_log)
+      # audit 4.2.1 truncates too long comm entries, while systemd shortened the entry from `systemd-update-utmp` (truncated) to `update-utmp`
+      # see also:
+      # - systemd: https://github.com/systemd/systemd/pull/43144
+      # - audit: https://github.com/linux-audit/audit-userspace/commit/d7ea98263ebdb974b383a4057856a5ec339776fc
+      # accept either fix in this test
+      assert 'comm="update-utmp"' in audit_log or f'comm="{"systemd-update-utmp"[:15]}"' in audit_log
+  '';
+
+}
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -71,7 +71,7 @@ stripDirs() {
    paths=${pathsNew}

    if [ -n "${paths}" ]; then
-        echo "stripping (with command $cmd and flags $stripFlags) in $paths"
+        echo "stripping (with command $cmd and flags $stripFlags) in$paths"
        local striperr
        striperr="$(mktemp --tmpdir="$TMPDIR" 'striperr.XXXXXX')"
        # Make sure we process files only once. `strip`ping the same file through different
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -14,6 +14,16 @@ gappsWrapperArgsHook() {
        gappsWrapperArgs+=(--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE")
    fi

+    # Per the XDG Base Directories Specification, XDG_DATA_DIRS
+    # defaults to /usr/local/share/:/usr/share/ if unset.  To preserve
+    # the transparency of the wrapper, continue including these paths
+    # if XDG_DATA_DIRS is not set outside the wrapper.  This is
+    # important for programs to work properly on non-NixOS systems
+    # where these paths exist.
+    if [ -n "$GSETTINGS_SCHEMAS_PATH" ] || [ -d "${prefix:?}/share" ]; then
+        gappsWrapperArgs+=(--set-default XDG_DATA_DIRS /usr/local/share/:/usr/share/)
+    fi
+
    if [ -n "$GSETTINGS_SCHEMAS_PATH" ]; then
        gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH")
    fi
--- a/pkgs/by-name/al/alsa-plugins/package.nix
+++ b/pkgs/by-name/al/alsa-plugins/package.nix
@@ -1,6 +1,7 @@
 {
  stdenv,
  fetchurl,
+  fetchpatch,
  lib,
  pkg-config,
  alsa-lib,
@@ -21,6 +22,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-e9ioPTBOji2GoliV2Nyw7wJFqN8y4nGVnNvcavObZvI=";
  };

+  patches = [
+    (fetchpatch {
+      name = "ffmpeg-9-compatibility.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/alsa-plugins/-/raw/7f250af93b76e9b3d552af509beb8ea1356114d1/ffmpeg9.patch";
+      hash = "sha256-heAl6Ym3iYI8mhuuQpwBpc0FeFYsQZRHx4UUvqiVtBo=";
+    })
+  ];
+
  nativeBuildInputs = [ pkg-config ];

  buildInputs = [
--- a/pkgs/by-name/am/amf-headers/package.nix
+++ b/pkgs/by-name/am/amf-headers/package.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "GPUOpen-LibrariesAndSDKs";
    repo = "AMF";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-+jVYm/Zmt+1bzKnKTiClgoMRsyhqpuKZj79DvGHpPTM=";
+    sha256 = "sha256-ardO9GojOIQUnuSa2fGOCfFHI5PJYBsffCpNCh2dyRw=";
+    sparseCheckout = [ "amf/public/include" ];
  };

  installPhase = ''
--- a/pkgs/by-name/as/assimp/package.nix
+++ b/pkgs/by-name/as/assimp/package.nix
@@ -3,6 +3,9 @@
  stdenv,
  fetchFromGitHub,
  cmake,
+  pugixml,
+  rapidjson,
+  utf8cpp,
  zlib,
  nix-update-script,
 }:
@@ -23,6 +26,14 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-QWBi1pl5C76UtPhB6SmFipm9oEdnfhELMT3MqfV6oxg=";
  };

+  # assimp vendors many libraries that we have available in Nixpkgs, and offers no good way of pulling them from non-vendored sources.
+  # We thus patch the CMake declarations to do so.
+  # https://github.com/assimp/assimp/issues/5286
+  # also see:
+  # https://src.fedoraproject.org/rpms/assimp/blob/e0ca8c040bfd661b6d68551b6dc189ba33ffdac1/f/assimp-unbundle.patch
+  # https://salsa.debian.org/debian/assimp/-/tree/c60e93150d63590d671d9aab165cf259c71f5df9/debian/patches
+  patches = [ ./use-system-libraries.patch ];
+
  postPatch = ''
    # nix build sandbox does not set /var/tmp up:
    #   https://github.com/assimp/assimp/issues/6270
@@ -33,6 +44,9 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [ cmake ];

  buildInputs = [
+    pugixml
+    rapidjson
+    utf8cpp
    zlib
  ];

--- a/pkgs/by-name/as/assimp/use-system-libraries.patch
+++ b/pkgs/by-name/as/assimp/use-system-libraries.patch
@@ -0,0 +1,86 @@
+diff --git a/code/CMakeLists.txt b/code/CMakeLists.txt
+index b7b08de3b7..1c07aee928 100644
+--- a/code/CMakeLists.txt
+++ b/code/CMakeLists.txt
+@@ -1117,13 +1117,7 @@
+   hunter_add_package(pugixml)
+   find_package(pugixml CONFIG REQUIRED)
+ ELSEIF(NOT TARGET pugixml::pugixml)
+-  SET( Pugixml_SRCS
+-    ../contrib/pugixml/src/pugiconfig.hpp
+-    ../contrib/pugixml/src/pugixml.cpp
+-    ../contrib/pugixml/src/pugixml.hpp
+-  )
+-  INCLUDE_DIRECTORIES("../contrib/pugixml/src")
+-  SOURCE_GROUP( Contrib\\Pugixml FILES ${Pugixml_SRCS})
+  find_package(pugixml REQUIRED)
+ ENDIF()
+ 
+ # utf8
+@@ -1131,7 +1125,7 @@
+   hunter_add_package(utf8)
+   find_package(utf8cpp CONFIG REQUIRED)
+ ELSE()
+-  INCLUDE_DIRECTORIES("../contrib/utf8cpp/source")
+  find_package(utf8cpp REQUIRED)
+ ENDIF()
+ 
+ # polyclipping
+@@ -1287,7 +1281,8 @@
+   hunter_add_package(RapidJSON)
+   find_package(RapidJSON CONFIG REQUIRED)
+ ELSE()
+-  INCLUDE_DIRECTORIES("../contrib/rapidjson/include")
+  find_package(RapidJSON CONFIG REQUIRED)
+  include_directories(${RapidJSON_INCLUDE_DIRS})
+   ADD_DEFINITIONS( -DRAPIDJSON_HAS_STDSTRING=1)
+   option( ASSIMP_RAPIDJSON_NO_MEMBER_ITERATOR "Suppress rapidjson warning on MSVC (NOTE: breaks android build)" ON )
+   if(ASSIMP_RAPIDJSON_NO_MEMBER_ITERATOR)
+@@ -1353,7 +1348,7 @@
+   ${ASSIMP_EXPORTER_SRCS}
+ 
+   ${FBX_COMMON_SRCS}
+-  
+
+   # Third-party libraries
+   ${unzip_compile_SRCS}
+   ${Poly2Tri_SRCS}
+@@ -1497,13 +1492,11 @@
+     target_link_libraries(assimp PRIVATE ${draco_LIBRARIES})
+   endif()
+ ELSE()
+-  TARGET_LINK_LIBRARIES(assimp ${ZLIB_LIBRARIES} ${OPENDDL_PARSER_LIBRARIES})
+  TARGET_LINK_LIBRARIES(assimp PRIVATE ${ZLIB_LIBRARIES} ${OPENDDL_PARSER_LIBRARIES})
+   if (ASSIMP_BUILD_DRACO)
+     target_link_libraries(assimp ${draco_LIBRARIES})
+   endif()
+-  if(TARGET pugixml::pugixml)
+-    target_link_libraries(assimp pugixml::pugixml)
+-  endif()
+  target_link_libraries(assimp PRIVATE pugixml utf8::cpp)
+ ENDIF()
+ 
+ if(ASSIMP_ANDROID_JNIIOSYSTEM)
+@@ -1608,7 +1601,7 @@
+ 
+ # Add RT-extension library for glTF importer with Open3DGC-compression.
+ IF (RT_FOUND AND ASSIMP_IMPORTER_GLTF_USE_OPEN3DGC)
+-  TARGET_LINK_LIBRARIES(assimp rt)
+  TARGET_LINK_LIBRARIES(assimp PRIVATE rt)
+ ENDIF ()
+ 
+ IF(ASSIMP_INSTALL)
+diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
+index 362a43be05..368b52b126 100644
+--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
+@@ -263,7 +263,8 @@
+   hunter_add_package(RapidJSON)
+   find_package(RapidJSON CONFIG REQUIRED)
+ ELSE()
+-  INCLUDE_DIRECTORIES("../contrib/rapidjson/include")
+  find_package(RapidJSON CONFIG REQUIRED)
+  include_directories(${RapidJSON_INCLUDE_DIRS})
+   ADD_DEFINITIONS( -DRAPIDJSON_HAS_STDSTRING=1)
+   option( ASSIMP_RAPIDJSON_NO_MEMBER_ITERATOR "Suppress rapidjson warning on MSVC (NOTE: breaks android build)" ON )
+   if(ASSIMP_RAPIDJSON_NO_MEMBER_ITERATOR)
--- a/pkgs/by-name/at/at-spi2-core/package.nix
+++ b/pkgs/by-name/at/at-spi2-core/package.nix
@@ -29,7 +29,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "at-spi2-core";
-  version = "2.60.4";
+  version = "2.60.6";

  outputs = [
    "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Gh9bqYBZF/QfxqpoI9z4h6KR1gekJ+LVr7a136ZQcMc=";
+    hash = "sha256-qJtkqLIXqAQr3w41y/q2Kc7uNWQNunXfV4r96ap4nVc=";
  };

  nativeBuildInputs = [
@@ -79,15 +79,14 @@ stdenv.mkDerivation (finalAttrs: {
  doCheck = false;

  mesonFlags = [
-    # Provide dbus-daemon fallback when it is not already running when
-    # at-spi2-bus-launcher is executed. This allows us to avoid
-    # including the entire dbus closure in libraries linked with
-    # the at-spi2-core libraries.
-    "-Ddbus_daemon=/run/current-system/sw/bin/dbus-daemon"
+    # Allows at-spi2-bus-launcher to use dbus-daemon from PATH.
+    # This allows us to avoid including the entire dbus closure in libraries
+    # linked with the at-spi2-core libraries.
+    "-Ddbus_daemon=dbus-daemon"
  ]
  ++ lib.optionals systemdSupport [
    # Same as the above, but for dbus-broker
-    "-Ddbus_broker=/run/current-system/sw/bin/dbus-broker-launch"
+    "-Ddbus_broker=dbus-broker-launch"
  ]
  ++ lib.optionals (!systemdSupport) [
    "-Duse_systemd=false"
@@ -108,10 +107,17 @@ stdenv.mkDerivation (finalAttrs: {
  };

  postFixup = ''
-    # Cannot use wrapGAppsHook'due to a dependency cycle
-    wrapProgram $out/libexec/at-spi-bus-launcher \
-      ${lib.optionalString withDconf ''--prefix GIO_EXTRA_MODULES : "${lib.getLib dconf}/lib/gio/modules"''} \
+    busLauncherWrapperArgs=(
+      # Prefer dbus-daemon and dbus-broker-launch from system locations.
+      --prefix PATH : "/run/current-system/sw/bin:/usr/bin"
+
+      # Access to accessibility settings.
+      ${lib.optionalString withDconf ''--prefix GIO_EXTRA_MODULES : "${lib.getLib dconf}/lib/gio/modules"''}
      --prefix XDG_DATA_DIRS : ${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}
+    )
+
+    # Cannot use wrapGAppsHook'due to a dependency cycle
+    wrapProgram "$out/libexec/at-spi-bus-launcher" "''${busLauncherWrapperArgs[@]}"
  '';

  meta = {
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -30,13 +30,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "audit";
-  version = "4.2";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "linux-audit";
    repo = "audit-userspace";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-poldhsF+ccutCxK7KE/gYpxa1x3wUQJWoCwU6pGFj6A=";
+    hash = "sha256-W8VyeOYQGPAvvmQUe3F22u5ldWwIuxrVJ/sXyu0Qrl4=";
  };

  postPatch = ''
@@ -153,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
      musl = pkgsMusl.audit or null;
      static = pkgsStatic.audit or null;
      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      inherit (nixosTests) audit audit-testsuite;
+      inherit (nixosTests) audit audit-testsuite utmp;
      # Broken on a hardened kernel
      package = finalAttrs.finalPackage.overrideAttrs (previousAttrs: {
        pname = previousAttrs.pname + "-test";
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  pkg-config,
  libuuid,
  libsodium,
@@ -32,29 +31,20 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bcachefs-tools";
-  version = "1.38.8";
+  version = "1.39.1";

  src = fetchFromGitHub {
    owner = "koverstreet";
    repo = "bcachefs-tools";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9sDE7ua3WMCfV9ZbwQdAbpatv2IhvcwHzzPr+/l2au0=";
+    hash = "sha256-KJBzVbK5DL+ZK27Oyyn8vCWRQUHrIAelrex1oX+fWq4=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-F1+FeAlYSqOxeWJI8vHShpXrOZqYXjNGvty/s6f6u8w=";
+    hash = "sha256-Yb2DaFLuhAkwYED+s9SRKsjxluWoES4RSvKPKfd/kyE=";
  };

-  patches = [
-    # Fix compile-time assertion failure on big-endian
-    (fetchpatch {
-      name = "0001-bcachefs-tools-debug-copy-packed-bkey-fields-before-asserting.patch";
-      url = "https://evilpiepirate.org/git/bcachefs-tools.git/patch/?id=79f119c4cd6900ab9ea27b0aa671f68300d9d38e";
-      hash = "sha256-ACrpad93wrZOXhc73otnXBNQvyoDeZSfgtwze5nKaUE=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace Makefile \
      --replace-fail "target/release/bcachefs" "target/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/bcachefs"
@@ -113,6 +103,12 @@ stdenv.mkDerivation (finalAttrs: {
    "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER" = "${stdenv.cc.targetPrefix}cc";
  };

+  # Workaround for RISCV cross-compilation issue
+  # https://github.com/koverstreet/bcachefs-tools/issues/850
+  preBuild = lib.optionalString stdenv.hostPlatform.isRiscV ''
+    export BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS --target=riscv64-unknown-linux-gnu -march=rv64gc"
+  '';
+
  # FIXME: Try enabling this once the default linux kernel is at least 6.7
  doCheck = false; # needs bcachefs module loaded on builder

@@ -163,6 +159,5 @@ stdenv.mkDerivation (finalAttrs: {
    ];
    platforms = lib.platforms.linux;
    mainProgram = "bcachefs";
-    broken = stdenv.hostPlatform.isi686; # error: stack smashing detected
  };
 })
--- a/pkgs/by-name/bl/bluez-headers/package.nix
+++ b/pkgs/by-name/bl/bluez-headers/package.nix
@@ -11,14 +11,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bluez-headers";
-  version = "5.86";
+  version = "5.87";

  # This package has the source, because of the emulatorAvailable check in the
  # bluez function args, that causes an infinite recursion with Python on cross
  # builds.
  src = fetchurl {
    url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mfFEVAxgcFkeTFO8uXfrQmZMYrezbLNaKc9y3tM5Yh0=";
+    hash = "sha256-Jr3PLOvXMQxvWYhQYGsDfvDFFf5mCOvFTSLFDEwys18=";
  };

  dontConfigure = true;
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  meta = {
-    homepage = "https://www.bluez.org/";
+    homepage = "https://bluez.github.io/";
    description = "Official Linux Bluetooth protocol stack";
    changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
    license = with lib.licenses; [
--- a/pkgs/by-name/bl/bluez/lreadline.patch
+++ b/pkgs/by-name/bl/bluez/lreadline.patch
@@ -1,10 +1,9 @@
-# Adjusted version of https://lore.kernel.org/linux-bluetooth/20250703182908.2370130-1-hi@alyssa.is/raw
 diff --git a/Makefile.tools b/Makefile.tools
-index 2080f0978..885371de9 100644
+index 1a4e56608..a8bff6df3 100644
 --- a/Makefile.tools
 +++ b/Makefile.tools
-@@ -19,7 +19,7 @@ client_bluetoothctl_SOURCES = client/main.c \
- 					client/telephony.h client/telephony.c
+@@ -20,7 +20,7 @@ client_bluetoothctl_SOURCES = client/main.c \
+ 					client/cs.h client/cs.c
 client_bluetoothctl_LDADD = lib/libbluetooth-internal.la \
 			gdbus/libgdbus-internal.la src/libshared-glib.la \
 -			$(GLIB_LIBS) $(DBUS_LIBS) -lreadline
@@ -12,16 +11,16 @@ index 2080f0978..885371de9 100644
 endif
 
 if ZSH_COMPLETIONS
-@@ -385,7 +385,7 @@ tools_meshctl_SOURCES = tools/meshctl.c \
+@@ -389,7 +389,7 @@ tools_meshctl_SOURCES = tools/meshctl.c \
 				tools/mesh-gatt/onoff-model.c
 tools_meshctl_LDADD = gdbus/libgdbus-internal.la src/libshared-glib.la \
 				lib/libbluetooth-internal.la \
 -				$(GLIB_LIBS) $(DBUS_LIBS) -ljson-c -lreadline
 +				$(GLIB_LIBS) $(DBUS_LIBS) -ljson-c $(READLINE_LIBS)
- 
- EXTRA_DIST += tools/mesh-gatt/local_node.json tools/mesh-gatt/prov_db.json
 endif
-@@ -404,7 +404,7 @@ tools_mesh_cfgclient_SOURCES = tools/mesh-cfgclient.c \
+ 
+ bin_PROGRAMS +=  tools/mesh-cfgclient
+@@ -406,7 +406,7 @@ tools_mesh_cfgclient_SOURCES = tools/mesh-cfgclient.c \
 				mesh/crypto.h mesh/crypto.c
 
 tools_mesh_cfgclient_LDADD = lib/libbluetooth-internal.la src/libshared-ell.la \
@@ -30,7 +29,7 @@ index 2080f0978..885371de9 100644
 
 bin_PROGRAMS +=  tools/mesh-cfgtest
 
-@@ -512,7 +512,7 @@ noinst_PROGRAMS += tools/btmgmt tools/obex-client-tool tools/obex-server-tool \
+@@ -489,7 +489,7 @@ noinst_PROGRAMS += tools/btmgmt tools/obex-client-tool tools/obex-server-tool \
 tools_obex_client_tool_SOURCES = $(gobex_sources) $(btio_sources) \
 						tools/obex-client-tool.c
 tools_obex_client_tool_LDADD = lib/libbluetooth-internal.la \
@@ -39,7 +38,7 @@ index 2080f0978..885371de9 100644
 
 tools_obex_server_tool_SOURCES = $(gobex_sources) $(btio_sources) \
 						tools/obex-server-tool.c
-@@ -523,16 +523,16 @@ tools_bluetooth_player_SOURCES = tools/bluetooth-player.c client/print.c \
+@@ -500,16 +500,16 @@ tools_bluetooth_player_SOURCES = tools/bluetooth-player.c client/print.c \
 				client/player.c
 tools_bluetooth_player_LDADD = gdbus/libgdbus-internal.la \
 				src/libshared-glib.la \
@@ -59,7 +58,7 @@ index 2080f0978..885371de9 100644
 if DEPRECATED
 noinst_PROGRAMS += attrib/gatttool
 
-@@ -542,7 +542,7 @@ attrib_gatttool_SOURCES = attrib/gatttool.c attrib/att.c attrib/gatt.c \
+@@ -519,7 +519,7 @@ attrib_gatttool_SOURCES = attrib/gatttool.c attrib/att.c attrib/gatt.c \
 				attrib/utils.c src/log.c client/display.c \
 				client/display.h
 attrib_gatttool_LDADD = lib/libbluetooth-internal.la \
@@ -68,18 +67,18 @@ index 2080f0978..885371de9 100644
 
 endif
 endif
-@@ -592,5 +592,5 @@ tools/btpclient.$(OBJEXT): src/libshared-ell.la ell/internal
+@@ -575,5 +575,5 @@ client/btpclient/btpclient.$(OBJEXT): src/libshared-ell.la ell/internal
 
- tools_btpclientctl_SOURCES = tools/btpclientctl.c client/display.c
- tools_btpclientctl_LDADD = src/libshared-mainloop.la src/libshared-glib.la \
+ client_btpclient_btpclientctl_SOURCES = client/btpclient/btpclientctl.c client/display.c
+ client_btpclient_btpclientctl_LDADD = src/libshared-mainloop.la src/libshared-glib.la \
 -				lib/libbluetooth-internal.la -lreadline
 +				lib/libbluetooth-internal.la $(READLINE_LIBS)
 endif
 diff --git a/configure.ac b/configure.ac
-index 52de7d665..f110ab103 100644
+index b011e9b0a..10f1af4af 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -338,8 +338,7 @@ AC_ARG_ENABLE(client, AS_HELP_STRING([--disable-client],
+@@ -340,8 +340,7 @@ AC_ARG_ENABLE(client, AS_HELP_STRING([--disable-client],
 AM_CONDITIONAL(CLIENT, test "${enable_client}" != "no")
 
 if (test "${enable_client}" != "no" || test "${enable_mesh}" = "yes"); then
--- a/pkgs/by-name/bl/bluez/package.nix
+++ b/pkgs/by-name/bl/bluez/package.nix
@@ -32,23 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
  inherit (bluez-headers) version src;

  patches = [
-    # https://github.com/bluez/bluez/issues/1896
-    # Remove the following 2 in the next release
-    (fetchpatch2 {
-      name = "fix-btctl-noninteractive-regression";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=b33e923b55e4d0e9d78a83cfcb541fd1f687ef54";
-      hash = "sha256-q7eN4ktw7DtdwMHHi7GU7fbvHAdMttKF1kDSWzZqa6A=";
-    })
-    (fetchpatch2 {
-      name = "fix-btctl-noninteractive-regression-2";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=21e13976f2e375d701b8b7032ba5c1b2e56c305f";
-      hash = "sha256-JrdmYiC+U0KeMP8oVg12Z8CvkMEKWBVgiiUACx0E7dY=";
-    })
-    (fetchpatch2 {
-      name = "support-libical-4.0.patch";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=e60d07255327db3fc4e3a28d7fcc792cd42c34d0";
-      hash = "sha256-1uw+5nTjh+t1/L++fRNIlQWblwDwTJifH0EvAn3dym8=";
-    })
    ./lreadline.patch
  ];

--- a/pkgs/by-name/co/coreutils/CVE-2026-56391.patch
+++ b/pkgs/by-name/co/coreutils/CVE-2026-56391.patch
--- a/pkgs/by-name/co/coreutils/CVE-2026-56392.patch
+++ b/pkgs/by-name/co/coreutils/CVE-2026-56392.patch
--- a/pkgs/by-name/co/coreutils/package.nix
+++ b/pkgs/by-name/co/coreutils/package.nix
--- a/pkgs/by-name/db/dbus/package.nix
+++ b/pkgs/by-name/db/dbus/package.nix
@@ -127,6 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.mesonEnable "launchd" stdenv.hostPlatform.isDarwin)
    (lib.mesonEnable "systemd" enableSystemd)
    "-Dselinux=disabled"
+    "-Dc_args=-Wno-error=incompatible-pointer-types"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # D-Bus defaults to launchd-activation on Darwin, but that requires the launch agent be installed. It also breaks
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.5.4",
-  "rev": "08e34c447bae34eaee3723cac61f2878b6bdf787",
-  "hash": "sha256-6xpKZKfH5/nwE2nU5kcpgITKFm3ilb1PYf9QEk+bKoM=",
-  "python_hash": "sha256-2TgMuaeAehJ5rvpfA57KTmHtTZnvfa/nl/Y9ASCwVs0="
+  "version": "1.5.5",
+  "rev": "d8cdaa33fda8df955cc76ef58a280f68f4cd43fa",
+  "hash": "sha256-vFXrMcWF5KDYYRjWZb6iJdhGnCAb6SMlSgzlcr+FQ8Y=",
+  "python_hash": "sha256-O4tYdPz6H2By7WXT9GzfyBGNeJruCkzSmTYIbiEq2dQ="
 }
--- a/pkgs/by-name/ed/eden/package.nix
+++ b/pkgs/by-name/ed/eden/package.nix
@@ -13,7 +13,8 @@
  fetchFromGitHub,
  fetchurl,
  ffmpeg-headless,
-  fmt,
+  # FIXME: unpin when upstream supports fmt 12
+  fmt_11,
  frozen-containers,
  gamemode,
  glslang,
@@ -102,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
    cubeb
    enet
    ffmpeg-headless
-    fmt
+    fmt_11
    frozen-containers
    gamemode
    httplib'
--- a/pkgs/by-name/fo/fontforge/package.nix
+++ b/pkgs/by-name/fo/fontforge/package.nix
@@ -82,7 +82,12 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  # do not use x87's 80-bit arithmetic, rounding errors result in very different font binaries
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isi686 "-msse2 -mfpmath=sse";
+  env.NIX_CFLAGS_COMPILE = lib.join " " (
+    [
+      "-Wno-error=incompatible-pointer-types"
+    ]
+    ++ lib.optional stdenv.hostPlatform.isi686 "-msse2 -mfpmath=sse"
+  );

  strictDeps = true;

--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -52,7 +52,10 @@ stdenv.mkDerivation (finalAttrs: {
    #
    # This might be a problem with our Clang, as it does not reproduce
    # with Xcode, but we just work around it by silencing the warning.
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++17-attribute-extensions";
+    NIX_CFLAGS_COMPILE = lib.join " " (
+      lib.optional stdenv.cc.isClang "-Wno-error=c2y-extensions"
+      ++ lib.optional stdenv.cc.isClang "-Wno-c++17-attribute-extensions"
+    );
  }
  // lib.optionalAttrs stdenv.hostPlatform.isGnu {
    # For test:locale_impermeability_test
--- a/pkgs/by-name/gd/gdk-pixbuf/package.nix
+++ b/pkgs/by-name/gd/gdk-pixbuf/package.nix
@@ -1,7 +1,6 @@
 {
  stdenv,
  fetchurl,
-  fetchpatch,
  nixosTests,
  fixDarwinDylibNames,
  meson,
@@ -29,7 +28,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gdk-pixbuf";
-  version = "2.44.6";
+  version = "2.44.7";

  outputs = [
    "out"
@@ -41,19 +40,12 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gdk-pixbuf/${lib.versions.majorMinor finalAttrs.version}/gdk-pixbuf-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FAwtC4mfz4U+6SsmNzydwijbzeCCCkJGaT9DKKJ0Zvo=";
+    hash = "sha256-Fy+A42JuwxUgqXBADxo2lOBHGPbCzSiF91JQ+1pplaQ=";
  };

  patches = [
    # Move installed tests to a separate output
    ./installed-tests-path.patch
-
-    # Fix loading of xpm module if built-in
-    # https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/267
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/62b8f9fd0bb3b862823cd34afce4b389fbd27569.patch";
-      hash = "sha256-ECEIt8lq/jBtDdBetErKpap2PWGav10vqCXKCpIQSyA=";
-    })
  ];

  # gdk-pixbuf-thumbnailer is not wrapped therefore strictDeps will work
--- a/pkgs/by-name/gj/gjs/package.nix
+++ b/pkgs/by-name/gj/gjs/package.nix
@@ -41,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gjs";
-  version = "1.88.0";
+  version = "1.88.1";

  outputs = [
    "out"
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MKC58zF+jmCxiW2ykDxw6LDNM9+VPDKHVYA6dRkdxFM=";
+    hash = "sha256-dnurgOZl1nLLAFY8JfCzkqnsjCmW7R1EVMaYtMLwo9k=";
  };

  patches = [
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -82,7 +82,7 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glib";
-  version = "2.88.1";
+  version = "2.88.3";

  outputs = [
    "bin"
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UauATFb26rPlBFx3TRKQrF5Mkj1Pmj2OMxI77kXBhA4=";
+    hash = "sha256-qyTSTmmN+h5Ai3vNtQj0qvyQYYWouM5y/febu9ybODs=";
  };

  patches =
--- a/pkgs/by-name/gl/glslang/package.nix
+++ b/pkgs/by-name/gl/glslang/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "glslang";
-  version = "16.3.0";
+  version = "16.4.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "glslang";
    tag = finalAttrs.version;
-    hash = "sha256-wclcJ0NfqFXSUHGVsxjn2I8XxWbrkzOB4WXqsN1XtmE=";
+    hash = "sha256-nPXwBROAj/zYccM5Lydwws13e/nW96gm+f4218sQhE8=";
  };

  outputs = [
--- a/pkgs/by-name/gn/gn/package.nix
+++ b/pkgs/by-name/gn/gn/package.nix
@@ -36,6 +36,9 @@ stdenv.mkDerivation {
    '';
  };

+  strictDeps = true;
+  __structuredAttrs = true;
+
  nativeBuildInputs = [
    ninja
    python3
--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,34 +8,49 @@
 python3Packages.buildPythonApplication rec {
  __structuredAttrs = true;
  pname = "graphify";
-  version = "0.4.23";
+  version = "0.9.28";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Graphify-Labs";
    repo = "graphify";
    tag = "v${version}";
-    hash = "sha256-QEzB1tFBqGhpmI7oudMRC1Ia0CDcm+GYt6AgxMA5zDo=";
+    hash = "sha256-iu/ARF1ylyrDUWke70kLpji4azfIeBSDSQ6uS+CKYiw=";
  };

  build-system = [
    python3.pkgs.setuptools
  ];

+  # The bindings in python3Packages.tree-sitter-grammars track the grammar
+  # repos, whose versions drift from the pins upstream declares.
+  pythonRelaxDeps = [
+    "tree-sitter-fortran"
+    "tree-sitter-groovy"
+    "tree-sitter-julia"
+    "tree-sitter-kotlin"
+  ];
+
  dependencies =
    with python3.pkgs;
    [
      networkx
+      numpy
+      rapidfuzz
      tree-sitter
    ]
    ++ (with python3.pkgs.tree-sitter-grammars; [
+      tree-sitter-bash
      tree-sitter-c
      tree-sitter-c-sharp
      tree-sitter-cpp
      tree-sitter-elixir
+      tree-sitter-fortran
      tree-sitter-go
+      tree-sitter-groovy
      tree-sitter-java
      tree-sitter-javascript
+      tree-sitter-json
      tree-sitter-julia
      tree-sitter-kotlin
      tree-sitter-lua
@@ -53,11 +68,21 @@ python3Packages.buildPythonApplication rec {
    ]);

  optional-dependencies = with python3.pkgs; {
+    anthropic = [
+      anthropic
+    ];
+    bedrock = [
+      boto3
+    ];
+    chinese = [
+      jieba
+    ];
    leiden = [
      graspologic
    ];
    mcp = [
      mcp
+      starlette
    ];
    neo4j = [
      neo4j
@@ -66,10 +91,17 @@ python3Packages.buildPythonApplication rec {
      openpyxl
      python-docx
    ];
+    openai = [
+      openai
+      tiktoken
+    ];
    pdf = [
-      html2text
+      markdownify
      pypdf
    ];
+    postgres = [
+      psycopg
+    ];
    svg = [
      matplotlib
    ];
@@ -82,11 +114,24 @@ python3Packages.buildPythonApplication rec {
    ];
  };

+  pythonImportsCheck = [ "graphify" ];
+
+  # The attribute and the command are `graphify`, but upstream publishes the
+  # distribution as `graphifyy`. pythonMetadataCheckPhase resolves the
+  # distribution by `pname`, so it cannot find it:
+  #   nix-build -E 'with import ./. {};
+  #     python3.withPackages (_: [ (python3.pkgs.toPythonModule graphify) ])'
+  #   => PackageNotFoundError: No package metadata was found for graphify
+  dontCheckPythonMetadata = true;
+
  meta = {
    description = "AI coding assistant skill. Turn any folder of code, docs, papers, images, or videos into a queryable knowledge graph.";
    homepage = "https://github.com/Graphify-Labs/graphify";
-    changelog = "https://github.com/Graphify-Labs/graphify/blob/${src.rev}/CHANGELOG.md";
-    license = lib.licenses.mit;
+    changelog = "https://github.com/Graphify-Labs/graphify/blob/${src.tag}/CHANGELOG.md";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
    maintainers = with lib.maintainers; [ stunkymonkey ];
    mainProgram = "graphify";
  };
--- a/pkgs/by-name/gr/grpc/package.nix
+++ b/pkgs/by-name/gr/grpc/package.nix
@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation (finalAttrs: {
  pname = "grpc";
-  version = "1.82.1"; # N.B: if you change this, please update:
+  version = "1.83.0"; # N.B: if you change this, please update:
  # pythonPackages.grpcio
  # pythonPackages.grpcio-channelz
  # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "grpc";
    repo = "grpc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w4tl1y1GITlfeHTsSAZm45d8HQVzqSBVEQXoEqO0h5g=";
+    hash = "sha256-A2QtLdsunMOulbpyaSOoAID9caK0tpuiyZJ5C5zrr+k=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/gs/gssdp_1_6/package.nix
+++ b/pkgs/by-name/gs/gssdp_1_6/package.nix
@@ -13,6 +13,10 @@
  glib,
  gnome,
  gssdp-tools,
+  withIntrospection ?
+    lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+    && stdenv.hostPlatform.emulatorAvailable buildPackages,
+  buildPackages,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -22,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
  outputs = [
    "out"
    "dev"
+  ]
+  ++ lib.optionals withIntrospection [
    "devdoc"
  ];

@@ -38,10 +44,12 @@ stdenv.mkDerivation (finalAttrs: {
    meson
    ninja
    pkg-config
+    glib
+  ]
+  ++ lib.optionals withIntrospection [
    gobject-introspection
    vala
    gi-docgen
-    python3
  ];

  buildInputs = [
@@ -53,16 +61,17 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  mesonFlags = [
-    "-Dgtk_doc=true"
    "-Dsniffer=false"
    # This packages only has manpages for gssdp-device-sniffer, which we disabled above.
    "-Dmanpages=false"
+    (lib.mesonBool "gtk_doc" withIntrospection)
+    (lib.mesonBool "introspection" withIntrospection)
  ];

  # On Darwin: Failed to bind socket, Operation not permitted
  doCheck = !stdenv.hostPlatform.isDarwin;

-  postFixup = ''
+  postFixup = lib.optionalString withIntrospection ''
    # Move developer documentation to devdoc output.
    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
    find -L "$out/share/doc" -type f -regex '.*\.devhelp2?' -print0 \
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hwdata";
-  version = "0.409";
+  version = "0.410";

  src = fetchFromGitHub {
    owner = "vcrhonek";
    repo = "hwdata";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-WJ7oe94rTb+gzuawafpx7YyNTUzZe7ZWE0ZWWQKoyCA=";
+    hash = "sha256-9yw0z1fTcUjb2oWSFj91wY3W8GgPDqnqFMTpoR36mak=";
  };

  doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -157,7 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
    moveToOutput "bin/*-config" "$dev"
    moveToOutput "lib/ImageMagick-*/config-Q16HDRI" "$dev" # includes configure params
    configDestination=($out/share/ImageMagick-*)
-    grep -v '/nix/store' $dev/lib/ImageMagick-*/config-Q16HDRI/configure.xml > $configDestination/configure.xml
+    grep -v "$NIX_STORE" $dev/lib/ImageMagick-*/config-Q16HDRI/configure.xml > $configDestination/configure.xml
    for file in "$dev"/bin/*-config; do
      substituteInPlace "$file" --replace-fail "$PKG_CONFIG" \
        "PKG_CONFIG_PATH='$dev/lib/pkgconfig' '$(command -v $PKG_CONFIG)'"
--- a/pkgs/by-name/le/lerc/package.nix
+++ b/pkgs/by-name/le/lerc/package.nix
@@ -10,7 +10,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lerc";
-  version = "4.1.1";
+  version = "4.2.0";

  outputs = [
    "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "esri";
    repo = "lerc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YTNIydQLCBzsuvPWA6qnOkOIPf9JlByJdNHkTevE7Z0=";
+    hash = "sha256-ysD+0B5yMOdNOKe9MS2T8o0KgqygdxLYiLMr8XeG4JE=";
  };

  # Required to get the freebsd-ports patch to apply.
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libadwaita";
-  version = "1.9.2";
+  version = "1.9.3";

  outputs = [
    "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "GNOME";
    repo = "libadwaita";
    tag = finalAttrs.version;
-    hash = "sha256-XKKjnZz4CII6w9fKFptPK3aTNa5eMfyE7rcerbgaDco=";
+    hash = "sha256-1V3L10YgRnOoJud/lybfSj2AYOY0kRAJdfamJg+S1fo=";
  };

  depsBuildBuild = [
--- a/pkgs/by-name/li/libmodplug/package.nix
+++ b/pkgs/by-name/li/libmodplug/package.nix
@@ -14,10 +14,15 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "1pnri98a603xk47smnxr551svbmgbzcw018mq1k6srbrq6kaaz25";
  };

-  # Unfortunately, upstream appears inactive and the patches from the fork don’t apply cleanly.
-  # Modify `src/fastmix.cpp` to remove usage of the register storage class, which is
-  # not allowed in C++17 and is an error in clang 16.
-  prePatch = "substituteInPlace src/fastmix.cpp --replace 'register ' ''";
+  postPatch = ''
+    # Unfortunately, upstream appears inactive and the patches from the fork don’t apply cleanly.
+    # Modify `src/fastmix.cpp` to remove usage of the register storage class, which is
+    # not allowed in C++17 and is an error in clang 16.
+    substituteInPlace src/fastmix.cpp --replace-fail 'register ' ""
+
+    substituteInPlace libmodplug.pc.in \
+      --replace-fail 'includedir=''${prefix}/include' 'includedir=@includedir@'
+  '';

  outputs = [
    "out"
--- a/pkgs/by-name/li/libmpack/package.nix
+++ b/pkgs/by-name/li/libmpack/package.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "0rai5djdkjz7bsn025k5489in7r1amagw1pib0z4qns6b52kiar2";
  };

+  preBuild = lib.optionalString stdenv.hostPlatform.isStatic ''
+    mkdir -p build/release/src build/release/test/deps/tap
+  '';
+
  makeFlags = [
    "LIBTOOL=${libtool}/bin/libtool"
    "PREFIX=$(out)"
--- a/pkgs/by-name/li/libraqm/package.nix
+++ b/pkgs/by-name/li/libraqm/package.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libraqm";
-  version = "0.10.5";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "HOST-Oman";
    repo = "libraqm";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-6STgs9//BQRu1TTxf+L6+Jj0Z7rkaBFodXzQVRyybE4=";
+    sha256 = "sha256-3wE2Xr07kFMDw5j6cWwv1cutL2bg7Ia7CdkAx4ysa5A=";
  };

  buildInputs = [
--- a/pkgs/by-name/li/libssh/package.nix
+++ b/pkgs/by-name/li/libssh/package.nix
@@ -19,11 +19,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libssh";
-  version = "0.12.1";
+  version = "0.12.2";

  src = fetchurl {
    url = "https://www.libssh.org/files/${lib.versions.majorMinor finalAttrs.version}/libssh-${finalAttrs.version}.tar.xz";
-    hash = "sha256-05Qa8KLXjV2C7Xo2mI6RM5lDEvA1uWWabkP42zloeEw=";
+    hash = "sha256-SVYPZ32W43BqkErC3hEW4l82gJN9UeXJIZj8ukocHp8=";
  };

  outputs = [
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -27,18 +27,21 @@ stdenv.mkDerivation (finalAttrs: {
    # https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
    ./CVE-2026-7598.patch

+    # backport of https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d
    (fetchurl {
      name = "CVE-2025-15661.patch";
      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2025-15661.patch";
      hash = "sha256-Rz6i/881CbObUDcZbcPlgVPaKizSp6ZRTdmJNJ9HLHE=";
    })

+    # backport of https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
    (fetchurl {
      name = "CVE-2026-55199.patch";
      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2026-55199.patch";
      hash = "sha256-AFZa5kohha62aE0if5ckmAdJ0TZNcjfP32yDznoEhNo=";
    })

+    # backport of https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
    (fetchurl {
      name = "CVE-2026-55200.patch";
      url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2026-55200.patch";
@@ -53,16 +56,47 @@ stdenv.mkDerivation (finalAttrs: {
    })

    # https://github.com/libssh2/libssh2/issues/1925#issuecomment-4938515829
+    # backport of https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12
    (fetchurl {
      name = "CVE-2026-58050.patch";
      url = "https://raw.githubusercontent.com/JuliaPackaging/Yggdrasil/9404aa5dd96c945a790c425a5f49af19ed2a93b0/L/LibSSH2/LibSSH2%401.11/bundled/patches/CVE-2026-58050-3449752.patch";
      hash = "sha256-BZ1ewZgrroev2gkJwdoHCMFJK4wiRmA/Y4tzwaQqBd8=";
    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a
    (fetchurl {
      name = "CVE-2026-58051.patch";
      url = "https://github.com/JuliaPackaging/Yggdrasil/raw/9404aa5dd96c945a790c425a5f49af19ed2a93b0/L/LibSSH2/LibSSH2%401.11/bundled/patches/CVE-2026-58051-a9758da.patch";
      hash = "sha256-fduXIH02uwzqWV2RDidZmaDBy51V8yuC4XKlGYacjxg=";
    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
+    (fetchurl {
+      name = "CVE-2026-66032.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66032.patch";
+      hash = "sha256-H6VXhVc7uCFxj/k3Xouyg+8GYpsn/9IecXZrPkzsgks=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
+    (fetchurl {
+      name = "CVE-2026-66033.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66033.patch";
+      hash = "sha256-To2ul9ibaAkn0BWNu7fUbpaqHqEX+juUsBbjA0BGF6s=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9
+    (fetchurl {
+      name = "CVE-2026-66034.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66034.patch";
+      hash = "sha256-xYg9qh87KlExI38snAq5E5hF51mIoaJ1wOX9e1uEdmk=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
+    (fetchurl {
+      name = "CVE-2026-66035.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66035.patch";
+      hash = "sha256-+Wr9dp+g347pgKaJYRNRx+EXHA3iOKgOO4tjxi7zkD8=";
+    })
  ];

  # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
--- a/pkgs/by-name/li/libxfont_2/package.nix
+++ b/pkgs/by-name/li/libxfont_2/package.nix
@@ -15,7 +15,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "libxfont_2";
-  version = "2.0.8";
+  version = "2.0.9";

  outputs = [
    "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "mirror://xorg/individual/lib/libXfont2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9VbA4Qk6TmkRzJC8SxBtIBkC7hh/10ryBv8WL35qJNU=";
+    hash = "sha256-8EKjcGZoFee5Qem3AZAkdVvRxsKVSvv6UVrzeCUXmeI=";
  };

  strictDeps = true;
--- a/pkgs/by-name/ll/llhttp/package.nix
+++ b/pkgs/by-name/ll/llhttp/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "llhttp";
-  version = "9.4.2";
+  version = "9.4.3";

  src = fetchFromGitHub {
    owner = "nodejs";
    repo = "llhttp";
    tag = "release/v${finalAttrs.version}";
-    hash = "sha256-LS8HS8CnXJ3X8WlIvtxBLc0h1wLL/HmTqZWHlvBjTEo=";
+    hash = "sha256-wz87FgdZn0vtdlTWOZL5/Ujhs/uzSwFMHzQ6D9S7dH8=";
  };

  outputs = [
--- a/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
+++ b/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
@@ -366,10 +366,10 @@ void set_env_prefix(char *env, char *sep, char *prefix) {
        return;
      }
      unsigned long sep_len = strlen(sep);
-      int n_before = existing_prefix - existing_env;
+      int n_before = existing_prefix - existing_env - sep_len;
      assert_success(asprintf(&val, \"%s%s%.*s%s\", prefix, sep,
                              n_before, existing_env,
-                              existing_prefix + prefix_len + sep_len));
+                              existing_prefix + prefix_len));
    } else {
      assert_success(asprintf(&val, \"%s%s%s\", prefix, sep, existing_env));
    }
--- a/pkgs/by-name/ml/mlt/package.nix
+++ b/pkgs/by-name/ml/mlt/package.nix
@@ -7,7 +7,8 @@
  cmake,
  pkg-config,
  which,
-  ffmpeg,
+  # FIXME: unpin when opencv supports ffmpeg 9
+  ffmpeg_8,
  fftw,
  fontconfig,
  frei0r,
@@ -82,11 +83,11 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    gdk-pixbuf
-    (opencv4.override { ffmpeg-headless = ffmpeg; })
-    ffmpeg
+    (opencv4.override { ffmpeg_8-headless = ffmpeg_8; })
+    ffmpeg_8
    fftw
    fontconfig
-    (frei0r.override { opencv = opencv4.override { ffmpeg-headless = ffmpeg; }; })
+    (frei0r.override { opencv = opencv4.override { ffmpeg_8-headless = ffmpeg_8; }; })
    libdv
    libebur128
    libexif
@@ -146,7 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
  preFixup = ''
    wrapProgram $out/bin/melt \
      --prefix FREI0R_PATH : ${
-        (frei0r.override { opencv = opencv4.override { ffmpeg-headless = ffmpeg; }; })
+        (frei0r.override { opencv = opencv4.override { ffmpeg_8-headless = ffmpeg_8; }; })
      }/lib/frei0r-1 \
      ${lib.optionalString enableJackrack "--prefix LADSPA_PATH : ${ladspaPlugins}/lib/ladspa"} \
      ${lib.optionalString (qtbase != null) "\${qtWrapperArgs[@]}"}
@@ -159,7 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  passthru = {
-    inherit ffmpeg;
+    ffmpeg = ffmpeg_8;
  };

  passthru.updateScript = gitUpdater {
--- a/pkgs/by-name/mo/moltenvk/package.nix
+++ b/pkgs/by-name/mo/moltenvk/package.nix
@@ -21,7 +21,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "MoltenVK";
-  version = "1.4.1";
+  version = "1.4.2";

  strictDeps = true;

@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "KhronosGroup";
    repo = "MoltenVK";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-7S10p/XrQ/oMXuCnOU6gqnWMGMfP5vhimec1ThxmuIE=";
+    hash = "sha256-iyYxuWZZfk2W3DW9OX3m77RLk0e8GTTpEV3Th7mIrXY=";
  };

  postPatch = ''
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
    while IFS= read -d "" proj; do
      echo "Updating deployment target to ${stdenv.hostPlatform.darwinMinVersion}: $proj"
      substituteInPlace "$proj" \
-        --replace-fail 'MACOSX_DEPLOYMENT_TARGET = 11.0' "MACOSX_DEPLOYMENT_TARGET = $MACOSX_DEPLOYMENT_TARGET"
+        --replace-fail 'MACOSX_DEPLOYMENT_TARGET = 12.0' "MACOSX_DEPLOYMENT_TARGET = $MACOSX_DEPLOYMENT_TARGET"
    done < <(grep -Z -rl --include=project.pbxproj MACOSX_DEPLOYMENT_TARGET)

    # Move `mvkGitRevDerived.h` to a stable location
--- a/pkgs/by-name/mp/mpg123/package.nix
+++ b/pkgs/by-name/mp/mpg123/package.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;

 stdenv.mkDerivation (finalAttrs: {
  pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.6";
+  version = "1.33.7";

  src = fetchurl {
    url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-kpp8GLpmK4knrtTeIprZroqytIBt0PMLkBE+sbTiGVo=";
+    hash = "sha256-MdDjWkylZ+ybXr2mwwYrtENdbT6s1u8NlcrdeFTcA+4=";
  };

  outputs = [
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -13,7 +13,7 @@
  libinotify-kqueue,
  epoll-shim,
  systemd,
-  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, # enableSystemd=false maintained by maintainers.qyliss.
+  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, # enableSystemd=false maintained by maintainers.highghlow.
  pkg-config,
  docutils,
  doxygen,
@@ -229,6 +229,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.mesonEnable "pipewire-v4l2" stdenv.hostPlatform.isLinux)
    (lib.mesonEnable "libsystemd" enableSystemd)
    (lib.mesonEnable "systemd-system-service" enableSystemd)
+    (lib.mesonEnable "systemd-user-service" enableSystemd)
    (lib.mesonEnable "udev" stdenv.hostPlatform.isLinux)
    (lib.mesonEnable "ffmpeg" true)
    (lib.mesonEnable "pw-cat-ffmpeg" true)
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@@ -22,8 +22,8 @@
  docbook_xml_dtd_412,
  gtk-doc,
  coreutils,
-  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdMinimal,
-  systemdMinimal,
+  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
  elogind,
  buildPackages,
  withIntrospection ?
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    # On Linux, fall back to elogind when systemd support is off.
-    (if useSystemd then systemdMinimal else elogind)
+    (if useSystemd then systemdLibs else elogind)
  ];

  propagatedBuildInputs = [
--- a/pkgs/by-name/pr/protobufc/package.nix
+++ b/pkgs/by-name/pr/protobufc/package.nix
@@ -36,6 +36,21 @@ stdenv.mkDerivation (finalAttrs: {
    zlib
  ];

+  # The upstream macro is vendored from a very old autoconf archive:
+  # https://github.com/protobuf-c/protobuf-c/commit/42612b4ba4b11d48b76e3643fa6d42f617e661b6
+  # and the build system appears to arbitrarily require C++17 specifically:
+  # https://github.com/protobuf-c/protobuf-c/blob/4719fdd7760624388c2c5b9d6759eb6a47490626/configure.ac#L72
+  # However, the default standard version used by GCC continues to increase
+  # (e.g. C++20 for GCC 16), and so protobuf-c's dependencies do as well. In
+  # particular, abseil-cpp has headers that protobuf-c includes and are
+  # sensitive to the standard version. While we could override the standard
+  # version used by these dependents, it is simpler to drop the requirement and
+  # allow the compiler default standard to be used.
+  postPatch = ''
+    substituteInPlace configure.ac --replace-fail \
+      "AX_CXX_COMPILE_STDCXX(17, noext, mandatory)" ""
+  '';
+
  env.PROTOC = lib.getExe buildPackages.protobuf_33;

  meta = {
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "publicsuffix-list";
-  version = "0-unstable-2026-06-24";
+  version = "0-unstable-2026-07-25";

  src = fetchFromGitHub {
    owner = "publicsuffix";
    repo = "list";
-    rev = "18ecca5d54471f21918798da451dd8d03a18f3c7";
-    hash = "sha256-xvOAZpWhuOU3koEHgNfVK6aHy+VMYRoHj3fq9PxaAFo=";
+    rev = "e1b8015c3b2f0f4f8c18659c2480fc1a22c07b20";
+    hash = "sha256-F+OmANpg7I4dBFL7PM3oJlhpDzfxrRTfo+50lQHdU2M=";
  };

  dontBuild = true;
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@@ -20,7 +20,6 @@
  withTcb ? lib.meta.availableOn stdenv.hostPlatform tcb,
  tcb,
  cmocka,
-  fetchpatch,
 }:
 let
  glibc' =
@@ -34,13 +33,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "shadow";
-  version = "4.19.4";
+  version = "4.20.0";

  src = fetchFromGitHub {
    owner = "shadow-maint";
    repo = "shadow";
    tag = finalAttrs.version;
-    hash = "sha256-vR6dwB3EttGY2DgQ20nOr9kNhF+nsAaBEyklcJAZ20Y=";
+    hash = "sha256-UafTyfK+pmW2wyAQnvHov9KIorf1HSc6haskfv7auHs=";
  };

  outputs = [
@@ -150,36 +149,6 @@ stdenv.mkDerivation (finalAttrs: {
        cp -r . $out/
      '';
      dontBuild = true;
-      patches = [
-        # tests: update useradd tests to expect ID 1001
-        (fetchpatch {
-          name = "update-useradd-tests.patch";
-          url = "https://github.com/shadow-maint/shadow/commit/59fbe8415dab17f1e702fbdee96956886c86c737.patch";
-          hash = "sha256-U0+NSCd4AfTuHMddTx9+wNtpdJt9t8+D5ApW0OCNgsY=";
-          stripLen = 2;
-        })
-        # tests: update usermod tests to expect ID 1001
-        (fetchpatch {
-          name = "update-usermod-tests.patch";
-          url = "https://github.com/shadow-maint/shadow/commit/91c2ad44ababca2e32cdb71152b0f7f2a7c546be.patch";
-          hash = "sha256-v1EEvMfUYoE/ZnBM0k/+kUBK3W1dXr588OQzvFmnXLI=";
-          stripLen = 2;
-        })
-        # tests: update groupadd tests to expect GID 1001
-        (fetchpatch {
-          name = "update-groupadd-tests.patch";
-          url = "https://github.com/shadow-maint/shadow/commit/60568eaec13d1e417f56f0e59ac9573c0e3b9a83.patch";
-          hash = "sha256-tLmGeW4Y7UcZqMhW3IXgygKPhCmbZkkW5XTJ7CFz9vg=";
-          stripLen = 2;
-        })
-        # tests: update newgrp tests to expect GID 1002
-        (fetchpatch {
-          name = "update-newgrp-tests.patch";
-          url = "https://github.com/shadow-maint/shadow/commit/49ff9bf33a7b6af57cb26688c3139f014302c9d9.patch";
-          hash = "sha256-1760t4Ezd5Ke4PFZ70Njb+k+1kp17aT/7uqu1PswVss=";
-          stripLen = 2;
-        })
-      ];
      postPatch = ''
        # Replace the gshadow existence check in the test framework with a more NixOS-friendly one, since NixOS does not have /etc/gshadow as a regular file
        substituteInPlace framework/hosts/shadow.py \
--- a/pkgs/by-name/sh/shotcut/package.nix
+++ b/pkgs/by-name/sh/shotcut/package.nix
@@ -15,7 +15,7 @@
  qt6Packages,
  cmake,
  gitUpdater,
-  ffmpeg,
+  ffmpeg_8,
  wrapGAppsHook3,
 }:

@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    SDL2
-    (frei0r.override { opencv = opencv4.override { ffmpeg-headless = ffmpeg; }; })
+    (frei0r.override { opencv = opencv4.override { ffmpeg_8-headless = ffmpeg_8; }; })
    ladspaPlugins
    gettext
    qt6Packages.mlt
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {

  patches = [
    (replaceVars ./fix-mlt-ffmpeg-path.patch {
-      inherit ffmpeg;
+      ffmpeg = ffmpeg_8;
      mlt = qt6Packages.mlt;
    })
  ];
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {

  qtWrapperArgs = [
    "--set FREI0R_PATH ${
-      (frei0r.override { opencv = opencv4.override { ffmpeg-headless = ffmpeg; }; })
+      (frei0r.override { opencv = opencv4.override { ffmpeg_8-headless = ffmpeg_8; }; })
    }/lib/frei0r-1"
    "--set LADSPA_PATH ${ladspaPlugins}/lib/ladspa"
    "--prefix LD_LIBRARY_PATH : ${
--- a/pkgs/by-name/si/simdjson/package.nix
+++ b/pkgs/by-name/si/simdjson/package.nix
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "simdjson";
-  version = "4.6.4";
+  version = "4.6.5";

  src = fetchFromGitHub {
    owner = "simdjson";
    repo = "simdjson";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8oQzsR7DSaNTN9su1uI9tRQ9HvOwXShPwSrnQj8+lGM=";
+    hash = "sha256-mN8k98+vqhehDvTXoP1wB/V25oKnGQYCVXrvh/rVssw=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/sp/spirv-cross/package.nix
+++ b/pkgs/by-name/sp/spirv-cross/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "spirv-cross";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "SPIRV-Cross";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-JdVAS5uVSfe0mOGtyodkgmvgD4of9Amq8PbDSAtgaXc=";
+    hash = "sha256-HjAVP+yMeybM8VQQO3aKmuxpvjA03EGjKUPWVQKoRuc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -2,36 +2,20 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  cmake,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "spirv-headers";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "SPIRV-Headers";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-nwzhJlkdN8DaExHvnuVc5rZmlrkPYb7Qmj1fx3O5Zpw=";
+    hash = "sha256-tGY4H3+5p9M5LBK/xxRdMT9CX+qq3e7fPkaftnpjU9I=";
  };

-  patches = [
-    # backport to fix glslang tests
-    # FIXME: remove in next update
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/1a22b167081842915a1c78a0b5b5a353a23284aa.diff";
-      hash = "sha256-XUHfPHnk7bWK4vnozfW/84vaZN+rbFJUZSa6Og8GUAU=";
-    })
-    # Backport new predicated load/store instructions, needed by spirv-llvm-translator
-    # Not in any tagged releases yet, should exist in the next release after 1.4.350.1.
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/b8a32968473ce852a809b9de5f04f02a5a9dfa78.patch";
-      hash = "sha256-59jmN28ifEhAxySXCpuGZ62jo1WVsRPnVosK8X4yrjM=";
-    })
-  ];
-
  nativeBuildInputs = [ cmake ];

  meta = {
--- a/pkgs/by-name/sp/spirv-tools/package.nix
+++ b/pkgs/by-name/sp/spirv-tools/package.nix
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchFromGitHub,
-  fetchpatch,
  cmake,
  python3,
  spirv-headers,
@@ -10,30 +9,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "spirv-tools";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "SPIRV-Tools";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-tR3POZH/LXaAljMUS9aHBBvIvlr6o7d6+YUtJCRMS1w=";
+    hash = "sha256-ne2JF68MJNriPIiA/fRCb6VYH3vWsoyov4S82QQY2AI=";
  };

  patches = [
    # https://github.com/KhronosGroup/SPIRV-Tools/pull/6483
    ./0001-Fix-generated-pkg-config-modules-with-absolute-insta.patch
-
-    # backport to fix glslang tests
-    # FIXME: remove in next update
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/2ec8457ab33d539b6f1fecc998360c0b8b05ed4f.diff";
-      hash = "sha256-YHbYBwXMm4rTKpmMW6I3LUafhA4RuNUdXqUBUAXwXpE=";
-    })
-
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/0db9162641d9709c63c92a13e66fd88905180e89.diff";
-      hash = "sha256-eoS35Zxb+frQTTTNCaZ4TV/QZjaK45mW1OzzIlXQ1C0=";
-    })
  ]
  # The cmake options are sufficient for turning on static building, but not
  # for disabling shared building, just trim the shared lib from the CMake
--- a/pkgs/by-name/sv/sv-lang/package.nix
+++ b/pkgs/by-name/sv/sv-lang/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  boost,
  catch2_3,
  cmake,
@@ -23,6 +24,20 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-popHzwX0qwv2POAl7/qX3e//OwJRXGtSl9xogpSn2LI=";
  };

+  patches = [
+    (fetchpatch {
+      name = "fmt-12.2.patch";
+      url = "https://github.com/MikePopoloski/slang/commit/5a898b4b9225d281902fcd59fe4732b1561677d2.patch";
+      excludes = [ "tests/unittests/diagnostics/WaiverTests.cpp" ];
+      hash = "sha256-Y+GG8UINWXh7eTXEweM42oPY8ByP4DQYgTjSLukz4I4=";
+    })
+  ];
+
+  patchFlags = [
+    "-p1"
+    "-F3"
+  ];
+
  cmakeFlags = [
    # fix for https://github.com/NixOS/nixpkgs/issues/144170
    "-DCMAKE_INSTALL_INCLUDEDIR=include"
--- a/pkgs/by-name/sw/swtpm/package.nix
+++ b/pkgs/by-name/sw/swtpm/package.nix
@@ -46,6 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
    python3
    autoreconfHook
    makeWrapper
+    # configure.ac does AC_CHECK_PROG([OPENSSL_CLITOOL], [openssl], ...) and
+    # errors out when the tool is not on PATH. openssl is in buildInputs for
+    # the library, which puts its bin dir on PATH only when build == host, so
+    # the check fails when cross-compiling.
+    openssl
  ];

  nativeCheckInputs = [
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ty";
-  version = "0.0.69";
+  version = "0.0.70";
  __structuredAttrs = true;

  src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    repo = "ty";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-bu/2vHmhHYS/3EZM9Ibh8Y0v/aigriDwWu7Wn7gNvds=";
+    hash = "sha256-rlhU/987KaTAXukZDUDY0XyDUQiC6qHGIXS2epg6ziI=";
  };

  # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoBuildFlags = [ "--package=ty" ];

-  cargoHash = "sha256-DUCTpqnzsGPH3OQkutduqrCZd7uuOgbZZmnXNCC8YdY=";
+  cargoHash = "sha256-eM+MdAxx6UqvFSTnUmCk7Nx1MuprrYrv/64Jy90nE0c=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = [ rust-jemalloc-sys ];
--- a/pkgs/by-name/uc/ucx/package.nix
+++ b/pkgs/by-name/uc/ucx/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
  strictDeps = true;

  pname = "ucx";
-  version = "1.21.0";
+  version = "1.22.0";

  src = fetchFromGitHub {
    owner = "openucx";
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
    # Otherwise compilation fails with:
    #   fatal error: gpunetio/common/doca_gpunetio_verbs_def.h: No such file or directory
    fetchSubmodules = true;
-    hash = "sha256-Td6L5wXDadIbHfk251bj6k9J3kIjqCYVx5lDso/u76M=";
+    hash = "sha256-R/uUjkYLPtY9c3vZWrkzKaSgK9Z/cppJCwQ1V1cuwPc=";
  };

  # UCX uses the `#pragma omp master` declaration which is deprecated since
--- a/pkgs/by-name/vu/vulkan-extension-layer/package.nix
+++ b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vulkan-extension-layer";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "Vulkan-ExtensionLayer";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-6ZtPp6OqzzppmijIU1/77qcUvwCck/eMZOUh5pSwVc8=";
+    hash = "sha256-R9hs69SvZeK0w7YF7rhhVp9mRQing3y8NffWfRlXBQI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vu/vulkan-headers/package.nix
+++ b/pkgs/by-name/vu/vulkan-headers/package.nix
@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "vulkan-headers";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  # Adding `ninja` here to enable Ninja backend. Otherwise on gcc-14 or
  # later the build fails as:
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "KhronosGroup";
    repo = "Vulkan-Headers";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-RcUVurC+Rc0MyWpQLaLVmdn7FZO1GWWzTZZAOwvKwb4=";
+    hash = "sha256-tAYvYx/Mqvf/I177xmx7oLZVc7S7GK3MArY3i+FCYuw=";
  };

  passthru.updateScript = ./update.sh;
--- a/pkgs/by-name/vu/vulkan-loader/package.nix
+++ b/pkgs/by-name/vu/vulkan-loader/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vulkan-loader";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "Vulkan-Loader";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-jgibBetbMpqRJ+OJpJgNxgC6phECewNqtla9CCJj56U=";
+    hash = "sha256-sPv3pA/oclV75CuxsYeIAZ6zH3C6FPmhdI0+djxRExk=";
  };

  patches = [ ./fix-pkgconfig.patch ];
--- a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
@@ -27,13 +27,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vulkan-tools-lunarg";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "LunarG";
    repo = "VulkanTools";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-tKt/OrGIVfg2/aK9dYPuOB4+05ayUheP9T7Ny5MfWTk=";
+    hash = "sha256-7nrEXdt0c02D2Z270W45YBwbfzsTwt854tKx+HlTHYA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vu/vulkan-tools/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools/package.nix
@@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "vulkan-tools";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "Vulkan-Tools";
    rev = "vulkan-sdk-${version}";
-    hash = "sha256-qtEq1ZQT5JXE4bXzy8W053CRF/dOFVV7d7NE9uNYssI=";
+    hash = "sha256-kbySCu2c5nh6icnPQV6qplfg1gHFnGPEYOG6G6TG8EU=";
  };

  patches = [ ./wayland-scanner.patch ];
--- a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
+++ b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vulkan-utility-libraries";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "Vulkan-Utility-Libraries";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-E0T5eSI30eDB7//6srjwlkX9HfUp1UiyCPWDyK+ZEi8=";
+    hash = "sha256-WcSiUe3vB7zUO0vpqcVJkKqhnZXz76ApWaoMO49efXg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vu/vulkan-validation-layers/package.nix
+++ b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "vulkan-validation-layers";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "Vulkan-ValidationLayers";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-3qUZP/R29eqTR4IAWH6jBGgmRqE0d1ahcdKbxUOAmTY=";
+    hash = "sha256-AO1ci608M6CoCrPR6UI2ZjCRlyzOeN8lkimZZODazb0=";
  };

  strictDeps = true;
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "volk";
-  version = "1.4.350.0";
+  version = "1.4.357.0";

  src = fetchFromGitHub {
    owner = "zeux";
    repo = "volk";
    rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-7JsOWhMTnxeJfsTVgnnHQt5gYJ8tqELT+s3VDHTPof8=";
+    hash = "sha256-iaKwjY4oJz4IdZ4JYuinOmWIFo6TkF7VikWZRhCWfNk=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/we/webrtc-audio-processing/package.nix
+++ b/pkgs/by-name/we/webrtc-audio-processing/package.nix
@@ -46,7 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  propagatedBuildInputs = [
-    abseil-cpp
+    # webrtc-audio-processing specifies C++17, so abseil must match. Otherwise,
+    # abseil exposes a different (incompatible) interface based on the default
+    # C++ standard of the compiler.
+    # https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/blob/d0569cfa50c1858ee279d77b3fc8870be6902441/meson.build#L7
+    (abseil-cpp.override { cxxStandard = "17"; })
  ];

  mesonFlags =
--- a/pkgs/by-name/wh/which/package.nix
+++ b/pkgs/by-name/wh/which/package.nix
@@ -31,6 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
    "man"
  ];

+  __structuredAttrs = true;
+
  meta = {
    homepage = "https://www.gnu.org/software/which/";
    description = "Shows the full path of (shell) commands";
--- a/pkgs/by-name/wi/wildmidi/package.nix
+++ b/pkgs/by-name/wi/wildmidi/package.nix
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "wildmidi";
-  version = "0.4.6";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "Mindwerks";
    repo = "wildmidi";
    rev = "${pname}-${version}";
-    sha256 = "sha256-syjs8y75M2ul7whiZxnWMSskRJd0ixFqnep7qsTbiDE=";
+    sha256 = "sha256-KFJW2m7TJ0RExK/C0XHyOefKGFLUszl7Jh6l10NjeHM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/zx/zxing-cpp/package.nix
+++ b/pkgs/by-name/zx/zxing-cpp/package.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "zxing-cpp";
-  version = "3.0.2";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "zxing-cpp";
    repo = "zxing-cpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZtjvHBnuPJkc9kU998jH7IPlX3jF/RGtLNWDzsb0v4A=";
+    hash = "sha256-dCqn2qYQGHY/nmwwkgd4uGoKp0YeQxWiHpS0Hhsm+UE=";
  };

  strictDeps = true;
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    "-DZXING_DEPENDENCIES=LOCAL"
    "-DZXING_EXAMPLES=OFF"
    "-DZXING_USE_BUNDLED_ZINT=OFF"
+    (lib.cmakeFeature "ZXING_WRITERS" "BOTH")
  ];

  passthru = {
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -32,8 +32,8 @@ let
    "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg=";
    # By unofficial and very loose convention we keep the latest version of
    # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.6.5".sha256 = "sha256-kex19kclLtbmrq6bGhP0fHxs/ZtoSI3Gnxpv6lrMtEA=";
    "2.6.6".sha256 = "sha256-plp6MIEqr1SSXRGSubnoEPUnx5kRxgALdUgQWu99o0s=";
+    "2.6.7".sha256 = "sha256-Hr3DXJ3I4nG4zRrESWXgC/JV+cAiFlD8t38Ps0wtOt4=";
  };
  # Collection of pre-built SBCL binaries for platforms that need them for
  # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
--- a/pkgs/development/compilers/zulu/common.nix
+++ b/pkgs/development/compilers/zulu/common.nix
@@ -79,6 +79,9 @@ let
    pname = "zulu-${javaPackage}";
    version = dist.jdkVersion;

+    __structuredAttrs = true;
+    strictDeps = true;
+
    src = fetchurl {
      url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-${platform}_${arch}.tar.gz";
      inherit (dist) hash;
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -404,6 +404,13 @@ builtins.intersectAttrs super {
    postInstall = ''
      ${drv.postInstall or ""}
      ln -s "''${!outputBin}/bin/pandoc" "''${!outputBin}/bin/pandoc-server"
+    ''
+    # Assert the lua and server features are enabled by default
+    # c.f. https://github.com/NixOS/nixpkgs/issues/540900
+    # FIXME: overrideCabal does not allow configuring installCheckPhase, so use postInstall
+    + lib.optionalString canExecute ''
+      "''${!outputBin}/bin/pandoc" --version | grep -qF '+lua'
+      "''${!outputBin}/bin/pandoc" --version | grep -qF '+server'
    '';
  }) super.pandoc-cli;

--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
  luaversion = "5.1";

  postPatch = ''
-    substituteInPlace Makefile --replace ldconfig :
+    substituteInPlace Makefile --replace-fail ldconfig :
    if test -n "''${dontStrip-}"; then
      # CCDEBUG must be non-empty or everything will be stripped, -g being
      # passed by nixpkgs CC wrapper is insufficient on its own
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
        sourceVersion = {
          major = "3";
          minor = "14";
-          patch = "6";
+          patch = "7";
          suffix = "";
        };
-        hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM=";
+        hash = "sha256-O0jayPtZ9i6qZ6yDwesSvaG3oIQG3ShuJSwRpmvif4E=";
      };
    };

@@ -59,10 +59,10 @@
      sourceVersion = {
        major = "3";
        minor = "13";
-        patch = "14";
+        patch = "15";
        suffix = "";
      };
-      hash = "sha256-Y55DJDxiCjCPloIT354A8vj2IzL3rbqnp+65eDBXxpA=";
+      hash = "sha256-HmanlFpIOQ7kwqQmig5BhYhAWaE8SqttFIqiCN7qSnY=";
      inherit passthruFun;
    };

--- a/pkgs/development/interpreters/python/hooks/python-metadata-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-metadata-check-hook.sh
@@ -7,20 +7,21 @@ pythonMetadataCheckPhase() {
  echo "Executing pythonMetadataCheckPhase"

  # shellcheck disable=SC2154
-  pythonMetadataCheckOutput="$out"
+  local pythonMetadataCheckOutput="$out"
  if [[ -n "${python-}" ]]; then
    echo "Using python specific output \$python for metadata check"
    pythonMetadataCheckOutput=$python
  fi
  # shellcheck disable=SC2154
-  derivationPname="$pname"
+  local derivationPname="$pname"
  # shellcheck disable=SC2154
-  derivationVersion="$version"
+  local derivationVersion="$version"
  # `python -P` avoids picking up egg-info dirs in $PWD
+  local metadataVersion
  metadataVersion="$(PYTHONPATH="$pythonMetadataCheckOutput/@pythonSitePackages@:$PYTHONPATH" \
    @pythonInterpreter@ -P -c 'from importlib.metadata import version; import sys; print(version(sys.argv[1]))' "$derivationPname")"

-  # chethat both versions can be parsed
+  # check that both versions can be parsed
  @pythonWithPackaging@ -c "from packaging.version import Version; from sys import argv; Version(argv[1]); Version(argv[2])" "$derivationVersion" "$metadataVersion"

  if @pythonWithPackaging@ -c "from packaging.version import Version; from sys import argv, exit; exit(Version(argv[1]) == Version(argv[2]))" "$derivationVersion" "$metadataVersion"; then
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -194,6 +194,35 @@ stdenv.mkDerivation {
      extraPrefix = "libs/context/";
      sha256 = "sha256-bCfLL7bD1Rn4Ie/P3X+nIcgTkbXdCX6FW7B9lHsmVW8=";
    })
+    # Backports https://github.com/boostorg/context/pull/331, which prevents
+    # an optimisation that breaks coroutine migration between threads.
+    # (mostly needed to avoid conflicts when applying the patch below,
+    # but it's a meaningful standalone fix too).
+    ++
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.92.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/0921b9fd5c776aec7748475c6c10807e0d51bc6d.patch";
+          relative = "include";
+          hash = "sha256-nQYMd3HFsDLxijnGdyas0ZHs3ylQVMGQL14K7F6MkF0=";
+        })
+    # Backports https://github.com/boostorg/context/pull/337 which fixes a regression that breaks
+    # std::uncaught_exceptions for abandoned coroutines under libstdc++ and fcontext implementation.
+    # This bug also caused subtle breakage in Nix. See https://github.com/NixOS/nix/issues/16174.
+    ++
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.93.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/5883212311535a0046031d74d1568ae173c1e35b.patch";
+          relative = "include";
+          hash = "sha256-CytNLi2d0wjI/lY5lDv98mwwQaEt7qeIs4UkE6QgCBU=";
+        })
+    ++
+      # This also broke Nix https://github.com/NixOS/nix/issues/13145 and probably much more dependants too.
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.89.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/c79564d0de69422ed33f2fbc892908ad510e6a19.patch";
+          relative = "include";
+          hash = "sha256-5iZ+rSdtyOupBUYws6U8whd43XMkTlQlApW5xvE0ZB4=";
+        })
    # This fixes another issue regarding ill-formed constant expressions, which is a default error
    # in clang 16 and will be a hard error in clang 17.
    ++ lib.optional (lib.versionOlder version "1.80") (fetchpatch {
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -75,7 +75,7 @@ rec {
  # unversioned aliases to allow for quicker migration to new releases,
  # but can pin one of the versioned variants if they do not work with
  # the current default version.
-  ffmpeg = ffmpeg_8;
-  ffmpeg-headless = ffmpeg_8-headless;
-  ffmpeg-full = ffmpeg_8-full;
+  ffmpeg = ffmpeg_9;
+  ffmpeg-headless = ffmpeg_9-headless;
+  ffmpeg-full = ffmpeg_9-full;
 }
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -838,7 +838,7 @@ stdenv.mkDerivation (
      in
      "remove-references-to ${lib.concatMapStringsSep " " (o: "-t ${o}") toStrip} config.h";

-    __structuredAttrs = versionAtLeast version "9";
+    __structuredAttrs = true;
    strictDeps = true;

    nativeBuildInputs = [
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -103,7 +103,16 @@ in
  };

  fmt_12 = generic {
-    version = "12.1.0";
-    hash = "sha256-ZmI1Dv0ZabPlxa02OpERI47jp7zFfjpeWCy1WyuPYZ0=";
+    version = "12.2.0";
+    hash = "sha256-Tc7PmNxUv7ajw6GaHPGEEtrD/fl6is7RB8TPestJa1o=";
+
+    patches = lib.optionals stdenv.is32bit [
+      # fix build on 32-bit targets
+      # FIXME: remove in next update
+      (fetchpatch {
+        url = "https://github.com/fmtlib/fmt/commit/588b3a0f8f6a8bcf2a959cae882d5b2703e86737.patch";
+        hash = "sha256-DiE3nwYrtNDJ6cqYreU499Y0auH6dsAW21TRPe16Tx8=";
+      })
+    ];
  };
 }
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -17,7 +17,7 @@
  isocodes,
  libjpeg,
  libpng,
-  tremor, # provides 'virbisidec'
+  libvorbis,
  libGL,
  withIntrospection ?
    lib.meta.availableOn stdenv.hostPlatform gobject-introspection
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
    isocodes
    libpng
    libjpeg
-    tremor
+    libvorbis
    pango
  ]
  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
@@ -143,6 +143,8 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.mesonEnable "introspection" withIntrospection)
    (lib.mesonEnable "doc" enableDocumentation)
    (lib.mesonEnable "libvisual" false)
+    (lib.mesonEnable "tremor" false) # unmaintained in nixpkgs, just use regular libvorbis instead
+    (lib.mesonEnable "vorbis" true)
  ]
  ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
    "-Dtests=disabled"
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -9,7 +9,8 @@
  gstreamer,
  gst-plugins-base,
  gettext,
-  ffmpeg-headless,
+  # FIXME: unpin when upstream supports ffmpeg 9
+  ffmpeg_8-headless,
  # Checks meson.is_cross_build(), so even canExecute isn't enough.
  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
  hotdoc,
@@ -50,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    gstreamer
    gst-plugins-base
-    ffmpeg-headless
+    ffmpeg_8-headless
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    apple-sdk_gstreamer
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -27,13 +27,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.24.0";
+  version = "2.24.1";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "libva";
    rev = finalAttrs.version;
-    sha256 = "sha256-NDh8XI1JJPegDXO2nH2XKVywp25Su/ytgR1OHI7nvdI=";
+    sha256 = "sha256-kgFvqyUlBZApc8D2i3BX6bHkUVNon5bL4asZ9myhQEM=";
  };

  outputs = [
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -97,6 +97,8 @@ stdenv.mkDerivation (finalAttrs: {
    ];
  };

+  __structuredAttrs = true;
+
  meta = {
    changelog = "https://github.com/besser82/libxcrypt/blob/v${finalAttrs.version}/NEWS";
    description = "Extended crypt library for descrypt, md5crypt, bcrypt, and others";
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -59,7 +59,8 @@
  enableVtk ? false,
  vtk,
  enableFfmpeg ? true,
-  ffmpeg-headless,
+  # FIXME: unpin once upstream has ffmpeg 9 support
+  ffmpeg_8-headless,
  enableGStreamer ? true,
  elfutils,
  gst_all_1,
@@ -386,7 +387,7 @@ effectiveStdenv.mkDerivation {
    openjpeg
  ]
  ++ optionals enableFfmpeg [
-    ffmpeg-headless
+    ffmpeg_8-headless
  ]
  ++ optionals (enableGStreamer && effectiveStdenv.hostPlatform.isLinux) [
    elfutils
--- a/pkgs/development/libraries/protobuf/fix-BoolKeys-test-on-be.patch
+++ b/pkgs/development/libraries/protobuf/fix-BoolKeys-test-on-be.patch
@@ -0,0 +1,32 @@
+From 02774a2aea957c552383cc6cae43076f5436d867 Mon Sep 17 00:00:00 2001
+From: Sai Sindhuri Avulamanda <sai.sindhuri.avulamanda@ibm.com>
+Date: Wed, 11 Feb 2026 11:00:05 +0530
+Subject: [PATCH] Fix BoolKeys test to use integer-to-bool cast
+
+Signed-off-by: saisindhuri91 <Sai.Sindhuri.Avulamanda@ibm.com>
+---
+ upb/hash/test.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/upb/hash/test.cc b/upb/hash/test.cc
+index 546df9d71c1f0..fcb7deaa8e4bc 100644
+--- a/upb/hash/test.cc
+++ b/upb/hash/test.cc
+@@ -336,7 +336,7 @@ TEST(IntTableTest, BoolKeys) {
+   // First element.
+   EXPECT_TRUE(upb_inttable_next(&t, &key, &val, &iter));
+   bool key_bool;
+-  memcpy(&key_bool, &key, sizeof(key_bool));
+  key_bool = static_cast<bool>(key);
+   EXPECT_EQ(key_bool, false);
+   EXPECT_EQ(upb_inttable_iter_key(&t, iter), false);
+   EXPECT_EQ(val.val, true);
+@@ -345,7 +345,7 @@ TEST(IntTableTest, BoolKeys) {
+ 
+   // Second element.
+   EXPECT_TRUE(upb_inttable_next(&t, &key, &val, &iter));
+-  memcpy(&key_bool, &key, sizeof(key_bool));
+  key_bool = static_cast<bool>(key);
+   EXPECT_EQ(key_bool, true);
+   EXPECT_EQ(upb_inttable_iter_key(&t, iter), true);
+   EXPECT_EQ(val.val, false);
--- a/pkgs/development/libraries/protobuf/generic.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@@ -73,6 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
        url = "https://github.com/protocolbuffers/protobuf/commit/8282f0f8ecf8b847e5964a308e041ba3b049811c.patch";
        hash = "sha256-4c/yLuAd29Cxrz6I9F2Lj02lW2bazIcGb+86uxZY7qA=";
      })
+    ]
+    ++ lib.optionals ((lib.versionAtLeast version "33") && (lib.versionOlder version "36")) [
      # Fix packed enum decoding on big-endian platforms
      # https://github.com/protocolbuffers/protobuf/pull/25683
      ./fix-upb-packed-enum-be.patch
@@ -83,6 +85,10 @@ stdenv.mkDerivation (finalAttrs: {
      # entries in `linkarr_upb_AllExts` during test builds.
      # Context: https://github.com/protocolbuffers/protobuf/issues/21021
      ./fix-upb-linkarr-sentinel-init.patch
+
+      # Fix BoolKeys test on big-endian
+      # https://github.com/protocolbuffers/protobuf/pull/25862
+      ./fix-BoolKeys-test-on-be.patch
    ];

  postPatch =
--- a/pkgs/development/libraries/tpm2-tss/default.nix
+++ b/pkgs/development/libraries/tpm2-tss/default.nix
@@ -31,13 +31,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "tpm2-tss";
-  version = "4.1.3";
+  version = "4.2.0";

  src = fetchFromGitHub {
    owner = "tpm2-software";
    repo = finalAttrs.pname;
    rev = finalAttrs.version;
-    hash = "sha256-BP28utEUI9g1VNv3lCXuiKrDtEImFQxxZfIjLiE3Wr8=";
+    hash = "sha256-MNrVKoA2sW3wKaQsq27UtakzdKmfirtDCoPWu0EEndw=";
  };

  outputs = [
@@ -87,17 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
    # Do not rely on dynamic loader path
    # TCTI loader relies on dlopen(), this patch prefixes all calls with the output directory
    ./no-dynamic-loader-path.patch
-
-    # Configure script expects tools from shadow (e.g. useradd) but they are
-    # actually optional (and we can’t use them in Nix sandbox anyway). Make the
-    # check in configure.ac a warning instead of an error so that we can run
-    # configure phase on platforms that don’t have shadow package (e.g. macOS).
-    # Note that *on platforms* does not mean *for platform* i.e. this is for
-    # cross-compilation, tpm2-tss does not support macOS, see upstream issue:
-    # https://github.com/tpm2-software/tpm2-tss/issues/2629
-    # See also
-    # https://github.com/tpm2-software/tpm2-tss/blob/6c46325b466f35d40c2ed1043bfdfcfb8a367a34/Makefile.am#L880-L898
-    ./no-shadow.patch
  ];

  postPatch = ''
@@ -115,11 +104,6 @@ stdenv.mkDerivation (finalAttrs: {
    done
    substituteInPlace src/tss2-fapi/ifapi_config.c \
      --replace-fail 'SYSCONFDIR' '"/etc"'
-
-    # https://github.com/tpm2-software/tpm2-tss/pull/3041
-    substituteInPlace test/unit/tcti-libtpms.c \
-      --replace-fail 'check_expected_ptr(st);' 'check_expected(st);' \
-      --replace-fail 'check_expected_ptr(buf_len);' 'check_expected(buf_len);'
  ''
  # tcti tests rely on mocking function calls, which appears not to be supported
  # on clang
--- a/pkgs/development/libraries/tpm2-tss/no-dynamic-loader-path.patch
+++ b/pkgs/development/libraries/tpm2-tss/no-dynamic-loader-path.patch
@@ -1,8 +1,6 @@
-diff --git a/src/tss2-tcti/tctildr-dl.c b/src/tss2-tcti/tctildr-dl.c
-index d26219d2..92d2b6a3 100644
 --- a/src/tss2-tcti/tctildr-dl.c
 +++ b/src/tss2-tcti/tctildr-dl.c
-@@ -88,14 +88,24 @@ handle_from_name(const char *file,
+@@ -84,14 +84,24 @@
     const char *formats[] = {
         /* <name> */
         "%s",
@@ -27,479 +25,457 @@ index d26219d2..92d2b6a3 100644
     };
 
     if (handle == NULL) {
-diff --git a/test/unit/tctildr-dl.c b/test/unit/tctildr-dl.c
-index 135e1b14..7d654d1f 100644
 --- a/test/unit/tctildr-dl.c
 +++ b/test/unit/tctildr-dl.c
-@@ -168,6 +168,10 @@ test_handle_from_name_second_dlopen_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -153,6 +153,9 @@
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_A);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
- 
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_A);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, TEST_HANDLE);
-@@ -186,10 +190,18 @@ test_handle_from_name_third_dlopen_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
 
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -170,10 +173,16 @@
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_A);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_A);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
 
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_B);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, TEST_HANDLE);
-@@ -208,14 +220,26 @@ test_handle_from_name_fourth_dlopen_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
 
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -191,14 +200,23 @@
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_A);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_A);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
+ 
     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
- 
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_B);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
 
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_C);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_D);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, TEST_HANDLE);
-@@ -234,18 +258,34 @@ test_handle_from_name_fifth_dlopen_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
 
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_D);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -216,18 +234,30 @@
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_A);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_A);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
+ 
     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
- 
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_B);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
+ 
     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
- 
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_C);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_D);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
 
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_D);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_D);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
+ 
     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_E);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, TEST_HANDLE);
-@@ -281,22 +321,42 @@ test_get_info_default_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, HANDLE);
-@@ -321,22 +381,42 @@ test_get_info_default_info_fail (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, HANDLE);
-@@ -483,120 +563,225 @@ test_tcti_fail_all (void **state)
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -265,22 +295,37 @@
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-default.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
+ 
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
+ 
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
+ 
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
+ 
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -306,22 +351,37 @@
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-default.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -463,120 +523,225 @@
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-default.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+    will_return(__wrap_dlopen, NULL);
+     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
     /* Skip over libtss2-tcti-tabrmd.so */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-tabrmd.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-tabrmd.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-tabrmd.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-tabrmd.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-tabrmd.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
     /* Skip over libtss2-tcti-device.so, /dev/tpmrm0 */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-device.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-device.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
     /* Skip over libtss2-tcti-device.so, /dev/tpm0 */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-device.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-device.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
     /* Skip over libtss2-tcti-device.so, /dev/tcm0 */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-device.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-device.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
     /* Skip over libtss2-tcti-swtpm.so */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-swtpm.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-swtpm.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-swtpm.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-swtpm.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-swtpm.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-swtpm.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-swtpm.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-swtpm.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-swtpm.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-swtpm.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
     /* Skip over libtss2-tcti-mssim.so */
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-mssim.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-mssim.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-mssim.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-mssim.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-mssim.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-mssim.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-mssim.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-mssim.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-mssim.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-mssim.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
-     TSS2_RC r;
+     TSS2_RC            r;
     TSS2_TCTI_CONTEXT *tcti;
-@@ -619,18 +804,33 @@ test_info_from_name_handle_fail (void **state)
+@@ -597,18 +762,33 @@
     expect_string(__wrap_dlopen, filename, "foo");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "foo");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-foo.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-foo.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-foo.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-foo.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-foo.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-foo.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
-     TSS2_RC rc = info_from_name ("foo", &info, &data);
-     assert_int_equal (rc, TSS2_TCTI_RC_NOT_SUPPORTED);
-@@ -741,18 +941,33 @@ test_tctildr_get_info_from_name (void **state)
+     TSS2_RC rc = info_from_name("foo", &info, &data);
+     assert_int_equal(rc, TSS2_TCTI_RC_NOT_SUPPORTED);
+@@ -719,18 +899,33 @@
     expect_string(__wrap_dlopen, filename, "foo");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "foo");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-foo.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-foo.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-foo.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-foo.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
     expect_string(__wrap_dlopen, filename, "libtss2-foo.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-foo.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
+    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
 
-     TSS2_RC rc = tctildr_get_info ("foo", &info, &data);
-     assert_int_equal (rc, TSS2_TCTI_RC_NOT_SUPPORTED);
+     TSS2_RC rc = tctildr_get_info("foo", &info, &data);
+     assert_int_equal(rc, TSS2_TCTI_RC_NOT_SUPPORTED);
--- a/pkgs/development/libraries/tpm2-tss/no-shadow.patch
+++ b/pkgs/development/libraries/tpm2-tss/no-shadow.patch
@@ -1,16 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index e2d579b8..0eac4ff3 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -672,9 +672,9 @@ AS_IF([test "$HOSTOS" = "Linux" && test "x$systemd_sysusers" != "xyes"],
-       AC_CHECK_PROG(adduser, adduser, yes)
-       AC_CHECK_PROG(addgroup, addgroup, yes)
-       AS_IF([test "x$addgroup" != "xyes" && test "x$groupadd" != "xyes" ],
-         [AC_MSG_ERROR([addgroup or groupadd are needed.])])
-+         [AC_MSG_WARN([addgroup or groupadd are needed.])])
-       AS_IF([test "x$adduser" != "xyes" && test "x$useradd" != "xyes" ],
-         [AC_MSG_ERROR([adduser or useradd are needed.])])])
-+         [AC_MSG_WARN([adduser or useradd are needed.])])])
- 
- AC_SUBST([PATH])
- 
--- a/pkgs/development/lua-modules/luv/lib.nix
+++ b/pkgs/development/lua-modules/luv/lib.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation {
  inherit (lua.pkgs.luv) version src meta;

  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "BUILD_STATIC_LIBS" stdenv.hostPlatform.isStatic)
    "-DBUILD_MODULE=OFF"
    "-DWITH_SHARED_LIBUV=ON"
    "-DLUA_BUILD_TYPE=System"
@@ -30,10 +31,7 @@ stdenv.mkDerivation {
    lua
  ];

-  nativeBuildInputs = [
-    cmake
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];

  passthru.tests = {
    # Test luv too
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  fetchpatch,
  buildPythonPackage,
  callPackage,
  setuptools,
@@ -22,30 +21,21 @@

 buildPythonPackage rec {
  pname = "cryptography";
-  version = "49.0.0";
+  version = "50.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pyca";
    repo = "cryptography";
    tag = version;
-    hash = "sha256-yHUIGauFZYnjcoROvocT1UqQ0B8ZuVTaJ0ZAfri6T1E=";
+    hash = "sha256-KHxEVSYr8yrODSVsGNgZowI/YnhG3qnFgae9877H+VE=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-yMCBu/RGRcEQST8tEWCNgVvlQsp2KamOqt60qvOYdt8=";
+    hash = "sha256-heJGLh0MgDPpksWyPLaIkZ5gVEWx8UnaJKv4GvclpmI=";
  };

-  patches = [
-    (fetchpatch {
-      # Add test marks where malloc failure is expected on systems with overcommit enabled
-      name = "malloc-overcommit-mark.patch";
-      url = "https://github.com/pyca/cryptography/commit/2efeba9cc67809b67e659bea8eaea680df2135e8.patch";
-      hash = "sha256-06Z+sk2JTJ50CCnPf2vXyPL5BZeI98oc43LpccenzNg=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace-fail "--benchmark-disable" ""
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -41,14 +41,14 @@

 buildPythonPackage rec {
  pname = "django";
-  version = "5.2.16";
+  version = "5.2.17";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "django";
    repo = "django";
    tag = version;
-    hash = "sha256-DZa3OkqnrgXp1A/HerKYdUdanvi5jxHndo1DV4RVs0M=";
+    hash = "sha256-7it3opzsiN/hHhpipZz4ogmRKGz7E9/LmTF03/UYIB0=";
  };

  patches = [
--- a/pkgs/development/python-modules/gitpython/default.nix
+++ b/pkgs/development/python-modules/gitpython/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "gitpython";
-  version = "3.1.51";
+  version = "3.1.58";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "gitpython-developers";
    repo = "GitPython";
    tag = finalAttrs.version;
-    hash = "sha256-c8tjBvWjVR7krR59Tfx5jKoJc/fcLWVt5D4xk15DvP4=";
+    hash = "sha256-C6hrN7SRWngwkD/NYvsoEVQUagdurkxzWbnn42EJOHE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
  pname = "grpcio-channelz";
-  version = "1.82.1";
+  version = "1.83.0";
  pyproject = true;

  src = fetchPypi {
    pname = "grpcio_channelz";
    inherit version;
-    hash = "sha256-/Q6lQDfasOu4BAaiqH6AmyTUEKLp209mL6IqKZ8AUOs=";
+    hash = "sha256-gaqgIn5UGWGvsnhNNcmWO9sPdmtGQ9JAODmBeKYc9lw=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
  pname = "grpcio-health-checking";
-  version = "1.82.1";
+  version = "1.83.0";
  format = "setuptools";

  src = fetchPypi {
    pname = "grpcio_health_checking";
    inherit version;
-    hash = "sha256-hiVeBOHTnxyXpmMtQbYySTUUCN5cWOhe7eh6/X2YKN0=";
+    hash = "sha256-rWvE1aEQOtcE0lzNgt7zAN+ieZaxhcqz5Mzu7yxoZ9Q=";
  };

  propagatedBuildInputs = [
--- a/Show More
+++ b/Show More