diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 57e443dfd8dc..4669b5eb3d41 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -140,6 +140,8 @@
[pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
for details.
+- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
+
- `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
- Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
diff --git a/nixos/modules/services/audio/mympd.nix b/nixos/modules/services/audio/mympd.nix
index 3e728abaa4de..5f0b027d33bf 100644
--- a/nixos/modules/services/audio/mympd.nix
+++ b/nixos/modules/services/audio/mympd.nix
@@ -108,7 +108,7 @@ in
DynamicUser = true;
ExecStart = lib.getExe cfg.package;
LockPersonality = true;
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
PrivateDevices = true;
ProtectClock = true;
ProtectControlGroups = true;
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index d046076da878..fd29a8c667be 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -752,7 +752,7 @@ in
"AF_INET6"
];
LockPersonality = true;
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
RestrictRealtime = true;
RestrictSUIDSGID = true;
PrivateMounts = true;
diff --git a/nixos/modules/services/mail/cyrus-imap.nix b/nixos/modules/services/mail/cyrus-imap.nix
index 32a9869dd3c7..94b7d35850a8 100644
--- a/nixos/modules/services/mail/cyrus-imap.nix
+++ b/nixos/modules/services/mail/cyrus-imap.nix
@@ -355,7 +355,7 @@ in
PrivateDevices = true;
ProtectSystem = "full";
CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectControlGroups = true;
diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix
index 48b0795c53c1..950ac5859b62 100644
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@@ -1061,7 +1061,7 @@ in
"CAP_SYS_RESOURCE"
];
LockPersonality = true;
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
NoNewPrivileges = false; # e.g for sendmail
OOMPolicy = "continue";
PrivateTmp = true;
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 7839796f1a91..758e8c95c470 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -1011,7 +1011,7 @@ in
PrivateDevices = true;
ProtectSystem = "full";
CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectControlGroups = true;
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 6834ca2008ea..5ed68d6df619 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -777,7 +777,7 @@ in
];
RestrictNamespaces = true;
LockPersonality = true;
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 3a0f637c5ca6..6c334776462a 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -953,7 +953,7 @@ in
++ lib.optional (useSendmail && config.services.postfix.enable) "AF_NETLINK";
RestrictNamespaces = true;
LockPersonality = true;
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
diff --git a/nixos/modules/services/networking/suricata/default.nix b/nixos/modules/services/networking/suricata/default.nix
index 4b3613690b36..ce371b209b44 100644
--- a/nixos/modules/services/networking/suricata/default.nix
+++ b/nixos/modules/services/networking/suricata/default.nix
@@ -273,7 +273,7 @@ in
ProtectSystem = "strict";
DevicePolicy = "closed";
LockPersonality = true;
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
ProtectHostname = true;
ProtectProc = true;
ProtectKernelLogs = true;
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 0a0ccf403ebc..6bf841a0c527 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1614,11 +1614,7 @@ in
];
RestrictNamespaces = true;
LockPersonality = true;
- MemoryDenyWriteExecute =
- !(
- (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
- || (lib.getName cfg.package == "openresty")
- );
+ MemoryDenyWriteExecute = false; # for pcre2 & several plugins
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
diff --git a/nixos/modules/services/web-servers/unit/default.nix b/nixos/modules/services/web-servers/unit/default.nix
index 301f01b5cf48..a1f6be076e2f 100644
--- a/nixos/modules/services/web-servers/unit/default.nix
+++ b/nixos/modules/services/web-servers/unit/default.nix
@@ -139,7 +139,7 @@ in
"AF_INET6"
];
LockPersonality = true;
- MemoryDenyWriteExecute = true;
+ MemoryDenyWriteExecute = false; # pcre2 jit
RestrictRealtime = true;
RestrictSUIDSGID = true;
PrivateMounts = true;
diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix
index 1a9ce996c0dd..69dc6afc9f93 100644
--- a/pkgs/build-support/bintools-wrapper/default.nix
+++ b/pkgs/build-support/bintools-wrapper/default.nix
@@ -478,6 +478,8 @@ stdenvNoCC.mkDerivation {
apple-sdk.__spliced.buildTarget or apple-sdk;
};
+ __structuredAttrs = true;
+
meta =
let
bintools_ = optionalAttrs (bintools != null) bintools;
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index b33f75e34676..4f4b6a9e5911 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -735,7 +735,6 @@ rec {
meta ? { },
passthru ? { },
substitutions ? { },
- __structuredAttrs ? false,
}@args:
script:
runCommand name
@@ -745,10 +744,6 @@ rec {
# Make the position of the derivation accurate.
# Since not having `name` is deprecated, this should be fairly accurate.
pos = lib.unsafeGetAttrPos "name" args;
- # TODO(@Artturin:) substitutions should be inside the env attrset
- # but users are likely passing non-substitution arguments through substitutions
- # turn off __structuredAttrs to unbreak substituteAll
- inherit __structuredAttrs;
pname = name;
version = "26.05pre-git";
inherit meta;
@@ -756,6 +751,7 @@ rec {
inherit propagatedBuildInputs;
inherit propagatedNativeBuildInputs;
strictDeps = true;
+ __structuredAttrs = true;
# TODO 2023-01, no backport: simplify to inherit passthru;
passthru =
passthru
@@ -771,7 +767,9 @@ rec {
recordPropagatedDependencies
''
+ lib.optionalString (substitutions != { }) ''
- substituteAll ${script} $out/nix-support/setup-hook
+ substitute ${script} $out/nix-support/setup-hook ${
+ lib.concatMapAttrsStringSep " " (name: _: "--subst-var ${name}") substitutions
+ }
''
);
diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
index 807d61e658bf..cc897aaa19f7 100644
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -19,6 +19,7 @@
libpulseaudio,
libzip,
nlohmann_json,
+ stb,
SDL2,
spdlog,
tinyxml-2,
@@ -89,12 +90,6 @@ let
'';
};
- stb' = fetchurl {
- name = "stb_image.h";
- url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
- hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
- };
-
stormlib' = applyPatches {
src = fetchFromGitHub {
owner = "ladislav-zezula";
@@ -220,7 +215,7 @@ stdenv.mkDerivation (finalAttrs: {
preConfigure = ''
# mirror 2ship's stb
mkdir stb
- cp ${stb'} ./stb/${stb'.name}
+ cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
cp ${stb_impl} ./stb/${stb_impl.name}
substituteInPlace libultraship/cmake/dependencies/common.cmake \
--replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/ab/abseil-cpp_202505/package.nix b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
index 9dd41332758e..2485b170ce43 100644
--- a/pkgs/by-name/ab/abseil-cpp_202505/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202505/package.nix
@@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
description = "Open-source collection of C++ code designed to augment the C++ standard library";
homepage = "https://abseil.io/";
diff --git a/pkgs/by-name/ab/abseil-cpp_202508/package.nix b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
index 4c5a7b415cfe..c15d08514b2d 100644
--- a/pkgs/by-name/ab/abseil-cpp_202508/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202508/package.nix
@@ -50,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
description = "Open-source collection of C++ code designed to augment the C++ standard library";
homepage = "https://abseil.io/";
diff --git a/pkgs/by-name/ab/abseil-cpp_202601/package.nix b/pkgs/by-name/ab/abseil-cpp_202601/package.nix
index f71a2aedf920..15d8d2a42a22 100644
--- a/pkgs/by-name/ab/abseil-cpp_202601/package.nix
+++ b/pkgs/by-name/ab/abseil-cpp_202601/package.nix
@@ -39,6 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
buildInputs = [ gtest ];
+ __structuredAttrs = true;
+
meta = {
description = "Open-source collection of C++ code designed to augment the C++ standard library";
homepage = "https://abseil.io/";
diff --git a/pkgs/by-name/ad/ada/package.nix b/pkgs/by-name/ad/ada/package.nix
index 79878f5a553b..4afbdecb59de 100644
--- a/pkgs/by-name/ad/ada/package.nix
+++ b/pkgs/by-name/ad/ada/package.nix
@@ -14,13 +14,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "ada";
- version = "3.4.4";
+ version = "4.0.0";
src = fetchFromGitHub {
owner = "ada-url";
repo = "ada";
tag = "v${finalAttrs.version}";
- hash = "sha256-kfUbsqQ+CsqnySKgeL1GFJLcDe1Irivp4CoZG93BZYg=";
+ hash = "sha256-TvjoLUKO2+YgS1mlyglLb+rBLTO/SWSBVA2S34Z6kMI=";
};
nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/argp-standalone/package.nix b/pkgs/by-name/ar/argp-standalone/package.nix
index 3064c3c94f83..a0aacd8ca60b 100644
--- a/pkgs/by-name/ar/argp-standalone/package.nix
+++ b/pkgs/by-name/ar/argp-standalone/package.nix
@@ -22,8 +22,12 @@ stdenv.mkDerivation (finalAttrs: {
ninja
];
+ strictDeps = true;
+
doCheck = true;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://github.com/argp-standalone/argp-standalone";
description = "Standalone version of arguments parsing functions from Glibc";
diff --git a/pkgs/by-name/as/asciidoc/package.nix b/pkgs/by-name/as/asciidoc/package.nix
index 5aee5a2d9108..8ceb6a06a487 100644
--- a/pkgs/by-name/as/asciidoc/package.nix
+++ b/pkgs/by-name/as/asciidoc/package.nix
@@ -151,7 +151,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
src = fetchFromGitHub {
owner = "asciidoc-py";
repo = "asciidoc-py";
- rev = finalAttrs.version;
+ tag = finalAttrs.version;
hash = "sha256-td3C7xTWfSzdo9Bbz0dHW2oPaCQYmUE9H2sUFfg5HH0=";
};
@@ -320,6 +320,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
runHook postCheck
'';
+ __structuredAttrs = true;
+
meta = {
description = "Text-based document generation system";
longDescription = ''
diff --git a/pkgs/by-name/au/auto-patchelf/package.nix b/pkgs/by-name/au/auto-patchelf/package.nix
index 7823a55c72e5..4d5cf55f3236 100644
--- a/pkgs/by-name/au/auto-patchelf/package.nix
+++ b/pkgs/by-name/au/auto-patchelf/package.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation {
buildInputs = [ pythonEnv ];
+ strictDeps = true;
+
src = ./source;
buildPhase = ''
@@ -33,6 +35,8 @@ stdenv.mkDerivation {
runHook postInstall
'';
+ __structuredAttrs = true;
+
meta = {
description = "Automatically patch ELF binaries using patchelf";
mainProgram = "auto-patchelf";
diff --git a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
index bda5329a1df3..b16c98096360 100644
--- a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
+++ b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py
@@ -240,6 +240,35 @@ def find_first_matching_rpath_with_origin(binary: Path, lib_dir: Path, rpaths: l
return Path(rpath)
return None
+
+def relativize_rpath_to_origin(*, binary_path: Path, rpath_entries: list[Path], containing_path: Path) -> list[Path]:
+ """
+ Rewrite absolute RPATH entries to use $ORIGIN when the entry sits
+ under containing_path (the --paths entry the binary was found
+ under).
+
+ The resulting RPATH is relocatable: as long as the directory layout
+ within containing_path is preserved, the whole tree can be moved
+ and the binary will still find its dependencies.
+
+ Entries that already contain $ORIGIN are left untouched.
+ Entries outside containing_path are also left absolute.
+ """
+ containing_norm: Path = Path(os.path.normpath(containing_path))
+ new_rpath_entries: list[Path] = []
+ for entry in rpath_entries:
+ if "$ORIGIN" in entry.as_posix():
+ new_rpath_entries.append(entry)
+ continue
+ entry_norm: Path = Path(os.path.normpath(entry))
+ if not entry_norm.is_relative_to(containing_norm):
+ new_rpath_entries.append(entry)
+ continue
+ rel = os.path.relpath(entry_norm, binary_path.parent)
+ new_rpath_entries.append(Path("$ORIGIN") / rel)
+ return new_rpath_entries
+
+
class Event(Protocol):
"""Protocol for loggable events that occur during the auto-patchelf process."""
def to_human_readable_str(self) -> str: ...
@@ -317,7 +346,18 @@ class Logger:
-def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], append_rpaths: list[Path] = [], keep_libc: bool = False, preserve_origin: bool = False, extra_args: list[str] = []) -> list[Dependency]:
+def auto_patchelf_file(
+ *,
+ logger: Logger,
+ runtime_deps: list[Path],
+ append_rpaths: list[Path] = [],
+ keep_libc: bool = False,
+ preserve_origin: bool = False,
+ relativize_rpath: bool = False,
+ extra_args: list[str] = [],
+ path: Path,
+ containing_path: Path
+) -> list[Dependency]:
try:
with open_elf(path) as elf:
@@ -436,6 +476,9 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
if "$ORIGIN" in existing_rpath:
rpath.append(Path(existing_rpath))
+ if relativize_rpath:
+ rpath = relativize_rpath_to_origin(binary_path=path, rpath_entries=rpath, containing_path=containing_path)
+
# Dedup the rpath
rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath)))
@@ -458,6 +501,7 @@ def auto_patchelf(
append_rpaths: list[Path] = [],
keep_libc: bool = False,
preserve_origin: bool = False,
+ relativize_rpath: bool = False,
add_existing: bool = True,
extra_args: list[str] = []) -> None:
@@ -472,9 +516,20 @@ def auto_patchelf(
populate_cache(lib_dirs)
dependencies = []
- for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
- if not path.is_symlink() and path.is_file():
- dependencies += auto_patchelf_file(logger, path, runtime_deps, append_rpaths, keep_libc, preserve_origin, extra_args)
+ for containing_path in paths_to_patch:
+ for path in glob(containing_path, '*', recursive):
+ if not path.is_symlink() and path.is_file():
+ dependencies += auto_patchelf_file(
+ logger=logger,
+ runtime_deps=runtime_deps,
+ append_rpaths=append_rpaths,
+ keep_libc=keep_libc,
+ preserve_origin=preserve_origin,
+ relativize_rpath=relativize_rpath,
+ extra_args=extra_args,
+ path=path,
+ containing_path=containing_path
+ )
missing = [dep for dep in dependencies if not dep.found]
@@ -560,6 +615,12 @@ def main() -> None:
action="store_true",
help="When possible, replace absolute RPATH entries with original $ORIGIN entries that resolve to the same directory.",
)
+ parser.add_argument(
+ "--relativize-rpath",
+ dest="relativize_rpath",
+ action="store_true",
+ help="Rewrite absolute RPATH entries to use $ORIGIN when the binary and the entry live under the same --paths root, so the patched tree is relocatable.",
+ )
parser.add_argument(
"--ignore-existing",
dest="add_existing",
@@ -597,6 +658,7 @@ def main() -> None:
append_rpaths=args.append_rpaths,
keep_libc=args.keep_libc,
preserve_origin=args.preserve_origin,
+ relativize_rpath=args.relativize_rpath,
add_existing=args.add_existing,
extra_args=args.extra_args)
diff --git a/pkgs/by-name/au/autoconf-archive/package.nix b/pkgs/by-name/au/autoconf-archive/package.nix
index 8a3e537001e7..deca81bdad53 100644
--- a/pkgs/by-name/au/autoconf-archive/package.nix
+++ b/pkgs/by-name/au/autoconf-archive/package.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
buildInputs = [ xz ];
+ __structuredAttrs = true;
+
meta = {
description = "Archive of autoconf m4 macros";
homepage = "https://www.gnu.org/software/autoconf-archive/";
diff --git a/pkgs/by-name/bi/bison/package.nix b/pkgs/by-name/bi/bison/package.nix
index db0d43a5a3ca..b108cc896905 100644
--- a/pkgs/by-name/bi/bison/package.nix
+++ b/pkgs/by-name/bi/bison/package.nix
@@ -28,10 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
"host"
];
- # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
- # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
- # cannot add bash to buildInputs due to infinite recursion
- strictDeps = stdenv.hostPlatform != stdenv.buildPlatform;
+ strictDeps = true;
nativeBuildInputs = [
m4
@@ -40,6 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
++ lib.optional stdenv.hostPlatform.isSunOS help2man;
propagatedBuildInputs = [ m4 ];
+ # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
+ # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
+ # cannot add bash to buildInputs due to infinite recursion
+ postFixup = lib.optionalString (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) ''
+ patchShebangs --build $out/bin/yacc
+ '';
+
enableParallelBuilding = true;
# tests are flaky / timing sensitive on FreeBSD
enableParallelChecking = !stdenv.hostPlatform.isFreeBSD;
@@ -50,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
# TODO: enable doInstallCheck unconditionally when fixed upstream.
doInstallCheck = !stdenv.cc.isClang;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/bison/";
description = "Yacc-compatible parser generator";
diff --git a/pkgs/by-name/bo/boost-build/package.nix b/pkgs/by-name/bo/boost-build/package.nix
index de41ba27871a..732b35fd8fda 100644
--- a/pkgs/by-name/bo/boost-build/package.nix
+++ b/pkgs/by-name/bo/boost-build/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
useBoost.src or (fetchFromGitHub {
owner = "boostorg";
repo = "build";
- rev = defaultVersion;
+ tag = defaultVersion;
sha256 = "1r4rwlq87ydmsdqrik4ly5iai796qalvw7603mridg2nwcbbnf54";
});
@@ -58,6 +58,8 @@ stdenv.mkDerivation {
bison
];
+ strictDeps = true;
+
buildPhase = ''
runHook preBuild
./bootstrap.sh
@@ -76,6 +78,8 @@ stdenv.mkDerivation {
runHook postInstall
'';
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.boost.org/build/";
license = lib.licenses.boost;
diff --git a/pkgs/by-name/br/brotli/package.nix b/pkgs/by-name/br/brotli/package.nix
index c6cc9bc0e8bb..6d26a2de5ac5 100644
--- a/pkgs/by-name/br/brotli/package.nix
+++ b/pkgs/by-name/br/brotli/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
nativeBuildInputs = [ cmake ];
+ strictDeps = true;
+
cmakeFlags = lib.optional staticOnly "-DBUILD_SHARED_LIBS=OFF";
outputs = [
@@ -60,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
updateScript = nix-update-script { };
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://github.com/google/brotli";
changelog = "https://github.com/google/brotli/blob/${finalAttrs.src.tag}/CHANGELOG.md";
diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index c4052964cd91..9ee779721bf0 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -70,6 +70,8 @@ stdenv.mkDerivation {
nativeBuildInputs = [ buildcatrust ];
+ strictDeps = true;
+
buildPhase = ''
mkdir unbundled hashed
buildcatrust \
@@ -247,5 +249,7 @@ stdenv.mkDerivation {
};
};
+ __structuredAttrs = true;
+
inherit meta;
}
diff --git a/pkgs/by-name/ca/catch2/package.nix b/pkgs/by-name/ca/catch2/package.nix
index 5d8315120c08..1565a2d1ae73 100644
--- a/pkgs/by-name/ca/catch2/package.nix
+++ b/pkgs/by-name/ca/catch2/package.nix
@@ -12,14 +12,18 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "catchorg";
repo = "Catch2";
- rev = "v${finalAttrs.version}";
- sha256 = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
+ tag = "v${finalAttrs.version}";
+ hash = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
};
nativeBuildInputs = [ cmake ];
+ strictDeps = true;
+
cmakeFlags = [ "-H.." ];
+ __structuredAttrs = true;
+
meta = {
description = "Multi-paradigm automated test framework for C++ and Objective-C (and, maybe, C)";
homepage = "http://catch-lib.net";
diff --git a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
index 6bd9bda7135a..5171993b8856 100644
--- a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
+++ b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
@@ -6,8 +6,6 @@
makeSetupHook {
name = "check-phase-thread-limit-hook";
- __structuredAttrs = true;
-
meta = {
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ grimmauld ];
diff --git a/pkgs/by-name/ch/chromaprint/package.nix b/pkgs/by-name/ch/chromaprint/package.nix
index 1f4a27adb643..f08c1c0e914e 100644
--- a/pkgs/by-name/ch/chromaprint/package.nix
+++ b/pkgs/by-name/ch/chromaprint/package.nix
@@ -2,7 +2,6 @@
lib,
stdenv,
fetchFromGitHub,
- fetchpatch,
fetchurl,
cmake,
ninja,
@@ -17,23 +16,15 @@
stdenv.mkDerivation (finalAttrs: {
pname = "chromaprint";
- version = "1.6.0";
+ version = "1.6.1";
src = fetchFromGitHub {
owner = "acoustid";
repo = "chromaprint";
tag = "v${finalAttrs.version}";
- hash = "sha256-G3HIMgbjaAXsC+8nt7mkj58xA62qwA8FC+PfTGblhNg=";
+ hash = "sha256-Es903zeZ++9/Xb/npUU3rB0V87DVqwT9uTMbQdSzfJI=";
};
- patches = [
- # fix generated pkg-config files
- (fetchpatch {
- url = "https://github.com/acoustid/chromaprint/commit/782ef6bb5f6498e35f8e275f76998fbd5ffa36d6.patch";
- hash = "sha256-drUfAMzTrqqB5UbzOnfPq6XD3HI+3sxyJJSTCa0BmD8=";
- })
- ];
-
nativeBuildInputs = [
cmake
ninja
diff --git a/pkgs/by-name/co/coreutils/package.nix b/pkgs/by-name/co/coreutils/package.nix
index 9a47b436ae3d..696a0844475e 100644
--- a/pkgs/by-name/co/coreutils/package.nix
+++ b/pkgs/by-name/co/coreutils/package.nix
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
# sandbox does not allow setgid
sed '2i echo Skipping chmod setgid test && exit 77' -i ./tests/chmod/setgid.sh
substituteInPlace ./tests/install/install-C.sh \
- --replace 'mode3=2755' 'mode3=1755'
+ --replace-fail 'mode3=2755' 'mode3=1755'
# Fails on systems with a rootfs. Looks like a bug in the test, see
# https://lists.gnu.org/archive/html/bug-coreutils/2019-12/msg00000.html
@@ -162,6 +162,8 @@ stdenv.mkDerivation (finalAttrs: {
# TODO(@Ericson2314): Investigate whether Darwin could benefit too
++ optional (isCross && stdenv.hostPlatform.libc != "glibc") libiconv;
+ strictDeps = true;
+
hardeningDisable = [ "trivialautovarinit" ];
configureFlags = [
@@ -271,6 +273,8 @@ stdenv.mkDerivation (finalAttrs: {
'';
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/coreutils/";
description = "GNU Core Utilities";
diff --git a/pkgs/by-name/cp/cpio/package.nix b/pkgs/by-name/cp/cpio/package.nix
index d53c81fe6919..30e608bda31f 100644
--- a/pkgs/by-name/cp/cpio/package.nix
+++ b/pkgs/by-name/cp/cpio/package.nix
@@ -2,7 +2,9 @@
lib,
stdenv,
fetchurl,
+ fetchpatch,
autoreconfHook,
+ texinfo,
# for passthru.tests
git,
@@ -20,7 +22,29 @@ stdenv.mkDerivation (finalAttrs: {
hash = "sha256-k3YQuXwymh7JJoVT+3gAN7z/8Nz/6XJevE/ZwaqQdds=";
};
- nativeBuildInputs = [ autoreconfHook ];
+ patches = [
+ (fetchpatch {
+ name = "CVE-2026-66484.patch";
+ url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=e2b9cbdd3354d2b1569b7390d1bc15c1930559ad";
+ hash = "sha256-WjphVpMaI/ePg8MTZx+vvilKzpRAAzhAFwCwrbsPLRE=";
+ })
+ (fetchpatch {
+ name = "CVE-2026-66485.patch";
+ url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=3cd514031371d8aeeaf2048aa10103e02831aaa9";
+ hash = "sha256-YDlROEYYlZERNzzlx1cQD29gV5IrU01aVcZ/sKpWrRo=";
+ })
+ (fetchpatch {
+ name = "CVE-2026-66486.patch";
+ url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=2ff9600c9ef32e88759843cdbde74c8db5ae9b30";
+ excludes = [ "NEWS" ];
+ hash = "sha256-qi9/9xhKnIyPpji63RgzbnnHZsJgwRnQVMaMiLxQipk=";
+ })
+ ];
+
+ nativeBuildInputs = [
+ autoreconfHook
+ texinfo # for makeinfo
+ ];
separateDebugInfo = true;
diff --git a/pkgs/by-name/cr/cryptsetup/package.nix b/pkgs/by-name/cr/cryptsetup/package.nix
index 21ae5fc76b40..0ff0e32e1742 100644
--- a/pkgs/by-name/cr/cryptsetup/package.nix
+++ b/pkgs/by-name/cr/cryptsetup/package.nix
@@ -25,7 +25,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "cryptsetup";
- version = "2.8.6";
+ version = "2.8.7";
outputs = [
"bin"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
url =
"mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/"
+ "cryptsetup-${finalAttrs.version}.tar.xz";
- hash = "sha256-gAQmX9mTiF0I97Yz2+BWhR3hohAwdhOk693HQ/zO/lo=";
+ hash = "sha256-53bw04HobKYQQsRXBpSR/o4KwoZ4DHw7Hk+ZIavJYdo=";
};
patches = [
diff --git a/pkgs/by-name/cu/cunit/package.nix b/pkgs/by-name/cu/cunit/package.nix
index 7d9ee6b0f51d..8c8db5d947bd 100644
--- a/pkgs/by-name/cu/cunit/package.nix
+++ b/pkgs/by-name/cu/cunit/package.nix
@@ -19,11 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
];
buildInputs = [ libtool ];
+ strictDeps = true;
+
src = fetchurl {
url = "mirror://sourceforge/cunit/CUnit/${finalAttrs.version}/CUnit-${finalAttrs.version}.tar.bz2";
sha256 = "057j82da9vv4li4z5ri3227ybd18nzyq81f6gsvhifs5z0vr3cpm";
};
+ __structuredAttrs = true;
+
meta = {
description = "Unit Testing Framework for C";
diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index dd12a5dcef57..10abd55a5977 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -14,7 +14,6 @@
systemdLibs,
acl,
gmp,
- darwin,
libusb1 ? null,
gnutls ? null,
avahi ? null,
@@ -40,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
"lib"
"dev"
"man"
+ "doc"
];
postPatch = ''
diff --git a/pkgs/by-name/da/dash/package.nix b/pkgs/by-name/da/dash/package.nix
index 1b1e6ceeef9d..916d5e54daa3 100644
--- a/pkgs/by-name/da/dash/package.nix
+++ b/pkgs/by-name/da/dash/package.nix
@@ -63,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
homepage = "http://gondor.apana.org.au/~herbert/dash/";
description = "POSIX-compliant implementation of /bin/sh that aims to be as small as possible";
diff --git a/pkgs/by-name/di/diffutils/package.nix b/pkgs/by-name/di/diffutils/package.nix
index ecbd00ec0094..ad36dd91eed9 100644
--- a/pkgs/by-name/di/diffutils/package.nix
+++ b/pkgs/by-name/di/diffutils/package.nix
@@ -12,12 +12,12 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "diffutils";
version = "3.12";
src = fetchurl {
- url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
+ url = "mirror://gnu/diffutils/diffutils-${finalAttrs.version}.tar.xz";
hash = "sha256-fIt/n8hgkUH96pzs6FJJ0whiQ5H/Yd7a9Sj8szdyff0=";
};
@@ -42,6 +42,8 @@ stdenv.mkDerivation rec {
# If no explicit coreutils is given, use the one from stdenv.
buildInputs = [ coreutils ];
+ strictDeps = true;
+
# Disable stack-related gnulib tests on x86_64-darwin because they have problems running under
# Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow and test-sigaction fail.
# Disable all gnulib tests when building on Darwin due to test-nl_langinfo-mt failure
@@ -78,6 +80,8 @@ stdenv.mkDerivation rec {
# Test failure on QEMU only (#300550)
doCheck = !stdenv.buildPlatform.isRiscV64;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/diffutils/diffutils.html";
description = "Commands for showing the differences between files (diff, cmp, etc.)";
@@ -88,4 +92,4 @@ stdenv.mkDerivation rec {
helsinki-Jo
];
};
-}
+})
diff --git a/pkgs/by-name/dn/dns-root-data/package.nix b/pkgs/by-name/dn/dns-root-data/package.nix
index 88499b9fba9d..87517dc95c4e 100644
--- a/pkgs/by-name/dn/dns-root-data/package.nix
+++ b/pkgs/by-name/dn/dns-root-data/package.nix
@@ -27,6 +27,9 @@ stdenv.mkDerivation {
cp ${./root.ds} $out/root.ds
'';
+ strictDeps = true;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.iana.org/domains/root/files";
description = "DNS root data including root hints and DNSSEC root trust anchor + key";
diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix
index 9c86d318fa57..555ba3a1cf12 100644
--- a/pkgs/by-name/du/duckdb/package.nix
+++ b/pkgs/by-name/du/duckdb/package.nix
@@ -5,15 +5,33 @@
cmake,
ninja,
openssl,
- openjdk11,
python3,
- unixodbc,
- withJdbc ? false,
- withOdbc ? false,
versionCheckHook,
}:
let
+ canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+ # Keep this in sync with DuckDBPlatform() in DuckDB's platform.hpp.
+ duckdbPlatform =
+ let
+ os =
+ if stdenv.hostPlatform.isWindows then
+ "windows"
+ else if stdenv.hostPlatform.isDarwin then
+ "osx"
+ else if stdenv.hostPlatform.isFreeBSD then
+ "freebsd"
+ else
+ "linux";
+ arch =
+ if stdenv.hostPlatform.isAarch64 then
+ "arm64"
+ else if stdenv.hostPlatform.is64bit then
+ "amd64"
+ else
+ "i686";
+ in
+ "${os}_${arch}${lib.optionalString stdenv.hostPlatform.isMusl "_musl"}${lib.optionalString stdenv.hostPlatform.isMinGW "_mingw"}";
versions = lib.importJSON ./versions.json;
in
stdenv.mkDerivation (finalAttrs: {
@@ -40,22 +58,19 @@ stdenv.mkDerivation (finalAttrs: {
ninja
python3
];
- buildInputs = [
- openssl
- ]
- ++ lib.optionals withJdbc [ openjdk11 ]
- ++ lib.optionals withOdbc [ unixodbc ];
+ buildInputs = [ openssl ];
cmakeFlags = [
(lib.cmakeFeature "DUCKDB_EXTENSION_CONFIGS" "${finalAttrs.src}/.github/config/in_tree_extensions.cmake")
- (lib.cmakeBool "BUILD_ODBC_DRIVER" withOdbc)
- (lib.cmakeBool "JDBC_DRIVER" withJdbc)
(lib.cmakeFeature "OVERRIDE_GIT_DESCRIBE" "v${finalAttrs.version}-0-g${finalAttrs.rev}")
# development settings
- (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.doInstallCheck)
+ (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.finalPackage.doInstallCheck)
+ ]
+ ++ lib.optionals (!canExecute) [
+ (lib.cmakeFeature "DUCKDB_EXPLICIT_PLATFORM" duckdbPlatform)
];
- doInstallCheck = true;
+ doInstallCheck = canExecute;
nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/ed/ed/package.nix b/pkgs/by-name/ed/ed/package.nix
index 8d97434a822d..11d4f49f4742 100644
--- a/pkgs/by-name/ed/ed/package.nix
+++ b/pkgs/by-name/ed/ed/package.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/ed/";
description = "GNU implementation of the standard Unix editor";
diff --git a/pkgs/by-name/ei/eigen/package.nix b/pkgs/by-name/ei/eigen/package.nix
index c127636f24c3..8b1c86f12fd8 100644
--- a/pkgs/by-name/ei/eigen/package.nix
+++ b/pkgs/by-name/ei/eigen/package.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
ctestCheckHook
];
+ strictDeps = true;
+
cmakeFlags = [
(lib.cmakeBool "EIGEN_LEAVE_TEST_IN_ALL_TARGET" true) # Build tests in parallel
];
@@ -47,6 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
# too many flaky tests
doCheck = false;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://eigen.tuxfamily.org";
description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix
index a66af1cb091b..b0124617be22 100644
--- a/pkgs/by-name/el/elfutils/package.nix
+++ b/pkgs/by-name/el/elfutils/package.nix
@@ -113,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
propagatedNativeBuildInputs = [ setupDebugInfoDirs ];
+ strictDeps = true;
+
hardeningDisable = [ "strictflexarrays3" ];
configureFlags = [
@@ -144,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: {
rev-prefix = "elfutils-";
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://sourceware.org/elfutils/";
description = "Set of utilities to handle ELF objects";
diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index 2e831ef025da..cbc79fe484c8 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -23,13 +23,13 @@ in
stdenv.mkDerivation (finalAttrs: {
pname = "expat";
- version = "2.8.2";
+ version = "2.8.3";
src = fetchurl {
url =
with finalAttrs;
"https://github.com/libexpat/libexpat/releases/download/${tagFor version}/${pname}-${version}.tar.xz";
- hash = "sha256-OtibhYjmZEvU5JmBSA1IshKJ7rvNTwoaSvscKfmbarQ=";
+ hash = "sha256-9iVt+QyQZ3PTRNoIRAK30+TyLtQbGlnJiQmKg9PqDIU=";
};
strictDeps = true;
@@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
changelog = "https://github.com/libexpat/libexpat/blob/${tagFor finalAttrs.version}/expat/Changes";
homepage = "https://libexpat.github.io/";
diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index fffc36fdfbbf..d9440337a1a2 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
nativeCheckInputs = lib.optionals (glibcLocales != null) [ glibcLocales ];
+ strictDeps = true;
+
cmakeFlags = [
(lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false)
(lib.cmakeBool "BENCHMARK_ENABLE_WERROR" false)
@@ -73,6 +75,8 @@ stdenv.mkDerivation (finalAttrs: {
inherit prometheus-cpp;
};
+ __structuredAttrs = true;
+
meta = {
description = "Microbenchmark support library";
homepage = "https://github.com/google/benchmark";
diff --git a/pkgs/by-name/gd/gdbm/package.nix b/pkgs/by-name/gd/gdbm/package.nix
index a31390c4ea3b..df4c6eae1247 100644
--- a/pkgs/by-name/gd/gdbm/package.nix
+++ b/pkgs/by-name/gd/gdbm/package.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation (finalAttrs: {
nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+ strictDeps = true;
+
hardeningDisable = [ "strictflexarrays3" ];
configureFlags = [ (lib.enableFeature true "libgdbm-compat") ];
@@ -63,6 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/gdbm/";
description = "GNU dbm key/value database library";
diff --git a/pkgs/by-name/ge/geoclue2/package.nix b/pkgs/by-name/ge/geoclue2/package.nix
index 951d6e1444c1..a2cf3a7ee8ee 100644
--- a/pkgs/by-name/ge/geoclue2/package.nix
+++ b/pkgs/by-name/ge/geoclue2/package.nix
@@ -29,7 +29,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "geoclue";
- version = "2.8.1";
+ version = "2.8.2";
outputs = [
"out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
owner = "geoclue";
repo = "geoclue";
tag = finalAttrs.version;
- hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg=";
+ hash = "sha256-fjF0yd3+b+q3gTW2PpPNFE6zQafilj/g9rXWSgs/XGE=";
};
patches = [
diff --git a/pkgs/by-name/ge/getopt/package.nix b/pkgs/by-name/ge/getopt/package.nix
index 27014776c148..866ce3db12ee 100644
--- a/pkgs/by-name/ge/getopt/package.nix
+++ b/pkgs/by-name/ge/getopt/package.nix
@@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {
# attempt to use C library functions without declaring them, which is raised as an error.
env.NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
+ strictDeps = true;
+
makeFlags = [
"WITHOUT_GETTEXT=1"
"LIBCGETOPT=0"
@@ -23,6 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
"CC:=$(CC)"
];
+ __structuredAttrs = true;
+
meta = {
platforms = lib.platforms.unix;
homepage = "http://frodo.looijaard.name/project/getopt";
diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index a6fe8a13efc3..f20fdd8eaf3e 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -133,6 +133,12 @@ stdenv.mkDerivation (finalAttrs: {
url = "https://lore.kernel.org/git/20260504101429.340123-1-joerg@thalheim.io/raw";
hash = "sha256-44EPfEJ39LjPWjqjFb52EKNaJGzYxZzJaJOis8QnazU=";
})
+ # Fix fortify darwin crashes when dealing with unicode filenames.
+ (fetchurl {
+ name = "darwin-unicode-filename-fix.patch";
+ url = "https://lore.kernel.org/git/20260704233724.16928-1-ihar.hrachyshka@gmail.com/raw";
+ hash = "sha256-lpGz3nFKQvFDtW2TtQLx/684ECJVBLGPGqip0XEtOdU=";
+ })
]
++ lib.optionals withSsh [
# Hard-code the ssh executable to ${pkgs.openssh}/bin/ssh instead of
@@ -207,6 +213,8 @@ stdenv.mkDerivation (finalAttrs: {
buildPackages.stdenv.cc
];
+ strictDeps = true;
+
env = {
# required to support pthread_cancel()
NIX_LDFLAGS =
@@ -228,7 +236,7 @@ stdenv.mkDerivation (finalAttrs: {
];
preBuild = ''
- makeFlagsArray+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
+ makeFlags+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
'';
makeFlags = [
@@ -274,7 +282,7 @@ stdenv.mkDerivation (finalAttrs: {
''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}}
SHELL="$SHELL"
)
- concatTo flagsArray makeFlags makeFlagsArray buildFlags buildFlagsArray
+ concatTo flagsArray makeFlags buildFlags
echoCmd 'build flags' "''${flagsArray[@]}"
''
+ lib.optionalString withManual ''
@@ -335,7 +343,7 @@ stdenv.mkDerivation (finalAttrs: {
''${enableParallelInstalling:+-j''${NIX_BUILD_CORES}}
SHELL="$SHELL"
)
- concatTo flagsArray makeFlags makeFlagsArray installFlags installFlagsArray
+ concatTo flagsArray makeFlags installFlags
echoCmd 'install flags' "''${flagsArray[@]}"
# Install git-subtree.
@@ -478,7 +486,7 @@ stdenv.mkDerivation (finalAttrs: {
installCheckTarget = "test";
- # see also installCheckFlagsArray
+ # see also installCheckFlags in preInstallCheck
installCheckFlags = [
"DEFAULT_TEST_TARGET=prove"
"PERL_PATH=${buildPackages.perl}/bin/perl"
@@ -502,7 +510,7 @@ stdenv.mkDerivation (finalAttrs: {
NIX_BUILD_CORES=32
fi
- installCheckFlagsArray+=(
+ installCheckFlags+=(
GIT_PROVE_OPTS="--jobs $NIX_BUILD_CORES --failures --state=failed,save"
GIT_TEST_INSTALLED=$out/bin
${lib.optionalString (!svnSupport) "NO_SVN_TESTS=y"}
diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index d504331900ce..b671ab262978 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
description = "C library of programming buildings blocks";
homepage = "https://gitlab.gnome.org/GNOME/glib";
diff --git a/pkgs/by-name/gn/gnu-config/package.nix b/pkgs/by-name/gn/gnu-config/package.nix
index 80baba133a06..fc52ff2e9b6d 100644
--- a/pkgs/by-name/gn/gnu-config/package.nix
+++ b/pkgs/by-name/gn/gnu-config/package.nix
@@ -67,6 +67,8 @@ stdenv.mkDerivation {
strictDeps = true;
+ __structuredAttrs = true;
+
meta = {
description = "Attempt to guess a canonical system name";
homepage = "https://savannah.gnu.org/projects/config";
diff --git a/pkgs/by-name/gn/gnugrep/package.nix b/pkgs/by-name/gn/gnugrep/package.nix
index 9f0ecedd8792..03b965b7268b 100644
--- a/pkgs/by-name/gn/gnugrep/package.nix
+++ b/pkgs/by-name/gn/gnugrep/package.nix
@@ -15,16 +15,12 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-let
- version = "3.12";
-in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
pname = "gnugrep";
- inherit version;
+ version = "3.12";
src = fetchurl {
- url = "mirror://gnu/grep/grep-${version}.tar.xz";
+ url = "mirror://gnu/grep/grep-${finalAttrs.version}.tar.xz";
hash = "sha256-JkmyfA6Q5jLq3NdXvgbG6aT0jZQd5R58D4P/dkCKB7k=";
};
@@ -39,13 +35,9 @@ stdenv.mkDerivation {
# - on Musl: https://github.com/NixOS/nixpkgs/pull/228714
# - on x86_64-darwin: https://github.com/NixOS/nixpkgs/pull/228714#issuecomment-1576826330
# - when building on Darwin (cross-compilation): test-nl_langinfo-mt fails
- postPatch =
- if stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin then
- ''
- sed -i 's:gnulib-tests::g' Makefile.in
- ''
- else
- null;
+ postPatch = lib.optionalString (stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin) ''
+ substituteInPlace Makefile.in --replace-fail "gnulib-tests" ""
+ '';
nativeCheckInputs = [
perl
@@ -63,6 +55,8 @@ stdenv.mkDerivation {
]
++ lib.optional (!stdenv.hostPlatform.isWindows) runtimeShellPackage;
+ strictDeps = true;
+
# cygwin: FAIL: multibyte-white-space
# freebsd: FAIL mb-non-UTF8-performance
# x86_64-darwin: fails 'stack-overflow' tests on Rosetta 2 emulator
@@ -97,6 +91,8 @@ stdenv.mkDerivation {
NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/grep/";
description = "GNU implementation of the Unix grep command";
@@ -116,7 +112,7 @@ stdenv.mkDerivation {
teams = [ lib.teams.security-review ];
platforms = lib.platforms.all;
mainProgram = "grep";
- identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version // {
+ identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version // {
product = "grep";
};
};
@@ -124,4 +120,4 @@ stdenv.mkDerivation {
passthru = {
inherit pcre2;
};
-}
+})
diff --git a/pkgs/by-name/gn/gnum4/package.nix b/pkgs/by-name/gn/gnum4/package.nix
index 73c5be0ac04e..78e02d2698fa 100644
--- a/pkgs/by-name/gn/gnum4/package.nix
+++ b/pkgs/by-name/gn/gnum4/package.nix
@@ -47,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
]
++ lib.optional stdenv.hostPlatform.isMinGW "CFLAGS=-fno-stack-protector";
+ __structuredAttrs = true;
+
meta = {
description = "GNU M4, a macro processor";
longDescription = ''
diff --git a/pkgs/by-name/gn/gnumake/package.nix b/pkgs/by-name/gn/gnumake/package.nix
index 9f2aa3d764e9..bde1af39133b 100644
--- a/pkgs/by-name/gn/gnumake/package.nix
+++ b/pkgs/by-name/gn/gnumake/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "mirror://gnu/make/make-${finalAttrs.version}.tar.gz";
- sha256 = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
+ hash = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
};
# To update patches:
@@ -82,6 +82,8 @@ stdenv.mkDerivation (finalAttrs: {
gnumakeWithGuile = gnumake.override { guileSupport = true; };
};
+ __structuredAttrs = true;
+
meta = {
description = "Tool to control the generation of non-source files from sources";
longDescription = ''
diff --git a/pkgs/by-name/gn/gnupatch/package.nix b/pkgs/by-name/gn/gnupatch/package.nix
index e32573c05048..361365accfb3 100644
--- a/pkgs/by-name/gn/gnupatch/package.nix
+++ b/pkgs/by-name/gn/gnupatch/package.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
strictDeps = true;
+ __structuredAttrs = true;
+
meta = {
description = "GNU Patch, a program to apply differences to files";
mainProgram = "patch";
diff --git a/pkgs/by-name/gn/gnutls/package.nix b/pkgs/by-name/gn/gnutls/package.nix
index c132697abbd7..df21d5943035 100644
--- a/pkgs/by-name/gn/gnutls/package.nix
+++ b/pkgs/by-name/gn/gnutls/package.nix
@@ -58,12 +58,12 @@ let
util-linux = util-linuxMinimal;
in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "gnutls";
version = "3.8.13";
src = fetchurl {
- url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz";
+ url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor finalAttrs.version}/gnutls-${finalAttrs.version}.tar.xz";
hash = "sha256-/+2Owb8JwkJtTxSq43feR1O1PlN9aF5gTpmosWypyX4=";
};
@@ -173,6 +173,8 @@ stdenv.mkDerivation rec {
propagatedBuildInputs = [ nettle ];
+ strictDeps = true;
+
inherit doCheck;
# stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests.
# Also empty files won't work, and we want to avoid potentially impure /etc/
@@ -215,6 +217,8 @@ stdenv.mkDerivation rec {
static = pkgsStatic.gnutls;
};
+ __structuredAttrs = true;
+
meta = {
description = "GNU Transport Layer Security Library";
@@ -236,6 +240,6 @@ stdenv.mkDerivation rec {
license = lib.licenses.lgpl21Plus;
maintainers = with lib.maintainers; [ vcunat ];
platforms = lib.platforms.all;
- identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
+ identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
};
-}
+})
diff --git a/pkgs/by-name/gr/graphviz/package.nix b/pkgs/by-name/gr/graphviz/package.nix
index 6eae0490bca2..1a0439dbe8cc 100644
--- a/pkgs/by-name/gr/graphviz/package.nix
+++ b/pkgs/by-name/gr/graphviz/package.nix
@@ -40,13 +40,13 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "graphviz";
- version = "15.1.0";
+ version = "15.1.1";
src = fetchFromGitLab {
owner = "graphviz";
repo = "graphviz";
tag = finalAttrs.version;
- hash = "sha256-5v/ib8hwqHrJLs+jvDGvg0aJiKIt8ipXEd1EUzew7XU=";
+ hash = "sha256-nDuLQfYu0fzJXS8/oH6Bv9gGuLK+FwwgbPQE+nVKelw=";
};
nativeBuildInputs = [
diff --git a/pkgs/by-name/gt/gtest/package.nix b/pkgs/by-name/gt/gtest/package.nix
index 49d5de368f04..fec50046d186 100644
--- a/pkgs/by-name/gt/gtest/package.nix
+++ b/pkgs/by-name/gt/gtest/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "google";
repo = "googletest";
- rev = "v${finalAttrs.version}";
+ tag = "v${finalAttrs.version}";
hash = "sha256-HIHMxAUR4bjmFLoltJeIAVSulVQ6kVuIT2Ku+lwAx/4=";
};
@@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
re2
];
+ strictDeps = true;
+
cmakeFlags = [
"-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
]
@@ -64,6 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
]
++ lib.optional withAbseil "-DGTEST_HAS_ABSL=ON";
+ __structuredAttrs = true;
+
meta = {
description = "Google's framework for writing C++ tests";
homepage = "https://github.com/google/googletest";
diff --git a/pkgs/by-name/gt/gtk-doc/package.nix b/pkgs/by-name/gt/gtk-doc/package.nix
index 9f58e9fb8f75..475149609a7b 100644
--- a/pkgs/by-name/gt/gtk-doc/package.nix
+++ b/pkgs/by-name/gt/gtk-doc/package.nix
@@ -14,7 +14,7 @@
dblatex,
}:
-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
pname = "gtk-doc";
version = "1.36.1";
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
domain = "gitlab.gnome.org";
owner = "GNOME";
repo = "gtk-doc";
- tag = version;
+ tag = finalAttrs.version;
hash = "sha256-8hB43BCAtT1B7/ak2i0FAlYD3Kb4rNCWfsJ+wqGu3FA=";
};
@@ -85,12 +85,14 @@ python3.pkgs.buildPythonApplication rec {
};
};
+ __structuredAttrs = true;
+
meta = {
- changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${src.tag}/NEWS";
+ changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${finalAttrs.src.tag}/NEWS";
description = "Tools to extract documentation embedded in GTK and GNOME source code";
homepage = "https://gitlab.gnome.org/GNOME/gtk-doc";
license = lib.licenses.gpl2Plus;
maintainers = with lib.maintainers; [ pSub ];
teams = [ lib.teams.gnome ];
};
-}
+})
diff --git a/pkgs/by-name/hd/hdrhistogram_c/package.nix b/pkgs/by-name/hd/hdrhistogram_c/package.nix
index 3ebcbe73e089..4c0f3a16cfeb 100644
--- a/pkgs/by-name/hd/hdrhistogram_c/package.nix
+++ b/pkgs/by-name/hd/hdrhistogram_c/package.nix
@@ -32,6 +32,20 @@ stdenv.mkDerivation (finalAttrs: {
validatePkgConfig
];
+ cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [
+ (lib.cmakeBool "HDR_HISTOGRAM_BUILD_SHARED" false)
+ # Examples and tests depend on the shared library target; skip them in
+ # static builds (tests still run for the regular pkgs.hdrhistogram_c build).
+ (lib.cmakeBool "HDR_HISTOGRAM_BUILD_PROGRAMS" false)
+ ];
+
+ # The .pc file always references -lhdr_histogram, but in static builds only
+ # libhdr_histogram_static.a is produced. Provide a symlink so pkg-config
+ # consumers find the right archive.
+ postInstall = lib.optionalString stdenv.hostPlatform.isStatic ''
+ ln -s $out/lib/libhdr_histogram_static.a $out/lib/libhdr_histogram.a
+ '';
+
doCheck = true;
passthru = {
diff --git a/pkgs/by-name/he/help2man/package.nix b/pkgs/by-name/he/help2man/package.nix
index aee62e34cb57..7e19937f788d 100644
--- a/pkgs/by-name/he/help2man/package.nix
+++ b/pkgs/by-name/he/help2man/package.nix
@@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
chmod +x $out/bin/help2man
'';
+ __structuredAttrs = true;
+
meta = {
description = "Generate man pages from `--help' output";
mainProgram = "help2man";
diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix
index 2ad8fa7c8a26..dd3baede3a0f 100644
--- a/pkgs/by-name/ip/iproute2/package.nix
+++ b/pkgs/by-name/ip/iproute2/package.nix
@@ -16,24 +16,25 @@
pkgsStatic,
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "iproute2";
version = "7.1.0";
src = fetchurl {
- url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${version}.tar.xz";
+ url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${finalAttrs.version}.tar.xz";
hash = "sha256-/Z+huVgJQXFXyoPdcpV+MmG9vOiWNTy5NvgK8LM6S1w=";
};
postPatch = ''
substituteInPlace Makefile \
- --replace "CC := gcc" "CC ?= $CC"
+ --replace-fail "CC := gcc" "CC ?= $CC"
'';
outputs = [
"out"
"dev"
"scripts"
+ "man"
];
configureFlags = [
@@ -44,7 +45,6 @@ stdenv.mkDerivation rec {
makeFlags = [
"PREFIX=$(out)"
"SBINDIR=$(out)/sbin"
- "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs
"HDRDIR=$(dev)/include/iproute2"
]
++ lib.optionals stdenv.hostPlatform.isStatic [
@@ -86,6 +86,8 @@ stdenv.mkDerivation rec {
libbpf
];
+ __structuredAttrs = true;
+ strictDeps = true;
enableParallelBuilding = true;
passthru.updateScript = gitUpdater {
@@ -105,4 +107,4 @@ stdenv.mkDerivation rec {
fpletz
];
};
-}
+})
diff --git a/pkgs/by-name/jq/jq/package.nix b/pkgs/by-name/jq/jq/package.nix
index 762562f1c7b3..fdd171b08316 100644
--- a/pkgs/by-name/jq/jq/package.nix
+++ b/pkgs/by-name/jq/jq/package.nix
@@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
'';
strictDeps = true;
+ __structuredAttrs = true;
enableParallelBuilding = true;
buildInputs = lib.optionals onigurumaSupport [ oniguruma ];
diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix
index fe81d018859c..7164e86c9d7a 100644
--- a/pkgs/by-name/li/libarchive/package.nix
+++ b/pkgs/by-name/li/libarchive/package.nix
@@ -32,13 +32,13 @@
assert xarSupport -> libxml2 != null;
stdenv.mkDerivation (finalAttrs: {
pname = "libarchive";
- version = "3.8.8";
+ version = "3.8.9";
src = fetchFromGitHub {
owner = "libarchive";
repo = "libarchive";
rev = "v${finalAttrs.version}";
- hash = "sha256-l8xh+z6lP7VnxMIf9tfoSByerjwN6Z4dE3JNA9zS3LM=";
+ hash = "sha256-/CoInUlOiFvR83mEeV3Tx+2SQGywWDQ4nY+NstE/cP4=";
};
outputs = [
@@ -108,6 +108,8 @@ stdenv.mkDerivation (finalAttrs: {
acl
];
+ strictDeps = true;
+
hardeningDisable = [
"strictflexarrays3"
]
@@ -140,6 +142,8 @@ stdenv.mkDerivation (finalAttrs: {
enableParallelBuilding = true;
+ __structuredAttrs = true;
+
meta = {
homepage = "http://libarchive.org";
description = "Multi-format archive and compression library";
diff --git a/pkgs/by-name/li/libblake3/package.nix b/pkgs/by-name/li/libblake3/package.nix
index 08740597b3a3..74cc4afc1445 100644
--- a/pkgs/by-name/li/libblake3/package.nix
+++ b/pkgs/by-name/li/libblake3/package.nix
@@ -10,7 +10,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "libblake3";
- version = "1.8.5";
+ version = "1.8.6";
outputs = [
"out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
owner = "BLAKE3-team";
repo = "BLAKE3";
tag = finalAttrs.version;
- hash = "sha256-4Oany3uk0759YIZgD1gsONSFU1Mn/GAMvsSeP33J9Ts=";
+ hash = "sha256-dCRtXHTJnDSJQ2T5bux+ND4e+5uRIoUFn5gYXvMfZi8=";
};
sourceRoot = finalAttrs.src.name + "/c";
diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix
index 8930cd4d6aee..403a2f70c0bf 100644
--- a/pkgs/by-name/li/libcamera/package.nix
+++ b/pkgs/by-name/li/libcamera/package.nix
@@ -10,6 +10,7 @@
libdrm,
libevent,
libyaml,
+ libyuv,
gst_all_1,
gtest,
graphviz,
@@ -18,21 +19,26 @@
python3Packages,
udev,
libpisp,
+ libglvnd,
withTracing ? lib.meta.availableOn stdenv.hostPlatform lttng-ust,
lttng-ust, # withTracing
- withQcam ? false,
- qt6, # withQcam
- libtiff, # withQcam
+ withSoftispGPU ? true, # software ISP GPU acceleration
+ withQcam ? false, # cannot be enabled per default as it causes infinite recursion
+ # withQcam
+ qt6,
+ libjpeg,
+ libtiff,
+ SDL2,
}:
stdenv.mkDerivation rec {
pname = "libcamera";
- version = "0.7.0";
+ version = "0.7.2";
src = fetchgit {
url = "https://git.libcamera.org/libcamera/libcamera.git";
rev = "v${version}";
- hash = "sha256-W9pRE8/0Cf2EEP5bbvy4FsDSeKKSklfJb6T48ZN4dzE=";
+ hash = "sha256-vhFkeT1j2KKm+CVvGrtH5BEYJSEdaX7N7DRdA0a9EWk=";
};
outputs = [
@@ -80,6 +86,8 @@ stdenv.mkDerivation rec {
# pycamera
python3Packages.pybind11
+ libyuv
+
# yamlparser
libyaml
@@ -87,10 +95,13 @@ stdenv.mkDerivation rec {
]
++ lib.optionals stdenv.hostPlatform.isAarch [ libpisp ]
++ lib.optionals withTracing [ lttng-ust ]
+ ++ lib.optionals withSoftispGPU [ libglvnd ]
++ lib.optionals withQcam [
+ libjpeg
libtiff
qt6.qtbase
qt6.qttools
+ SDL2
];
nativeBuildInputs = [
@@ -109,22 +120,27 @@ stdenv.mkDerivation rec {
++ lib.optional withQcam qt6.wrapQtAppsHook;
mesonFlags = [
- "-Dv4l2=true"
+ (lib.mesonEnable "v4l2" true)
(lib.mesonEnable "tracing" withTracing)
(lib.mesonEnable "qcam" withQcam)
- "-Dlibunwind=disabled"
- "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
+ (lib.mesonEnable "apps-output-dng" withQcam)
+ (lib.mesonEnable "cam-output-sdl2" withQcam)
+ (lib.mesonEnable "cam-jpeg" withQcam)
+ (lib.mesonEnable "softisp-gpu" withSoftispGPU)
+ (lib.mesonEnable "libunwind" false)
+ (lib.mesonEnable "libdw" false)
+ (lib.mesonEnable "lc-compliance" false) # tries unconditionally to download gtest when enabled
# Avoid blanket -Werror to evade build failures on less
# tested compilers.
- "-Dwerror=false"
+ (lib.mesonBool "werror" false)
# Documentation breaks binary compatibility.
# Given that upstream also provides public documentation,
# we can disable it here.
- "-Ddocumentation=disabled"
+ (lib.mesonEnable "documentation" false)
]
++ lib.optionals stdenv.hostPlatform.isAarch [
# we don't have tensorflow-lite to build this
- "-Drpi-awb-nn=disabled"
+ (lib.mesonEnable "rpi-awb-nn" false)
];
env = {
diff --git a/pkgs/by-name/li/libcanberra/package.nix b/pkgs/by-name/li/libcanberra/package.nix
index baad63c8bf83..7c8f51c0aaad 100644
--- a/pkgs/by-name/li/libcanberra/package.nix
+++ b/pkgs/by-name/li/libcanberra/package.nix
@@ -11,8 +11,8 @@
gst_all_1,
libvorbis,
libcap,
- withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
- systemd,
+ withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+ systemdLibs,
withAlsa ? stdenv.hostPlatform.isLinux,
alsa-lib,
}:
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
])
++ lib.optional (gtkSupport == "gtk3") gtk3-x11
++ lib.optional stdenv.hostPlatform.isLinux libcap
- ++ lib.optional withSystemd systemd
+ ++ lib.optional withSystemd systemdLibs
++ lib.optional withAlsa alsa-lib;
configureFlags = [
diff --git a/pkgs/by-name/li/libedit/package.nix b/pkgs/by-name/li/libedit/package.nix
index b74e107981a8..fd14cb442404 100644
--- a/pkgs/by-name/li/libedit/package.nix
+++ b/pkgs/by-name/li/libedit/package.nix
@@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: {
ncurses
];
+ strictDeps = true;
+
# GCC automatically include `stdc-predefs.h` while Clang does not do this by
# default. While Musl is ISO 10646 compliant, it does not define
# __STDC_ISO_10646__.
@@ -50,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
xargs sed -i -e 's,-lncurses[a-z]*,-L${ncurses.out}/lib -lncursesw,g'
'';
+ __structuredAttrs = true;
+
meta = {
homepage = "http://www.thrysoee.dk/editline/";
changelog = "https://www.thrysoee.dk/editline/#changelog";
diff --git a/pkgs/by-name/li/libev/package.nix b/pkgs/by-name/li/libev/package.nix
index e51b04890ee6..cdb8e7264232 100644
--- a/pkgs/by-name/li/libev/package.nix
+++ b/pkgs/by-name/li/libev/package.nix
@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+ strictDeps = true;
+
configureFlags = lib.optional static "LDFLAGS=-static";
makeFlags =
@@ -42,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
"LDFLAGS+=-lws2_32"
]);
+ __structuredAttrs = true;
+
meta = {
description = "High-performance event loop/event model with lots of features";
homepage = "https://software.schmorp.de/pkg/libev.html";
diff --git a/pkgs/by-name/li/libevent/package.nix b/pkgs/by-name/li/libevent/package.nix
index d220a63c4963..05d16036ed14 100644
--- a/pkgs/by-name/li/libevent/package.nix
+++ b/pkgs/by-name/li/libevent/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
# Don't define BIO_get_init() for LibreSSL 3.5+
(fetchpatch {
url = "https://github.com/libevent/libevent/commit/883630f76cbf512003b81de25cd96cb75c6cf0f9.patch";
- sha256 = "sha256-VPJqJUAovw6V92jpqIXkIR1xYGbxIWxaHr8cePWI2SU=";
+ hash = "sha256-VPJqJUAovw6V92jpqIXkIR1xYGbxIWxaHr8cePWI2SU=";
})
];
@@ -59,6 +59,8 @@ stdenv.mkDerivation (finalAttrs: {
buildInputs =
lib.optional sslSupport openssl ++ lib.optional stdenv.hostPlatform.isCygwin findutils;
+ strictDeps = true;
+
doCheck = false; # needs the net
postInstall = lib.optionalString sslSupport ''
@@ -70,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
enableParallelBuilding = true;
+ __structuredAttrs = true;
+
meta = {
description = "Event notification library";
mainProgram = "event_rpcgen.py";
diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix
index 069f6508d0ce..89031a595b68 100644
--- a/pkgs/by-name/li/libffiReal/package.nix
+++ b/pkgs/by-name/li/libffiReal/package.nix
@@ -13,13 +13,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "libffi";
- version = "3.7.1";
+ version = "3.8.0";
src = fetchurl {
url =
with finalAttrs;
"https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
- hash = "sha256-1emmY43b0lE921RRjrZ+S75vpwe8wBwQ9iEvCgiNgZ0=";
+ hash = "sha256-faPi2aFx6woDj1kuytP/K7JVDzSW2Hs7Ka0M9EMMDbQ=";
};
# Note: this package is used for bootstrapping fetchurl, and thus
@@ -73,6 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
description = "Foreign function call interface library";
longDescription = ''
diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix
index bfa7ff5c49c7..0e23409dcd67 100644
--- a/pkgs/by-name/li/libgcrypt/package.nix
+++ b/pkgs/by-name/li/libgcrypt/package.nix
@@ -16,12 +16,12 @@
assert enableCapabilities -> stdenv.hostPlatform.isLinux;
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "libgcrypt";
version = "1.12.2";
src = fetchurl {
- url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
+ url = "mirror://gnupg/libgcrypt/libgcrypt-${finalAttrs.version}.tar.bz2";
hash = "sha256-fOM8JJIiGgQ2+WqFACFenz49y1/SanV81BXnqEO6vV4=";
};
@@ -123,13 +123,15 @@ stdenv.mkDerivation rec {
inherit gnupg libotr rsyslog;
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/libgcrypt/";
- changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=${pname}.git;a=blob;f=NEWS;hb=refs/tags/${pname}-${version}";
+ changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=NEWS;hb=refs/tags/libgcrypt-${finalAttrs.version}";
description = "General-purpose cryptographic library";
license = lib.licenses.lgpl2Plus;
platforms = lib.platforms.all;
maintainers = [ ];
- identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" version;
+ identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" finalAttrs.version;
};
-}
+})
diff --git a/pkgs/by-name/li/libmpc/package.nix b/pkgs/by-name/li/libmpc/package.nix
index 4bfea7b7bd24..d29fcc4dc70b 100644
--- a/pkgs/by-name/li/libmpc/package.nix
+++ b/pkgs/by-name/li/libmpc/package.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
doCheck = true; # not cross;
+ __structuredAttrs = true;
+
meta = {
description = "Library for multiprecision complex arithmetic with exact rounding";
diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix
index a946663f2f4c..5a0590c209f5 100644
--- a/pkgs/by-name/li/libnice/package.nix
+++ b/pkgs/by-name/li/libnice/package.nix
@@ -1,21 +1,28 @@
{
lib,
stdenv,
- fetchurl,
+ testers,
+ fetchFromGitLab,
fetchpatch,
+ nix-update-script,
meson,
ninja,
pkg-config,
- python3,
- gobject-introspection,
- gtk-doc,
- docbook_xsl,
- docbook_xml_dtd_412,
glib,
gupnp-igd,
gst_all_1,
gnutls,
+ enableDocumentation ? stdenv.buildPlatform == stdenv.hostPlatform,
+ gtk-doc,
+ docbook_xsl,
+ docbook_xml_dtd_412,
graphviz,
+ python3,
+ withIntrospection ?
+ lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+ && stdenv.hostPlatform.emulatorAvailable buildPackages,
+ buildPackages,
+ gobject-introspection,
}:
stdenv.mkDerivation (finalAttrs: {
@@ -27,11 +34,14 @@ stdenv.mkDerivation (finalAttrs: {
"out"
"dev"
]
- ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
+ ++ lib.optionals enableDocumentation [ "devdoc" ];
- src = fetchurl {
- url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz";
- hash = "sha256-YY/E6N45O3GbFkHB2O7AGCbU050VrekmedIhx/Xk5w0=";
+ src = fetchFromGitLab {
+ domain = "gitlab.freedesktop.org";
+ owner = "libnice";
+ repo = "libnice";
+ tag = finalAttrs.version;
+ hash = "sha256-UPppE5kBois0jJwsHKefBC8iTfSIkPZXV6XnUBnEFn8=";
};
patches = [
@@ -51,18 +61,26 @@ stdenv.mkDerivation (finalAttrs: {
./musl.patch
];
+ # specifies <1.30, but also works with later versions
+ postPatch = ''
+ substituteInPlace docs/reference/libnice/meson.build \
+ --replace-fail "version: '<1.30', " ""
+ '';
+
nativeBuildInputs = [
meson
ninja
pkg-config
- python3
+ ]
+ ++ lib.optionals withIntrospection [
gobject-introspection
-
- # documentation
+ ]
+ ++ lib.optionals enableDocumentation [
gtk-doc
docbook_xsl
docbook_xml_dtd_412
graphviz
+ python3
];
buildInputs = [
@@ -76,16 +94,28 @@ stdenv.mkDerivation (finalAttrs: {
glib
];
- mesonFlags = [
- "-Dgtk_doc=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
- "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
- "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
- ];
+ mesonFlags = lib.mapAttrsToList lib.mesonEnable {
+ gtk_doc = enableDocumentation;
+ introspection = withIntrospection;
+
+ # requires many dependencies and probably not useful for our users
+ examples = false;
+ tests = finalAttrs.finalPackage.doCheck;
+
+ gstreamer = true;
+
+ glib_debug = false;
+ };
# Tests are flaky
# see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295
doCheck = false;
+ passthru = {
+ updateScript = nix-update-script { };
+ tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+ };
+
meta = {
changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS";
description = "GLib ICE implementation";
@@ -97,10 +127,12 @@ stdenv.mkDerivation (finalAttrs: {
It provides a GLib-based library, libnice and a Glib-free library,
libstun as well as GStreamer elements.'';
homepage = "https://libnice.freedesktop.org/";
+ pkgConfigModules = [ "nice" ];
platforms = lib.platforms.unix;
license = with lib.licenses; [
lgpl21
mpl11
];
+ maintainers = with lib.maintainers; [ tmarkus ];
};
})
diff --git a/pkgs/by-name/li/libpcap/package.nix b/pkgs/by-name/li/libpcap/package.nix
index fefde4c82aa9..5abab91f1a89 100644
--- a/pkgs/by-name/li/libpcap/package.nix
+++ b/pkgs/by-name/li/libpcap/package.nix
@@ -12,7 +12,7 @@
pkg-config,
rdma-core,
withBluez ? false,
- withRdma ? false,
+ withRdma ? lib.meta.availableOn stdenv.hostPlatform rdma-core,
withRemote ? false,
# for passthru.tests
diff --git a/pkgs/by-name/li/libpfm/package.nix b/pkgs/by-name/li/libpfm/package.nix
index 87dcac45923c..e2c1362ea74a 100644
--- a/pkgs/by-name/li/libpfm/package.nix
+++ b/pkgs/by-name/li/libpfm/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "mirror://sourceforge/perfmon2/libpfm4/libpfm-${finalAttrs.version}.tar.gz";
- sha256 = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
+ hash = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
};
# Don't install libpfm.so on windows as it doesn't exist
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
# See: https://github.com/NixOS/nixpkgs/pull/252982#discussion_r1314346216
postPatch = ''
substituteInPlace config.mk examples/Makefile \
- --replace '($(SYS),WINDOWS)' '($(SYS),Windows)'
+ --replace-fail '($(SYS),WINDOWS)' '($(SYS),Windows)'
'';
makeFlags = [
@@ -33,11 +33,17 @@ stdenv.mkDerivation (finalAttrs: {
"SYS=${stdenv.hostPlatform.uname.system}"
];
- env.NIX_CFLAGS_COMPILE = "-Wno-error";
- env.CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n";
+ env = {
+ NIX_CFLAGS_COMPILE = "-Wno-error";
+ CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n";
+ };
buildInputs = lib.optional stdenv.hostPlatform.isMinGW windows.libgnurx;
+ strictDeps = true;
+
+ __structuredAttrs = true;
+
meta = {
description = "Helper library to program the performance monitoring events";
longDescription = ''
diff --git a/pkgs/by-name/li/libpisp/package.nix b/pkgs/by-name/li/libpisp/package.nix
index 6ee36b13ea8a..01f247bf2650 100644
--- a/pkgs/by-name/li/libpisp/package.nix
+++ b/pkgs/by-name/li/libpisp/package.nix
@@ -7,28 +7,19 @@
ninja,
boost,
nlohmann_json,
- fetchpatch,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "libpisp";
- version = "1.2.1";
+ version = "1.7.0";
src = fetchFromGitHub {
owner = "raspberrypi";
repo = "libpisp";
tag = "v${finalAttrs.version}";
- hash = "sha256-YshU7G5Rov67CVwFbf5ENp2j5ptAvkVrlMu85KmnEpk=";
+ hash = "sha256-hzJA8hoOXf2Lswwz9t0StJ9JJP8ICWJlstzSsli4Yqs=";
};
- patches = [
- # fix build with glibc 2.42 & -Werror
- (fetchpatch {
- url = "https://github.com/raspberrypi/libpisp/commit/f2bbf7e000d3f11cac235b8ea1291722080a016c.patch";
- hash = "sha256-vrdmVadyjlAnZtmBahOs/hlKPrkh/BF3LvrTPM9D15Q=";
- })
- ];
-
nativeBuildInputs = [
pkg-config
meson
diff --git a/pkgs/by-name/li/libsodium/package.nix b/pkgs/by-name/li/libsodium/package.nix
index 4b27cbb4c759..240617b896eb 100644
--- a/pkgs/by-name/li/libsodium/package.nix
+++ b/pkgs/by-name/li/libsodium/package.nix
@@ -9,13 +9,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "libsodium";
- version = "1.0.22-unstable-2026-07-08";
+ version = "1.0.22-unstable-2026-07-31";
src = fetchFromGitHub {
owner = "jedisct1";
repo = "libsodium";
- rev = "77a422c85a3b8b487de50c811b38d18394831ba6";
- hash = "sha256-Ahka2PnrmYvTLjZMzik5mFsxhDpMLRMKT/I5ftUb0Xc=";
+ rev = "701aa826b97dc84a353d70a551d49dc26da539c5";
+ hash = "sha256-vJK7nuvy22EWCdau9cn4HOvO8XDiVQXwf/zwhq9R9Jg=";
};
outputs = [
diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix
index b7c88dfc5eb7..1e2299e9075e 100644
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -114,6 +114,8 @@ stdenv.mkDerivation (finalAttrs: {
propagatedBuildInputs = [ openssl ]; # see Libs: in libssh2.pc
buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64;
+ strictDeps = true;
+
passthru.tests = {
inherit
aria2
@@ -124,6 +126,8 @@ stdenv.mkDerivation (finalAttrs: {
curl = (curl.override { scpSupport = true; }).tests.withCheck;
};
+ __structuredAttrs = true;
+
meta = {
description = "Client-side C library implementing the SSH2 protocol";
homepage = "https://www.libssh2.org";
diff --git a/pkgs/by-name/li/libtasn1/package.nix b/pkgs/by-name/li/libtasn1/package.nix
index 7de5f9bc2b74..8e27bac39404 100644
--- a/pkgs/by-name/li/libtasn1/package.nix
+++ b/pkgs/by-name/li/libtasn1/package.nix
@@ -32,14 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
perl
];
+ strictDeps = true;
+
doCheck = true;
- preCheck =
- if stdenv.hostPlatform.isDarwin then "export DYLD_LIBRARY_PATH=`pwd`/lib/.libs" else null;
+ preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+ export DYLD_LIBRARY_PATH=$(pwd)/lib/.libs
+ '';
passthru.tests = {
inherit gnutls samba qemu;
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/libtasn1/";
description = "ASN.1 library";
diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix
index bcbf5472a7e2..c16084e0ac39 100644
--- a/pkgs/by-name/li/libuv/package.nix
+++ b/pkgs/by-name/li/libuv/package.nix
@@ -7,7 +7,6 @@
darwin,
libtool,
pkg-config,
- pkgsStatic,
# for passthru.tests
bind,
@@ -19,6 +18,7 @@
neovim,
nodejs,
ocamlPackages,
+ pkgsStatic,
python3,
testers,
}:
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "libuv";
repo = "libuv";
- rev = "v${finalAttrs.version}";
+ tag = "v${finalAttrs.version}";
hash = "sha256-Y9Nph2LkT1qnOYTW3WCumWWwORnI4P7HxzBjUlGaL7M=";
};
@@ -151,8 +151,6 @@ stdenv.mkDerivation (finalAttrs: {
in
lib.optionalString (finalAttrs.finalPackage.doCheck) ''
sed '/${tdRegexp}/d' -i test/test-list.h
- # https://github.com/libuv/libuv/issues/4794
- substituteInPlace Makefile.am --replace-fail -lutil "-lutil -lm"
'';
nativeBuildInputs = [
@@ -162,6 +160,8 @@ stdenv.mkDerivation (finalAttrs: {
pkg-config
];
+ strictDeps = true;
+
# This is part of the Darwin bootstrap, so we don’t always get
# `libutil.dylib` automatically propagated through the SDK.
buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -209,6 +209,8 @@ stdenv.mkDerivation (finalAttrs: {
pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
};
+ __structuredAttrs = true;
+
meta = {
description = "Multi-platform support library with a focus on asynchronous I/O";
homepage = "https://libuv.org/";
diff --git a/pkgs/by-name/li/libxslt/package.nix b/pkgs/by-name/li/libxslt/package.nix
index da39812157a4..e0303ba11235 100644
--- a/pkgs/by-name/li/libxslt/package.nix
+++ b/pkgs/by-name/li/libxslt/package.nix
@@ -97,6 +97,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://gitlab.gnome.org/GNOME/libxslt";
description = "C library and tools to do XSL transformations";
diff --git a/pkgs/by-name/lm/lmdb/package.nix b/pkgs/by-name/lm/lmdb/package.nix
index 41c92ea0c8b6..f228bf12fd4f 100644
--- a/pkgs/by-name/lm/lmdb/package.nix
+++ b/pkgs/by-name/lm/lmdb/package.nix
@@ -7,14 +7,14 @@
stdenv.mkDerivation rec {
pname = "lmdb";
- version = "0.9.35";
+ version = "0.9.36";
src = fetchFromGitLab {
domain = "git.openldap.org";
owner = "openldap";
repo = "openldap";
rev = "LMDB_${version}";
- sha256 = "sha256-XkOeVqzKojRLojBLkXB0V9lypJnL5ZmGAwutn6aRQIU=";
+ sha256 = "sha256-iOwjUqR2ChCEUDsIFEetVktCD7Mx3R5JgHE+qIhBd5I=";
};
postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb";
diff --git a/pkgs/by-name/lz/lzo/package.nix b/pkgs/by-name/lz/lzo/package.nix
index a3ecb16bb807..da806c6a1e24 100644
--- a/pkgs/by-name/lz/lzo/package.nix
+++ b/pkgs/by-name/lz/lzo/package.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://www.oberhumer.com/opensource/lzo/download/lzo-${finalAttrs.version}.tar.gz";
- sha256 = "0wm04519pd3g8hqpjqhfr72q8qmbiwqaxcs3cndny9h86aa95y60";
+ hash = "sha256-wPiSlDIIJm+bZUOzrjCPq2KExckOYnkxRG+0m0IhoHI=";
};
nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
@@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
"doc"
];
+ __structuredAttrs = true;
+
meta = {
description = "Real-time data (de)compression library";
longDescription = ''
diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index fae97effb3b9..4576351fb4b2 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -48,6 +48,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
updateScript = nix-update-script { };
};
+ __structuredAttrs = true;
+
meta = {
description = "Build and publish Rust crates Python packages";
longDescription = ''
diff --git a/pkgs/by-name/mb/mbedtls/generic.nix b/pkgs/by-name/mb/mbedtls/generic.nix
index b74fe03e288e..8204cd73e95f 100644
--- a/pkgs/by-name/mb/mbedtls/generic.nix
+++ b/pkgs/by-name/mb/mbedtls/generic.nix
@@ -19,6 +19,7 @@
stdenv.mkDerivation rec {
pname = "mbedtls";
inherit version;
+ __structuredAttrs = true;
src = fetchFromGitHub {
owner = "Mbed-TLS";
diff --git a/pkgs/by-name/mi/mimalloc/package.nix b/pkgs/by-name/mi/mimalloc/package.nix
index 6f4c2362a33e..810596fdfe03 100644
--- a/pkgs/by-name/mi/mimalloc/package.nix
+++ b/pkgs/by-name/mi/mimalloc/package.nix
@@ -12,13 +12,13 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "mimalloc";
- version = "3.3.2";
+ version = "3.4.5";
src = fetchFromGitHub {
owner = "microsoft";
repo = "mimalloc";
tag = "v${finalAttrs.version}";
- hash = "sha256-GZ37qQVDe9jgMb4Coe5oKvgaLTspZDlSkS5rdy1MfUU=";
+ hash = "sha256-vNVZw2YsDkf0GcdFTNb/fXMQLQYvoc8P425LupPShpo=";
};
doCheck = !stdenv.hostPlatform.isStatic;
diff --git a/pkgs/by-name/mj/mjpegtools/package.nix b/pkgs/by-name/mj/mjpegtools/package.nix
index 157948c85891..fb6511452c38 100644
--- a/pkgs/by-name/mj/mjpegtools/package.nix
+++ b/pkgs/by-name/mj/mjpegtools/package.nix
@@ -2,7 +2,6 @@
stdenv,
lib,
fetchurl,
- gtk2,
libdv,
libjpeg,
libpng,
@@ -46,12 +45,13 @@ stdenv.mkDerivation (finalAttrs: {
libpng
]
++ lib.optionals (!withMinimal) [
- gtk2
libx11
SDL
SDL_gfx
];
+ configureFlags = [ "--without-gtk" ];
+
env.NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${lib.getDev SDL}/include/SDL";
postPatch = ''
diff --git a/pkgs/by-name/mp/mpdecimal/package.nix b/pkgs/by-name/mp/mpdecimal/package.nix
index ca1d0bba4969..0d90dec4f5aa 100644
--- a/pkgs/by-name/mp/mpdecimal/package.nix
+++ b/pkgs/by-name/mp/mpdecimal/package.nix
@@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
nativeBuildInputs = [ autoreconfHook ];
+ strictDeps = true;
+
enableParallelBuilding = true;
postInstall = ''
@@ -32,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
echo -n $cxx >> $dev/nix-support/propagated-build-inputs
'';
+ __structuredAttrs = true;
+
meta = {
description = "Library for arbitrary precision decimal floating point arithmetic";
diff --git a/pkgs/by-name/mp/mpfr/package.nix b/pkgs/by-name/mp/mpfr/package.nix
index f9db385a11cb..579523e45309 100644
--- a/pkgs/by-name/mp/mpfr/package.nix
+++ b/pkgs/by-name/mp/mpfr/package.nix
@@ -12,14 +12,14 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
version = "4.2.2";
pname = "mpfr";
src = fetchurl {
urls = [
- "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz"
- "mirror://gnu/mpfr/${pname}-${version}.tar.xz"
+ "https://www.mpfr.org/mpfr-${finalAttrs.version}/mpfr-${finalAttrs.version}.tar.xz"
+ "mirror://gnu/mpfr/mpfr-${finalAttrs.version}.tar.xz"
];
hash = "sha256-tnugOD736KhWNzTi6InvXsPDuJigHQD6CmhprYHGzgE=";
};
@@ -67,10 +67,12 @@ stdenv.mkDerivation rec {
# Expect the text in format of 'GNU MPFR version 4.1.1'
new_version="$(curl -s https://www.mpfr.org/mpfr-current/ |
pcre2grep -o1 'GNU MPFR version ([0-9.]+)')"
- update-source-version ${pname} "$new_version"
+ update-source-version ${finalAttrs.pname} "$new_version"
'';
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.mpfr.org/";
description = "Library for multiple-precision floating-point arithmetic";
@@ -92,4 +94,4 @@ stdenv.mkDerivation rec {
maintainers = [ ];
platforms = lib.platforms.all;
};
-}
+})
diff --git a/pkgs/by-name/mu/musl-fts/package.nix b/pkgs/by-name/mu/musl-fts/package.nix
index 09c7cedb009b..6ba3b321df29 100644
--- a/pkgs/by-name/mu/musl-fts/package.nix
+++ b/pkgs/by-name/mu/musl-fts/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "void-linux";
repo = "musl-fts";
- rev = "v${finalAttrs.version}";
+ tag = "v${finalAttrs.version}";
sha256 = "Azw5qrz6OKDcpYydE6jXzVxSM5A8oYWAztrHr+O/DOE=";
};
@@ -22,8 +22,12 @@ stdenv.mkDerivation (finalAttrs: {
pkg-config
];
+ strictDeps = true;
+
enableParallelBuilding = true;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://github.com/void-linux/musl-fts";
description = "Implementation of fts(3) for musl-libc";
diff --git a/pkgs/by-name/mu/musl-obstack/package.nix b/pkgs/by-name/mu/musl-obstack/package.nix
index e0172eb8aab9..cbd56e5bb559 100644
--- a/pkgs/by-name/mu/musl-obstack/package.nix
+++ b/pkgs/by-name/mu/musl-obstack/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "void-linux";
repo = "musl-obstack";
- rev = "v${finalAttrs.version}";
+ tag = "v${finalAttrs.version}";
sha256 = "sha256-oydS7FubUniMHAUWfg84OH9+CZ0JCrTXy7jzwOyJzC8=";
};
@@ -26,8 +26,12 @@ stdenv.mkDerivation (finalAttrs: {
pkg-config
];
+ strictDeps = true;
+
enableParallelBuilding = true;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://github.com/void-linux/musl-obstack";
description = "Extraction of the obstack functions and macros from GNU libiberty for use with musl-libc";
diff --git a/pkgs/by-name/ng/nghttp2/package.nix b/pkgs/by-name/ng/nghttp2/package.nix
index 209717165a3b..68a42a1826af 100644
--- a/pkgs/by-name/ng/nghttp2/package.nix
+++ b/pkgs/by-name/ng/nghttp2/package.nix
@@ -42,13 +42,13 @@ assert enableHpack -> enableApp;
assert enableHttp3 -> enableApp;
assert enableJemalloc -> enableApp;
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "nghttp2";
- version = "1.69.0";
+ version = "1.70.0";
src = fetchurl {
- url = "https://github.com/nghttp2/nghttp2/releases/download/v${version}/nghttp2-${version}.tar.bz2";
- hash = "sha256-PxhfWxw+d4heuc8/LE2ksan3OiS/WVe4KRg60Tf4Lcg=";
+ url = "https://github.com/nghttp2/nghttp2/releases/download/v${finalAttrs.version}/nghttp2-${finalAttrs.version}.tar.bz2";
+ hash = "sha256-j6yh94qpmsO8F2ina34PazbY5qYsE4GHUbHSBfAvlAU=";
};
outputs = [
@@ -77,6 +77,8 @@ stdenv.mkDerivation rec {
]
++ lib.optionals enablePython [ python3 ];
+ strictDeps = true;
+
enableParallelBuilding = true;
configureFlags = [
@@ -116,6 +118,8 @@ stdenv.mkDerivation rec {
inherit curl libsoup_3;
};
+ __structuredAttrs = true;
+
meta = {
description = "HTTP/2 C library and tools";
longDescription = ''
@@ -129,10 +133,10 @@ stdenv.mkDerivation rec {
'';
homepage = "https://nghttp2.org/";
- changelog = "https://github.com/nghttp2/nghttp2/releases/tag/v${version}";
+ changelog = "https://github.com/nghttp2/nghttp2/releases/tag/v${finalAttrs.version}";
# News articles with changes summary can be found here: https://nghttp2.org/blog/archives/
license = lib.licenses.mit;
maintainers = [ ];
platforms = lib.platforms.all;
};
-}
+})
diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix
index 852ebfce6194..94cbf454b4d2 100644
--- a/pkgs/by-name/ng/nghttp3/package.nix
+++ b/pkgs/by-name/ng/nghttp3/package.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
nativeBuildInputs = [ cmake ];
+ strictDeps = true;
+
cmakeFlags = [
(lib.cmakeBool "ENABLE_SHARED_LIB" (!stdenv.hostPlatform.isStatic))
(lib.cmakeBool "ENABLE_STATIC_LIB" stdenv.hostPlatform.isStatic)
@@ -35,6 +37,8 @@ stdenv.mkDerivation (finalAttrs: {
inherit curl;
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://github.com/ngtcp2/nghttp3";
changelog = "https://github.com/ngtcp2/nghttp3/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/ni/ninja/package.nix b/pkgs/by-name/ni/ninja/package.nix
index 29196bd5db6a..39a2ada4da2a 100644
--- a/pkgs/by-name/ni/ninja/package.nix
+++ b/pkgs/by-name/ni/ninja/package.nix
@@ -52,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
libxslt.bin
];
+ strictDeps = true;
+
patches = [
./0001-spawn-sh-instead-of-bin-sh.patch
]
@@ -114,6 +116,8 @@ stdenv.mkDerivation (finalAttrs: {
passthru.updateScript = nix-update-script { };
+ __structuredAttrs = true;
+
meta = {
description = "Small build system with a focus on speed";
mainProgram = "ninja";
diff --git a/pkgs/by-name/no/noctalia-greeter/package.nix b/pkgs/by-name/no/noctalia-greeter/package.nix
index e223372a8a8a..2025ae76565b 100644
--- a/pkgs/by-name/no/noctalia-greeter/package.nix
+++ b/pkgs/by-name/no/noctalia-greeter/package.nix
@@ -28,18 +28,6 @@
nix-update-script,
}:
-let
- # nixpkgs stb doesn't have stb_image_resize2.h which noctalia-greeter needs
- stb' = stb.overrideAttrs {
- version = "0-unstable-2025-10-26";
- src = fetchFromGitHub {
- owner = "nothings";
- repo = "stb";
- rev = "f1c79c02822848a9bed4315b12c8c8f3761e1296";
- hash = "sha256-BlyXJtAI7WqXCTT3ylww8zoG0hBxaojJnQDvdQOXJPE=";
- };
- };
-in
stdenv.mkDerivation (finalAttrs: {
pname = "noctalia-greeter";
version = "1.2.1";
@@ -73,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
libxkbcommon
nlohmann_json
pango
- stb'
+ stb
tomlplusplus
wayland
wayland-protocols
diff --git a/pkgs/by-name/no/noctalia/package.nix b/pkgs/by-name/no/noctalia/package.nix
index 445d0e3dd69b..db034268800e 100644
--- a/pkgs/by-name/no/noctalia/package.nix
+++ b/pkgs/by-name/no/noctalia/package.nix
@@ -49,18 +49,6 @@
gitMinimal,
}:
-let
- # nixpkgs stb doesn't have stb_image_resize2.h which noctalia needs
- stb' = stb.overrideAttrs {
- version = "0-unstable-2025-10-26";
- src = fetchFromGitHub {
- owner = "nothings";
- repo = "stb";
- rev = "f1c79c02822848a9bed4315b12c8c8f3761e1296";
- hash = "sha256-BlyXJtAI7WqXCTT3ylww8zoG0hBxaojJnQDvdQOXJPE=";
- };
- };
-in
stdenv.mkDerivation (finalAttrs: {
__structuredAttrs = true;
@@ -111,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
pipewire
polkit
sdbus-cpp_2
- stb'
+ stb
systemdLibs
tomlplusplus
wayland
diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix
index 372a7b3f067f..9784147f643b 100644
--- a/pkgs/by-name/ns/nspr/package.nix
+++ b/pkgs/by-name/ns/nspr/package.nix
@@ -8,11 +8,11 @@
stdenv.mkDerivation (finalAttrs: {
pname = "nspr";
- version = "4.39";
+ version = "4.40";
src = fetchurl {
url = "mirror://mozilla/nspr/releases/v${finalAttrs.version}/src/nspr-${finalAttrs.version}.tar.gz";
- hash = "sha256-u9Au6HpVZ2Bjpj5byBngIn3iZmtHMHsqATRBTN9CNo4=";
+ hash = "sha256-wMGITGJ/Pbeng/fHMUxpUiayBDaWeR0VUZ5+BXjBm9w=";
};
patches = [
@@ -53,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
};
meta = {
+ changelog = "https://github.com/mozilla/nspr/releases/tag/NSPR_${lib.concatStringsSep "_" (lib.splitVersion finalAttrs.version)}_RTM";
homepage = "https://firefox-source-docs.mozilla.org/nspr/index.html";
description = "Netscape Portable Runtime, a platform-neutral API for system-level and libc-like functions";
maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/pc/pcre2/package.nix b/pkgs/by-name/pc/pcre2/package.nix
index d846f87c0e42..91f18224b430 100644
--- a/pkgs/by-name/pc/pcre2/package.nix
+++ b/pkgs/by-name/pc/pcre2/package.nix
@@ -3,9 +3,6 @@
stdenv,
fetchurl,
updateAutotoolsGnuConfigScriptsHook,
- # Causes consistent segfaults on ELFv1 PPC64 when trying to use Perl regex in gnugrep
- # https://github.com/PCRE2Project/pcre2/issues/762
- withJitSealloc ? !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isAbiElfv1),
}:
stdenv.mkDerivation (finalAttrs: {
@@ -28,9 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
"--enable-pcre2-32"
# only enable jit on supported platforms which excludes Apple Silicon, see https://github.com/zherczeg/sljit/issues/51
"--enable-jit=${if stdenv.hostPlatform.isS390x then "no" else "auto"}"
- ]
- # fix pcre jit in systemd units that set MemoryDenyWriteExecute=true like gitea
- ++ lib.optional withJitSealloc "--enable-jit-sealloc";
+ ];
outputs = [
"bin"
diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index 144def6c59a9..981c7f867324 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -12,8 +12,8 @@
elogind,
libinotify-kqueue,
epoll-shim,
- systemd,
- enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, # enableSystemd=false maintained by maintainers.highghlow.
+ systemdLibs,
+ enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs, # enableSystemd=false maintained by maintainers.highghlow.
pkg-config,
docutils,
doxygen,
@@ -157,7 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
]
++ (
if enableSystemd then
- [ systemd ]
+ [ systemdLibs ]
else if stdenv.hostPlatform.isLinux then
[
elogind
diff --git a/pkgs/by-name/pn/pnpmBuildHook/package.nix b/pkgs/by-name/pn/pnpmBuildHook/package.nix
index 361c15a16b99..0c86980d53b8 100644
--- a/pkgs/by-name/pn/pnpmBuildHook/package.nix
+++ b/pkgs/by-name/pn/pnpmBuildHook/package.nix
@@ -6,5 +6,4 @@ makeSetupHook {
# the config hook must also be used.
name = "pnpm-build-hook";
- __structuredAttrs = true;
} ./pnpm-build-hook.sh
diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix
index 723f80bcdc74..381463f368af 100644
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@@ -2,7 +2,6 @@
lib,
stdenv,
fetchFromGitHub,
- fetchpatch,
pkg-config,
glib,
expat,
@@ -22,6 +21,7 @@
docbook_xml_dtd_412,
gtk-doc,
coreutils,
+ useConsoleKit ? false,
useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
systemdLibs,
elogind,
@@ -40,10 +40,12 @@ let
system = "/run/current-system/sw";
setuid = "/run/wrappers/bin";
in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "polkit";
version = "127";
+ disallowedReferences = lib.optional useConsoleKit systemdLibs;
+
outputs = [
"bin"
"dev"
@@ -54,7 +56,7 @@ stdenv.mkDerivation rec {
src = fetchFromGitHub {
owner = "polkit-org";
repo = "polkit";
- rev = version;
+ rev = finalAttrs.version;
hash = "sha256-YTugETy0rqu/bv53jV1UeGqSK79bRXR52EJNcTblvzo=";
};
@@ -95,7 +97,7 @@ stdenv.mkDerivation rec {
dbus
duktape
]
- ++ lib.optionals stdenv.hostPlatform.isLinux [
+ ++ lib.optionals (stdenv.hostPlatform.isLinux && !useConsoleKit) [
# On Linux, fall back to elogind when systemd support is off.
(if useSystemd then systemdLibs else elogind)
];
@@ -146,7 +148,14 @@ stdenv.mkDerivation rec {
"-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
]
++ lib.optionals stdenv.hostPlatform.isLinux [
- "-Dsession_tracking=${if useSystemd then "logind" else "elogind"}"
+ "-Dsession_tracking=${
+ if useSystemd then
+ "logind"
+ else if useConsoleKit then
+ "ConsoleKit"
+ else
+ "elogind"
+ }"
];
inherit doCheck;
@@ -193,4 +202,4 @@ stdenv.mkDerivation rec {
];
teams = [ lib.teams.freedesktop ];
};
-}
+})
diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index d6c15745fa64..fd7ab77f7b9e 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,17 +7,19 @@
stdenvNoCC.mkDerivation {
pname = "publicsuffix-list";
- version = "0-unstable-2026-07-25";
+ version = "0-unstable-2026-08-14";
src = fetchFromGitHub {
owner = "publicsuffix";
repo = "list";
- rev = "e1b8015c3b2f0f4f8c18659c2480fc1a22c07b20";
- hash = "sha256-F+OmANpg7I4dBFL7PM3oJlhpDzfxrRTfo+50lQHdU2M=";
+ rev = "a77cfe0674a4b05c6e2448c01f3cb2c965a1b6d8";
+ hash = "sha256-b/8hOFxgnoGQHGfgZ3Xz8H4Gu5ssxwHOCHswX2uQHMc=";
};
dontBuild = true;
+ strictDeps = true;
+
installPhase = ''
runHook preInstall
@@ -28,6 +30,8 @@ stdenvNoCC.mkDerivation {
passthru.updateScript = unstableGitUpdater { };
+ __structuredAttrs = true;
+
meta = {
homepage = "https://publicsuffix.org/";
description = "Cross-vendor public domain suffix database";
diff --git a/pkgs/by-name/rd/rdfind/package.nix b/pkgs/by-name/rd/rdfind/package.nix
index a88ebc058953..a1e3e3fd9f52 100644
--- a/pkgs/by-name/rd/rdfind/package.nix
+++ b/pkgs/by-name/rd/rdfind/package.nix
@@ -8,11 +8,11 @@
stdenv.mkDerivation (finalAttrs: {
pname = "rdfind";
- version = "1.7.0";
+ version = "1.8.0";
src = fetchurl {
url = "https://rdfind.pauldreik.se/rdfind-${finalAttrs.version}.tar.gz";
- sha256 = "sha256-eMRjFS4dnk/Rv+uDuckt9ef8TF+Tx9Qm+x9++ivk3yk=";
+ sha256 = "sha256-Ci0NMgAswtwBNO57ZJvMgR7PsvjZ9nKqR2qFEVLnrzU=";
};
# the built-in configure script was generated by autoconf 2.72 and
diff --git a/pkgs/by-name/re/re2/package.nix b/pkgs/by-name/re/re2/package.nix
index 06249cd01c8f..06bc5bd10c12 100644
--- a/pkgs/by-name/re/re2/package.nix
+++ b/pkgs/by-name/re/re2/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "google";
repo = "re2";
- rev = finalAttrs.version;
+ tag = finalAttrs.version;
hash = "sha256-0J1HVk+eR7VN0ymucW9dNlT36j16XIfCzcs1EVyEIEU=";
};
@@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
propagatedBuildInputs = [ abseil-cpp ] ++ lib.optionals (!stdenv.hostPlatform.isStatic) [ icu ];
+ strictDeps = true;
+
cmakeFlags = [
(lib.cmakeBool "RE2_BUILD_TESTING" true)
(lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--timeout;999999")
@@ -60,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
haskell-re2 = haskellPackages.re2;
};
+ __structuredAttrs = true;
+
meta = {
description = "Regular expression library";
longDescription = ''
diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index f55b1a6275b9..0f37c334af04 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -14,13 +14,15 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "rhash";
repo = "RHash";
- rev = "v${finalAttrs.version}";
- sha256 = "sha256-9/kFI38PG3AKsdDqEV/wEzSel9IlQQ/pvOyhU/N/aV0=";
+ tag = "v${finalAttrs.version}";
+ hash = "sha256-9/kFI38PG3AKsdDqEV/wEzSel9IlQQ/pvOyhU/N/aV0=";
};
nativeBuildInputs = [ which ];
buildInputs = lib.optionals stdenv.hostPlatform.isFreeBSD [ gettext ];
+ strictDeps = true;
+
# configure script is not autotools-based, doesn't support these options
dontAddStaticConfigureFlags = true;
@@ -46,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
"install-lib-so-link"
];
+ __structuredAttrs = true;
+
meta = {
homepage = "https://rhash.sourceforge.net/";
description = "Console utility and library for computing and verifying hash sums of files";
diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index a39a47765b4d..4ca9e45f4258 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -2,9 +2,9 @@
lib,
stdenv,
fetchurl,
- fetchpatch,
updateAutotoolsGnuConfigScriptsHook,
+ bashNonInteractive,
perl,
python3,
libiconv,
@@ -29,27 +29,33 @@
stdenv.mkDerivation (finalAttrs: {
pname = "rsync";
- version = "3.4.4";
+ version = "3.5.0";
src = fetchurl {
# signed with key 9FEF 112D CE19 A0DC 7E88 2CB8 1BB2 4997 A853 5F6F
url = "mirror://samba/rsync/src/rsync-${finalAttrs.version}.tar.gz";
- hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY=";
+ hash = "sha256-x//R72U+mVQPZh5HywC3+crR7muXI5mxb5PWcmVuDTM=";
};
- patches = [
- # Fixes test failure on darwin
- (fetchpatch {
- url = "https://github.com/RsyncProject/rsync/commit/e1c5f0e93a75dd45f32f3b92ba221ef158ac2e5f.patch";
- hash = "sha256-pg65K9BCTq/WvS5icK6KT28ARccFKedp2445wLYdRsE=";
- excludes = [
- ".github/workflows/cygwin-build.yml"
- ];
- })
- ];
+ patches = [ ];
+
+ # Remove with the first upstream release that links t_acl against the snprintf fallback.
+ postPatch = ''
+ substituteInPlace Makefile.in \
+ --replace-fail 'T_ACL_OBJ = t_acl.o lib/acl.o' 'T_ACL_OBJ = t_acl.o lib/acl.o lib/snprintf.o'
+ '';
preBuild = ''
- patchShebangs ./runtests.py
+ patchShebangs ./runtests.py ./support/rrsync
+
+ # patchShebangs ignores non-executable test sources and embedded shebangs.
+ substituteInPlace \
+ testsuite/{daemon-namecvt-{empty-response,newline-token},rrsync-{sender-parent-pin,symlink}}_test.py \
+ --replace-fail '#!/usr/bin/env python3' '#!${python3}/bin/python3'
+
+ substituteInPlace \
+ testsuite/rsync-ssl-stunnel-{ca-required,hostname-check}_test.py \
+ --replace-fail '#!/usr/bin/env bash' '#!${stdenv.shell}'
'';
nativeBuildInputs = [
@@ -58,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
];
buildInputs = [
+ bashNonInteractive
libiconv
zlib
popt
@@ -103,12 +110,35 @@ stdenv.mkDerivation (finalAttrs: {
python3
];
- # Test fails when built in a chroot store
+ # These require set-id, chown, xattrs, or unrestricted /proc/self/fd,
+ # which the Linux Nix build sandbox does not provide.
preCheck = ''
- rm testsuite/chgrp.test
+ export RSYNC_EXCLUDE=${
+ lib.concatStringsSep "," (
+ lib.optionals stdenv.hostPlatform.isLinux [
+ "chmod-option"
+ "chmod-setid"
+ "chown-fake"
+ "fake-super-backup-fifo-regression"
+ "protected-regular"
+ "rrsync-backup-dir-inband-pivot"
+ "rrsync-pull-delivers-content"
+ "variety-symlink-traversal"
+ "variety"
+ ]
+ # This test assumes that every Linux libc provides glibc malloc stats.
+ ++ lib.optional stdenv.hostPlatform.isMusl "misc-coverage"
+ # These require a native compiler and dynamic interposition.
+ ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+ "link-dest-symlink-enotsup"
+ "partial-protected-regular-retry-linux"
+ ]
+ )
+ }
'';
doCheck = true;
+ strictDeps = true;
__darwinAllowLocalNetworking = true;
diff --git a/pkgs/by-name/rt/rtmpdump/package.nix b/pkgs/by-name/rt/rtmpdump/package.nix
index b84a0f644b31..f09b5c92387f 100644
--- a/pkgs/by-name/rt/rtmpdump/package.nix
+++ b/pkgs/by-name/rt/rtmpdump/package.nix
@@ -2,6 +2,8 @@
lib,
stdenv,
fetchgit,
+ testers,
+ versionCheckHook,
zlib,
gnutlsSupport ? false,
gnutls,
@@ -12,7 +14,7 @@
assert (gnutlsSupport || opensslSupport);
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
pname = "rtmpdump";
version = "2.6";
@@ -23,6 +25,18 @@ stdenv.mkDerivation {
hash = "sha256-rwMA9eougKnkpG+fe6vZIwOBt2CC1d9qI9a079EbE5o=";
};
+ postPatch = ''
+ for file in rtmp{dump.1,gw.8}{,.html} librtmp/librtmp.3{,.html}; do
+ substituteInPlace "$file" \
+ --replace-fail "RTMPDump v2.4" "RTMPDump v${finalAttrs.version}"
+ done
+
+ for file in Makefile librtmp/Makefile; do
+ substituteInPlace "$file" \
+ --replace-fail "VERSION=v2.4" "VERSION=v${finalAttrs.version}"
+ done
+ '';
+
preBuild = ''
makeFlagsArray+=(CC="$CC")
'';
@@ -44,18 +58,38 @@ stdenv.mkDerivation {
]
++ lib.optional opensslSupport openssl;
+ nativeInstallCheckInputs = [ versionCheckHook ];
+ versionCheckProgramArg = "--help";
+ doInstallCheck = true;
+
outputs = [
"out"
"dev"
];
+ # incdir hardcoded to ${prefix}/include, but we move includes to -dev
+ # pkg-config version field is specified without "v" prefix
+ postFixup = ''
+ substituteInPlace $dev/lib/pkgconfig/librtmp.pc \
+ --replace-fail 'incdir=''${prefix}/include' "incdir=$dev/include" \
+ --replace-fail 'Version: v${finalAttrs.version}' 'Version: ${finalAttrs.version}'
+ '';
+
separateDebugInfo = true;
+ passthru.tests.pkg-config = testers.hasPkgConfigModules {
+ package = finalAttrs.finalPackage;
+ versionCheck = true;
+ };
+
meta = {
description = "Toolkit for RTMP streams";
homepage = "https://rtmpdump.mplayerhq.hu/";
+ changelog = "https://rtmpdump.mplayerhq.hu/ChangeLog";
license = lib.licenses.gpl2Plus;
+ mainProgram = "rtmpdump";
+ pkgConfigModules = [ "librtmp" ];
platforms = lib.platforms.unix;
- maintainers = [ ];
+ maintainers = with lib.maintainers; [ tmarkus ];
};
-}
+})
diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 9345096f3fa7..c3c6c7af9c6f 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -70,7 +70,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
stdenv.mkDerivation (finalAttrs: {
pname = "sdl3";
- version = "3.4.12";
+ version = "3.4.14";
outputs = [
"lib"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
owner = "libsdl-org";
repo = "SDL";
tag = "release-${finalAttrs.version}";
- hash = "sha256-b6l3HgdhqIe9LazJmLivbCJgbKPAS8S54fuB9xvgalI=";
+ hash = "sha256-HzV5Fq+PhJr/dQBCVm2WL1BdaI4GG+W+B0scttjdRuQ=";
};
postPatch =
diff --git a/pkgs/by-name/sh/shadow/package.nix b/pkgs/by-name/sh/shadow/package.nix
index f47476196c2a..5c3c506ca15f 100644
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@@ -33,13 +33,13 @@ in
stdenv.mkDerivation (finalAttrs: {
pname = "shadow";
- version = "4.20.0";
+ version = "4.20.2";
src = fetchFromGitHub {
owner = "shadow-maint";
repo = "shadow";
tag = finalAttrs.version;
- hash = "sha256-UafTyfK+pmW2wyAQnvHov9KIorf1HSc6haskfv7auHs=";
+ hash = "sha256-uZQHIRjuXl1QQE5VCbdT6c+NEhFzb06WbjhH2wplU1E=";
};
outputs = [
diff --git a/pkgs/by-name/sh/shipwright/package.nix b/pkgs/by-name/sh/shipwright/package.nix
index 6315867c2555..d1c4f44aa6ac 100644
--- a/pkgs/by-name/sh/shipwright/package.nix
+++ b/pkgs/by-name/sh/shipwright/package.nix
@@ -25,6 +25,7 @@
nlohmann_json,
tinyxml-2,
spdlog,
+ stb,
writeTextFile,
fixDarwinDylibNames,
applyPatches,
@@ -83,12 +84,6 @@ let
'';
};
- stb' = fetchurl {
- name = "stb_image.h";
- url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
- hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
- };
-
stormlib' = applyPatches {
src = fetchFromGitHub {
owner = "ladislav-zezula";
@@ -208,7 +203,7 @@ stdenv.mkDerivation (finalAttrs: {
preConfigure = ''
mkdir stb
- cp ${stb'} ./stb/${stb'.name}
+ cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
cp ${stb_impl} ./stb/${stb_impl.name}
substituteInPlace libultraship/cmake/dependencies/common.cmake \
--replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/sp/spaghettikart/package.nix b/pkgs/by-name/sp/spaghettikart/package.nix
index bd4f62496b24..79b9a60a1db3 100644
--- a/pkgs/by-name/sp/spaghettikart/package.nix
+++ b/pkgs/by-name/sp/spaghettikart/package.nix
@@ -24,6 +24,7 @@
SDL2,
SDL2_net,
spdlog,
+ stb,
tinyxml-2,
tomlplusplus,
zenity,
@@ -83,12 +84,6 @@ let
'';
};
- stb' = fetchurl {
- name = "stb_image.h";
- url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
- hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
- };
-
stormlib' = applyPatches {
src = fetchFromGitHub {
owner = "ladislav-zezula";
@@ -219,7 +214,7 @@ stdenv.mkDerivation (finalAttrs: {
preConfigure = ''
mkdir stb
- cp ${stb'} ./stb/${stb'.name}
+ cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
cp ${stb_impl} ./stb/${stb_impl.name}
substituteInPlace libultraship/cmake/dependencies/common.cmake \
--replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/st/starship-sf64/package.nix b/pkgs/by-name/st/starship-sf64/package.nix
index 9e65e91818e1..ec907ef85153 100644
--- a/pkgs/by-name/st/starship-sf64/package.nix
+++ b/pkgs/by-name/st/starship-sf64/package.nix
@@ -24,6 +24,7 @@
nlohmann_json,
SDL2,
spdlog,
+ stb,
tinyxml-2,
zenity,
sdl_gamecontrollerdb,
@@ -76,12 +77,6 @@ let
'';
};
- stb' = fetchurl {
- name = "stb_image.h";
- url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
- hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
- };
-
stormlib' = applyPatches {
src = fetchFromGitHub {
owner = "ladislav-zezula";
@@ -195,7 +190,7 @@ stdenv.mkDerivation (finalAttrs: {
preConfigure = ''
mkdir stb
- cp ${stb'} ./stb/${stb'.name}
+ cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
cp ${stb_impl} ./stb/${stb_impl.name}
substituteInPlace libultraship/cmake/dependencies/common.cmake \
--replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
diff --git a/pkgs/by-name/st/stb/package.nix b/pkgs/by-name/st/stb/package.nix
index 3283dcc11f17..cd3e8b268a66 100644
--- a/pkgs/by-name/st/stb/package.nix
+++ b/pkgs/by-name/st/stb/package.nix
@@ -4,17 +4,18 @@
fetchFromGitHub,
copyPkgconfigItems,
makePkgconfigItem,
+ unstableGitUpdater,
}:
stdenv.mkDerivation (finalAttrs: {
pname = "stb";
- version = "0-unstable-2023-01-29";
+ version = "0-unstable-2026-04-15";
src = fetchFromGitHub {
owner = "nothings";
repo = "stb";
- rev = "5736b15f7ea0ffb08dd38af21067c314d6a3aae9";
- hash = "sha256-s2ASdlT3bBNrqvwfhhN6skjbmyEnUgvNOrvhgUSRj98=";
+ rev = "31c1ad37456438565541f4919958214b6e762fb4";
+ hash = "sha256-m2yNUlA37hDkKQVrQ+R8nufHfW/cXLnMo+n1X1Cyun0=";
};
nativeBuildInputs = [ copyPkgconfigItems ];
@@ -42,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
runHook postInstall
'';
+ passthru.updateScript = unstableGitUpdater { };
+
meta = {
description = "Single-file public domain libraries for C/C++";
homepage = "https://github.com/nothings/stb";
diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix
index 77345bd6a3ae..1919c9e29903 100644
--- a/pkgs/by-name/st/strace/package.nix
+++ b/pkgs/by-name/st/strace/package.nix
@@ -3,6 +3,7 @@
stdenv,
fetchurl,
perl,
+ bashNonInteractive,
libunwind,
buildPackages,
gitUpdater,
@@ -28,17 +29,19 @@ stdenv.mkDerivation (finalAttrs: {
depsBuildBuild = [ buildPackages.stdenv.cc ];
nativeBuildInputs = [ perl ];
- enableParallelBuilding = true;
-
- # libunwind for -k.
- # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace.
- # The build will silently fall back and -k will not work on RISC-V.
buildInputs = [
+ bashNonInteractive # for strace-log-merge shebang
+ # libunwind for -k.
+ # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace.
+ # The build will silently fall back and -k will not work on RISC-V.
libunwind
]
# -kk
++ lib.optional (lib.meta.availableOn stdenv.hostPlatform elfutils) elfutils;
+ enableParallelBuilding = true;
+ strictDeps = true;
+
configureFlags = [
"--enable-mpers=check"
]
@@ -50,6 +53,8 @@ stdenv.mkDerivation (finalAttrs: {
rev-prefix = "v";
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://strace.io/";
description = "System call tracer for Linux";
diff --git a/pkgs/by-name/sw/swig/package.nix b/pkgs/by-name/sw/swig/package.nix
index 7b7b7e01a8f3..6afb32b575f8 100644
--- a/pkgs/by-name/sw/swig/package.nix
+++ b/pkgs/by-name/sw/swig/package.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "swig";
repo = "swig";
- rev = "v${finalAttrs.version}";
+ tag = "v${finalAttrs.version}";
hash = "sha256-jsi83v9sg0n5kUfDACqdNAS2VuLSyxv+pe2LRcO4Khc=";
};
@@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
enableParallelBuilding = true;
+ __structuredAttrs = true;
+
meta = {
changelog = "https://github.com/swig/swig/blob/${finalAttrs.src.rev}/CHANGES.current";
description = "Interface compiler that connects C/C++ code to higher-level languages";
diff --git a/pkgs/by-name/ti/tinyalsa/package.nix b/pkgs/by-name/ti/tinyalsa/package.nix
index f90680f8f41b..de827704e4c8 100644
--- a/pkgs/by-name/ti/tinyalsa/package.nix
+++ b/pkgs/by-name/ti/tinyalsa/package.nix
@@ -1,43 +1,55 @@
{
lib,
stdenv,
+ testers,
+ unstableGitUpdater,
fetchFromGitHub,
- cmake,
+ meson,
+ ninja,
}:
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
pname = "tinyalsa";
- version = "unstable-2022-06-05";
+ version = "2.0.0-unstable-2026-07-27";
src = fetchFromGitHub {
owner = "tinyalsa";
repo = "tinyalsa";
- rev = "3d70d227e7dfd1be6f8f420a5aae164a2b4126e0";
- hash = "sha256-RHeF3VShy+LYFtJK+AEU7swIr5/rnpg2fdllnH9cFCk=";
+ rev = "9fab97ca07184371ecad81154d1dadb09d0fa7cf";
+ hash = "sha256-+/wz0pwyF1kulUA5kjFGVOwbSkunEU+WzsZf/UsCEVk=";
};
+ separateDebugInfo = true;
+ strictDeps = true;
+ __structuredAttrs = true;
+
+ outputs = [
+ "out"
+ "dev"
+ "bin"
+ ];
+
nativeBuildInputs = [
- cmake
+ meson
+ ninja
];
- cmakeFlags = [
- "-DTINYALSA_USES_PLUGINS=ON"
- ];
-
- env.NIX_CFLAGS_COMPILE = toString [
- "-Wno-error=sign-compare"
- ];
-
- postPatch = ''
- substituteInPlace CMakeLists.txt \
- --replace-fail "cmake_minimum_required(VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)"
- '';
+ passthru = {
+ updateScript = unstableGitUpdater {
+ tagPrefix = "v";
+ };
+ tests.pkg-config = testers.hasPkgConfigModules {
+ package = finalAttrs.finalPackage;
+ versionCheck = false;
+ };
+ };
meta = {
homepage = "https://github.com/tinyalsa/tinyalsa";
description = "Tiny library to interface with ALSA in the Linux kernel";
license = lib.licenses.mit;
- maintainers = [ ];
+ pkgConfigModules = [ "tinyalsa" ];
+ maintainers = with lib.maintainers; [ tmarkus ];
platforms = with lib.platforms; linux;
};
-}
+})
diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index 1968cf15d603..f16b467c5821 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -135,17 +135,17 @@ let
in
rustPlatform.buildRustPackage (finalAttrs: {
pname = "tree-sitter";
- version = "0.26.9";
+ version = "0.26.11";
src = fetchFromGitHub {
owner = "tree-sitter";
repo = "tree-sitter";
tag = "v${finalAttrs.version}";
- hash = "sha256-ohVhW4AEKX5VspqBePtfxbJGkjmJnNkf5ntU3RUxF+0=";
+ hash = "sha256-YXnmVM90sEH8kqgqCygpeCAyvggMIsv+oXi0SJOvMRM=";
fetchSubmodules = true;
};
- cargoHash = "sha256-3egxdusYHQs8PadxGZ44+VWtlTcGBrcqlWMUyUzpWnY=";
+ cargoHash = "sha256-kHDjPRhBUYlxLWYSv6cn6U1QDIWwCgHeIz2A5yCi1yo=";
cargoBuildFeatures = lib.optionals wasmSupport [ "wasm" ];
diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix
index 75cb3cc49134..7e3f8f38535d 100644
--- a/pkgs/by-name/tz/tzdata/package.nix
+++ b/pkgs/by-name/tz/tzdata/package.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
];
propagatedBuildOutputs = [ ];
+ strictDeps = true;
+
makeFlags = [
"TOPDIR=${placeholder "out"}"
"TZDIR=${placeholder "out"}/share/zoneinfo"
@@ -113,6 +115,8 @@ stdenv.mkDerivation (finalAttrs: {
# minor releases.
passthru.tests = postgresql;
+ __structuredAttrs = true;
+
meta = {
homepage = "http://www.iana.org/time-zones";
description = "Database of current and historical time zones";
diff --git a/pkgs/by-name/ud/udisks/package.nix b/pkgs/by-name/ud/udisks/package.nix
index 9761a5e10247..e62fee1b6f25 100644
--- a/pkgs/by-name/ud/udisks/package.nix
+++ b/pkgs/by-name/ud/udisks/package.nix
@@ -8,7 +8,7 @@
autoreconfHook,
gtk-doc,
acl,
- systemd,
+ systemdLibs,
glib,
libatasmart,
polkit,
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
libgudev
libblockdev
acl
- systemd
+ systemdLibs
glib
libatasmart
polkit
diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index a90eb0b1d364..2dba1d12c66d 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -63,13 +63,13 @@ assert lib.assertMsg (
) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)";
stdenv.mkDerivation (finalAttrs: {
pname = "unbound";
- version = "1.25.2";
+ version = "1.26.0";
src = fetchFromGitHub {
owner = "NLnetLabs";
repo = "unbound";
tag = "release-${finalAttrs.version}";
- hash = "sha256-zt0JpVmct7w6ay+p8CdH6SGt/rL/v//e7K3MT8KZfOY=";
+ hash = "sha256-ESRboc5vwsNZ/Yynl2JGRWhH1QEYZumoTzgSvN3NbSU=";
};
outputs = [
diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index bfabdf565486..46c428876cac 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -171,6 +171,8 @@ stdenv.mkDerivation (finalAttrs: {
++ lib.optionals ncursesSupport [ ncurses ]
++ lib.optionals systemdSupport [ systemdLibs ];
+ strictDeps = true;
+
enableParallelBuilding = true;
postInstall = ''
@@ -229,6 +231,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
description = "Set of system utilities for Linux";
diff --git a/pkgs/by-name/xz/xz/package.nix b/pkgs/by-name/xz/xz/package.nix
index 62460c88acd4..1313bc1779a2 100644
--- a/pkgs/by-name/xz/xz/package.nix
+++ b/pkgs/by-name/xz/xz/package.nix
@@ -77,6 +77,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
changelog = "https://github.com/tukaani-project/xz/releases/tag/v${finalAttrs.version}";
description = "General-purpose data compression software, successor of LZMA";
diff --git a/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch b/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch
deleted file mode 100644
index 58d070a3c2b9..000000000000
--- a/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From: Santiago Vila
-Subject: Fix build with gcc-14
-Bug-Debian: https://bugs.debian.org/1075706
-X-Debian-version: 3.0-14
-
---- a/unix/configure
-+++ b/unix/configure
-@@ -514,14 +514,16 @@
- echo Check for $func
- echo "int main(){ $func(); return 0; }" > conftest.c
- $CC $BFLAG -o conftest conftest.c >/dev/null 2>/dev/null
-- [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_`echo $func | tr '[a-z]' '[A-Z]'`"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_`echo $func | tr '[a-z]' '[A-Z]'`"
- done
-
-
- echo Check for memset
- echo "int main(){ char k; memset(&k,0,0); return 0; }" > conftest.c
- $CC -o conftest conftest.c >/dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM"
-
-
- echo Check for memmove
-@@ -551,7 +553,8 @@
- }
- _EOF_
- $CC $CFLAGS -c conftest.c >/dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_ERRNO"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_ERRNO"
-
-
- echo Check for directory libraries
-@@ -567,7 +570,8 @@
- $CC -o conftest conftest.c -l$lib >/dev/null 2>/dev/null
- [ $? -eq 0 ] && OPT=-l$lib && break
- done
-- if [ ${OPT} ]; then
-+ # glibc-based systems do not need this
-+ if true; then
- LFLAGS2="${LFLAGS2} ${OPT}"
- else
- CFLAGS="${CFLAGS} -DNO_DIR"
-@@ -629,7 +633,8 @@
- }
- _EOF_
- $CC ${CFLAGS} -c conftest.c > /dev/null 2>/dev/null
--[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_VALLOC"
-+# glibc-based systems do not need this
-+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_VALLOC"
-
-
- echo Check for /usr/local/bin and /usr/local/man
diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix
index 3bf6b8a1641a..e67be89c2a9b 100644
--- a/pkgs/by-name/zi/zip/package.nix
+++ b/pkgs/by-name/zi/zip/package.nix
@@ -6,17 +6,20 @@
libnatspec ? null,
libiconv,
fetchpatch,
+ fetchDebianPatch,
}:
assert enableNLS -> libnatspec != null;
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "zip";
version = "3.0";
src = fetchurl {
urls = [
- "ftp://ftp.info-zip.org/pub/infozip/src/zip${lib.replaceStrings [ "." ] [ "" ] version}.tgz"
+ "ftp://ftp.info-zip.org/pub/infozip/src/zip${
+ lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
+ }.tgz"
"https://src.fedoraproject.org/repo/pkgs/zip/zip30.tar.gz/7b74551e63f8ee6aab6fbc86676c0d37/zip30.tar.gz"
];
sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h";
@@ -44,9 +47,12 @@ stdenv.mkDerivation rec {
# zip I/O error: No such file or directory
# zip error: Could not create output file (was replacing the original zip file)
# make[2]: *** [CreateJars.gmk:659: /build/source/build/linux-x86_64-normal-server-release/images/src.zip] Error 1
- #
- # Source: Debian
- ./12-fix-build-with-gcc-14.patch
+ (fetchDebianPatch {
+ inherit (finalAttrs) pname version;
+ debianRevision = "16";
+ patch = "fix-build-with-gcc-14.patch";
+ hash = "sha256-C966AdPV5E44cJ1L28iFvmXq3frjNiW6PoHiOOusS04=";
+ })
(fetchpatch {
url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/zip/files/zip-3.0-pic.patch?id=d37d095fc7a2a9e4a8e904a7bf0f597fe99df85a";
hash = "sha256-OXgC9KqiOpH/o/bSabt3LqtoT/xifqfkvpLLPfPz+1c=";
@@ -74,6 +80,22 @@ stdenv.mkDerivation rec {
url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/zip/files/zip-3.0-zipnote-freeze.patch?id=d37d095fc7a2a9e4a8e904a7bf0f597fe99df85a";
hash = "sha256-EVr7YS3IytnCRjAYUlkg05GA/kaAY9NRFG7uDt0QLAY=";
})
+ # Fix buffer overflow (CVE-2018-13410).
+ # See: https://seclists.org/fulldisclosure/2018/Jul/24
+ (fetchDebianPatch {
+ inherit (finalAttrs) pname version;
+ debianRevision = "16";
+ patch = "buffer-overflow-cve-2018-13410.patch";
+ hash = "sha256-Hgy0yrBuSX2XWN1PNASQbjiXfyzSScwHQ+o0fv6Sgs4=";
+ })
+ # Command injection in zip -T for specially crafted file
+ # names. See: https://seclists.org/oss-sec/2026/q3/494
+ (fetchDebianPatch {
+ inherit (finalAttrs) pname version;
+ debianRevision = "16";
+ patch = "fix-command-injection.patch";
+ hash = "sha256-cfE98l98KkPfDS5KT/DB2bqFNPTbHBKyJ7W2+iKgaGI=";
+ })
]
++ lib.optionals (enableNLS && !stdenv.hostPlatform.isCygwin) [ ./natspec-gentoo.patch.bz2 ];
@@ -88,4 +110,4 @@ stdenv.mkDerivation rec {
maintainers = with lib.maintainers; [ RossComputerGuy ];
mainProgram = "zip";
};
-}
+})
diff --git a/pkgs/by-name/zl/zlib-ng/package.nix b/pkgs/by-name/zl/zlib-ng/package.nix
index 6d813b919db7..5bf6295a3e2c 100644
--- a/pkgs/by-name/zl/zlib-ng/package.nix
+++ b/pkgs/by-name/zl/zlib-ng/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "zlib-ng";
repo = "zlib-ng";
- rev = finalAttrs.version;
+ tag = finalAttrs.version;
hash = "sha256-6GlHCnx9dQtmViPnvHnMS+l9Z+g6M8ynrSxLhLtmAKU=";
};
@@ -46,6 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
]
++ lib.optionals withZlibCompat [ "-DZLIB_COMPAT=ON" ];
+ __structuredAttrs = true;
+
meta = {
description = "Zlib data compression library for the next generation systems";
homepage = "https://github.com/zlib-ng/zlib-ng";
diff --git a/pkgs/by-name/zv/zvbi/package.nix b/pkgs/by-name/zv/zvbi/package.nix
index 50c58744efab..ea33b1e12e8e 100644
--- a/pkgs/by-name/zv/zvbi/package.nix
+++ b/pkgs/by-name/zv/zvbi/package.nix
@@ -13,13 +13,13 @@
stdenv.mkDerivation (finalAttrs: {
pname = "zvbi";
- version = "0.2.44";
+ version = "0.2.45";
src = fetchFromGitHub {
owner = "zapping-vbi";
repo = "zvbi";
rev = "v${finalAttrs.version}";
- hash = "sha256-knc9PejugU6K4EQflfz91keZr3ZJqZu2TKFQFFJrxiI=";
+ hash = "sha256-Nkg/Y7tHYAEi3ndbiJwwutVrGCOIE5RUCNQW3j12BkM=";
};
configureFlags = lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [
diff --git a/pkgs/development/compilers/arocc/default.nix b/pkgs/development/compilers/arocc/default.nix
index 2372e60c421d..a017b60b9a4e 100644
--- a/pkgs/development/compilers/arocc/default.nix
+++ b/pkgs/development/compilers/arocc/default.nix
@@ -2,18 +2,18 @@
lib,
fetchFromGitHub,
callPackage,
- zig_0_14,
+ zig,
}:
let
versions = [
{
- zig = zig_0_14;
- version = "0-unstable-2025-03-05";
+ inherit zig;
+ version = "0-unstable-2026-04-02";
src = fetchFromGitHub {
owner = "Vexu";
repo = "arocc";
- rev = "8c6bab43ba351fc045a1d262d8a8da4a11215e37";
- hash = "sha256-J5Cj9UMwAMwH2JGby13FIKl5Qbj4N4XpSSY7zL21aoY=";
+ rev = "5f5a050569a95ecc40a426f0c3666ae7ef987ede";
+ hash = "sha256-f8Z0SXWx5Uia2TCMB5SUpcO8+xUnaWk32Oknva7xcxw=";
};
}
];
diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix
index b9c04a91729c..ccb5b67f17af 100644
--- a/pkgs/development/compilers/go/1.26.nix
+++ b/pkgs/development/compilers/go/1.26.nix
@@ -25,11 +25,11 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "go";
- version = "1.26.5";
+ version = "1.26.7";
src = fetchurl {
url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
- hash = "sha256-SVvkvIcXasVnOS5bQRar2YRm0z17SdQedkzMaXay3EI=";
+ hash = "sha256-DtJOrHVRBQhbif6cq8J0K5GgrXuUtZ0602SRjryJVq0=";
};
strictDeps = true;
diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix
index 47d32565ac18..17847cb1ae04 100644
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@@ -127,8 +127,8 @@ let
in
rec {
vala_0_56 = generic {
- version = "0.56.18";
- hash = "sha256-8q/+fUCrY9uOe57MP2vcnC/H4xNMhP8teV9IL+kmo4I=";
+ version = "0.56.19";
+ hash = "sha256-WtfLv8wN5htAPWeXye9gRVv769jhYq7DO1sLCXrfudU=";
};
vala = vala_0_56;
diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix
index c4fc149074ee..c7cc52a75a5e 100644
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@@ -82,6 +82,8 @@ stdenv.mkDerivation (
nativeBuildInputs = [ makeWrapper ];
buildInputs = [ readline ];
+ strictDeps = true;
+
inherit patches;
postPatch = ''
@@ -217,6 +219,8 @@ stdenv.mkDerivation (
);
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.lua.org";
description = "Powerful, fast, lightweight, embeddable scripting language";
diff --git a/pkgs/development/interpreters/luajit/2.1.nix b/pkgs/development/interpreters/luajit/2.1.nix
index 84c188166673..a227695f2cc4 100644
--- a/pkgs/development/interpreters/luajit/2.1.nix
+++ b/pkgs/development/interpreters/luajit/2.1.nix
@@ -8,13 +8,13 @@
callPackage ./default.nix {
# The patch version is the timestamp of the git commit,
# obtain via `cat $(nix-build -A luajit_2_1.src)/.relver`
- version = "2.1.1774638290";
+ version = "2.1.1785763465";
src = fetchFromGitHub {
owner = "LuaJIT";
repo = "LuaJIT";
- rev = "fbb36bb6bfa88716a47c58bcf9ce9f2ef752abac";
- hash = "sha256-BqH66q38mJpIYJgPiSPt7I0B3VLBvuDRRTiMJ7ldkBI=";
+ rev = "1edc3e52b67eaf6ce5f809be8e17d6862594b8bc";
+ hash = "sha256-mcOvVJ7AaoHrbEXxznpOkFoY7Kbd2aWMoOmyx5B4FIg=";
};
inherit self passthruFun;
diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
new file mode 100644
index 000000000000..fc8ee2f29ea9
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch
@@ -0,0 +1,39 @@
+CVE-2026-15534, upstream commit
+568e6fd238867bb9e99fa3f47cba3169009239e0.
+
+diff --git a/regexec.c b/regexec.c
+index 35a727459c4a..29aa73c13cb9 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -9211,7 +9211,8 @@ NULL
+ reginfo->poscache_iter = reginfo->poscache_maxiter;
+ }
+
+- if (reginfo->poscache_iter-- == 0) {
++ if (reginfo->poscache_iter == 1) {
++ reginfo->poscache_iter--;
+ /* initialise cache */
+ const SSize_t size = (reginfo->poscache_maxiter + 7)/8;
+ regmatch_info_aux *const aux = reginfo->info_aux;
+@@ -9232,11 +9233,10 @@ NULL
+ );
+ }
+
+- if (reginfo->poscache_iter < 0) {
++ if (reginfo->poscache_iter == 0) {
+ /* have we already failed at this position? */
+ SSize_t offset, mask;
+
+- reginfo->poscache_iter = -1; /* stop eventual underflow */
+ offset = (FLAGS(scan) & 0xf) - 1
+ + (locinput - reginfo->strbeg)
+ * (FLAGS(scan)>>4);
+@@ -9252,6 +9252,8 @@ NULL
+ ST.cache_offset = offset;
+ ST.cache_mask = mask;
+ }
++ else
++ reginfo->poscache_iter--;
+ }
+
+ /* Prefer B over A for minimal matching. */
diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch
new file mode 100644
index 000000000000..b5d0ff5ed3d0
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch
@@ -0,0 +1,59 @@
+CVE-2026-15534, upstream commit
+54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.
+
+diff --git a/regexec.c b/regexec.c
+index 29aa73c13cb9..66e0c0924059 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -9202,22 +9202,27 @@ NULL
+ if (!reginfo->poscache_maxiter) {
+ /* start the countdown: Postpone detection until we
+ * know the match is not *that* much linear. */
+- reginfo->poscache_maxiter
+- = (reginfo->strend - reginfo->strbeg + 1)
+- * (FLAGS(scan)>>4);
+- /* possible overflow for long strings and many CURLYX's */
+- if (reginfo->poscache_maxiter < 0)
+- reginfo->poscache_maxiter = I32_MAX;
+- reginfo->poscache_iter = reginfo->poscache_maxiter;
++ STRLEN len = reginfo->strend - reginfo->strbeg;
++ /* number of participating WHILEMs */
++ U8 n = (FLAGS(scan)>>4);
++
++ /* Only do the calculations and enable the cache if it
++ * won't overflow. This test is equivalent to:
++ * ((len + 1) * n + 7) <= max(STRLEN)
++ */
++ if (len < ((~(STRLEN)0) - 7)/n) {
++ reginfo->poscache_maxiter = (len + 1) * n;
++ reginfo->poscache_iter = reginfo->poscache_maxiter;
++ }
+ }
+
+ if (reginfo->poscache_iter == 1) {
+ reginfo->poscache_iter--;
+ /* initialise cache */
+- const SSize_t size = (reginfo->poscache_maxiter + 7)/8;
++ const STRLEN size = (reginfo->poscache_maxiter + 7)/8;
+ regmatch_info_aux *const aux = reginfo->info_aux;
+ if (aux->poscache) {
+- if ((SSize_t)reginfo->poscache_size < size) {
++ if (reginfo->poscache_size < size) {
+ Renew(aux->poscache, size, char);
+ reginfo->poscache_size = size;
+ }
+diff --git a/regexp.h b/regexp.h
+index 057d9ac5011b..d5d40e0a5618 100644
+--- a/regexp.h
++++ b/regexp.h
+@@ -839,8 +839,8 @@ typedef struct {
+ char *cutpoint; /* (*COMMIT) position (if any) */
+ regmatch_info_aux *info_aux; /* extra fields that need cleanup */
+ regmatch_info_aux_eval *info_aux_eval; /* extra saved state for (?{}) */
+- I32 poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
+- I32 poscache_iter; /* current countdown from _maxiter to zero */
++ STRLEN poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
++ STRLEN poscache_iter; /* current countdown from _maxiter to zero */
+ STRLEN poscache_size; /* size of regmatch_info_aux.poscache */
+ bool intuit; /* re_intuit_start() is the top-level caller */
+ bool is_utf8_pat; /* regex is utf8 */
diff --git a/pkgs/development/interpreters/perl/CVE-2026-8376.patch b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
deleted file mode 100644
index c8ad72298178..000000000000
--- a/pkgs/development/interpreters/perl/CVE-2026-8376.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Targeted patch for CVE-2026-8376, based on 5e7f119eb2bb1181be908701f22bf7068e722f1c but avoids changes to t/re/pat_psycho.t as they do not apply cleanly.
-
-diff --git a/regcomp_study.c b/regcomp_study.c
-index b513454a4258..1602663f4b26 100644
---- a/regcomp_study.c
-+++ b/regcomp_study.c
-@@ -2784,6 +2784,13 @@ Perl_study_chunk(pTHX_
- (U8 *) SvEND(data->last_found))
- - (U8*)s;
- l -= old;
-+
-+ if (l > 0 &&
-+ (mincount >= SSize_t_MAX / (SSize_t)l
-+ || old > SSize_t_MAX - mincount * (SSize_t)l)) {
-+ FAIL("Regexp out of space");
-+ }
-+
- /* Get the added string: */
- last_str = newSVpvn_utf8(s + old, l, UTF);
- last_chrs = UTF ? utf8_length((U8*)(s + old),
diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix
index cab0ea1a2268..6cc6f5755ac4 100644
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@@ -73,8 +73,8 @@ in
rec {
perl5 = callPackage ./interpreter.nix {
self = perl5;
- version = "5.42.0";
- sha256 = "sha256-4JPvGE1/mhuXl+JGUpb1VRCtttq4hCsMPtUzKWYwltw=";
+ version = "5.42.3";
+ sha256 = "sha256-ETd0CYWDe1zfFfDPq5Miedy0NS+RL+1vwUTotPCCNic=";
inherit passthruFun;
};
}
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index cdb03912b517..ae75db2ead90 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -37,7 +37,8 @@ let
# Do not look in /usr etc. for dependencies.
./no-sys-dirs.patch
- ./CVE-2026-8376.patch
+ ./CVE-2026-15534-1.patch
+ ./CVE-2026-15534-2.patch
]
# Fix build on Solaris on x86_64
@@ -83,48 +84,7 @@ let
# Inject fixed CPAN releases for bundled dual-life distributions until the
# next perl maintenance release includes them.
- vendoredPerlDistributions = [
- {
- # CVE-2026-7010
- path = "cpan/HTTP-Tiny";
- src = fetchurl {
- url = "mirror://cpan/authors/id/H/HA/HAARG/HTTP-Tiny-0.094.tar.gz";
- hash = "sha256-poQemfwbVdFd6VlHzL17dnvsxRxxAhl/qPBE333cB0M=";
- };
- }
- {
- # CVE-2026-3381, CVE-2026-4176
- path = "cpan/Compress-Raw-Zlib";
- src = fetchurl {
- url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.222.tar.gz";
- hash = "sha256-Hf19URplVifIGBXTDTurwo+luIRV/wP4sECZ3LUShrg=";
- };
- }
- {
- # Runtime dependency of IO-Compress 2.220.
- path = "cpan/Compress-Raw-Bzip2";
- src = fetchurl {
- url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.218.tar.gz";
- hash = "sha256-iRU+ai69pSNJSTsHT6S3VJ/x+QU952E8GKXgXFtBX6g=";
- };
- }
- {
- # CVE-2026-48962, CVE-2026-48961, CVE-2026-48959
- path = "cpan/IO-Compress";
- src = fetchurl {
- url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
- hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
- };
- }
- {
- # CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
- path = "cpan/Archive-Tar";
- src = fetchurl {
- url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz";
- hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw=";
- };
- }
- ];
+ vendoredPerlDistributions = [ ];
replaceVendoredPerlDistributions = lib.concatMapStringsSep "\n" (d: ''
rm -rf ${d.path}
@@ -440,6 +400,8 @@ stdenv.mkDerivation (
# fixes build failure due to missing d_fdopendir/HAS_FDOPENDIR configure option
# https://github.com/arsv/perl-cross/pull/159
./cross-fdopendir.patch
+
+ ./perl-cross-1.6.4--5.42.3.patch
];
depsBuildBuild = [
diff --git a/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch
new file mode 100644
index 000000000000..853fb8a667a2
--- /dev/null
+++ b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch
@@ -0,0 +1,86 @@
+perl-cross 1.6.4 ships no patch set for perl 5.42.3. The perl5-5.42.0 set
+applies unchanged, so link it under the name perl-cross looks for. The
+links are per-file because `find cnf/diffs/perl5-$version`, which
+perl-cross uses to collect them, does not descend into a symlinked
+directory.
+
+diff --git a/cnf/diffs/perl5-5.42.3/constant.patch b/cnf/diffs/perl5-5.42.3/constant.patch
+new file mode 120000
+index 0000000..61f792a
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/constant.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/constant.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/dynaloader.patch b/cnf/diffs/perl5-5.42.3/dynaloader.patch
+new file mode 120000
+index 0000000..543415e
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/dynaloader.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/dynaloader.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/findext.patch b/cnf/diffs/perl5-5.42.3/findext.patch
+new file mode 120000
+index 0000000..94ed668
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/findext.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/findext.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/installscripts.patch b/cnf/diffs/perl5-5.42.3/installscripts.patch
+new file mode 120000
+index 0000000..6f715b4
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/installscripts.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/installscripts.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/liblist.patch b/cnf/diffs/perl5-5.42.3/liblist.patch
+new file mode 120000
+index 0000000..5037380
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/liblist.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/liblist.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/makemaker.patch b/cnf/diffs/perl5-5.42.3/makemaker.patch
+new file mode 120000
+index 0000000..cf9fc6c
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/makemaker.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/makemaker.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/posix-makefile.patch b/cnf/diffs/perl5-5.42.3/posix-makefile.patch
+new file mode 120000
+index 0000000..072ba89
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/posix-makefile.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/posix-makefile.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/test-checkcase.patch b/cnf/diffs/perl5-5.42.3/test-checkcase.patch
+new file mode 120000
+index 0000000..6ecc9bc
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/test-checkcase.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/test-checkcase.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/test-makemaker.patch b/cnf/diffs/perl5-5.42.3/test-makemaker.patch
+new file mode 120000
+index 0000000..fc6bcda
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/test-makemaker.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/test-makemaker.patch
+\ No newline at end of file
+diff --git a/cnf/diffs/perl5-5.42.3/xconfig.patch b/cnf/diffs/perl5-5.42.3/xconfig.patch
+new file mode 120000
+index 0000000..87ac501
+--- /dev/null
++++ b/cnf/diffs/perl5-5.42.3/xconfig.patch
+@@ -0,0 +1 @@
++../perl5-5.42.0/xconfig.patch
+\ No newline at end of file
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 28d68b002166..2222676354bd 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -12,9 +12,6 @@ let
let
base = callPackage ./generic.nix {
stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
- pcre2 = pcre2.override {
- withJitSealloc = false; # See https://bugs.php.net/bug.php?id=78927 and https://bugs.php.net/bug.php?id=78630
- };
inherit version hash;
};
in
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index e9440614cf34..895394823001 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: {
]
++ buildInputs;
+ strictDeps = true;
+
prePatch = optionalString stdenv.hostPlatform.isDarwin ''
substituteInPlace configure --replace-fail '`/usr/bin/arch`' '"i386"'
'';
diff --git a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
index 3ee947e278e6..151ea81cf134 100644
--- a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh
@@ -10,11 +10,16 @@ unittestCheckPhase() {
local -a flagsArray=()
# Compatibility layer to the obsolete unittestFlagsArray
+ if [[ -z "${dontUseUnittestDiscover-}" ]]; then
+ flagsArray+=("discover")
+ fi
+
eval "flagsArray+=(${unittestFlagsArray[*]-})"
concatTo flagsArray unittestFlags
+
echoCmd 'unittest flags' "${flagsArray[@]}"
- @pythonCheckInterpreter@ -m unittest discover "${flagsArray[@]}"
+ @pythonCheckInterpreter@ -m unittest "${flagsArray[@]}"
runHook postCheck
echo "Finished executing unittestCheckPhase"
diff --git a/pkgs/development/libraries/appstream/default.nix b/pkgs/development/libraries/appstream/default.nix
index 095a87c4d853..61d93622913e 100644
--- a/pkgs/development/libraries/appstream/default.nix
+++ b/pkgs/development/libraries/appstream/default.nix
@@ -32,13 +32,13 @@
pango,
librsvg,
bash-completion,
- systemd,
+ systemdLibs,
nixosTests,
testers,
withIntrospection ?
lib.meta.availableOn stdenv.hostPlatform gobject-introspection
&& stdenv.hostPlatform.emulatorAvailable buildPackages,
- withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+ withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
}:
stdenv.mkDerivation (finalAttrs: {
@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {
bash-completion
]
++ lib.optionals withSystemd [
- systemd
+ systemdLibs
];
mesonFlags = [
diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index 10891ece56a8..fbab3ffe14c2 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -10,12 +10,12 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "attr";
version = "2.6.0";
src = fetchurl {
- url = "mirror://savannah/attr/attr-${version}.tar.gz";
+ url = "mirror://savannah/attr/attr-${finalAttrs.version}.tar.gz";
hash = "sha256-1C+jdFExgLtIyxGkZpb0iCQOUST/HmrYiwq/9waYVhI=";
};
@@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
nativeBuildInputs = [ gettext ];
+ strictDeps = true;
+
postPatch = ''
for script in install-sh include/install-sh; do
patchShebangs $script
@@ -38,6 +40,8 @@ stdenv.mkDerivation rec {
# See nixos/tests/attr.nix
doCheck = false;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://savannah.nongnu.org/projects/attr/";
description = "Library and tools for manipulating extended attributes";
@@ -45,6 +49,6 @@ stdenv.mkDerivation rec {
badPlatforms = lib.platforms.microblaze;
license = lib.licenses.gpl2Plus;
teams = [ lib.teams.security-review ];
- identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" version;
+ identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" finalAttrs.version;
};
-}
+})
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index 9a37a2d12637..492830ac3f5d 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -36,8 +36,8 @@ let
};
v9 = {
- version = "9.0";
- hash = "sha256-LbHwxvylAPh5lb/H+o+9eMVTB9X+tphrxYYX0cqAL0k=";
+ version = "9.0.1";
+ hash = "sha256-9Vnryl9jSSXRfvt2jPsNp7vHWL0KYdWA29D2zDRAZ+0=";
};
in
diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix
index 6c63ba589886..a3bcaac532e9 100644
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -106,7 +106,7 @@ in
version = "12.2.0";
hash = "sha256-Tc7PmNxUv7ajw6GaHPGEEtrD/fl6is7RB8TPestJa1o=";
- patches = lib.optionals stdenv.hostPlatform.is32bit [
+ patches = [
# fix build on 32-bit targets
# FIXME: remove in next update
(fetchpatch {
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 6814348c1d24..aa242f4e262a 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -12,12 +12,12 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "gettext";
version = "1.0";
src = fetchurl {
- url = "mirror://gnu/gettext/${pname}-${version}.tar.gz";
+ url = "mirror://gnu/gettext/gettext-${finalAttrs.version}.tar.gz";
hash = "sha256-hdmbecmBpASHTALgNCF2z3XHaY4rUf5BAxz2Um2XTxo=";
};
patches = [
@@ -45,6 +45,10 @@ stdenv.mkDerivation rec {
"gl_cv_func_wcwidth_works=yes"
];
+ makeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+ "CFLAGS=-D_FORTIFY_SOURCE=0"
+ ];
+
postPatch = ''
# Older versions of gettext come with a copy of `extern-inline.m4` that is not compatible with clang 18.
# When a project uses gettext + autoreconfPhase, autoreconfPhase will invoke `autopoint -f`, which will
@@ -103,6 +107,8 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true;
enableParallelChecking = false; # fails sometimes
+ __structuredAttrs = true;
+
meta = {
description = "Well integrated set of translation tools and documentation";
@@ -131,8 +137,4 @@ stdenv.mkDerivation rec {
license = lib.licenses.gpl2Plus;
platforms = lib.platforms.all;
};
-}
-
-// lib.optionalAttrs stdenv.hostPlatform.isDarwin {
- makeFlags = [ "CFLAGS=-D_FORTIFY_SOURCE=0" ];
-}
+})
diff --git a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
deleted file mode 100644
index 5e55d1242bb4..000000000000
--- a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 4d9c6b19fcb34fab03fb7dab8f6d36a2cc4ef982 Mon Sep 17 00:00:00 2001
-From: Florian Weimer
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 1/3] resolv: Check for inet_ntop failure in ns_sprintrrf
-
-This makes the output more consistent (either failure or complete
-output) and helps with systematic testing with varying buffer
-sizes.
-
-Reviewed-by: Carlos O'Donell
-Reviewed-by: Adhemerval Zanella
-(cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a)
----
- resolv/ns_print.c | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index cef2212fd2..cb680fb74e 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- switch (type) {
- case ns_t_a:
- if (rdlen != (size_t)NS_INADDRSZ)
-- goto formerr;
-- (void) inet_ntop(AF_INET, rdata, buf, buflen);
-+ goto formerr;
-+ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
-+ return -1;
- addlen(strlen(buf), &buf, &buflen);
- break;
-
-@@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- }
-
- case ns_t_aaaa:
-- if (rdlen != (size_t)NS_IN6ADDRSZ)
-- goto formerr;
-- (void) inet_ntop(AF_INET6, rdata, buf, buflen);
-+ if (rdlen != (size_t)NS_IN6ADDRSZ)
-+ goto formerr;
-+ if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
-+ return -1;
- addlen(strlen(buf), &buf, &buflen);
- break;
-
-@@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- goto formerr;
-
- /* Address. */
-- (void) inet_ntop(AF_INET, rdata, buf, buflen);
-+ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
-+ return -1;
- addlen(strlen(buf), &buf, &buflen);
- rdata += NS_INADDRSZ;
-
-@@ -542,7 +545,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- if (rdata + pbyte >= edata) goto formerr;
- memset(&a, 0, sizeof(a));
- memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
-- (void) inet_ntop(AF_INET6, &a, buf, buflen);
-+ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
-+ return -1;
- addlen(strlen(buf), &buf, &buflen);
- rdata += sizeof(a) - pbyte;
- }
---
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
deleted file mode 100644
index 5b39165a43b0..000000000000
--- a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From 103658e72f5aaeb36a5e405f9abaa1b687488fc1 Mon Sep 17 00:00:00 2001
-From: Florian Weimer
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 2/3] resolv: More types as unknown in ns_sprintrrf
- (CVE-2026-5435)
-
-Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy
-implementations of TSIG, fixing bug 34033, and partially
-fixing bug 34069.
-
-Reviewed-by: Carlos O'Donell
-Reviewed-by: Adhemerval Zanella
-(cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
----
- resolv/ns_print.c | 96 -----------------------------------------------
- 1 file changed, 96 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index cb680fb74e..8c876b147e 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -437,96 +437,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- break;
- }
-
-- case ns_t_cert: {
-- u_int c_type, key_tag, alg;
-- int n;
-- unsigned int siz;
-- char base64_cert[8192], tmp[40];
-- const char *leader;
--
-- c_type = ns_get16(rdata); rdata += NS_INT16SZ;
-- key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
-- alg = (u_int) *rdata++;
--
-- len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
-- T(addstr(tmp, len, &buf, &buflen));
-- siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
-- if (siz > sizeof(base64_cert) * 3/4) {
-- const char *str = "record too long to print";
-- T(addstr(str, strlen(str), &buf, &buflen));
-- }
-- else {
-- len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
--
-- if (len < 0)
-- goto formerr;
-- else if (len > 15) {
-- T(addstr(" (", 2, &buf, &buflen));
-- leader = "\n\t\t";
-- spaced = 0;
-- }
-- else
-- leader = " ";
--
-- for (n = 0; n < len; n += 48) {
-- T(addstr(leader, strlen(leader),
-- &buf, &buflen));
-- T(addstr(base64_cert + n, MIN(len - n, 48),
-- &buf, &buflen));
-- }
-- if (len > 15)
-- T(addstr(" )", 2, &buf, &buflen));
-- }
-- break;
-- }
--
-- case ns_t_tkey: {
-- /* KJD - need to complete this */
-- u_long t;
-- int mode, err, keysize;
--
-- /* Algorithm name. */
-- T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
-- T(addstr(" ", 1, &buf, &buflen));
--
-- /* Inception. */
-- t = ns_get32(rdata); rdata += NS_INT32SZ;
-- len = SPRINTF((tmp, "%lu ", t));
-- T(addstr(tmp, len, &buf, &buflen));
--
-- /* Expiration. */
-- t = ns_get32(rdata); rdata += NS_INT32SZ;
-- len = SPRINTF((tmp, "%lu ", t));
-- T(addstr(tmp, len, &buf, &buflen));
--
-- /* Mode , Error, Key Size. */
-- /* Priority, Weight, Port. */
-- mode = ns_get16(rdata); rdata += NS_INT16SZ;
-- err = ns_get16(rdata); rdata += NS_INT16SZ;
-- keysize = ns_get16(rdata); rdata += NS_INT16SZ;
-- len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
-- T(addstr(tmp, len, &buf, &buflen));
--
-- /* XXX need to dump key, print otherdata length & other data */
-- break;
-- }
--
-- case ns_t_tsig: {
-- /* BEW - need to complete this */
-- int n;
--
-- T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
-- T(addstr(" ", 1, &buf, &buflen));
-- rdata += 8; /*%< time */
-- n = ns_get16(rdata); rdata += INT16SZ;
-- rdata += n; /*%< sig */
-- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
-- sprintf(buf, "%d", ns_get16(rdata));
-- rdata += INT16SZ;
-- addlen(strlen(buf), &buf, &buflen);
-- break;
-- }
--
- case ns_t_a6: {
- struct in6_addr a;
- int pbyte, pbit;
-@@ -561,12 +471,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- break;
- }
-
-- case ns_t_opt: {
-- len = SPRINTF((tmp, "%u bytes", class));
-- T(addstr(tmp, len, &buf, &buflen));
-- break;
-- }
--
- default:
- snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
- comment = errbuf;
---
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
deleted file mode 100644
index 8bde49f159e0..000000000000
--- a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 2290143edc27486196815874dca5a528c118a73f Mon Sep 17 00:00:00 2001
-From: Florian Weimer
-Date: Fri, 19 Jun 2026 18:22:20 +0200
-Subject: [PATCH 3/3] resolv: Fix buffer overreads in ns_sprintrrf
- (CVE-2026-6238)
-
-Check that the RDATA payload does not require more than RDATALEN
-bytes while processing it. The fixes cover A6, LOC records.
-(CERT, TKEY, TSIG were fixed before, by switching to the generic
-formatter.)
-
-The vulnerable LOC record handling was first introduced before
-glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.
-
-CERT, TSIG, TKEY handling came with commit
-b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.
-
-A6 record handling was introduced in commit
-91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
-(ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
-2.7.
-
-This fixes bug 34069.
-
-Reviewed-by: Carlos O'Donell
-Reviewed-by: Adhemerval Zanella
-(cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
----
- resolv/ns_print.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/resolv/ns_print.c b/resolv/ns_print.c
-index 8c876b147e..6832255a25 100644
---- a/resolv/ns_print.c
-+++ b/resolv/ns_print.c
-@@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
- case ns_t_loc: {
- char t[255];
-
-- /* XXX protocol format checking? */
-+ if (rdlen != 16)
-+ goto formerr;
- (void) loc_ntoa(rdata, t);
- T(addstr(t, strlen(t), &buf, &buflen));
- break;
-@@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
-
- /* address suffix: provided only when prefix len != 128 */
- if (pbit < 128) {
-- if (rdata + pbyte >= edata) goto formerr;
-+ unsigned int bytelen = sizeof(a) - pbyte;
-+ if (edata - rdata < bytelen) goto formerr;
- memset(&a, 0, sizeof(a));
-- memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
-+ memcpy(&a.s6_addr[pbyte], rdata, bytelen);
- if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
- return -1;
- addlen(strlen(buf), &buf, &buflen);
-- rdata += sizeof(a) - pbyte;
-+ rdata += bytelen;
- }
-
- /* prefix name: provided only when prefix len > 0 */
---
-2.54.0
-
diff --git a/pkgs/development/libraries/glibc/2.42-master.patch b/pkgs/development/libraries/glibc/2.42-master.patch
index a7bdf93961db..8abd567ee32b 100644
--- a/pkgs/development/libraries/glibc/2.42-master.patch
+++ b/pkgs/development/libraries/glibc/2.42-master.patch
@@ -7913,3 +7913,3262 @@ index 86ae5019a6..17b5565d0f 100644
/* Enlarge the buffer. */
wstr = (wchar_t *) realloc (*strptr,
newsize * sizeof (wchar_t));
+
+commit b866ef29773b22a1343ff9084374775114350b78
+Author: Maciej W. Rozycki
+Date: Wed May 27 12:57:10 2026 -0400
+
+ support: Implement 'xfmemopen' for seamless 'fmemopen' use
+
+ Add 'xfmemopen' wrapper for seamless 'fmemopen' use in tests, following
+ 'xfopen', 'xfclose', etc., and providing a standardized error reporting
+ facility.
+
+ Reviewed-by: Florian Weimer
+ (cherry picked from commit fe709cc24578ecfd2ff5b07e10e3829fcb55075b)
+
+ Reviewed-by: Carlos O'Donell
+
+diff --git a/support/Makefile b/support/Makefile
+index d41278eeab..f67f38130a 100644
+--- a/support/Makefile
++++ b/support/Makefile
+@@ -134,6 +134,7 @@ libsupport-routines = \
+ xfclose \
+ xfdopendir \
+ xfgets \
++ xfmemopen \
+ xfopen \
+ xfork \
+ xfread \
+diff --git a/support/xfmemopen.c b/support/xfmemopen.c
+new file mode 100644
+index 0000000000..f1dbc72c67
+--- /dev/null
++++ b/support/xfmemopen.c
+@@ -0,0 +1,31 @@
++/* fmemopen with error checking.
++ Copyright (C) 2025 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++
++#include
++#include
++
++FILE *
++xfmemopen (void *mem, size_t len, const char *mode)
++{
++ FILE *fp = fmemopen (mem, len, mode);
++ if (fp == NULL)
++ FAIL_EXIT1 ("fmemopen (mode \"%s\"): %m", mode);
++ return fp;
++}
+diff --git a/support/xstdio.h b/support/xstdio.h
+index c3fdf9496f..70b83f11da 100644
+--- a/support/xstdio.h
++++ b/support/xstdio.h
+@@ -27,6 +27,7 @@ __BEGIN_DECLS
+ FILE *xfopen (const char *path, const char *mode);
+ void xfclose (FILE *);
+ FILE *xfreopen (const char *path, const char *mode, FILE *stream);
++FILE *xfmemopen (void *mem, size_t len, const char *mode);
+ void xfread (void *ptr, size_t size, size_t nmemb, FILE *stream);
+ char *xfgets (char *s, int size, FILE *stream);
+
+
+commit 97926e9017f3faeaacce9337f1288460f5e6ec7d
+Author: Maciej W. Rozycki
+Date: Wed May 27 12:57:10 2026 -0400
+
+ stdio-common: Reject insufficient character data in scanf [BZ #12701]
+
+ Reject invalid formatted scanf character data with the 'c' conversion
+ where there is not enough input available to satisfy the field width
+ requested. It is required by ISO C that this conversion matches a
+ sequence of characters of exactly the number specified by the field
+ width and it is also already documented as such in our own manual:
+
+ "It reads precisely the next N characters, and fails if it cannot get
+ that many."
+
+ Currently a matching success is instead incorrectly produced where the
+ EOF condition is encountered before the required number of characters
+ has been retrieved, and the characters actually obtained are stored in
+ the buffer provided.
+
+ Add test cases accordingly and remove placeholders from 'c' conversion
+ input data for the existing scanf tests.
+
+ Reviewed-by: Adhemerval Zanella
+
+ [This is a modified version of commit 2b16c76609, which tests for the
+ old behavior and only includes the test cases, for older branches
+ and downstream backports - DJ]
+
+ Reviewed-by: Carlos O'Donell
+
+diff --git a/localedata/Makefile b/localedata/Makefile
+index 4a23593cca..bff5c0bc71 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -236,6 +236,7 @@ tests = \
+ bug-iconv-trans \
+ bug-setlocale1 \
+ bug-usesetlocale \
++ tst-bz12701-lc \
+ tst-bz13988 \
+ tst-c-utf8-consistency \
+ tst-digits \
+diff --git a/localedata/tst-bz12701-lc.c b/localedata/tst-bz12701-lc.c
+new file mode 100644
+index 0000000000..23c2ab7d2a
+--- /dev/null
++++ b/localedata/tst-bz12701-lc.c
+@@ -0,0 +1,218 @@
++/* Verify scanf field width handling with the 'lc' conversion (BZ #12701).
++ Copyright (C) 2025-2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++#include
++#include
++#include
++#include
++
++#include
++#include
++#include
++#include
++
++/* Compare character-wise the initial part of the wide character object
++ pointed to by WS corresponding to wide characters obtained by the
++ conversion of first N bytes of the multibyte character object pointed
++ to by S. */
++
++static int
++tst_bz12701_lc_memcmp (const wchar_t *ds, const char *s, size_t n)
++{
++ size_t nc = mbsnrtowcs (NULL, &s, n, 0, NULL);
++
++ struct support_next_to_fault ntf;
++ ntf = support_next_to_fault_allocate (nc * sizeof (wchar_t));
++ wchar_t *ss = (wchar_t *) ntf.buffer;
++
++ mbsnrtowcs (ss, &s, n, nc, NULL);
++ int r = wmemcmp (ds, ss, nc);
++
++ support_next_to_fault_free (&ntf);
++
++ return r;
++}
++
++/* Verify various aspects of field width handling, including the data
++ obtained, the number of bytes consumed, and the stream position. */
++
++static int
++do_test (void)
++{
++ if (setlocale (LC_ALL, "pl_PL.UTF-8") == NULL)
++ FAIL_EXIT1 ("setlocale (LC_ALL, \"pl_PL.UTF-8\")");
++
++ /* Part of a tongue-twister in Polish, which says:
++ "On a rainy morning cuckoos and warblers, rather than starting
++ on earthworms, stuffed themselves fasted with the flesh of cress." */
++ static const char s[126] = "Dżdżystym rankiem gżegżółki i piegże, "
++ "zamiast wziąć się za dżdżownice, "
++ "nażarły się na czczo miąższu rzeżuchy";
++
++ const char *sp = s;
++ size_t nc;
++ TEST_VERIFY_EXIT ((nc = mbsnrtowcs (NULL, &sp, sizeof (s), 0, NULL)) == 108);
++
++ struct support_next_to_fault ntfo, ntfi;
++ ntfo = support_next_to_fault_allocate (nc * sizeof (wchar_t));
++ ntfi = support_next_to_fault_allocate (sizeof (s));
++ wchar_t *e = (wchar_t *) ntfo.buffer + nc;
++ char *b = ntfi.buffer;
++
++ wchar_t *c;
++ FILE *f;
++ int ic;
++ int n;
++ int i;
++
++ memcpy (ntfi.buffer, s, sizeof (s));
++
++ ic = i = 0;
++ f = xfmemopen (b, sizeof (s), "r");
++
++ c = e - 1;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ /* Avoid: "warning: zero width in gnu_scanf format [-Werror=format=]". */
++ DIAG_PUSH_NEEDS_COMMENT;
++ DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wformat");
++ TEST_VERIFY_EXIT (fscanf (f, "%0lc%n", c, &n) == 1);
++ DIAG_POP_NEEDS_COMMENT;
++ TEST_VERIFY_EXIT (n == 1);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 1;
++ i += n;
++
++ c = e - 1;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 2);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 1;
++ i += n;
++
++ c = e - 1;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%1lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 1);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 1;
++ i += n;
++
++ c = e - 2;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 3);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 2;
++ i += n;
++
++ c = e - 4;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%4lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 4);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 4;
++ i += n;
++
++ c = e - 8;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%8lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 8);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 8;
++ i += n;
++
++ c = e - 16;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%16lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 20);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 16;
++ i += n;
++
++ c = e - 32;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%32lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 38);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 32;
++ i += n;
++
++ c = e - (nc - ic);
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_COMPARE (fscanf (f, "%64lc%n", c, &n), 1);
++ TEST_COMPARE (n , 49);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, sizeof (s) - i) == 0);
++
++ TEST_VERIFY_EXIT (ftell (f) == sizeof (s));
++ TEST_VERIFY_EXIT (feof (f) != 0);
++
++ xfclose (f);
++
++ ic = i = 0;
++ f = xfmemopen (b, 3, "r");
++
++ c = e - 2;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 3);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 2;
++ i += n;
++
++ c = e - (nc - ic);
++ TEST_VERIFY_EXIT (feof (f) == 0);
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == EOF);
++ TEST_VERIFY_EXIT (n == 3);
++
++ TEST_VERIFY_EXIT (ftell (f) == 3);
++ TEST_VERIFY_EXIT (feof (f) != 0);
++
++ xfclose (f);
++
++ ic = i = 0;
++ f = xfmemopen (b, 3, "r");
++
++ c = e - 1;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 1);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0);
++ ic += 1;
++ i += n;
++
++ c = e - (nc - ic);
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 2);
++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, 3 - i) == 0);
++
++ TEST_VERIFY_EXIT (ftell (f) == 3);
++ TEST_VERIFY_EXIT (feof (f) != 0);
++
++ xfclose (f);
++
++ support_next_to_fault_free (&ntfi);
++ support_next_to_fault_free (&ntfo);
++
++ return 0;
++}
++
++#include
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index e52c333808..fdb545242e 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -260,6 +260,7 @@ tests := \
+ tllformat \
+ tst-bz11319 \
+ tst-bz11319-fortify2 \
++ tst-bz12701-c \
+ tst-cookie \
+ tst-dprintf-length \
+ tst-fclose-devzero \
+diff --git a/stdio-common/tst-bz12701-c.c b/stdio-common/tst-bz12701-c.c
+new file mode 100644
+index 0000000000..4f3616fbfd
+--- /dev/null
++++ b/stdio-common/tst-bz12701-c.c
+@@ -0,0 +1,169 @@
++/* Verify scanf field width handling with the 'c' conversion (BZ #12701).
++ Copyright (C) 2025-2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++#include
++
++#include
++#include
++#include
++#include
++
++/* Verify various aspects of field width handling, including the data
++ obtained, the number of bytes consumed, and the stream position. */
++
++static int
++do_test (void)
++{
++ static const char s[43] = "The quick brown fox jumps over the lazy dog";
++ struct support_next_to_fault ntfo, ntfi;
++ ntfo = support_next_to_fault_allocate (sizeof (s));
++ ntfi = support_next_to_fault_allocate (sizeof (s));
++ char *e = ntfo.buffer + sizeof (s);
++ char *b = ntfi.buffer;
++
++ char *c;
++ FILE *f;
++ int n;
++ int i;
++
++ memcpy (ntfi.buffer, s, sizeof (s));
++
++ i = 0;
++ f = xfmemopen (b, sizeof (s), "r");
++
++ c = e - 1;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ /* Avoid: "warning: zero width in gnu_scanf format [-Werror=format=]". */
++ DIAG_PUSH_NEEDS_COMMENT;
++ DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wformat");
++ TEST_VERIFY_EXIT (fscanf (f, "%0c%n", c, &n) == 1);
++ DIAG_POP_NEEDS_COMMENT;
++ TEST_VERIFY_EXIT (n == 1);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - 1;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 1);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - 1;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%1c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 1);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - 2;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 2);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - 4;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%4c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 4);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - 8;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%8c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 8);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - 16;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%16c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 16);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - (sizeof (s) - i);
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%32c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 10);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, sizeof (s) - i) == 0);
++
++ TEST_VERIFY_EXIT (ftell (f) == sizeof (s));
++ TEST_VERIFY_EXIT (feof (f) != 0);
++
++ xfclose (f);
++
++ i = 0;
++ f = xfmemopen (b, 3, "r");
++
++ c = e - 1;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 1);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - 2;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 2);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - (3 - i);
++ TEST_VERIFY_EXIT (feof (f) == 0);
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == EOF);
++ TEST_VERIFY_EXIT (n == 2);
++
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (feof (f) != 0);
++
++ xfclose (f);
++
++ i = 0;
++ f = xfmemopen (b, 3, "r");
++
++ c = e - 2;
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 2);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0);
++ i += n;
++
++ c = e - (3 - i);
++ TEST_VERIFY_EXIT (ftell (f) == i);
++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1);
++ TEST_VERIFY_EXIT (n == 1);
++ TEST_VERIFY_EXIT (memcmp (c, s + i, 3 - i) == 0);
++
++ TEST_VERIFY_EXIT (ftell (f) == 3);
++ TEST_VERIFY_EXIT (feof (f) != 0);
++
++ xfclose (f);
++
++ support_next_to_fault_free (&ntfi);
++ support_next_to_fault_free (&ntfo);
++
++ return 0;
++}
++
++#include
+
+commit 6cebb0b80fd783e442a8ad27c3f52cde52a9cac7
+Author: DJ Delorie
+Date: Wed May 27 12:57:10 2026 -0400
+
+ stdio-common: Allow partially-filled %mc buffers [BZ #12701]
+
+ This is a backwards-compatible alternative to the main solution to
+ the %mc part of 12701. The allocated buffer is expanded to the
+ requested size and NUL padded, but truncated reads are allowed.
+
+ Reviewed-by: Carlos O'Donell
+
+diff --git a/localedata/Makefile b/localedata/Makefile
+index bff5c0bc71..e212facef0 100644
+--- a/localedata/Makefile
++++ b/localedata/Makefile
+@@ -237,6 +237,7 @@ tests = \
+ bug-setlocale1 \
+ bug-usesetlocale \
+ tst-bz12701-lc \
++ tst-bz12701-lc2 \
+ tst-bz13988 \
+ tst-c-utf8-consistency \
+ tst-digits \
+diff --git a/localedata/tst-bz12701-lc2.c b/localedata/tst-bz12701-lc2.c
+new file mode 100644
+index 0000000000..b24e86df0b
+--- /dev/null
++++ b/localedata/tst-bz12701-lc2.c
+@@ -0,0 +1,47 @@
++/* Verify scanf memory handling with the 'c' conversion (BZ #12701).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++#include
++#include
++
++#include
++#include
++#include
++#include
++
++static int
++do_test (void)
++{
++ wchar_t *c = NULL;
++ int i;
++
++ TEST_VERIFY (sscanf ("1234", "%30mlc", &c) == 1);
++
++ TEST_VERIFY (c != NULL);
++ TEST_COMPARE_BLOB (c, 5 * sizeof (wchar_t),
++ L"1234\0", 5 * sizeof (wchar_t));
++ for (i = 5; i < 30; i ++)
++ TEST_VERIFY (c[i] == L'\0');
++
++ TEST_VERIFY (malloc_usable_size (c) >= 30 * sizeof(wchar_t));
++
++ return 0;
++}
++
++#include
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index fdb545242e..27e7ea20f0 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -261,6 +261,7 @@ tests := \
+ tst-bz11319 \
+ tst-bz11319-fortify2 \
+ tst-bz12701-c \
++ tst-bz12701-c2 \
+ tst-cookie \
+ tst-dprintf-length \
+ tst-fclose-devzero \
+diff --git a/stdio-common/tst-bz12701-c2.c b/stdio-common/tst-bz12701-c2.c
+new file mode 100644
+index 0000000000..5f9ca7c592
+--- /dev/null
++++ b/stdio-common/tst-bz12701-c2.c
+@@ -0,0 +1,46 @@
++/* Verify scanf memory handling with the 'c' conversion (BZ #12701).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++#include
++#include
++
++#include
++#include
++#include
++#include
++
++static int
++do_test (void)
++{
++ char *c = NULL;
++ int i;
++
++ TEST_VERIFY (sscanf ("1234", "%30mc", &c) == 1);
++
++ TEST_VERIFY (c != NULL);
++ TEST_COMPARE_BLOB (c, 5, "1234\0", 5);
++ for (i = 5; i < 30; i ++)
++ TEST_VERIFY (c[i] == '\0');
++
++ TEST_VERIFY (malloc_usable_size (c) >= 30);
++
++ return 0;
++}
++
++#include
+diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
+index 17b5565d0f..90a1886951 100644
+--- a/stdio-common/vfscanf-internal.c
++++ b/stdio-common/vfscanf-internal.c
+@@ -780,9 +780,9 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ conv_error (); \
+ } while (0)
+ #ifdef COMPILE_WSCANF
+- STRING_ARG (str, char, 100);
++ STRING_ARG (str, char, (width > 0 ? width : 1));
+ #else
+- STRING_ARG (str, char, (width > 1024 ? 1024 : width));
++ STRING_ARG (str, char, (width > 0 ? width : 1));
+ #endif
+
+ c = inchar ();
+@@ -891,6 +891,11 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+
+ if (!(flags & SUPPRESS))
+ {
++ /* If the buffer isn't completely filled, pad it with NULs. */
++ if (flags & MALLOC)
++ while (width-- > 0)
++ *str++ = '\0';
++
+ if ((flags & MALLOC) && str - *strptr != strsize)
+ {
+ char *cp = (char *) realloc (*strptr, str - *strptr);
+@@ -908,7 +913,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ if (width == -1)
+ width = 1;
+
+- STRING_ARG (wstr, wchar_t, (width > 1024 ? 1024 : width));
++ STRING_ARG (wstr, wchar_t, (width > 0 ? width : 1));
+
+ c = inchar ();
+ if (__glibc_unlikely (c == EOF))
+@@ -1044,6 +1049,11 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+
+ if (!(flags & SUPPRESS))
+ {
++ /* If the buffer isn't completely filled, pad it with NULs. */
++ if (flags & MALLOC)
++ while (width-- > 0)
++ *wstr++ = L'\0';
++
+ if ((flags & MALLOC) && wstr - (wchar_t *) *strptr != strsize)
+ {
+ wchar_t *cp = (wchar_t *) realloc (*strptr,
+
+commit 748699d9385fc298f7d3369af0a015a6d88b7e64
+Author: Sam James
+Date: Sat Jun 6 20:32:27 2026 +0100
+
+ elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
+
+ dbe5065f2166be20e57a24f246a40d50e001a05d and ae589cb84df10825fc545a45c7007a5f79409bf1
+ cater for setups where ld.so.conf{,.d} is required to find runtime support
+ libraries, but tst-glibc-hwcaps-prepend-cache clobbers the created ld.so.conf
+ with its own entry.
+
+ Fix it to instead use the ld.so.conf.d created in ae589cb84df10825fc545a45c7007a5f79409bf1
+ to co-exist with existing entries.
+
+ Bug: https://bugs.gentoo.org/976773
+ Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31901
+ Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34210
+ Tested-by: Andreas K. Hüttel
+ Reported-by: Eli Schwartz
+ Reviewed-by: Andreas K. Hüttel
+ (cherry picked from commit d0cc9bf859d0434e397530d75a6507f13db79fba)
+
+diff --git a/elf/tst-glibc-hwcaps-prepend-cache.c b/elf/tst-glibc-hwcaps-prepend-cache.c
+index b7df3962b5..2d51c22328 100644
+--- a/elf/tst-glibc-hwcaps-prepend-cache.c
++++ b/elf/tst-glibc-hwcaps-prepend-cache.c
+@@ -46,7 +46,7 @@ do_test (void)
+
+ {
+ /* Install the default implementation of libmarkermod1.so. */
+- char *conf_path = xasprintf ("%s/ld.so.conf", support_sysconfdir_prefix);
++ char *conf_path = xasprintf ("%s/ld.so.conf.d/hwcaps.conf", support_sysconfdir_prefix);
+ xmkdirp (support_sysconfdir_prefix, 0777);
+ support_write_file_string (conf_path, "/glibc-test/lib\n");
+ free (conf_path);
+
+commit f671746f6c3ae511432b5666953be668267159f8
+Author: Florian Weimer
+Date: Tue Jun 9 07:28:02 2026 +0200
+
+ iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
+
+ When tentatively converting characters on behalf of
+ __gconv_transliterate, do not create a persistent error. Just
+ produce a local error, and rely on __gconv_transliterate to
+ produce the error if all transliteration options are exhausted.
+
+ This fixes transliteration of “½” to ASCII, which cannot use the
+ “ 1⁄2 ” alternative. Eventually, the “ 1/2 ” alternative is chosen,
+ but the error sticks. Therefore, iconv exited with status 1 before
+ this change.
+
+ Adjust iconv/tst-iconv_prog.sh to test both C and en_US.UTF-8 locales.
+ This requires changing the way the ICONV template is defined, so that
+ run_program_env is evaluated multiple times.
+
+ Fixes commit 9a4b0eaf726f5404c6683d5c7c5e86f61c3f3fbc ("iconv: do not
+ report error exit with transliteration [BZ #32448]"),
+ commit 6cbf845fcdc76131d0e674cee454fe738b69c69d ("iconv: Preserve
+ iconv -c error exit on invalid inputs (bug 32046)"), and bug 34236.
+
+ Reviewed-by: Aurelien Jarno
+ (cherry picked from commit e9325bd7d04aacc45cf39505e279b1ca9de22c08)
+
+diff --git a/iconv/Makefile b/iconv/Makefile
+index 9a94a41ba4..028d24ffc3 100644
+--- a/iconv/Makefile
++++ b/iconv/Makefile
+@@ -138,7 +138,8 @@ $(objpfx)test-iconvconfig.out: $(objpfx)iconvconfig
+ rm -f $$tmp) > $@; \
+ $(evaluate-test)
+
+-$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog
++$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog \
++ $(gen-locales)
+ $(BASH) $< $(common-objdir) '$(test-wrapper-env)' \
+ '$(run-program-env)' > $@; \
+ $(evaluate-test)
+diff --git a/iconv/loop.c b/iconv/loop.c
+index 1378d23147..74b2a3e26d 100644
+--- a/iconv/loop.c
++++ b/iconv/loop.c
+@@ -144,8 +144,10 @@
+ if (irreversible == NULL) \
+ { \
+ /* This means we are in call from __gconv_transliterate. In this \
+- case we are not doing any error recovery ourselves. */ \
+- result = __gconv_mark_illegal_input (step_data); \
++ case we are not doing any error recovery ourselves. Do not create \
++ a persistent error state. If __gconv_transliterate exhausts all \
++ alternatives, it will call __gconv_mark_illegal_input itself. */ \
++ result = __GCONV_ILLEGAL_INPUT; \
+ break; \
+ } \
+ \
+diff --git a/iconv/tst-iconv_prog.sh b/iconv/tst-iconv_prog.sh
+index e2a43280d2..7d7948b7aa 100644
+--- a/iconv/tst-iconv_prog.sh
++++ b/iconv/tst-iconv_prog.sh
+@@ -27,10 +27,10 @@ LIBPATH=$codir:$codir/iconvdata
+
+ # How the start the iconv(1) program. $from is not defined/expanded yet.
+ ICONV='
++$test_wrapper_env $run_program_env
+ $codir/elf/ld.so --library-path $LIBPATH --inhibit-rpath ${from}.so
+ $codir/iconv/iconv_prog
+ '
+-ICONV="$test_wrapper_env $run_program_env $ICONV"
+
+ TIMEOUTFACTOR=${TIMEOUTFACTOR:-1}
+
+@@ -218,6 +218,7 @@ testarray=(
+ "\x00\x00;;INVALID;UTF-8;1"
+ "\x00\x00;;UTF-8;INVALID;1"
+ "\xc3\xa9;;UTF-8;ASCII//TRANSLIT;0"
++"X\xc2\xbdY;;UTF-8;ASCII//TRANSLIT;0"
+ )
+
+ # Requires $twobyte input, $c flag, $from, and $to to be set; sets $ret
+@@ -278,12 +279,21 @@ check_errtest_result ()
+ fi
+ }
+
+-for testcommand in "${testarray[@]}"; do
+- twobyte="$(echo "$testcommand" | cut -d";" -f 1)"
+- c="$(echo "$testcommand" | cut -d";" -f 2)"
+- from="$(echo "$testcommand" | cut -d";" -f 3)"
+- to="$(echo "$testcommand" | cut -d";" -f 4)"
+- eret="$(echo "$testcommand" | cut -d";" -f 5)"
+- execute_test
+- check_errtest_result
+-done
++run_test_array ()
++{
++ for testcommand in "${testarray[@]}"; do
++ twobyte="$(echo "$testcommand" | cut -d";" -f 1)"
++ c="$(echo "$testcommand" | cut -d";" -f 2)"
++ from="$(echo "$testcommand" | cut -d";" -f 3)"
++ to="$(echo "$testcommand" | cut -d";" -f 4)"
++ eret="$(echo "$testcommand" | cut -d";" -f 5)"
++ execute_test
++ check_errtest_result
++ done
++}
++
++echo "info: testing C locale"
++run_test_array
++echo "info: testing en_US.UTF-8 locale"
++run_program_env="$run_program_env LC_ALL=en_US.UTF-8"
++run_test_array
+
+commit f6713070c6accac5c93d96c1d580833afacde3f5
+Author: Adhemerval Zanella
+Date: Wed May 13 08:32:24 2026 -0300
+
+ arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
+
+ _dl_runtime_resolve and _dl_runtime_profile only preserved the integer
+ argument registers (r0-r3) across the inner call to _dl_fixup /
+ _dl_profile_fixup. Two related ABI requirements demand more:
+
+ * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the
+ function being resolved. Recent GCC emits VFP instructions inside
+ the fixup routines, clobbering them, so the resolved function sees
+ corrupted arguments (BZ 34144).
+
+ * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers
+ reachable through the dynamic linker) must only corrupt integer
+ core registers. IFUNC resolvers, audit modules, and interposed
+ malloc invoked during symbol resolution may also use VFP, even on
+ softfp ABI builds (BZ 15792).
+
+ Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31
+ when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup
+ call. Whether VFP is usable is a property of the hardware, not of
+ the ABI glibc was built with, so the decision is gated on AT_HWCAP at
+ runtime in both hardfp and softfp builds; hardfp builds will always
+ find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU
+ correctly skip the save.
+
+ For _dl_runtime_profile the save area is slipped in just before the
+ bl to _dl_profile_fixup; the outgoing framesizep argument is
+ recomputed to account for the extra frame, and both the fast path
+ (no audit framesize) and the slow path (audit wraps with
+ pltenter/pltexit) traverse the restore before splitting.
+
+ Checked on arm-linux-gnueabihf.
+
+ Tested-by: Aurelien Jarno
+ Reviewed-by: Wilco Dijkstra
+ (cherry picked from commit 1111fbdd3e7ebed402800bc23e67055eaae0d972)
+
+diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile
+index 9c4fd6b236..be9e46aeeb 100644
+--- a/sysdeps/arm/Makefile
++++ b/sysdeps/arm/Makefile
+@@ -30,6 +30,25 @@ $(objpfx)tst-armtlsdescloc: $(objpfx)tst-armtlsdesclocmod.so
+ $(objpfx)tst-armtlsdescextnow: $(objpfx)tst-armtlsdescextnowmod.so
+ $(objpfx)tst-armtlsdescextlazy: $(objpfx)tst-armtlsdescextlazymod.so
+ endif
++
++tests += \
++ tst-bz34144 \
++ tst-bz34144-audit \
++ # tests
++modules-names += \
++ tst-bz34144-auditmod \
++ tst-bz34144-mod \
++ # modules-names
++$(objpfx)tst-bz34144: $(objpfx)tst-bz34144-mod.so
++$(objpfx)tst-bz34144-audit: $(objpfx)tst-bz34144-mod.so
++$(objpfx)tst-bz34144-audit.out: $(objpfx)tst-bz34144-auditmod.so
++# Use lazy binding to check if _dl_runtime_resolve correctly save/restore
++# the VFP state.
++LDFLAGS-tst-bz34144 = -Wl,-z,lazy
++# With LD_AUDIT, lazy resolution goes through _dl_runtime_profile, which
++# must also save/restore VFP state (BZ 34144).
++LDFLAGS-tst-bz34144-audit = -Wl,-z,lazy
++tst-bz34144-audit-ENV = LD_AUDIT=$(objpfx)tst-bz34144-auditmod.so
+ endif
+ endif
+
+diff --git a/sysdeps/arm/dl-trampoline.S b/sysdeps/arm/dl-trampoline.S
+index fffac55050..ef358d48bc 100644
+--- a/sysdeps/arm/dl-trampoline.S
++++ b/sysdeps/arm/dl-trampoline.S
+@@ -20,6 +20,7 @@
+ #define NO_THUMB
+ #include
+ #include
++#include
+
+ .text
+ .globl _dl_runtime_resolve
+@@ -36,13 +37,40 @@ _dl_runtime_resolve:
+ @ ip contains &GOT[n+3] (pointer to function)
+ @ lr points to &GOT[2]
+
+- @ Save arguments. We save r4 to realign the stack.
++ @ Save arguments. We save r4 to realign the stack and to hold
++ @ the hwcap value used to decide whether to save VFP registers.
+ push {r0-r4}
+ cfi_adjust_cfa_offset (20)
+ cfi_rel_offset (r0, 0)
+ cfi_rel_offset (r1, 4)
+ cfi_rel_offset (r2, 8)
+ cfi_rel_offset (r3, 12)
++ cfi_rel_offset (r4, 16)
++
++#ifdef SHARED
++ @ Preserve all call-clobbered VFP registers across _dl_fixup.
++ @ VFP may be used by IFUNC resolvers, audit modules, interposed
++ @ malloc, and the __aeabi_mem* helpers required by RTABI32,
++ @ which mandates that those helpers only corrupt integer core
++ @ registers.
++ LDR_GLOBAL (r4, r3, C_SYMBOL_NAME(_rtld_global_ro), \
++ RTLD_GLOBAL_RO_DL_HWCAP_OFFSET)
++
++ tst r4, #HWCAP_ARM_VFP
++ beq .Lno_vfp_save
++
++# define VFP_STACK_REQ (32*8 + 8)
++ sub sp, sp, VFP_STACK_REQ
++ cfi_adjust_cfa_offset (VFP_STACK_REQ)
++ mov r3, sp
++ .inst 0xeca30b20 @ vstmia r3!, {d0-d15}
++ tst r4, #HWCAP_ARM_VFPD32
++ beq 1f
++ .inst 0xece30b20 @ vstmia r3!, {d16-d31}
++1: .inst 0xeef12a10 @ vmrs r2, fpscr
++ str r2, [r3]
++.Lno_vfp_save:
++#endif /* SHARED */
+
+ @ get pointer to linker struct
+ ldr r0, [lr, #-4]
+@@ -59,8 +87,23 @@ _dl_runtime_resolve:
+ @ save the return
+ mov ip, r0
+
+- @ get arguments and return address back. We restore r4
+- @ only to realign the stack.
++#ifdef SHARED
++ tst r4, #HWCAP_ARM_VFP
++ beq .Lno_vfp_restore
++ mov r3, sp
++ .inst 0xecb30b20 @ vldmia r3!, {d0-d15}
++ tst r4, #HWCAP_ARM_VFPD32
++ beq 2f
++ .inst 0xecf30b20 @ vldmia r3!, {d16-d31}
++2: ldr r2, [r3]
++ .inst 0xeee12a10 @ vmsr fpscr, r2
++ add sp, sp, VFP_STACK_REQ
++ cfi_adjust_cfa_offset (-VFP_STACK_REQ)
++.Lno_vfp_restore:
++#endif /* SHARED */
++
++ @ get arguments and return address back. We restore r4 to
++ @ its original value as well.
+ pop {r0-r4,lr}
+ cfi_adjust_cfa_offset (-24)
+
+@@ -124,14 +167,71 @@ _dl_runtime_profile:
+ add r3, sp, #8
+ stmia r3!, {r0,r1}
+
++ @ Preserve all call-clobbered VFP registers across
++ @ _dl_profile_fixup. See the matching comment in
++ @ _dl_runtime_resolve above for the rationale (BZ 34144,
++ @ BZ 15792).
++ @
++ @ Stack layout below the current sp (which becomes the new sp
++ @ after the sub):
++ @ sp + 0 .. 3: outgoing arg (framesizep) for _dl_profile_fixup
++ @ sp + 4 .. 7: saved hwcap (so we can test it after the call)
++ @ sp + 8 .. 11: saved r2 (used as scratch for LDR_GLOBAL)
++ @ sp + 12 .. 15: padding (for 8-byte alignment of the VFP area)
++ @ sp + 16 .. 16+VFP_STACK_REQ-1: VFP regs + fpscr
++#define VFP_PROFILE_STACK (16 + VFP_STACK_REQ)
++ sub sp, sp, #VFP_PROFILE_STACK
++ cfi_adjust_cfa_offset (VFP_PROFILE_STACK)
++
++ @ r2 holds the retaddr (3rd arg to _dl_profile_fixup); spill
++ @ it so we can use it as the LDR_GLOBAL destination.
++ str r2, [sp, #8]
++
++ LDR_GLOBAL (r2, ip, C_SYMBOL_NAME(_rtld_global_ro), \
++ RTLD_GLOBAL_RO_DL_HWCAP_OFFSET)
++ str r2, [sp, #4]
++
++ tst r2, #HWCAP_ARM_VFP
++ beq .Lprofile_no_vfp_save
++ add ip, sp, #16
++ .inst 0xecac0b20 @ vstmia ip!, {d0-d15}
++ tst r2, #HWCAP_ARM_VFPD32
++ beq 7f
++ .inst 0xecec0b20 @ vstmia ip!, {d16-d31}
++7: .inst 0xeef12a10 @ vmrs r2, fpscr
++ str r2, [ip]
++.Lprofile_no_vfp_save:
++
++ @ Restore r2 (retaddr) for _dl_profile_fixup.
++ ldr r2, [sp, #8]
++
+ @ Set up extra args for _dl_profile_fixup.
+- @ r2 and r3 are already loaded.
+- add ip, sp, #208
++ @ The framesize slot is at the old sp+208, which is the new
++ @ sp + VFP_PROFILE_STACK + 208 -- compute in two steps because
++ @ the combined offset is not encodable as an ARM immediate.
++ add ip, sp, #VFP_PROFILE_STACK
++ add ip, ip, #208
+ str ip, [sp, #0]
+
+ @ call profiling fixup routine
+ bl _dl_profile_fixup
+
++ @ Restore VFP registers. r0 holds the resolved function
++ @ address; r1/r2/ip are caller-saved by the call.
++ ldr r1, [sp, #4]
++ tst r1, #HWCAP_ARM_VFP
++ beq .Lprofile_no_vfp_restore
++ add ip, sp, #16
++ .inst 0xecbc0b20 @ vldmia ip!, {d0-d15}
++ tst r1, #HWCAP_ARM_VFPD32
++ beq 8f
++ .inst 0xecfc0b20 @ vldmia ip!, {d16-d31}
++8: ldr r2, [ip]
++ .inst 0xeee12a10 @ vmsr fpscr, r2
++.Lprofile_no_vfp_restore:
++ add sp, sp, #VFP_PROFILE_STACK
++ cfi_adjust_cfa_offset (-VFP_PROFILE_STACK)
++
+ @ The address to call is now in r0.
+
+ @ Check whether we're wrapping this function.
+diff --git a/sysdeps/arm/tst-bz34144-audit.c b/sysdeps/arm/tst-bz34144-audit.c
+new file mode 100644
+index 0000000000..8f1084fa0a
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-audit.c
+@@ -0,0 +1,32 @@
++/* Test that lazy PLT resolution via _dl_runtime_profile preserves
++ caller-saved VFP registers used to pass double arguments (BZ 34144).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++
++extern void test_float_args (double a, double b, double c, double d,
++ double e, double f, double g, double h);
++
++static int
++do_test (void)
++{
++ test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0);
++ return 0;
++}
++
++#include
+diff --git a/sysdeps/arm/tst-bz34144-auditmod.c b/sysdeps/arm/tst-bz34144-auditmod.c
+new file mode 100644
+index 0000000000..ada9f126c2
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-auditmod.c
+@@ -0,0 +1,50 @@
++/* Minimal audit module used by tst-bz34144-audit to force PLT calls
++ to go through _dl_runtime_profile instead of _dl_runtime_resolve.
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++#include
++#include
++
++unsigned int
++la_version (unsigned int v)
++{
++ return v;
++}
++
++unsigned int
++la_objopen (struct link_map *l, Lmid_t lmid, uintptr_t *cookie)
++{
++ return LA_FLG_BINDFROM | LA_FLG_BINDTO;
++}
++
++uintptr_t
++la_symbind32 (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook,
++ uintptr_t *defcook, unsigned int *flags, const char *symname)
++{
++ return sym->st_value;
++}
++
++Elf32_Addr
++la_arm_gnu_pltenter (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook,
++ uintptr_t *defcook, La_arm_regs *regs,
++ unsigned int *flags, const char *symname,
++ long int *framesizep)
++{
++ return sym->st_value;
++}
+diff --git a/sysdeps/arm/tst-bz34144-mod.c b/sysdeps/arm/tst-bz34144-mod.c
+new file mode 100644
+index 0000000000..be6b54bf91
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144-mod.c
+@@ -0,0 +1,28 @@
++/* DSO used by tst-bz34144.
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++
++void
++test_float_args (double a, double b, double c, double d,
++ double e, double f, double g, double h)
++{
++ if (a != 2.0 || b != 3.0 || c != 4.0 || d != 5.0
++ || e != 6.0 || f != 7.0 || g != 8.0 || h != 9.0)
++ abort ();
++}
+diff --git a/sysdeps/arm/tst-bz34144.c b/sysdeps/arm/tst-bz34144.c
+new file mode 100644
+index 0000000000..61e41b3945
+--- /dev/null
++++ b/sysdeps/arm/tst-bz34144.c
+@@ -0,0 +1,32 @@
++/* Test that lazy PLT resolution preserves caller-saved VFP registers
++ used to pass double arguments (BZ 34144).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++
++extern void test_float_args (double a, double b, double c, double d,
++ double e, double f, double g, double h);
++
++static int
++do_test (void)
++{
++ test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0);
++ return 0;
++}
++
++#include
+
+commit 0be5a6a72a4a3132bc211720d2b6949a84f54dc3
+Author: John David Anglin
+Date: Tue Jun 23 13:41:10 2026 -0400
+
+ hppa: Fix missing call to __feraiseexcept (BZ 34306)
+
+ The feupdateenv function is supposed to raise exceptions after
+ installing the environment represented by its envp argument.
+ This was accidentally missed on hppa.
+
+ The failure to raise exceptions was noticed by the failure of
+ the math/test-narrowing-trap test.
+
+ Signed-off-by: John David Anglin
+
+diff --git a/sysdeps/hppa/fpu/feupdateenv.c b/sysdeps/hppa/fpu/feupdateenv.c
+index 46b83cc7a0..a3d3de33e4 100644
+--- a/sysdeps/hppa/fpu/feupdateenv.c
++++ b/sysdeps/hppa/fpu/feupdateenv.c
+@@ -24,6 +24,7 @@ __feupdateenv (const fenv_t *envp)
+ {
+ union { unsigned long long l; unsigned int sw[2]; } s;
+ fenv_t temp;
++
+ /* Get the current exception status */
+ __asm__ ("fstd %%fr0,0(%1) \n\t"
+ "fldd 0(%1),%%fr0 \n\t"
+@@ -46,6 +47,10 @@ __feupdateenv (const fenv_t *envp)
+
+ /* Install new environment. */
+ __fesetenv (&temp);
++
++ /* Raise exceptions. */
++ __feraiseexcept (temp.__status_word >> 27);
++
+ /* Success. */
+ return 0;
+ }
+
+commit 54929540335ef339ac66a8c28e3f4c22ebae2630
+Author: Fabian Rast
+Date: Thu Jun 11 14:30:37 2026 +0200
+
+ rtld: cache cpuid results on the stack for intel
+
+ dl_init_cacheinfo retrieves various information about cache
+ sizes, using the cpuid instruction on x86.
+ Previously, the same cpuid leaves were queried multiple times.
+ This behavior caused intel_check_word to prominently show up in
+ profiles of dynamic loader startup on the Intel(R) Xeon(R) Gold 6430.
+ The big performance impact could not be reproduced on other Intel cpus.
+
+ This patch reduces the number of cpuid queries on startup
+ by caching their results on the stack for reuse when searching for a
+ different cache size value.
+ This approach does not change the overall design of
+ the cache enumeration code (repeated calls to handle_* functions).
+ The values are cached on the stack instead of globally (e.g.
+ in the cpu_features global) because they are never needed after
+ early initialization.
+
+ The cache is only active for Intel cpus, because it has not yet
+ been shown through benchmarks that it meaningfully improves performance
+ for other processors.
+
+ Signed-off-by: Fabian Rast
+ Reviewed-by: Sunil K Pandey
+ (cherry picked from commit df83fa8813eb53dcb232462a4f6dd00c873115f0)
+
+diff --git a/sysdeps/x86/dl-cacheinfo.h b/sysdeps/x86/dl-cacheinfo.h
+index 6f9bb08a19..201d3ad278 100644
+--- a/sysdeps/x86/dl-cacheinfo.h
++++ b/sysdeps/x86/dl-cacheinfo.h
+@@ -98,6 +98,15 @@ static const struct intel_02_cache_info
+
+ #define nintel_02_known (sizeof (intel_02_known) / sizeof (intel_02_known [0]))
+
++/* Cache for redundant cpuid queries in handle_intel, intel_check_word and
++ get_common_cache_info. Currently, this has only been shown to significantly
++ improve performance on a specific Intel CPU (Xeon 6430). */
++struct intel_cpuid_cache
++{
++ unsigned char leaf2_valid, leaf4_valid; /* Number of cached (sub)leaves. */
++ unsigned int leaf2[4], leaf4[0x10][4];
++};
++
+ static int
+ intel_02_known_compare (const void *p1, const void *p2)
+ {
+@@ -118,7 +127,8 @@ static long int
+ __attribute__ ((noinline))
+ intel_check_word (int name, unsigned int value, bool *has_level_2,
+ bool *no_level_2_or_3,
+- const struct cpu_features *cpu_features)
++ const struct cpu_features *cpu_features,
++ struct intel_cpuid_cache *cache)
+ {
+ if ((value & 0x80000000) != 0)
+ /* The register value is reserved. */
+@@ -152,7 +162,21 @@ intel_check_word (int name, unsigned int value, bool *has_level_2,
+ unsigned int round = 0;
+ while (1)
+ {
+- __cpuid_count (4, round, eax, ebx, ecx, edx);
++ if (round < cache->leaf4_valid)
++ /* Subleaf was queried before. Do not execute cpuid again. */
++ eax = cache->leaf4[round][0], ebx = cache->leaf4[round][1],
++ ecx = cache->leaf4[round][2], edx = cache->leaf4[round][3];
++ else if (round == cache->leaf4_valid
++ && round < sizeof(cache->leaf4)/sizeof(*cache->leaf4))
++ {
++ /* Cache the cpuid result if we have space. */
++ __cpuid_count (4, round, eax, ebx, ecx, edx);
++ cache->leaf4[round][0] = eax, cache->leaf4[round][1] = ebx;
++ cache->leaf4[round][2] = ecx, cache->leaf4[round][3] = edx;
++ cache->leaf4_valid++;
++ }
++ else
++ __cpuid_count (4, round, eax, ebx, ecx, edx);
+
+ enum { null = 0, data = 1, inst = 2, uni = 3 } type = eax & 0x1f;
+ if (type == null)
+@@ -247,7 +271,8 @@ intel_check_word (int name, unsigned int value, bool *has_level_2,
+
+
+ static long int __attribute__ ((noinline))
+-handle_intel (int name, const struct cpu_features *cpu_features)
++handle_intel (int name, const struct cpu_features *cpu_features,
++ struct intel_cpuid_cache *cache)
+ {
+ unsigned int maxidx = cpu_features->basic.max_cpuid;
+
+@@ -260,41 +285,33 @@ handle_intel (int name, const struct cpu_features *cpu_features)
+ long int result = 0;
+ bool no_level_2_or_3 = false;
+ bool has_level_2 = false;
+- unsigned int eax;
+- unsigned int ebx;
+- unsigned int ecx;
+- unsigned int edx;
+- __cpuid (2, eax, ebx, ecx, edx);
++ int i;
++
++ if (!cache->leaf2_valid)
++ {
++ __cpuid (2, cache->leaf2[0], cache->leaf2[1],
++ cache->leaf2[2], cache->leaf2[3]);
++ cache->leaf2_valid = 1;
++ }
+
+ /* The low byte of EAX of CPUID leaf 2 should always return 1 and it
+ should be ignored. If it isn't 1, use CPUID leaf 4 instead. */
+- if ((eax & 0xff) != 1)
++ if ((cache->leaf2[0] & 0xff) != 1)
+ return intel_check_word (name, 0xff, &has_level_2, &no_level_2_or_3,
+- cpu_features);
+- else
+- {
+- eax &= 0xffffff00;
+-
+- /* Process the individual registers' value. */
+- result = intel_check_word (name, eax, &has_level_2,
+- &no_level_2_or_3, cpu_features);
+- if (result != 0)
+- return result;
++ cpu_features, cache);
+
+- result = intel_check_word (name, ebx, &has_level_2,
+- &no_level_2_or_3, cpu_features);
+- if (result != 0)
+- return result;
+-
+- result = intel_check_word (name, ecx, &has_level_2,
+- &no_level_2_or_3, cpu_features);
+- if (result != 0)
+- return result;
++ /* Process all descriptors in leaf 2. */
++ result = intel_check_word (name, cache->leaf2[0]&0xffffff00, &has_level_2,
++ &no_level_2_or_3, cpu_features, cache);
++ if (result != 0)
++ return result;
+
+- result = intel_check_word (name, edx, &has_level_2,
+- &no_level_2_or_3, cpu_features);
++ for (i = 1; i < 4; i++)
++ {
++ result = intel_check_word (name, cache->leaf2[i], &has_level_2,
++ &no_level_2_or_3, cpu_features, cache);
+ if (result != 0)
+- return result;
++ return result;
+ }
+
+ if (name >= _SC_LEVEL2_CACHE_SIZE && name <= _SC_LEVEL3_CACHE_LINESIZE
+@@ -611,7 +628,7 @@ handle_hygon (int name)
+
+ static void
+ get_common_cache_info (long int *shared_ptr, long int * shared_per_thread_ptr, unsigned int *threads_ptr,
+- long int core)
++ long int core, struct intel_cpuid_cache *cache)
+ {
+ unsigned int eax;
+ unsigned int ebx;
+@@ -669,7 +686,14 @@ get_common_cache_info (long int *shared_ptr, long int * shared_per_thread_ptr, u
+ int check = 0x1 | (threads_l3 == 0) << 1;
+ do
+ {
+- __cpuid_count (4, i++, eax, ebx, ecx, edx);
++ if (cache != NULL && i < cache->leaf4_valid)
++ eax = cache->leaf4[i][0], ebx = cache->leaf4[i][1],
++ ecx = cache->leaf4[i][2], edx = cache->leaf4[i][3];
++ else
++ /* Do not attempt to cache queries at this point,
++ because get_common_cache_info is called last. */
++ __cpuid_count (4, i, eax, ebx, ecx, edx);
++ i++;
+
+ /* There seems to be a bug in at least some Pentium Ds
+ which sometimes fail to iterate all cache parameters.
+@@ -849,35 +873,38 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+
+ if (cpu_features->basic.kind == arch_kind_intel)
+ {
+- data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features);
+- shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features);
++ struct intel_cpuid_cache cache;
++ cache.leaf2_valid = cache.leaf4_valid = 0;
++
++ data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features, &cache);
++ shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features, &cache);
+ shared_per_thread = shared;
+
+ level1_icache_size
+- = handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features);
++ = handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features, &cache);
+ level1_icache_linesize
+- = handle_intel (_SC_LEVEL1_ICACHE_LINESIZE, cpu_features);
++ = handle_intel (_SC_LEVEL1_ICACHE_LINESIZE, cpu_features, &cache);
+ level1_dcache_size = data;
+ level1_dcache_assoc
+- = handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features);
++ = handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features, &cache);
+ level1_dcache_linesize
+- = handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features);
++ = handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features, &cache);
+ level2_cache_size
+- = handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features);
++ = handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features, &cache);
+ level2_cache_assoc
+- = handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features);
++ = handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features, &cache);
+ level2_cache_linesize
+- = handle_intel (_SC_LEVEL2_CACHE_LINESIZE, cpu_features);
++ = handle_intel (_SC_LEVEL2_CACHE_LINESIZE, cpu_features, &cache);
+ level3_cache_size = shared;
+ level3_cache_assoc
+- = handle_intel (_SC_LEVEL3_CACHE_ASSOC, cpu_features);
++ = handle_intel (_SC_LEVEL3_CACHE_ASSOC, cpu_features, &cache);
+ level3_cache_linesize
+- = handle_intel (_SC_LEVEL3_CACHE_LINESIZE, cpu_features);
++ = handle_intel (_SC_LEVEL3_CACHE_LINESIZE, cpu_features, &cache);
+ level4_cache_size
+- = handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features);
++ = handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features, &cache);
+
+ get_common_cache_info (&shared, &shared_per_thread, &threads,
+- level2_cache_size);
++ level2_cache_size, &cache);
+ }
+ else if (cpu_features->basic.kind == arch_kind_zhaoxin)
+ {
+@@ -898,7 +925,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features)
+ level3_cache_linesize = handle_zhaoxin (_SC_LEVEL3_CACHE_LINESIZE);
+
+ get_common_cache_info (&shared, &shared_per_thread, &threads,
+- level2_cache_size);
++ level2_cache_size, NULL);
+ }
+ else if (cpu_features->basic.kind == arch_kind_amd)
+ {
+
+commit f2f55eac9e6f1167486f2694dea88adf87c77fdd
+Author: Florian Weimer
+Date: Fri Jun 19 18:22:20 2026 +0200
+
+ resolv: Declare __p_class_syms, __p_type_syms for internal use
+
+ Reviewed-by: Carlos O'Donell
+ Reviewed-by: Adhemerval Zanella
+ (cherry picked from commit 360f352c9a6da545d798ef3015e73ca114f0d230)
+
+diff --git a/include/resolv.h b/include/resolv.h
+index 4dbbac3800..d5ad9994b9 100644
+--- a/include/resolv.h
++++ b/include/resolv.h
+@@ -70,6 +70,11 @@ libc_hidden_proto (__libc_res_nameinquery)
+ extern __typeof (__res_queriesmatch) __libc_res_queriesmatch;
+ libc_hidden_proto (__libc_res_queriesmatch)
+
++extern const struct res_sym __p_class_syms[];
++libresolv_hidden_proto (__p_class_syms)
++extern const struct res_sym __p_type_syms[];
++libresolv_hidden_proto (__p_type_syms)
++
+ /* Variant of res_hnok which operates on binary (but uncompressed) names. */
+ bool __res_binary_hnok (const unsigned char *dn) attribute_hidden;
+
+diff --git a/resolv/res_debug.c b/resolv/res_debug.c
+index 73af0c72fe..6bf9962916 100644
+--- a/resolv/res_debug.c
++++ b/resolv/res_debug.c
+@@ -390,8 +390,6 @@ p_fqname(const u_char *cp, const u_char *msg, FILE *file) {
+ * that C_ANY is a qclass but not a class. (You can ask for records of class
+ * C_ANY, but you can't have any records of that class in the database.)
+ */
+-extern const struct res_sym __p_class_syms[];
+-libresolv_hidden_proto (__p_class_syms)
+ const struct res_sym __p_class_syms[] = {
+ {C_IN, (char *) "IN"},
+ {C_CHAOS, (char *) "CHAOS"},
+@@ -426,8 +424,6 @@ const struct res_sym __p_update_section_syms[] attribute_hidden = {
+ * Names of RR types and qtypes. The list is incomplete because its
+ * size is part of the ABI.
+ */
+-extern const struct res_sym __p_type_syms[];
+-libresolv_hidden_proto (__p_type_syms)
+ const struct res_sym __p_type_syms[] = {
+ {ns_t_a, (char *) "A", (char *) "address"},
+ {ns_t_ns, (char *) "NS", (char *) "name server"},
+
+commit 3c27e5170c456a69807348de8586c123f62a51f6
+Author: Florian Weimer
+Date: Fri Jun 19 18:22:20 2026 +0200
+
+ resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
+
+ The p_class and p_type results could overwrite each other if both
+ were unknown. Format unknown values with CLASS and TYPE prefixes,
+ as in RFC 3597. Handle A6 separately because it cannot be added
+ to __p_type_syms for ABI reasons.
+
+ Reviewed-by: Carlos O'Donell
+ Reviewed-by: Adhemerval Zanella
+ (cherry picked from commit f69b7f95e3694177546faec25d88bb266885c3b8)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index cef2212fd2..e75c39eaa8 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -78,6 +78,24 @@ ns_sprintrr(const ns_msg *handle, const ns_rr *rr,
+ }
+ libresolv_hidden_def (ns_sprintrr)
+
++/* Writes the class/type symbol NUMBER to *BUF, using the name from
++ *SYMS if possible. If NUMBER is not found in *SYMS, print the
++ number with PREFIX. */
++static int
++addsym (const struct res_sym *syms, int number, const char *prefix,
++ char **buf, size_t *buflen)
++{
++ for (; syms->name != NULL; syms++)
++ if (number == syms->number)
++ {
++ T (addstr (" ", 1, buf, buflen));
++ return addstr (syms->name, strlen (syms->name), buf, buflen);
++ }
++ char tmp[20];
++ int len = snprintf (tmp, sizeof (tmp), " %s%d", prefix, number);
++ return addstr (tmp, len, buf, buflen);
++}
++
+ /*%
+ * Convert the fields of an RR into presentation format.
+ *
+@@ -128,11 +146,21 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ /*
+ * TTL, Class, Type.
+ */
+- T(x = ns_format_ttl(ttl, buf, buflen));
+- addlen(x, &buf, &buflen);
+- len = SPRINTF((tmp, " %s %s", p_class(class), p_type(type)));
+- T(addstr(tmp, len, &buf, &buflen));
+- T(spaced = addtab(x + len, 16, spaced, &buf, &buflen));
++ {
++ char *start = buf;
++
++ T (x = ns_format_ttl (ttl, buf, buflen));
++ addlen (x, &buf, &buflen);
++ T (addsym (__p_class_syms, class, "CLASS", &buf, &buflen));
++ if (type == ns_t_a6)
++ /* A6 is not part of __p_type_syms, which is exported.
++ Adding A6 there would change its size. Handle it here. */
++ T (addstr (" A6", 3, &buf, &buflen));
++ else
++ T (addsym (__p_type_syms, type, "TYPE", &buf, &buflen));
++
++ T (spaced = addtab(buf - start, 16, spaced, &buf, &buflen));
++ }
+
+ /*
+ * RData.
+
+commit 509d819cea20f5d6c615eed1f869cc930effd9d2
+Author: Florian Weimer
+Date: Fri Jun 19 18:22:20 2026 +0200
+
+ resolv: Improve formatting of unknown records in ns_sprintrrf
+
+ Do not add the "unknown RR type" comment. After adding the TYPE
+ prefix, the number is largely redundant.
+
+ Reviewed-by: Carlos O'Donell
+ Reviewed-by: Adhemerval Zanella
+ (cherry picked from commit d58415eb17d457a160af99f9e8ab164404ca151b)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index e75c39eaa8..3d38876483 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -115,7 +115,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+
+ const char *comment;
+ char tmp[100];
+- char errbuf[40];
+ int len, x;
+
+ /*
+@@ -590,20 +589,18 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ T(addstr(tmp, len, &buf, &buflen));
+ break;
+ }
+-
+ default:
+- snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
+- comment = errbuf;
++ comment = "";
+ goto hexify;
+ }
+ return (buf - obuf);
+ formerr:
+- comment = "RR format error";
++ comment = " ; RR format error";
+ hexify: {
+ int n, m;
+ char *p;
+
+- len = SPRINTF((tmp, "\\# %u%s\t; %s", (unsigned)(edata - rdata),
++ len = SPRINTF((tmp, "\\# %u%s%s", (unsigned)(edata - rdata),
+ rdlen != 0U ? " (" : "", comment));
+ T(addstr(tmp, len, &buf, &buflen));
+ while (rdata < edata) {
+
+commit 05dc6da0b4e12dbc60d3705e4961b823d3f7026d
+Author: Florian Weimer
+Date: Fri Jun 19 18:22:20 2026 +0200
+
+ resolv: Check for inet_ntop failure in ns_sprintrrf
+
+ This makes the output more consistent (either failure or complete
+ output) and helps with systematic testing with varying buffer
+ sizes.
+
+ Reviewed-by: Carlos O'Donell
+ Reviewed-by: Adhemerval Zanella
+ (cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index 3d38876483..e58df5f35a 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -167,8 +167,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ switch (type) {
+ case ns_t_a:
+ if (rdlen != (size_t)NS_INADDRSZ)
+- goto formerr;
+- (void) inet_ntop(AF_INET, rdata, buf, buflen);
++ goto formerr;
++ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
++ return -1;
+ addlen(strlen(buf), &buf, &buflen);
+ break;
+
+@@ -334,9 +335,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ }
+
+ case ns_t_aaaa:
+- if (rdlen != (size_t)NS_IN6ADDRSZ)
+- goto formerr;
+- (void) inet_ntop(AF_INET6, rdata, buf, buflen);
++ if (rdlen != (size_t)NS_IN6ADDRSZ)
++ goto formerr;
++ if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
++ return -1;
+ addlen(strlen(buf), &buf, &buflen);
+ break;
+
+@@ -427,7 +429,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ goto formerr;
+
+ /* Address. */
+- (void) inet_ntop(AF_INET, rdata, buf, buflen);
++ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
++ return -1;
+ addlen(strlen(buf), &buf, &buflen);
+ rdata += NS_INADDRSZ;
+
+@@ -569,7 +572,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ if (rdata + pbyte >= edata) goto formerr;
+ memset(&a, 0, sizeof(a));
+ memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
+- (void) inet_ntop(AF_INET6, &a, buf, buflen);
++ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
++ return -1;
+ addlen(strlen(buf), &buf, &buflen);
+ rdata += sizeof(a) - pbyte;
+ }
+
+commit 299e1d25c32c5f9ef78ddd6cbfd0c6a09a1f4227
+Author: Florian Weimer
+Date: Fri Jun 19 18:22:20 2026 +0200
+
+ resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
+
+ Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy
+ implementations of TSIG, fixing bug 34033, and partially
+ fixing bug 34069.
+
+ Reviewed-by: Carlos O'Donell
+ Reviewed-by: Adhemerval Zanella
+ (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index e58df5f35a..ab68bf2cb7 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -464,96 +464,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ break;
+ }
+
+- case ns_t_cert: {
+- u_int c_type, key_tag, alg;
+- int n;
+- unsigned int siz;
+- char base64_cert[8192], tmp[40];
+- const char *leader;
+-
+- c_type = ns_get16(rdata); rdata += NS_INT16SZ;
+- key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
+- alg = (u_int) *rdata++;
+-
+- len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
+- T(addstr(tmp, len, &buf, &buflen));
+- siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
+- if (siz > sizeof(base64_cert) * 3/4) {
+- const char *str = "record too long to print";
+- T(addstr(str, strlen(str), &buf, &buflen));
+- }
+- else {
+- len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
+-
+- if (len < 0)
+- goto formerr;
+- else if (len > 15) {
+- T(addstr(" (", 2, &buf, &buflen));
+- leader = "\n\t\t";
+- spaced = 0;
+- }
+- else
+- leader = " ";
+-
+- for (n = 0; n < len; n += 48) {
+- T(addstr(leader, strlen(leader),
+- &buf, &buflen));
+- T(addstr(base64_cert + n, MIN(len - n, 48),
+- &buf, &buflen));
+- }
+- if (len > 15)
+- T(addstr(" )", 2, &buf, &buflen));
+- }
+- break;
+- }
+-
+- case ns_t_tkey: {
+- /* KJD - need to complete this */
+- u_long t;
+- int mode, err, keysize;
+-
+- /* Algorithm name. */
+- T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+- T(addstr(" ", 1, &buf, &buflen));
+-
+- /* Inception. */
+- t = ns_get32(rdata); rdata += NS_INT32SZ;
+- len = SPRINTF((tmp, "%lu ", t));
+- T(addstr(tmp, len, &buf, &buflen));
+-
+- /* Expiration. */
+- t = ns_get32(rdata); rdata += NS_INT32SZ;
+- len = SPRINTF((tmp, "%lu ", t));
+- T(addstr(tmp, len, &buf, &buflen));
+-
+- /* Mode , Error, Key Size. */
+- /* Priority, Weight, Port. */
+- mode = ns_get16(rdata); rdata += NS_INT16SZ;
+- err = ns_get16(rdata); rdata += NS_INT16SZ;
+- keysize = ns_get16(rdata); rdata += NS_INT16SZ;
+- len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
+- T(addstr(tmp, len, &buf, &buflen));
+-
+- /* XXX need to dump key, print otherdata length & other data */
+- break;
+- }
+-
+- case ns_t_tsig: {
+- /* BEW - need to complete this */
+- int n;
+-
+- T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
+- T(addstr(" ", 1, &buf, &buflen));
+- rdata += 8; /*%< time */
+- n = ns_get16(rdata); rdata += INT16SZ;
+- rdata += n; /*%< sig */
+- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
+- sprintf(buf, "%d", ns_get16(rdata));
+- rdata += INT16SZ;
+- addlen(strlen(buf), &buf, &buflen);
+- break;
+- }
+-
+ case ns_t_a6: {
+ struct in6_addr a;
+ int pbyte, pbit;
+@@ -588,11 +498,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ break;
+ }
+
+- case ns_t_opt: {
+- len = SPRINTF((tmp, "%u bytes", class));
+- T(addstr(tmp, len, &buf, &buflen));
+- break;
+- }
+ default:
+ comment = "";
+ goto hexify;
+
+commit cb4c62448047c043981deea84e5e01eccf8b36d4
+Author: Florian Weimer
+Date: Fri Jun 19 18:22:20 2026 +0200
+
+ resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
+
+ Check that the RDATA payload does not require more than RDATALEN
+ bytes while processing it. The fixes cover A6, LOC records.
+ (CERT, TKEY, TSIG were fixed before, by switching to the generic
+ formatter.)
+
+ The vulnerable LOC record handling was first introduced before
+ glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.
+
+ CERT, TSIG, TKEY handling came with commit
+ b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.
+
+ A6 record handling was introduced in commit
+ 91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
+ (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
+ 2.7.
+
+ This fixes bug 34069.
+
+ Reviewed-by: Carlos O'Donell
+ Reviewed-by: Adhemerval Zanella
+ (cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
+
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index ab68bf2cb7..f9dd086804 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -345,7 +345,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ case ns_t_loc: {
+ char t[255];
+
+- /* XXX protocol format checking? */
++ if (rdlen != 16)
++ goto formerr;
+ (void) loc_ntoa(rdata, t);
+ T(addstr(t, strlen(t), &buf, &buflen));
+ break;
+@@ -479,13 +480,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+
+ /* address suffix: provided only when prefix len != 128 */
+ if (pbit < 128) {
+- if (rdata + pbyte >= edata) goto formerr;
++ unsigned int bytelen = sizeof(a) - pbyte;
++ if (edata - rdata < bytelen) goto formerr;
+ memset(&a, 0, sizeof(a));
+- memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
++ memcpy(&a.s6_addr[pbyte], rdata, bytelen);
+ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
+ return -1;
+ addlen(strlen(buf), &buf, &buflen);
+- rdata += sizeof(a) - pbyte;
++ rdata += bytelen;
+ }
+
+ /* prefix name: provided only when prefix len > 0 */
+
+commit 296fb7f4a2b35db13efef52609f8efc00291b2a8
+Author: Florian Weimer
+Date: Fri Jun 19 18:22:20 2026 +0200
+
+ resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
+
+ This test case covers both input buffer overreads and output buffer
+ overflows. It should systematically cover these issues.
+
+ I used code auto-generation for updating the test expectations for
+ truncated RDATA in TXT, ISDN records, after writing the rest
+ of the test by hand.
+
+ Assisted-by: LLM
+ Reviewed-by: Carlos O'Donell
+ Reviewed-by: Adhemerval Zanella
+ (cherry picked from commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083)
+
+diff --git a/resolv/Makefile b/resolv/Makefile
+index 088a22ea18..c6d73b411c 100644
+--- a/resolv/Makefile
++++ b/resolv/Makefile
+@@ -98,6 +98,7 @@ tests += \
+ tst-ns_name \
+ tst-ns_name_compress \
+ tst-ns_name_pton \
++ tst-ns_sprintrr \
+ tst-res_hconf_reorder \
+ tst-res_hnok \
+ tst-resolv-aliases \
+@@ -331,5 +332,6 @@ $(objpfx)tst-ns_name: $(objpfx)libresolv.so
+ $(objpfx)tst-ns_name.out: tst-ns_name.data
+ $(objpfx)tst-ns_name_compress: $(objpfx)libresolv.so
+ $(objpfx)tst-ns_name_pton: $(objpfx)libresolv.so
++$(objpfx)tst-ns_sprintrr: $(objpfx)libresolv.so
+ $(objpfx)tst-res_hnok: $(objpfx)libresolv.so
+ $(objpfx)tst-p_secstodate: $(objpfx)libresolv.so
+diff --git a/resolv/tst-ns_sprintrr.c b/resolv/tst-ns_sprintrr.c
+new file mode 100644
+index 0000000000..34739b5924
+--- /dev/null
++++ b/resolv/tst-ns_sprintrr.c
+@@ -0,0 +1,329 @@
++/* Tests for the ns_sprintrr function.
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++
++#include
++#include
++#include
++#include
++#include
++#include
++#include
++
++#include
++
++/* Regions that test_one_record uses for input and output. */
++static struct support_next_to_fault ntf_in;
++static struct support_next_to_fault ntf_out;
++
++/* This is used by test_one_record to construct the packet. */
++static const char packet_prefix[] =
++ /* DNS response with one question, one answer record. */
++ "AA\x81\x80\0\1\0\1\0\0\0\0"
++ /* Question: www.example.org/IN/ANY. */
++ "\3www\7example\3org\0\0\xff\0\1"
++ /* Response: compression reference. */
++ "\xc0\x0c";
++
++/* Use ns_sprintrr to format a DNS record (starting with
++ packet_prefix) of type RTYPE, with a record payload of RDATALEN
++ bytes starting at RDATA. Check successful formatting against
++ EXPECTED. Try various truncated input and output buffers to catch
++ overreads and buffer overflows, using ntf_in and ntf_out above. */
++static void
++test_one_record (uint16_t rtype, const char *rdata, size_t rdatalen,
++ const char *expected)
++{
++ struct rr_header
++ {
++ uint16_t typ;
++ uint16_t cls;
++ uint32_t ttl;
++ uint16_t rdatalen;
++ uint16_t pad;
++ } hdr =
++ {
++ .typ = htons (rtype),
++ .cls = htons (ns_c_in),
++ .ttl = htonl (86400), /* One day. */
++ .rdatalen = htons (rdatalen),
++ };
++ enum { hdrlen = offsetof (struct rr_header, pad) };
++ TEST_COMPARE (hdrlen, 10);
++
++ /* Construct the packet from packet_prefix, hdr, and rdata. */
++ unsigned char packet[512];
++ size_t packetlen;
++ {
++ struct alloc_buffer buf = alloc_buffer_create (packet, sizeof (packet));
++ alloc_buffer_copy_bytes (&buf, packet_prefix, sizeof (packet_prefix) - 1);
++ alloc_buffer_copy_bytes (&buf, &hdr, hdrlen);
++ alloc_buffer_copy_bytes (&buf, rdata, rdatalen);
++ packetlen = sizeof (packet) - alloc_buffer_size (&buf);
++ }
++
++ /* Parse the record. */
++ ns_msg msg;
++ TEST_COMPARE (ns_initparse (packet, packetlen, &msg), 0);
++ ns_rr rr;
++ TEST_COMPARE (ns_parserr (&msg, ns_s_an, 0, &rr), 0);
++
++ /* Try sizes up to this limit. Go a bit beyond the expected size to
++ check for errors. */
++ size_t max_result_size = strlen (expected) + 16;
++
++ bool success = false;
++ for (size_t result_size = 1; result_size <= max_result_size; ++result_size)
++ {
++ char *result_start = ntf_out.buffer + ntf_out.length - result_size;
++ memset (result_start, 'X', result_size);
++
++ /* ns_sprintrr was deprecated in 2.34. */
++ DIAG_PUSH_NEEDS_COMMENT;
++ DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wdeprecated-declarations");
++ int ret = ns_sprintrr (&msg, &rr, NULL, NULL, result_start, result_size);
++ DIAG_POP_NEEDS_COMMENT;
++
++ if (ret > 0)
++ {
++ TEST_COMPARE_STRING (result_start, expected);
++ TEST_COMPARE (ret, strlen (expected));
++ success = true;
++ }
++ else
++ {
++ TEST_VERIFY (!success);
++ TEST_COMPARE (ret, -1);
++ }
++ }
++ TEST_VERIFY (success);
++
++ /* Test with truncated RDATA. */
++ for (size_t rdata_size = 0; rdata_size <= rdatalen; ++rdata_size)
++ {
++ size_t truncated_packet_size = packetlen - rdatalen + rdata_size;
++ unsigned char *packet_start
++ = ((unsigned char *) ntf_in.buffer + ntf_in.length
++ - truncated_packet_size);
++ memcpy (packet_start, packet, truncated_packet_size);
++ /* Patch in the updated RDATA length field. */
++ uint16_t new_rdatalen = htons (rdata_size);
++ memcpy (packet_start + truncated_packet_size - rdata_size - 2,
++ &new_rdatalen, 2);
++
++ ns_msg msg;
++ TEST_COMPARE (ns_initparse (packet_start, truncated_packet_size, &msg),
++ 0);
++ ns_rr rr;
++ TEST_COMPARE (ns_parserr (&msg, ns_s_an, 0, &rr), 0);
++
++ size_t result_size = strlen (expected) + 1;
++ char *result_start = ntf_out.buffer + ntf_out.length - result_size;
++ memset (result_start, 'X', result_size);
++
++ /* ns_sprintrr was deprecated in 2.34. */
++ DIAG_PUSH_NEEDS_COMMENT;
++ DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wdeprecated-declarations");
++ int ret = ns_sprintrr (&msg, &rr, NULL, NULL, result_start, result_size);
++ DIAG_POP_NEEDS_COMMENT;
++
++ /* This flag indicates whether the output is syntactically
++ correct. In some cases, truncation may still yield a valid
++ payload. */
++ bool broken = rdata_size < rdatalen;
++ switch (rtype)
++ {
++ case ns_t_wks:
++ /* WKS records use all trailing bytes for the port bitmap. */
++ broken = rdata_size < 5;
++ break;
++ case ns_t_nsap:
++ /* Uses all bytes that are available. */
++ broken = false;
++ break;
++ case ns_t_txt:
++ /* Truncation produces a valid payload if it occurs right
++ after a complete string in the TXT payload. */
++ broken = false;
++ for (size_t pos = 0; pos < rdata_size; )
++ {
++ unsigned int slen = rdata[pos] & 0xff;
++ if (pos + 1 + slen > rdata_size)
++ {
++ broken = true;
++ break;
++ }
++ pos += 1 + slen;
++ }
++ break;
++ case ns_t_isdn:
++ /* The second field is optional. If it is present, it must
++ not be truncated. */
++ broken = rdata_size < 6 || (rdata_size > 6 && rdata_size < rdatalen);
++ break;
++ case ns_t_a6:
++ /* The first A6 subtest contains a trailing domain name,
++ which is ignored and not formatted. */
++ if (rdata_size > 0 && rdata[0] == 0)
++ broken = rdata_size < 17;
++ break;
++ case ns_t_cert:
++ case ns_t_tkey:
++ case ns_t_tsig:
++ /* Only generic printing, which does not validate anything. */
++ broken = false;
++ break;
++ }
++
++ if (broken)
++ {
++ if (strstr (result_start, "RR format error") != NULL)
++ /* No further checks if an error indicator has been added
++ to the output. */
++ ;
++ else
++ TEST_COMPARE (ret, -1);
++ }
++ else
++ TEST_VERIFY (ret > 0);
++ }
++}
++
++static int
++do_test (void)
++{
++ ntf_in = support_next_to_fault_allocate (512);
++ ntf_out = support_next_to_fault_allocate (256);
++
++#define T(rtype, rdata, expected) \
++ test_one_record (rtype, rdata, sizeof (rdata) - 1, expected)
++ T (ns_t_a, "\xc0\0\2\1", "www.example.org.\t1D IN A\t\t192.0.2.1");
++ T (ns_t_cname, "\4www1\4prod\xc0\x10",
++ "www.example.org.\t1D IN CNAME\twww1.prod.example.org.");
++ T (ns_t_hinfo, "\5first\6second",
++ "www.example.org.\t1D IN HINFO\t\"first\" \"second\"");
++ T (ns_t_isdn, "\5first\6second",
++ "www.example.org.\t1D IN ISDN\t\"first\" \"second\"");
++ /* Bug: Extra space at the end in the text representation of ISDN RRs. */
++ T (ns_t_isdn, "\5first", "www.example.org.\t1D IN ISDN\t\"first\" ");
++ T (ns_t_soa,
++ "\2ns\xc0\x10\12hostmaster\xc0\x10"
++ "\0\0\0\1\0\0\0\2\0\0\0\3\0\0\0\4\0\0\0\5",
++ "www.example.org.\t1D IN SOA\tns.example.org. hostmaster.example.org. (\n"
++ "\t\t\t\t\t1\t\t; serial\n"
++ "\t\t\t\t\t2S\t\t; refresh\n"
++ "\t\t\t\t\t3S\t\t; retry\n"
++ "\t\t\t\t\t4S\t\t; expiry\n"
++ "\t\t\t\t\t5S )\t\t; minimum\n");
++ T (ns_t_mx, "\0\xa\2mx\xc0\x10",
++ "www.example.org.\t1D IN MX\t10 mx.example.org.");
++ T (ns_t_px, "\0\xa\3px1\xc0\x10\3px2\xc0\x10",
++ "www.example.org.\t1D IN PX\t10 px1.example.org. px2.example.org.");
++ T (ns_t_x25, "\4X.25",
++ "www.example.org.\t1D IN X25\t\"X.25\"");
++ T (ns_t_txt, "\1A\2BC\3DEF",
++ "www.example.org.\t1D IN TXT\t\"A\" \"BC\" \"DEF\"");
++ T (ns_t_nsap, "",
++ "www.example.org.\t1D IN NSAP\t");
++ T (ns_t_nsap, "\1",
++ "www.example.org.\t1D IN NSAP\t01");
++ T (ns_t_nsap, "\1\2",
++ "www.example.org.\t1D IN NSAP\t01.02");
++ T (ns_t_nsap, "\1\2\3",
++ "www.example.org.\t1D IN NSAP\t01.0203");
++ T (ns_t_nsap, "\1\2\3\4",
++ "www.example.org.\t1D IN NSAP\t01.0203.04");
++ T (ns_t_nsap,
++ "\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20\21\22\23\24\25\26\27\30\31\32"
++ "\33\34\35\36\37\40\41\42\43\44\45\46\47\50\51\52\53\54\55\56\57\60\61"
++ "\62\63\64\65\66\67\70\71\72\73\74\75\76\77\100\101\102\103\104\105\106"
++ "\107\110\111\112\113\114\115\116\117\120\121\122\123\124\125\126\127"
++ "\130\131\132\133\134\135\136\137\140\141\142\143\144\145\146\147\150"
++ "\151\152\153\154\155\156\157\160\161\162\163\164\165\166\167\170\171"
++ "\172\173\174\175\176\177\200\201\202\203\204\205\206\207\210\211\212"
++ "\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233"
++ "\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254"
++ "\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275"
++ "\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316"
++ "\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337"
++ "\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360"
++ "\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377",
++ "www.example.org.\t1D IN NSAP\t"
++ "01.0203.0405.0607.0809.0A0B.0C0D.0E0F.1011.1213.1415.1617.1819.1A1B"
++ ".1C1D.1E1F.2021.2223.2425.2627.2829.2A2B.2C2D.2E2F.3031.3233.3435.3637"
++ ".3839.3A3B.3C3D.3E3F.4041.4243.4445.4647.4849.4A4B.4C4D.4E4F.5051.5253"
++ ".5455.5657.5859.5A5B.5C5D.5E5F.6061.6263.6465.6667.6869.6A6B.6C6D.6E6F"
++ ".7071.7273.7475.7677.7879.7A7B.7C7D.7E7F.8081.8283.8485.8687.8889.8A8B"
++ ".8C8D.8E8F.9091.9293.9495.9697.9899.9A9B.9C9D.9E9F.A0A1.A2A3.A4A5.A6A7"
++ ".A8A9.AAAB.ACAD.AEAF.B0B1.B2B3.B4B5.B6B7.B8B9.BABB.BCBD.BEBF.C0C1.C2C3"
++ ".C4C5.C6C7.C8C9.CACB.CCCD.CECF.D0D1.D2D3.D4D5.D6D7.D8D9.DADB.DCDD.DEDF"
++ ".E0E1.E2E3.E4E5.E6E7.E8E9.EAEB.ECED.EEEF.F0F1.F2F3.F4F5.F6F7.F8F9.FAFB"
++ ".FCFD.FEFF");
++ T (ns_t_aaaa, "\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x34",
++ "www.example.org.\t1D IN AAAA\t2001:db8::1234");
++ /* Example from RFC 1876. The loc_ntoa format is different from the
++ official text representation. */
++ T (ns_t_loc,
++ "\000\063\026\023\211\027\055\320\160\276\025\360\000\230\215\040",
++ "www.example.org.\t1D IN LOC"
++ "\t42 21 54.000 N 71 06 18.000 W -24.00m 30.00m 10000.00m 10.00m");
++ T (ns_t_naptr,
++ "\0\1\0\2\5flags\7service\2.*\5naptr\xc0\x10",
++ "www.example.org.\t1D IN NAPTR\t1 2 \"flags\" \"service\" \".*\""
++ " naptr.example.org.");
++ T (ns_t_srv,
++ "\0\1\0\2\0\x50\4www1\xc0\x10",
++ "www.example.org.\t1D IN SRV\t1 2 80 www1.example.org.");
++ T (ns_t_rp, "\3rp1\xc0\x10\3rp2\xc0\x10",
++ "www.example.org.\t1D IN RP\trp1.example.org. rp2.example.org.");
++ T (ns_t_wks, "\xc0\0\2\1\6\0\0\0\0\0\0\0\0\0\0\200",
++ "www.example.org.\t1D IN WKS\t192.0.2.1 6 ( \n\t\t\t\t80 )");
++ T (ns_t_cert, "\0\1\x04\xd2\0blob",
++ "www.example.org.\t1D IN CERT\t\\# 9 (\n"
++ "\t00 01 04 d2 00 62 6c 6f 62 )\t\t\t; .....blob");
++ T (ns_t_tkey, "\4algo\0\0\0\0\1\0\0\0\2\0\3\0\4"
++ "\0\5\xa1\xa2\xa3\xa4\xa5\0\3\xb1\xb2\xb3",
++ "www.example.org.\t1D IN TYPE249\t\\# 30 (\n"
++ "\t04 61 6c 67 6f 00 00 00 00 01 00 00 00 02 00 03 ; .algo...........\n"
++ "\t00 04 00 05 a1 a2 a3 a4 a5 00 03 b1 b2 b3 )\t; ..............");
++ T (ns_t_tsig, "\4algo\0"
++ "\0\20\xdd\xcd\x64\x10\xe9\x21\x34\x1a\x8e\xe0\xa1\x9a\x30\xfc\x3b\xd1"
++ "\0\2\0\3\0\5other",
++ "www.example.org.\t1D IN TSIG\t\\# 35 (\n"
++ "\t04 61 6c 67 6f 00 00 10 dd cd 64 10 e9 21 34 1a ; .algo.....d..!4.\n"
++ "\t8e e0 a1 9a 30 fc 3b d1 00 02 00 03 00 05 6f 74 ; ....0.;.......ot\n"
++ "\t68 65 72 )\t\t\t\t\t; her");
++ T (ns_t_a6,
++ "\0\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x34\6prefix\xc0\x10",
++ "www.example.org.\t1D IN A6\t0 2001:db8::1234");
++ T (ns_t_a6,
++ "\0\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x35",
++ "www.example.org.\t1D IN A6\t0 2001:db8::1235");
++ T (ns_t_a6, "\200\6prefix\xc0\x10",
++ "www.example.org.\t1D IN A6\t128 prefix.example.org.");
++ T (ns_t_a6, "\x20\0\0\0\0\0\0\0\0\0\0\x12\x36\6prefix\xc0\x10",
++ "www.example.org.\t1D IN A6\t32 ::1236 prefix.example.org.");
++#undef T
++
++ support_next_to_fault_free (&ntf_in);
++ support_next_to_fault_free (&ntf_out);
++ return 0;
++}
++
++#include
+
+commit 7414631f8aec8b9cee1a8311506e1fdcd9b94c0d
+Author: Adhemerval Zanella
+Date: Tue Apr 14 10:50:37 2026 -0300
+
+ posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
+
+ The parse_tilde function previously used strndupa to allocate memory
+ for the parsed username on the stack, and since the input is
+ user-defined, this can lead to a stack overflow.
+
+ This patch fixes the issue by replacing strndupa with scratch_buffer,
+ by reusing the buffer used in the __getpwnam_r call.
+
+ The new “tst-wordexp-tilde.c” test is a test-container to avoid using
+ system-defined NSS modules.
+
+ Checked on x86_64-linux-gnu and i686-linux-gnu.
+
+ (cherry picked from commit 07c24f35392b727e6100d33edfdf811a6c68c218)
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 0b29c9aa4e..595c6b3ec2 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -356,6 +356,7 @@ tests-internal := \
+ tests-container := \
+ bug-ga2 \
+ tst-vfork3 \
++ tst-wordexp-tilde \
+ # tests-container
+
+ tests-time64 := \
+diff --git a/posix/tst-wordexp-tilde.c b/posix/tst-wordexp-tilde.c
+new file mode 100644
+index 0000000000..1661603681
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.c
+@@ -0,0 +1,244 @@
++/* Test wordexp tilde expansion with large usernames (BZ 34091).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++#include
++#include
++#include
++#include
++#include
++
++#include
++#include
++#include
++#include
++
++typedef void (*func_callback_t)(void);
++
++static void
++subprocess_small_stack (void *closure)
++{
++ struct rlimit rl;
++ TEST_COMPARE (getrlimit (RLIMIT_STACK, &rl), 0);
++ rl.rlim_cur = 512 * 1024;
++ TEST_COMPARE (setrlimit (RLIMIT_STACK, &rl), 0);
++
++ func_callback_t func_test = closure;
++ func_test ();
++}
++
++/* Build a string "~/tail" where is LEN bytes of the
++ character CH. The caller must free the result. */
++static char *
++make_tilde_input (char ch, size_t len, const char *tail)
++{
++ /* ~ + len + / + tail + \0 */
++ size_t taillen = tail != NULL ? strlen (tail) : 0;
++ size_t total = 1 + len + 1 + taillen + 1;
++ char *buf = xmalloc (total);
++ buf[0] = '~';
++ memset (buf + 1, ch, len);
++ buf[1 + len] = '/';
++ if (tail != NULL)
++ memcpy (buf + 1 + len + 1, tail, taillen);
++ buf[total - 1] = '\0';
++ return buf;
++}
++
++/* Test 1: A very long username must not crash. The username will not match
++ any real user, so wordexp returns ~/rest. */
++static void
++test_long_username (void)
++{
++ printf ("info: test_long_username_no_crash\n");
++
++ static const char REST[] = "rest";
++
++ /* 1 MiB username — well beyond any reasonable stack frame. */
++ const size_t long_len = 1024 * 1024;
++ char *input = make_tilde_input ('A', long_len, REST);
++
++ wordexp_t we = { 0 };
++ int ret = wordexp (input, &we, 0);
++ /* The (non-existent) username is invalid, so wordexp falls back to
++ literal output: ~AAA…/rest. */
++ TEST_COMPARE (ret, 0);
++ TEST_COMPARE (we.we_wordc, 1);
++
++ /* Verify prefix: '~' followed by long_len 'A's. */
++ const char *result = we.we_wordv[0];
++ TEST_COMPARE (result[0], '~');
++ TEST_COMPARE (strlen (result),
++ 1 /* ~ */ + long_len + sizeof (REST));
++ for (size_t j = 1; j <= long_len; j++)
++ if (result[j] != 'A')
++ {
++ printf (" mismatch at position %zu: expected 'A', got '%c'\n",
++ j, result[j]);
++ support_record_failure ();
++ break;
++ }
++ /* Verify the tail after the username. */
++ TEST_COMPARE_STRING (result + 1 + long_len, "/rest");
++
++ wordfree (&we);
++ free (input);
++}
++
++/* Test 2: A username that just exceeds the default scratch_buffer inline
++ size (1024 bytes) exercises the scratch_buffer_set_array_size growth path
++ without being excessively large. */
++static void
++test_scratch_buffer_growth (void)
++{
++ printf ("info: test_scratch_buffer_growth\n");
++
++ const size_t len = 2048;
++ char *input = make_tilde_input ('x', len, NULL);
++
++ wordexp_t we = { 0 };
++ int ret = wordexp (input, &we, 0);
++ TEST_COMPARE (ret, 0);
++ TEST_COMPARE (we.we_wordc, 1);
++
++ /* ~xxx…/ — the trailing slash makes a separate empty component, but
++ wordexp merges it into the single token ~xxx…/. */
++ const char *result = we.we_wordv[0];
++ TEST_COMPARE (result[0], '~');
++ for (size_t j = 1; j <= len; j++)
++ if (result[j] != 'x')
++ {
++ printf (" mismatch at position %zu\n", j);
++ support_record_failure ();
++ break;
++ }
++ TEST_COMPARE (result[1 + len], '/');
++
++ wordfree (&we);
++ free (input);
++}
++
++/* Test 3: ~root still resolves to the correct home directory through the
++ __getpwnam_r path. */
++static void
++test_known_user (void)
++{
++ printf ("info: test_known_user\n");
++
++ /* Look up root's home directory for comparison. */
++ struct passwd *pw = getpwnam ("root");
++ if (pw == NULL || pw->pw_dir == NULL)
++ {
++ printf (" SKIP: cannot look up root\n");
++ return;
++ }
++
++ char *expected = xasprintf ("%s/file", pw->pw_dir);
++
++ wordexp_t we = { 0 };
++ TEST_COMPARE (wordexp ("~root/file", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++ TEST_COMPARE_STRING (we.we_wordv[0], expected);
++
++ wordfree (&we);
++ free (expected);
++}
++
++/* Test 4: Bare tilde expands to $HOME. */
++static void
++test_bare_tilde (void)
++{
++ printf ("info: test_bare_tilde\n");
++
++ const char *home = getenv ("HOME");
++ if (home == NULL)
++ {
++ printf (" SKIP: HOME is not set\n");
++ return;
++ }
++
++ wordexp_t we = { 0 };
++ TEST_COMPARE (wordexp ("~", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++ TEST_COMPARE_STRING (we.we_wordv[0], home);
++
++ wordfree (&we);
++}
++
++/* Test 5: Short non-existent username falls back to literal ~username output,
++ exercising the invalid-login-name path. */
++static void
++test_unknown_user (void)
++{
++ printf ("info: test_unknown_user\n");
++
++ /* Pick a username that is extremely unlikely to exist. */
++ wordexp_t we = { 0 };
++ TEST_COMPARE (wordexp ("~no_such_user_xyzzy42", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++ TEST_COMPARE_STRING (we.we_wordv[0], "~no_such_user_xyzzy42");
++
++ wordfree (&we);
++}
++
++/* Test 6: Tilde with username and WRDE_APPEND — exercises parse_tilde's
++ interaction with the WRDE_APPEND word list. */
++static void
++test_tilde_with_append (void)
++{
++ printf ("info: test_tilde_with_append\n");
++
++ const char *home = getenv ("HOME");
++ if (home == NULL)
++ {
++ printf (" SKIP: HOME is not set\n");
++ return;
++ }
++
++ wordexp_t we = { 0 };
++ TEST_COMPARE (wordexp ("first", &we, 0), 0);
++
++ TEST_COMPARE (wordexp ("~/path", &we, WRDE_APPEND), 0);
++ TEST_COMPARE (we.we_wordc, 2);
++ TEST_COMPARE_STRING (we.we_wordv[0], "first");
++
++ char *expected = xasprintf ("%s/path", home);
++ TEST_COMPARE_STRING (we.we_wordv[1], expected);
++
++ wordfree (&we);
++ free (expected);
++}
++
++static int
++do_test (void)
++{
++ test_known_user ();
++ test_bare_tilde ();
++ test_unknown_user ();
++ test_tilde_with_append ();
++
++ support_isolate_in_subprocess (subprocess_small_stack,
++ test_long_username);
++
++ support_isolate_in_subprocess (subprocess_small_stack,
++ test_scratch_buffer_growth);
++
++ return 0;
++}
++
++#include
+diff --git a/posix/tst-wordexp-tilde.root/etc/group b/posix/tst-wordexp-tilde.root/etc/group
+new file mode 100644
+index 0000000000..1dbf9013ee
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/group
+@@ -0,0 +1 @@
++root:x:0:
+diff --git a/posix/tst-wordexp-tilde.root/etc/nsswitch.conf b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+new file mode 100644
+index 0000000000..098a8d5938
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+@@ -0,0 +1,3 @@
++passwd: files
++group: files
++shadow: files
+diff --git a/posix/tst-wordexp-tilde.root/etc/passwd b/posix/tst-wordexp-tilde.root/etc/passwd
+new file mode 100644
+index 0000000000..eb85a552ad
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/passwd
+@@ -0,0 +1 @@
++root:x:0:0:root:/root:/bin/sh
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index 9df4bb7424..731d1650e9 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -335,17 +335,29 @@ parse_tilde (char **word, size_t *word_length, size_t *max_length,
+ else
+ {
+ /* Look up user name in database to get home directory */
+- char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
+- struct passwd pwd, *tpwd;
+- int result;
++ size_t userlen = i - (1 + *offset);
++ /* tmpbuf contains both the user and the __getpwnam_r working area. */
+ struct scratch_buffer tmpbuf;
+ scratch_buffer_init (&tmpbuf);
++ if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
++ return WRDE_NOSPACE;
++ char *user = tmpbuf.data;
++ memcpy (user, &words[1 + *offset], userlen);
++ user[userlen] = '\0';
+
+- while ((result = __getpwnam_r (user, &pwd, tmpbuf.data, tmpbuf.length,
++ struct passwd pwd, *tpwd;
++ int result;
++ while ((result = __getpwnam_r (user,
++ &pwd,
++ tmpbuf.data + userlen + 1,
++ tmpbuf.length - userlen - 1,
+ &tpwd)) != 0
+ && errno == ERANGE)
+- if (!scratch_buffer_grow (&tmpbuf))
+- return WRDE_NOSPACE;
++ {
++ if (!scratch_buffer_grow_preserve (&tmpbuf))
++ return WRDE_NOSPACE;
++ user = tmpbuf.data;
++ }
+
+ if (result == 0 && tpwd != NULL && pwd.pw_dir)
+ *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
+
+commit 8be3551ccb4e17e93ad82152de56d2c90de21f97
+Author: Adhemerval Zanella
+Date: Mon Apr 13 16:33:30 2026 -0300
+
+ posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368)
+
+ The previous implementation saved a copy of the wordexp_t struct at
+ entry and blindly restored it on error via (*pwordexp = old_word).
+ This is incorrect when WRDE_APPEND is set because w_addword may have
+ called realloc on we_wordv during partial processing before the error
+ was detected. If realloc relocated the buffer, the saved we_wordv
+ pointer is dangling; restoring it causes a use-after-free in the
+ caller (e.g. via wordfree), and the relocated buffer is leaked.
+
+ Fix this by duplicating the we_wordv pointer array at entry when
+ WRDE_APPEND is set, so that all subsequent realloc calls inside
+ w_addword operate on the copy.
+
+ This change also fixes a POSIX conformance issue: if the WRDE_APPEND
+ flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall
+ not be modified.
+
+ Also fix two pre-existing error return paths in the '"' and '\'' cases
+ that returned directly from w_addword failures instead of going through
+ do_error, which would leak the saved array (and previously would also
+ skip the word cleanup).
+
+ Checked on x86_64-linux-gnu and i686-linux-gnu.
+
+ Reviewed-by: DJ Delorie
+ (cherry picked from commit e2cefe16c37a617df9f11407cb00a272a6098823)
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 595c6b3ec2..a12c49c0ed 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -326,6 +326,7 @@ tests := \
+ tst-wait3 \
+ tst-wait4 \
+ tst-waitid \
++ tst-wordexp-append \
+ tst-wordexp-nocmd \
+ tst-wordexp-reuse \
+ tstgetopt \
+diff --git a/posix/tst-wordexp-append.c b/posix/tst-wordexp-append.c
+new file mode 100644
+index 0000000000..87f388f0a7
+--- /dev/null
++++ b/posix/tst-wordexp-append.c
+@@ -0,0 +1,393 @@
++/* Test for wordexp with WRDE_APPEND flag.
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ . */
++
++#include
++#include
++#include
++#include
++#include
++
++#include
++#include
++
++static unsigned int relocating_reallocs;
++
++/* w_addword grows we_wordv with realloc, make every call guaranteed to
++ relocate the block. This makes BZ 34090 regression more deterministic. */
++void *
++realloc (void *ptr, size_t size)
++{
++ if (ptr == NULL)
++ return malloc (size);
++ if (size == 0)
++ {
++ free (ptr);
++ return NULL;
++ }
++
++ void *new = malloc (size);
++ if (new == NULL)
++ return NULL;
++
++ /* Copy only what is valid in the old block to avoid reading past it. */
++ size_t old = malloc_usable_size (ptr);
++ memcpy (new, ptr, old < size ? old : size);
++ /* Clobber the old block so that a stale we_wordv pointer restored on the
++ error path reads garbage instead of the old contents, which might
++ otherwise survive intact and mask the bug. */
++ memset (ptr, 0x5a, old);
++ free (ptr);
++ relocating_reallocs++;
++ return new;
++}
++
++/* Verify that all words in we match the expected NULL-terminated
++ array. */
++static void
++check_words (const wordexp_t *we, const char *const *expected)
++{
++ size_t i;
++ for (i = 0; expected[i] != NULL; i++)
++ {
++ TEST_VERIFY (i < we->we_wordc);
++ TEST_COMPARE_STRING (we->we_wordv[we->we_offs + i], expected[i]);
++ }
++ TEST_COMPARE (we->we_wordc, i);
++}
++
++#define CHECK_WORDS(we, ...) \
++ do { \
++ const char *const expected_[] = { __VA_ARGS__, NULL }; \
++ check_words (we, expected_); \
++ } while (0)
++
++/* Test 1: WRDE_APPEND + WRDE_BADCHAR preserves we_wordc. */
++static void
++test_append_badchar_preserves_count (void)
++{
++ printf ("info: test_append_badchar_preserves_count\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("one two three", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 3);
++
++ size_t saved_count = we.we_wordc;
++
++ /* ')' triggers WRDE_BADCHAR and "extra" would be a new word if the
++ expansion succeeded, exercising the w_addword path before the error
++ is detected. */
++ TEST_COMPARE (wordexp ("extra )", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (we.we_wordc, saved_count);
++
++ wordfree (&we);
++}
++
++/* Test 2: WRDE_APPEND + WRDE_BADCHAR preserves the we_wordv pointer even
++ when internal realloc would move the buffer. */
++static void
++test_append_badchar_preserves_pointer (void)
++{
++ printf ("info: test_append_badchar_preserves_pointer\n");
++ wordexp_t we = { 0 };
++
++ /* Use many words so that the initial we_wordv allocation is
++ non-trivial and a later realloc is more likely to move it. */
++ TEST_COMPARE (wordexp ("a b c d e f g h", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 8);
++
++ char **saved_wordv = we.we_wordv;
++ size_t saved_count = we.we_wordc;
++ unsigned int saved_reallocs = relocating_reallocs;
++
++ /* The interposed realloc guarantees the internal we_wordv buffer moves
++ during parsing, so the pointer-stability check below is meaningful. */
++ TEST_COMPARE (wordexp ("append )", &we, WRDE_APPEND), WRDE_BADCHAR);
++ /* Verify that a relocating realloc actually happened during the failed
++ call, otherwise the pointer-stability check is vacuous. */
++ TEST_VERIFY (relocating_reallocs > saved_reallocs);
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++
++ wordfree (&we);
++}
++
++/* Test 3: After a failed WRDE_APPEND the original words are still accessible
++ and correct. */
++static void
++test_append_badchar_words_intact (void)
++{
++ printf ("info: test_append_badchar_words_intact\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("alpha beta gamma", &we, 0), 0);
++ CHECK_WORDS (&we, "alpha", "beta", "gamma");
++
++ TEST_COMPARE (wordexp ("delta )", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++ /* Words must still be intact. */
++ CHECK_WORDS (&we, "alpha", "beta", "gamma");
++ /* The NULL terminator must still be present. */
++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++ wordfree (&we);
++}
++
++/* Test 4: Successful WRDE_APPEND still works (regression test). */
++static void
++test_append_success (void)
++{
++ printf ("info: test_append_success\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("hello", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++
++ char **saved_wordv = we.we_wordv;
++
++ TEST_COMPARE (wordexp ("world", &we, WRDE_APPEND), 0);
++ TEST_COMPARE (we.we_wordc, 2);
++ /* A successful append works on a fresh copy of the array, so the
++ caller-visible pointer must have changed. */
++ TEST_VERIFY (we.we_wordv != saved_wordv);
++ CHECK_WORDS (&we, "hello", "world");
++
++ wordfree (&we);
++}
++
++/* Test 5: Successful append after a failed append — the implementation must
++ recover and allow further use of the wordexp_t. */
++static void
++test_append_success_after_failure (void)
++{
++ printf ("info: test_append_success_after_failure\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("first", &we, 0), 0);
++ CHECK_WORDS (&we, "first");
++
++ TEST_COMPARE (wordexp ("bad |", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++ /* State must be exactly as before the failed call. */
++ CHECK_WORDS (&we, "first");
++
++ /* A subsequent successful append must work. */
++ TEST_COMPARE (wordexp ("second third", &we, WRDE_APPEND), 0);
++ CHECK_WORDS (&we, "first", "second", "third");
++
++ wordfree (&we);
++}
++
++/* Test 6: Multiple consecutive failed appends do not corrupt state. */
++static void
++test_append_multiple_failures (void)
++{
++ printf ("info: test_append_multiple_failures\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("keep this", &we, 0), 0);
++ CHECK_WORDS (&we, "keep", "this");
++
++ size_t saved_count = we.we_wordc;
++ char **saved_wordv = we.we_wordv;
++
++ /* Each of these bad characters must leave the state unchanged. */
++ TEST_COMPARE (wordexp ("x )", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x |", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x ;", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x &", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x <", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x >", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++ CHECK_WORDS (&we, "keep", "this");
++
++ wordfree (&we);
++}
++
++/* Test 7: WRDE_APPEND with WRDE_SYNTAX error (unterminated quote) also
++ preserves state. */
++static void
++test_append_syntax_error (void)
++{
++ printf ("info: test_append_syntax_error\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("original", &we, 0), 0);
++ CHECK_WORDS (&we, "original");
++
++ char **saved_wordv = we.we_wordv;
++ size_t saved_count = we.we_wordc;
++
++ /* Unterminated double quote triggers WRDE_SYNTAX. */
++ TEST_COMPARE (wordexp ("\"unterminated", &we, WRDE_APPEND), WRDE_SYNTAX);
++
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++ CHECK_WORDS (&we, "original");
++
++ wordfree (&we);
++}
++
++/* Test 8: Error without WRDE_APPEND still works (regression test for the
++ non-APPEND code path in do_error). */
++static void
++test_no_append_error (void)
++{
++ printf ("info: test_no_append_error\n");
++ wordexp_t we = { 0 };
++
++ /* Simple failure without WRDE_APPEND. */
++ TEST_COMPARE (wordexp ("bad |", &we, 0), WRDE_BADCHAR);
++
++ /* After failure without WRDE_APPEND the struct should be safe to
++ reuse — start fresh. */
++ TEST_COMPARE (wordexp ("ok", &we, 0), 0);
++ CHECK_WORDS (&we, "ok");
++
++ wordfree (&we);
++}
++
++/* Test 9: WRDE_BADCHAR on the very first character (no partial words added
++ before the error). */
++static void
++test_append_badchar_immediate (void)
++{
++ printf ("info: test_append_badchar_immediate\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("hello world", &we, 0), 0);
++ CHECK_WORDS (&we, "hello", "world");
++
++ char **saved_wordv = we.we_wordv;
++ size_t saved_count = we.we_wordc;
++
++ /* The bad character is the very first byte — no w_addword call happens
++ before the error. */
++ TEST_COMPARE (wordexp ("|", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++
++ wordfree (&we);
++}
++
++/* Test 10: WRDE_APPEND into an empty wordexp_t (initial call uses WRDE_APPEND
++ with a zeroed struct — unusual but allowed). */
++static void
++test_append_into_empty (void)
++{
++ printf ("info: test_append_into_empty\n");
++ wordexp_t we = { 0 };
++
++ /* First call with WRDE_APPEND on a zeroed struct. The implementation
++ must handle we_wordv == NULL gracefully. */
++ TEST_COMPARE (wordexp ("solo", &we, WRDE_APPEND), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++ CHECK_WORDS (&we, "solo");
++
++ wordfree (&we);
++}
++
++/* Verify that the leading we_offs slots are all NULL. */
++static void
++check_offs_null (const wordexp_t *we)
++{
++ for (size_t i = 0; i < we->we_offs; i++)
++ TEST_VERIFY (we->we_wordv[i] == NULL);
++}
++
++/* Test 11: successful WRDE_APPEND with WRDE_DOOFFS and a non-zero we_offs.
++ The leading offset slots must stay NULL and words must land at
++ we_wordv[we_offs + i] across both the initial and the appended call. */
++static void
++test_dooffs_append_success (void)
++{
++ printf ("info: test_dooffs_append_success\n");
++ wordexp_t we = { 0 };
++ we.we_offs = 2;
++
++ TEST_COMPARE (wordexp ("one two", &we, WRDE_DOOFFS), 0);
++ TEST_COMPARE (we.we_offs, 2);
++ check_offs_null (&we);
++ CHECK_WORDS (&we, "one", "two");
++
++ TEST_COMPARE (wordexp ("three", &we, WRDE_APPEND | WRDE_DOOFFS), 0);
++ TEST_COMPARE (we.we_offs, 2);
++ check_offs_null (&we);
++ CHECK_WORDS (&we, "one", "two", "three");
++ /* The NULL terminator must sit right after the last word. */
++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++ wordfree (&we);
++}
++
++/* Test 12: failed WRDE_APPEND with WRDE_DOOFFS preserves we_wordc, the
++ we_wordv pointer, the words and the leading NULL offset slots. This
++ exercises the we_offs arithmetic in the array duplication and in the
++ error-path cleanup (we_wordv[we_offs + --we_wordc]). */
++static void
++test_dooffs_append_error_preserves_state (void)
++{
++ printf ("info: test_dooffs_append_error_preserves_state\n");
++ wordexp_t we = { 0 };
++ we.we_offs = 3;
++
++ TEST_COMPARE (wordexp ("alpha beta", &we, WRDE_DOOFFS), 0);
++ check_offs_null (&we);
++ CHECK_WORDS (&we, "alpha", "beta");
++
++ char **saved_wordv = we.we_wordv;
++ size_t saved_count = we.we_wordc;
++ unsigned int saved_reallocs = relocating_reallocs;
++
++ /* "gamma" is a partial word added via w_addword (forcing a relocating
++ realloc of we_wordv) before ')' triggers WRDE_BADCHAR. */
++ TEST_COMPARE (wordexp ("gamma )", &we, WRDE_APPEND | WRDE_DOOFFS),
++ WRDE_BADCHAR);
++ TEST_VERIFY (relocating_reallocs > saved_reallocs);
++
++ TEST_COMPARE (we.we_offs, 3);
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++ check_offs_null (&we);
++ CHECK_WORDS (&we, "alpha", "beta");
++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++ wordfree (&we);
++}
++
++static int
++do_test (void)
++{
++ test_append_badchar_preserves_count ();
++ test_append_badchar_preserves_pointer ();
++ test_append_badchar_words_intact ();
++ test_append_success ();
++ test_append_success_after_failure ();
++ test_append_multiple_failures ();
++ test_append_syntax_error ();
++ test_no_append_error ();
++ test_append_badchar_immediate ();
++ test_append_into_empty ();
++ test_dooffs_append_success ();
++ test_dooffs_append_error_preserves_state ();
++
++ return 0;
++}
++
++#include
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index 731d1650e9..50b0d7a256 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -35,6 +35,7 @@
+ #include
+ #include <_itoa.h>
+ #include
++#include
+
+ /*
+ * This is a recursive-descent-style word expansion routine.
+@@ -2224,6 +2225,12 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ char ifs_white[4];
+ wordexp_t old_word = *pwordexp;
+
++ /* When WRDE_APPEND is set we work on a copy of the we_wordv array so that
++ the caller's original pointer is never invalidated by realloc inside
++ w_addword. The saved_wordv keeps the original; on success we free it,
++ on non-NOSPACE error we free the working copy and restore the original. */
++ char **saved_wordv = NULL;
++
+ if (flags & WRDE_REUSE)
+ {
+ /* Minimal implementation of WRDE_REUSE for now */
+@@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ pwordexp->we_offs = 0;
+ }
+ }
++ else if (pwordexp->we_wordv != NULL)
++ {
++ /* WRDE_APPEND with an existing word list: duplicate the array so that
++ realloc during parsing does not invalidate the caller's pointer. The
++ strings themselves are shared. */
++ size_t num_p;
++ char **dup;
++ if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p)
++ || INT_ADD_WRAPV (num_p, 1, &num_p))
++ return WRDE_NOSPACE;
++ dup = __libc_reallocarray (NULL, num_p, sizeof *dup);
++ if (dup == NULL)
++ return WRDE_NOSPACE;
++ memcpy (dup, pwordexp->we_wordv, num_p * sizeof *dup);
++ saved_wordv = pwordexp->we_wordv;
++ pwordexp->we_wordv = dup;
++ }
+
+ /* Find out what the field separators are.
+ * There are two types: whitespace and non-whitespace.
+@@ -2338,7 +2362,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ error = w_addword (pwordexp, NULL);
+
+ if (error)
+- return error;
++ goto do_error;
+ }
+
+ break;
+@@ -2356,7 +2380,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ error = w_addword (pwordexp, NULL);
+
+ if (error)
+- return error;
++ goto do_error;
+ }
+
+ break;
+@@ -2422,10 +2446,18 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+
+ /* There was a word separator at the end */
+ if (word == NULL) /* i.e. w_newword */
+- return 0;
++ {
++ free (saved_wordv);
++ return 0;
++ }
+
+- /* There was no field separator at the end */
+- return w_addword (pwordexp, word);
++ /* There was no field separator at the end. The only possible error
++ from w_addword is WRDE_NOSPACE. */
++ error = w_addword (pwordexp, word);
++ if (error != 0)
++ goto do_error;
++ free (saved_wordv);
++ return 0;
+
+ do_error:
+ /* Error:
+@@ -2436,11 +2468,30 @@ do_error:
+ free (word);
+
+ if (error == WRDE_NOSPACE)
+- return WRDE_NOSPACE;
++ {
++ /* we_wordc and we_wordv are updated to reflect any words that were
++ successfully expanded. The old array is obsolete. */
++ free (saved_wordv);
++ return WRDE_NOSPACE;
++ }
+
+- if ((flags & WRDE_APPEND) == 0)
+- wordfree (pwordexp);
++ if (flags & WRDE_APPEND)
++ {
++ /* POSIX 2024 states that for in other error cases, if the WRDE_APPEND
++ flag was specified, we_wordc and we_wordv shall not be modified.
++
++ Free strings appended during this call, discard the working copy of
++ we_wordv, and restore the caller's original pointer. */
++ while (pwordexp->we_wordc > old_word.we_wordc)
++ free (pwordexp->we_wordv[pwordexp->we_offs + --pwordexp->we_wordc]);
++ free (pwordexp->we_wordv);
++ pwordexp->we_wordv = saved_wordv;
++ }
++ else
++ {
++ wordfree (pwordexp);
++ *pwordexp = old_word;
++ }
+
+- *pwordexp = old_word;
+ return error;
+ }
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 6ce41321494e..1c95152d3f66 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -51,7 +51,7 @@
let
version = "2.42";
- patchSuffix = "-67";
+ patchSuffix = "-84";
sha256 = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
in
@@ -116,15 +116,6 @@ stdenv.mkDerivation (
# enable parallel & reproducible build of glibcLocales
./0001-localedata-allow-reproducible-parallel-install-of-lo.patch
./0002-Makeconfig-make-inst_complocaledir-overridable.patch
-
- # Security fixes.
- #
- # Can be dropped on 2.44. The first patch is only to make it
- # easier to backport the fix for CVE-2026-6238 and it seems
- # useful in its own right anyhow.
- ./0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
- ./0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
- ./0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
]
/*
NVCC does not support ARM intrinsics. Since is pulled in by almost
@@ -352,6 +343,8 @@ stdenv.mkDerivation (
doCheck = false; # fails
+ __structuredAttrs = true;
+
meta =
{
diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix
index 76b54b479c5d..6a81bdf49c04 100644
--- a/pkgs/development/libraries/gmp/6.x.nix
+++ b/pkgs/development/libraries/gmp/6.x.nix
@@ -14,19 +14,19 @@
# files.
let
- inherit (lib) optional;
+ inherit (lib) optionals;
in
let
- self = stdenv.mkDerivation rec {
+ self = stdenv.mkDerivation (finalAttrs: {
pname = "gmp${lib.optionalString cxx "-with-cxx"}";
version = "6.3.0";
src = fetchurl {
# we need to use bz2, others aren't in bootstrapping stdenv
urls = [
- "mirror://gnu/gmp/gmp-${version}.tar.bz2"
- "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2"
+ "mirror://gnu/gmp/gmp-${finalAttrs.version}.tar.bz2"
+ "ftp://ftp.gmplib.org/pub/gmp-${finalAttrs.version}/gmp-${finalAttrs.version}.tar.bz2"
];
hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs=";
};
@@ -65,11 +65,18 @@ let
# broken on multicore CPUs). Avoid this impurity.
"--build=${stdenv.buildPlatform.config}"
]
- ++ optional (cxx && stdenv.hostPlatform.isDarwin) "CPPFLAGS=-fexceptions"
- ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) "ABI=64"
+ ++ optionals (cxx && stdenv.hostPlatform.isDarwin) [
+ "CPPFLAGS=-fexceptions"
+ ]
+ ++ optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) [
+ "ABI=64"
+ ]
# to build a .dll on windows, we need --disable-static + --enable-shared
# see https://gmplib.org/manual/Notes-for-Particular-Systems.html
- ++ optional (!withStatic && stdenv.hostPlatform.isPE) "--disable-static --enable-shared";
+ ++ optionals (!withStatic && stdenv.hostPlatform.isPE) [
+ "--disable-static"
+ "--enable-shared"
+ ];
doCheck = true; # not cross;
@@ -77,6 +84,8 @@ let
enableParallelBuilding = true;
+ __structuredAttrs = true;
+
meta = {
homepage = "https://gmplib.org/";
description = "GNU multiple precision arithmetic library";
@@ -112,6 +121,6 @@ let
platforms = lib.platforms.all;
maintainers = with lib.maintainers; [ coolcuber ];
};
- };
+ });
in
self
diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix
index f470d9e7f161..d91572296421 100644
--- a/pkgs/development/libraries/gstreamer/bad/default.nix
+++ b/pkgs/development/libraries/gstreamer/bad/default.nix
@@ -116,7 +116,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "gst-plugins-bad";
- version = "1.28.5";
+ version = "1.28.6";
outputs = [
"out"
@@ -125,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz";
- hash = "sha256-2K9V+u8pWMGoZjdRR17kb1Fkh3z02MWRPqkG7xgK63E=";
+ hash = "sha256-Zjbywiic7aUsSrqXEzjIHitXgNM4G9NnPBwRbsh1h8M=";
};
patches = [
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 4415abbd5931..087c8c50b3d1 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -50,7 +50,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "gst-plugins-base";
- version = "1.28.5";
+ version = "1.28.6";
outputs = [
"out"
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz";
- hash = "sha256-d28ZIo+R/SW79U2YUFl+FYUH9ZSHKlK5toFOJCm0Pqo=";
+ hash = "sha256-C6aZx8bGb0umQL54yziiRxWt2Wg/PjoZn1Np3FpPBKw=";
};
__structuredAttrs = true;
@@ -129,37 +129,48 @@ stdenv.mkDerivation (finalAttrs: {
libdrm
];
- mesonFlags = [
- "-Dglib_debug=disabled" # cast checks should be disabled on stable releases
- "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
- # See https://github.com/GStreamer/gst-plugins-base/blob/d64a4b7a69c3462851ff4dcfa97cc6f94cd64aef/meson_options.txt#L15 for a list of choices
- "-Dgl_winsys=${
- lib.concatStringsSep "," (
+ mesonFlags =
+ let
+ # For a list of choices, see
+ # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/d529453528a5dd11c15eab788cce6676141134b7/subprojects/gst-plugins-base/meson.options#L14-1
+ # unsupported platforms: win32, winrt, android
+ # deprecated/ancient platforms: dispmanx, eagl
+ # TODO: should we add egl, surfaceless, viv-fb, gbm?
+ # (on Linux, autodiscovery would automatically add egl and surfaceless)
+ # 'egl', 'surfaceless', 'viv-fb', 'gbm',
+ enabledGlWinSys =
lib.optional enableX11 "x11"
++ lib.optional enableWayland "wayland"
- ++ lib.optional enableCocoa "cocoa"
- )
- }"
- (lib.mesonEnable "introspection" withIntrospection)
- (lib.mesonEnable "doc" enableDocumentation)
- (lib.mesonEnable "libvisual" false)
- (lib.mesonEnable "tremor" false) # unmaintained in nixpkgs, just use regular libvorbis instead
- (lib.mesonEnable "vorbis" true)
- ]
- ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
- "-Dtests=disabled"
- ]
- ++ lib.optionals (!enableX11) [
- "-Dx11=disabled"
- "-Dxi=disabled"
- "-Dxshm=disabled"
- "-Dxvideo=disabled"
- ]
- # TODO How to disable Wayland?
- ++ lib.optional (!enableGl) "-Dgl=disabled"
- ++ lib.optional (!enableAlsa) "-Dalsa=disabled"
- ++ lib.optional (!enableCdparanoia) "-Dcdparanoia=disabled"
- ++ lib.optional stdenv.hostPlatform.isDarwin "-Ddrm=disabled";
+ ++ lib.optional enableCocoa "cocoa";
+ in
+ lib.mapAttrsToList lib.mesonEnable {
+ orc = true;
+ orc-compiler = true;
+ nls = true;
+
+ glib_debug = false; # cast checks should be disabled on stable releases
+ examples = false; # requires many dependencies and probably not useful for our users
+ introspection = withIntrospection;
+ doc = enableDocumentation;
+
+ tests = finalAttrs.finalPackage.doCheck;
+
+ libvisual = false;
+ tremor = false; # unmaintained in nixpkgs, just use regular libvorbis instead
+ vorbis = true;
+
+ x11 = enableX11;
+ xi = enableX11;
+ xshm = enableX11;
+ xvideo = enableX11;
+
+ # TODO How to disable Wayland?
+ gl = enableGl;
+ alsa = enableAlsa;
+ cdparanoia = enableCdparanoia;
+ drm = !stdenv.hostPlatform.isDarwin;
+ }
+ ++ [ (lib.mesonOption "gl_winsys" (lib.concatStringsSep "," enabledGlWinSys)) ];
postPatch = ''
patchShebangs \
@@ -194,20 +205,39 @@ stdenv.mkDerivation (finalAttrs: {
waylandEnabled = enableWayland;
updateScript = directoryListingUpdater { odd-unstable = true; };
- };
- passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+ tests.pkg-config = testers.hasPkgConfigModules {
+ package = finalAttrs.finalPackage;
+ versionCheck = true;
+ };
+ };
meta = {
description = "Base GStreamer plug-ins and helper libraries";
homepage = "https://gstreamer.freedesktop.org";
license = lib.licenses.lgpl2Plus;
- pkgConfigModules = [
- "gstreamer-audio-1.0"
- "gstreamer-base-1.0"
- "gstreamer-net-1.0"
- "gstreamer-video-1.0"
- ];
+ pkgConfigModules = lib.map (m: "gstreamer-${m}-1.0") (
+ [
+ "allocators"
+ "app"
+ "audio"
+ "fft"
+ "pbutils"
+ "plugins-base"
+ "riff"
+ "rtp"
+ "rtsp"
+ "sdp"
+ "tag"
+ ]
+ ++ lib.optionals enableGl [
+ "gl"
+ "gl-egl"
+ "gl-prototypes"
+ ]
+ ++ lib.optional (enableGl && enableWayland) "gl-wayland"
+ ++ lib.optional (enableGl && enableX11) "gl-x11"
+ );
platforms = lib.platforms.unix;
maintainers = with lib.maintainers; [ tmarkus ];
};
diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix
index fcc1de6d9920..0c959452333b 100644
--- a/pkgs/development/libraries/gstreamer/core/default.nix
+++ b/pkgs/development/libraries/gstreamer/core/default.nix
@@ -40,7 +40,7 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "gstreamer";
- version = "1.28.5";
+ version = "1.28.6";
outputs = [
"bin"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz";
- hash = "sha256-pan3g4CbF6jrd09KdpWyy4y6axVSASmQb4fq8w5/hGk=";
+ hash = "sha256-Yra58K0xR6bdZCCsZKkRgLFOmQaVvd01O5YEFhHQUso=";
};
depsBuildBuild = [
diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix
index 55421dc2010e..12eafbc7e91a 100644
--- a/pkgs/development/libraries/gstreamer/devtools/default.nix
+++ b/pkgs/development/libraries/gstreamer/devtools/default.nix
@@ -27,7 +27,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "gst-devtools";
- version = "1.28.5";
+ version = "1.28.6";
outputs = [
"out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz";
- hash = "sha256-dFkEXbMdbkRgC8vgEdySV1AmiHDnuQ9+ego69KIcCeU=";
+ hash = "sha256-FNQfquA2GSUflZWdPVe/ZcYQaDiztUIY3JXHE14euhM=";
};
cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix
index 005a3f90c3a9..0bef33df0348 100644
--- a/pkgs/development/libraries/gstreamer/ges/default.nix
+++ b/pkgs/development/libraries/gstreamer/ges/default.nix
@@ -23,7 +23,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "gst-editing-services";
- version = "1.28.5";
+ version = "1.28.6";
outputs = [
"out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz";
- hash = "sha256-0C+d99108qUCQ6b6XjJ8+71cEhKc57bnPXDAhTJJGog=";
+ hash = "sha256-PRUeUJfWhsWJCudvFMV+4ZU4/WHGz2NxcfkLMJyv1Tw=";
};
separateDebugInfo = true;
diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix
index 987295f7ac0a..00b47201a47e 100644
--- a/pkgs/development/libraries/gstreamer/good/default.nix
+++ b/pkgs/development/libraries/gstreamer/good/default.nix
@@ -2,7 +2,6 @@
lib,
stdenv,
fetchurl,
- fetchpatch,
replaceVars,
meson,
nasm,
@@ -16,8 +15,6 @@
libGL,
libv4l,
libdv,
- libavc1394,
- libiec61883,
libvpx,
libdrm,
speex,
@@ -53,6 +50,10 @@
libxext,
libxdamage,
ncurses,
+ enableFireWire ? stdenv.hostPlatform.isLinux,
+ libavc1394,
+ libiec61883,
+ enableOSS ? stdenv.hostPlatform.isLinux,
enableWayland ? stdenv.hostPlatform.isLinux,
wayland,
wayland-protocols,
@@ -78,7 +79,7 @@ assert raspiCameraSupport -> hostSupportsRaspiCamera;
stdenv.mkDerivation (finalAttrs: {
pname = "gst-plugins-good";
- version = "1.28.5";
+ version = "1.28.6";
outputs = [
"out"
@@ -87,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz";
- hash = "sha256-WLRdJKHXeznXu32czG4tdrvyhhiZjDNcFj8Y5vlKkyQ=";
+ hash = "sha256-sMYgpLGLbukxtMQ7vxdg0whmbcN/cwp+fxrTJ+Wc4t8=";
};
patches = [
@@ -200,9 +201,11 @@ stdenv.mkDerivation (finalAttrs: {
libGL
libv4l
libpulseaudio
+ libgudev
+ ]
+ ++ lib.optionals enableFireWire [
libavc1394
libiec61883
- libgudev
]
++ lib.optionals stdenv.hostPlatform.isDarwin [
apple-sdk_gstreamer
@@ -214,45 +217,38 @@ stdenv.mkDerivation (finalAttrs: {
libjack2
];
- mesonFlags = [
- "-Dexamples=disabled" # requires many dependencies and probably not useful for our users
- "-Dglib_debug=disabled" # cast checks should be disabled on stable releases
- (lib.mesonEnable "doc" enableDocumentation)
- (lib.mesonEnable "asm" true)
- ]
- ++ lib.optionals (!qt5Support) [
- "-Dqt5=disabled"
- ]
- ++ lib.optionals (!qt6Support) [
- "-Dqt6=disabled"
- ]
- ++ lib.optionals (!gtkSupport) [
- "-Dgtk3=disabled"
- ]
- ++ lib.optionals (!enableX11) [
- "-Dximagesrc=disabled" # Linux-only
- ]
- ++ lib.optionals (!enableJack) [
- "-Djack=disabled"
- ]
- ++ lib.optionals (!stdenv.hostPlatform.isLinux) [
- "-Ddv1394=disabled" # Linux only
- "-Doss4=disabled" # Linux only
- "-Doss=disabled" # Linux only
- "-Dpulse=disabled" # TODO check if we can keep this enabled
- "-Dv4l2-gudev=disabled" # Linux-only
- "-Dv4l2=disabled" # Linux-only
- ]
- ++ (
- if raspiCameraSupport then
- [
- "-Drpi-lib-dir=${libraspberrypi}/lib"
- ]
- else
- [
- "-Drpicamsrc=disabled"
- ]
- );
+ mesonFlags =
+ lib.mapAttrsToList lib.mesonEnable {
+ orc = true;
+ orc-compiler = true;
+ nls = true;
+
+ tests = finalAttrs.finalPackage.doCheck;
+
+ examples = false; # requires many dependencies and probably not useful for our users
+ glib_debug = false; # cast checks should be disabled on stable releases
+ doc = enableDocumentation;
+ asm = true;
+ qt5 = qt5Support;
+ qt6 = qt6Support;
+ gtk3 = gtkSupport;
+ ximagesrc = enableX11; # Linux-only
+ jack = enableJack;
+
+ # Linux only
+ dv1394 = enableFireWire;
+ oss = enableOSS;
+ oss4 = enableOSS;
+ pulse = stdenv.hostPlatform.isLinux; # TODO check if we can keep this enabled
+ v4l2 = stdenv.hostPlatform.isLinux;
+ v4l2-gudev = stdenv.hostPlatform.isLinux;
+
+ rpicamsrc = raspiCameraSupport;
+ }
+ ++ lib.optionals raspiCameraSupport [
+ (lib.mesonOption "rpi-header-dir" "${lib.getDev libraspberrypi}/include")
+ (lib.mesonOption "rpi-lib-dir" "${lib.getLib libraspberrypi}/lib")
+ ];
postPatch = ''
patchShebangs \
@@ -264,7 +260,7 @@ stdenv.mkDerivation (finalAttrs: {
NIX_LDFLAGS =
# linking error on Darwin
# https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896
- "-lncurses";
+ lib.optionalString stdenv.hostPlatform.isDarwin "-lncurses";
};
# fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''"
@@ -273,6 +269,7 @@ stdenv.mkDerivation (finalAttrs: {
# must be explicitly set since 5590e365
dontWrapQtApps = true;
+ # Note: gst-plugins-good produces no pkg-config files unless building static libraries
preFixup = ''
moveToOutput "lib/gstreamer-1.0/pkgconfig" "$dev"
'';
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 3714fb286d9c..6dc5f3abd6e4 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -9,8 +9,7 @@
gstreamer,
gst-plugins-base,
gettext,
- # FIXME: unpin when upstream supports ffmpeg 9
- ffmpeg_8-headless,
+ ffmpeg-headless,
# Checks meson.is_cross_build(), so even canExecute isn't enough.
enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
hotdoc,
@@ -20,16 +19,11 @@
stdenv.mkDerivation (finalAttrs: {
pname = "gst-libav";
- version = "1.28.5";
-
- outputs = [
- "out"
- "dev"
- ];
+ version = "1.28.6";
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz";
- hash = "sha256-RShUZWBW8LFlEaHZrU8mef9eWofIn5DPfuXewAXdseQ=";
+ hash = "sha256-cebq+0//KmbRuwuo0HgiTf5+M5cwfYwLuj3CNgbgj1E=";
};
separateDebugInfo = true;
@@ -51,15 +45,16 @@ stdenv.mkDerivation (finalAttrs: {
buildInputs = [
gstreamer
gst-plugins-base
- ffmpeg_8-headless
+ ffmpeg-headless
]
++ lib.optionals stdenv.hostPlatform.isDarwin [
apple-sdk_gstreamer
];
- mesonFlags = [
- (lib.mesonEnable "doc" enableDocumentation)
- ];
+ mesonFlags = lib.mapAttrsToList lib.mesonEnable {
+ doc = enableDocumentation;
+ tests = finalAttrs.finalPackage.doCheck;
+ };
postPatch = ''
patchShebangs \
diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
index 5fdb31e1ddd8..742fbc362821 100644
--- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
+++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix
@@ -19,7 +19,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "gst-rtsp-server";
- version = "1.28.5";
+ version = "1.28.6";
outputs = [
"out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz";
- hash = "sha256-fhn93rEmG+vD7Dl4V/7dXHcSm2arUniP2trQURdWYiU=";
+ hash = "sha256-DLclsTUfdeiIA8Vd3eofJ74JUj3c1/KasYJw4YKipGM=";
};
separateDebugInfo = true;
diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix
index b524bc2fac7f..4ad03256c94e 100644
--- a/pkgs/development/libraries/gstreamer/ugly/default.nix
+++ b/pkgs/development/libraries/gstreamer/ugly/default.nix
@@ -27,7 +27,7 @@
stdenv.mkDerivation (finalAttrs: {
pname = "gst-plugins-ugly";
- version = "1.28.5";
+ version = "1.28.6";
outputs = [
"out"
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz";
- hash = "sha256-DvTPnDyaXndqbKjRkKMYYzkbaBmAJSFDuCKymqgx4SA=";
+ hash = "sha256-7iedoTp0D9fwYNYxpnMiP6O8yMM9NQyNAmS9Myok7Ng=";
};
separateDebugInfo = true;
diff --git a/pkgs/development/libraries/isl/generic.nix b/pkgs/development/libraries/isl/generic.nix
index 8988e8faf982..232057fe03e7 100644
--- a/pkgs/development/libraries/isl/generic.nix
+++ b/pkgs/development/libraries/isl/generic.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation {
makeFlags = lib.optional stdenv.hostPlatform.isPE "LDFLAGS=-no-undefined";
+ __structuredAttrs = true;
+
meta = {
homepage = "https://libisl.sourceforge.io/";
license = lib.licenses.lgpl21;
diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix
index 294e7a81d5e4..2e24e6a509e0 100644
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@@ -10,13 +10,13 @@
# assert !stdenv.hostPlatform.isLinux || stdenv.hostPlatform != stdenv.buildPlatform; # TODO: improve on cross
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "libiconv";
version = "1.19";
src = fetchurl {
- url = "mirror://gnu/libiconv/${pname}-${version}.tar.gz";
- sha256 = "sha256-iN2WqMBGTsoUT8eRrmDNMc2O54Mh5nOX4l/AlcShmqY=";
+ url = "mirror://gnu/libiconv/libiconv-${finalAttrs.version}.tar.gz";
+ hash = "sha256-iN2WqMBGTsoUT8eRrmDNMc2O54Mh5nOX4l/AlcShmqY=";
};
enableParallelBuilding = true;
@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
# https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0
nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
+ strictDeps = true;
+
# https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
@@ -82,7 +84,9 @@ stdenv.mkDerivation rec {
# remove after gnulib is updated
++ lib.optional stdenv.hostPlatform.isCygwin "gl_cv_clean_version_stddef=yes";
- passthru = { inherit setupHooks; };
+ passthru = { inherit (finalAttrs) setupHooks; };
+
+ __structuredAttrs = true;
meta = {
description = "Iconv(3) implementation";
@@ -106,4 +110,4 @@ stdenv.mkDerivation rec {
# This library is not needed on GNU platforms.
hydraPlatforms = with lib.platforms; cygwin ++ darwin ++ freebsd;
};
-}
+})
diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix
index 3d06a7410c5e..8b34a2842082 100644
--- a/pkgs/development/libraries/libidn2/default.nix
+++ b/pkgs/development/libraries/libidn2/default.nix
@@ -14,12 +14,12 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "libidn2";
version = "2.3.8";
src = fetchurl {
- url = "https://ftp.gnu.org/gnu/libidn/libidn2-${version}.tar.gz";
+ url = "https://ftp.gnu.org/gnu/libidn/libidn2-${finalAttrs.version}.tar.gz";
hash = "sha256-9VeRG/YXFiHh9y/zX1sYJbs1tS7UUyXc3ukx5dPAeHo=";
};
@@ -44,6 +44,8 @@ stdenv.mkDerivation rec {
buildInputs = [ libunistring ] ++ lib.optional stdenv.hostPlatform.isDarwin libiconv;
depsBuildBuild = [ buildPackages.stdenv.cc ];
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/libidn/#libidn2";
description = "Free software implementation of IDNA2008 and TR46";
@@ -65,6 +67,6 @@ stdenv.mkDerivation rec {
];
platforms = lib.platforms.all;
maintainers = with lib.maintainers; [ fpletz ];
- identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
+ identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
};
-}
+})
diff --git a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
index ff8c47915067..773dfb6efe0f 100644
--- a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
+++ b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix
@@ -4,7 +4,6 @@
libidn2,
libunistring,
runCommandLocal,
- patchelf,
}:
# Construct a copy of libidn2.* where all (transitive) libc references (in .bin)
# get replaced by a new one, so that there's no reference to bootstrap tools.
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 17ef7da85270..924696025cf1 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -61,6 +61,8 @@ stdenv.mkDerivation rec {
"dev"
];
+ propagatedBuildOutputs = [ "out" ];
+
src = fetchFromGitLab {
domain = "gitlab.freedesktop.org";
owner = "libinput";
diff --git a/pkgs/development/libraries/libxml2/common.nix b/pkgs/development/libraries/libxml2/common.nix
index 61c40a95ffe3..6fbae9218df3 100644
--- a/pkgs/development/libraries/libxml2/common.nix
+++ b/pkgs/development/libraries/libxml2/common.nix
@@ -153,6 +153,8 @@ stdenv'.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://gitlab.gnome.org/GNOME/libxml2";
description = "XML parsing library for C";
diff --git a/pkgs/development/libraries/nettle/generic.nix b/pkgs/development/libraries/nettle/generic.nix
index b626e137c427..9494a282a1df 100644
--- a/pkgs/development/libraries/nettle/generic.nix
+++ b/pkgs/development/libraries/nettle/generic.nix
@@ -25,6 +25,8 @@ stdenv.mkDerivation {
nativeBuildInputs = [ gnum4 ];
propagatedBuildInputs = [ gmp ];
+ strictDeps = true;
+
configureFlags =
# runtime selection of HW-accelerated code; it's default since 3.7
[ "--enable-fat" ]
@@ -40,6 +42,8 @@ stdenv.mkDerivation {
patches = lib.optional (stdenv.hostPlatform.system == "i686-cygwin") ./cygwin.patch;
+ __structuredAttrs = true;
+
meta = {
description = "Cryptographic library";
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index a7f342c6eaf7..20dac13831d2 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -36,6 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
]
++ lib.optional withJemalloc jemalloc;
+ strictDeps = true;
+
cmakeFlags = [
# The examples try to link against `ngtcp2_crypto_ossl` and `ngtcp2` libraries.
# This works in the dynamic case where the targets have the same name, but not here where they're suffixed with `_static`.
@@ -56,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
inherit curl;
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://github.com/ngtcp2/ngtcp2";
changelog = "https://github.com/ngtcp2/ngtcp2/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix
index 3de8d611a9d4..476334552e79 100644
--- a/pkgs/development/libraries/ngtcp2/gnutls.nix
+++ b/pkgs/development/libraries/ngtcp2/gnutls.nix
@@ -11,14 +11,14 @@
curlWithGnuTls,
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "ngtcp2";
version = "1.25.0";
src = fetchFromGitHub {
owner = "ngtcp2";
repo = "ngtcp2";
- rev = "v${version}";
+ tag = "v${finalAttrs.version}";
hash = "sha256-BBV4nNtSWQOFuwVOeH3LJEUeF7v4LVhGbfcrkroBAvc=";
};
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
];
buildInputs = [ gnutls ];
+ strictDeps = true;
+
configureFlags = [ "--with-gnutls=yes" ];
enableParallelBuilding = true;
@@ -43,6 +45,8 @@ stdenv.mkDerivation rec {
inherit curlWithGnuTls;
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://github.com/ngtcp2/ngtcp2";
description = "Effort to implement RFC9000 QUIC protocol";
@@ -52,7 +56,7 @@ stdenv.mkDerivation rec {
vcunat # for knot-dns
];
};
-}
+})
/*
Why split from ./default.nix?
diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix
index c0a00366eac2..580d1fbfb73e 100644
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@@ -3,6 +3,7 @@
stdenv,
fetchurl,
fetchFromGitLab,
+ fetchpatch,
cairo,
clang-tools,
cmake,
@@ -39,6 +40,7 @@
cups-filters,
gdal,
gegl,
+ gtk3,
inkscape,
scribus,
vips,
@@ -62,7 +64,7 @@ let
in
stdenv.mkDerivation (finalAttrs: {
pname = "poppler-${suffix}";
- version = "26.06.0"; # beware: updates often break cups-filters build, check scribus too!
+ version = "26.06.0";
outputs = [
"out"
@@ -74,6 +76,16 @@ stdenv.mkDerivation (finalAttrs: {
hash = "sha256-TLTlo9yMte7HUciiPIuhn2H5be3AzQfSruawyOLPa6Q=";
};
+ patches = [
+ # Backports Darwin crash fix from upstream
+ # https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1743
+ (fetchpatch {
+ name = "darwin-mutex-lock-crash.patch";
+ url = "https://gitlab.freedesktop.org/poppler/poppler/-/commit/08f4bca6a669f9fce75dbab743db559a86591738.patch";
+ hash = "sha256-+eWqVK/v3Ys9k2+z/dCoS2o82m039UER1StMUW4PIgM=";
+ })
+ ];
+
nativeBuildInputs = [
cmake
ninja
@@ -184,9 +196,17 @@ stdenv.mkDerivation (finalAttrs: {
gdal = gdal.override { usePoppler = true; };
python-poppler-qt5 = python3.pkgs.poppler-qt5;
- pkg-config = testers.hasPkgConfigModules {
- package = finalAttrs.finalPackage;
- };
+ pkg-config =
+ testers.hasPkgConfigModules {
+ package = finalAttrs.finalPackage;
+ }
+ // lib.optionalAttrs (!minimal) {
+ # Poppler skips tests unless GTK3 is detected; add to closure
+ poppler-with-gtk-tests = finalAttrs.finalPackage.overrideAttrs (old: {
+ pname = "${old.pname}-gtk-tests";
+ buildInputs = old.buildInputs ++ [ gtk3 ];
+ });
+ };
};
};
diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index bd94b3ae2c48..e97e92bf7f8c 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.1/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.2/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index cfcdb5f6c59a..786229c5651b 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -43,20 +43,6 @@ qtModule {
hash = "sha256-ESy35OlmsvI4yFQ/rFT8oelOUBCwCmlcbQJvwcTrCig=";
revert = true;
})
-
- # backport fix recommended by KDE
- (fetchpatch {
- url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff";
- hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM=";
- })
-
- # backport required at least for [musescore][1], and perhaps many other
- # applications.
- # [1]: https://github.com/musescore/MuseScore/issues/33015
- (fetchpatch {
- url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.diff";
- hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
- })
];
cmakeFlags = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index c70d2cbd1f88..b5e6c6bc6e19 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
qtModule rec {
pname = "qtmqtt";
- version = "6.11.1";
+ version = "6.11.2";
src = fetchFromGitHub {
owner = "qt";
repo = "qtmqtt";
tag = "v${version}";
- hash = "sha256-GWaF4iCPtATL1mJkPHVY0rom8R2FMNWGahE3KWBlfV8=";
+ hash = "sha256-Xg4vfVfYgruRXB6LSWFJWSMtsClJMtML+KhaQExWUGs=";
};
propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 93c206858d18..c6688d20db77 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,339 +4,339 @@
{
qt3d = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt3d-everywhere-src-6.11.1.tar.xz";
- sha256 = "01q11bs7vjz1s5wdrdjq904dgl2m6l7r8d3vd2kyf7lx0j78qvd6";
- name = "qt3d-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qt3d-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0adczdz74mlmrb8w7hzjln1902isn7bgfbzpr1r18wasg6j8a4a1";
+ name = "qt3d-everywhere-src-6.11.2.tar.xz";
};
};
qt5compat = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt5compat-everywhere-src-6.11.1.tar.xz";
- sha256 = "06qndy534rzabxk9yq07dsl8fj1vd72lmck11r5xbajil3d9zjyg";
- name = "qt5compat-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qt5compat-everywhere-src-6.11.2.tar.xz";
+ sha256 = "11s225zq0hskkq61rrfhy65aqzdny7np00c75ngnl2ci6gz21hv8";
+ name = "qt5compat-everywhere-src-6.11.2.tar.xz";
};
};
qtactiveqt = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtactiveqt-everywhere-src-6.11.1.tar.xz";
- sha256 = "05hcnhxkajry4ha7ykmqr83p16qjipspwxid8l2rxgz80wy6aadv";
- name = "qtactiveqt-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtactiveqt-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0g3ak3jmh4fqjl0xh3vcj7hlw7k7902b2arqxa304hmh1s0dmblx";
+ name = "qtactiveqt-everywhere-src-6.11.2.tar.xz";
};
};
qtbase = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtbase-everywhere-src-6.11.1.tar.xz";
- sha256 = "1b616gr7k8byfr2ns4vczs4kj3sznhlrlw9inpb3m8la48qllnfr";
- name = "qtbase-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtbase-everywhere-src-6.11.2.tar.xz";
+ sha256 = "08ng4gns21a3za3qszzw3yp3a2pxipma1zrl870xi97mrbn00bjv";
+ name = "qtbase-everywhere-src-6.11.2.tar.xz";
};
};
qtcanvaspainter = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
- sha256 = "1l08zp68q3wcr9v5hh82kw6jqvc1wmnrjn7h9959psx520dwcdly";
- name = "qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtcanvaspainter-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0q77hc83ynvnagwxa9z0j9rwvlzmyig06kklb7v5zvyfa1ra544a";
+ name = "qtcanvaspainter-everywhere-src-6.11.2.tar.xz";
};
};
qtcharts = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcharts-everywhere-src-6.11.1.tar.xz";
- sha256 = "0p2icmrwb6am7x2kgk9pnpa8ypi7jiscyaawgi0x31iaihqyvqrz";
- name = "qtcharts-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtcharts-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0agvnva90diqvllfvrd1smicar6nlv5pjqvwjfg509fih4xyasah";
+ name = "qtcharts-everywhere-src-6.11.2.tar.xz";
};
};
qtconnectivity = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtconnectivity-everywhere-src-6.11.1.tar.xz";
- sha256 = "14g5h0wixqy981cnn5f8gkjbji804f18gfjkzbanxd0lljg2h191";
- name = "qtconnectivity-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtconnectivity-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0dv0bqlvfdphk2a5pzq7fm222h6zvy87k18aaamq7585pmbimc45";
+ name = "qtconnectivity-everywhere-src-6.11.2.tar.xz";
};
};
qtdatavis3d = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdatavis3d-everywhere-src-6.11.1.tar.xz";
- sha256 = "1b4kcqfq5q79lm70f08qiksxl36laa9dgx9ladjk2xwl1af7n6hy";
- name = "qtdatavis3d-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdatavis3d-everywhere-src-6.11.2.tar.xz";
+ sha256 = "07b61fkdzkhv3hfa7r6vfadd72bnyk4cgqwws5ns3y6nqlcnjknj";
+ name = "qtdatavis3d-everywhere-src-6.11.2.tar.xz";
};
};
qtdeclarative = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdeclarative-everywhere-src-6.11.1.tar.xz";
- sha256 = "193ar0fcfzjjr7mi8i2622vip95qrr3qry949d9lyc5hf3v71rjj";
- name = "qtdeclarative-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdeclarative-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0c5lqr8kbrfvaxh147d92vqbcirw7wj94sxwx8ih2f3ya5q7nnr1";
+ name = "qtdeclarative-everywhere-src-6.11.2.tar.xz";
};
};
qtdoc = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdoc-everywhere-src-6.11.1.tar.xz";
- sha256 = "1hd5z6prx2sbr3wxzkynrn2iyjllvkids505l2xg3p272j4b5306";
- name = "qtdoc-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdoc-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1dsfnlsk0kihz55fnmyrybya9x3s88nam9jfpb5g68vk4n9if9sn";
+ name = "qtdoc-everywhere-src-6.11.2.tar.xz";
};
};
qtgraphs = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgraphs-everywhere-src-6.11.1.tar.xz";
- sha256 = "0qh43qxqg4biyrrsd78nmi4dm3dnbswa95cq8db2k3lans517cc4";
- name = "qtgraphs-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtgraphs-everywhere-src-6.11.2.tar.xz";
+ sha256 = "08cbzc0146j4d18dlqsw0qbilhcwk1hi9h8n84adsigs9a2hj8cz";
+ name = "qtgraphs-everywhere-src-6.11.2.tar.xz";
};
};
qtgrpc = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgrpc-everywhere-src-6.11.1.tar.xz";
- sha256 = "0l52w91hd2crq6zyh5a8arv07yixnwcr2pya74bxpk2hqpq08ys3";
- name = "qtgrpc-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtgrpc-everywhere-src-6.11.2.tar.xz";
+ sha256 = "14xdchng4sn90r2cva7wxrqlyzncpwkj11gscm4z73q5y0blcha4";
+ name = "qtgrpc-everywhere-src-6.11.2.tar.xz";
};
};
qthttpserver = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qthttpserver-everywhere-src-6.11.1.tar.xz";
- sha256 = "01p7li9fvwnz2shx3d9wj9nnnnipya2q0whchyvgjqb8yzy71gq4";
- name = "qthttpserver-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qthttpserver-everywhere-src-6.11.2.tar.xz";
+ sha256 = "13mxwy5h41c96ykdkxlxcdf2pqv2gswyvyzxrzsj13x55cxpdxgh";
+ name = "qthttpserver-everywhere-src-6.11.2.tar.xz";
};
};
qtimageformats = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtimageformats-everywhere-src-6.11.1.tar.xz";
- sha256 = "04y4pa5krrpyiqn039d6m8bzcxj6pa1m850rz3bmw5xc8ml6rgxj";
- name = "qtimageformats-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtimageformats-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1y0123s8hry81059w8x46fv0i0425zv99g09cc3m0rabyc08kkff";
+ name = "qtimageformats-everywhere-src-6.11.2.tar.xz";
};
};
qtlanguageserver = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlanguageserver-everywhere-src-6.11.1.tar.xz";
- sha256 = "1vwavpi8swgs88pfjfddnb9cmsb4k1sjcgywp2rsnm6ay8vqa02h";
- name = "qtlanguageserver-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlanguageserver-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0ppw27jsqsih48sd0iizfc2jwsxya8z0a9vjjaqhxjplxir45g1q";
+ name = "qtlanguageserver-everywhere-src-6.11.2.tar.xz";
};
};
qtlocation = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlocation-everywhere-src-6.11.1.tar.xz";
- sha256 = "06z4hbiqki5chhmph131s71czyrjpnjvy3rxb4560vwy55vwx49p";
- name = "qtlocation-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlocation-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0fn2clzz2wmc3lwzqlkwk07scvmmdhim1ihpxkv7dg8zw3nafl2d";
+ name = "qtlocation-everywhere-src-6.11.2.tar.xz";
};
};
qtlottie = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlottie-everywhere-src-6.11.1.tar.xz";
- sha256 = "0y969gp64imwh49d5zbnw0wi2yva9fsp6qn58617rs9kvkdzml70";
- name = "qtlottie-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlottie-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0lj8a90frd265waypkwghabj0r9h5p6vh1dlrjksksyr2qkp2g7m";
+ name = "qtlottie-everywhere-src-6.11.2.tar.xz";
};
};
qtmultimedia = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtmultimedia-everywhere-src-6.11.1.tar.xz";
- sha256 = "02lvq1jk6m67m6z0w7vdzxhzmi441j8avvp79mfclfpfvm98w3rr";
- name = "qtmultimedia-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtmultimedia-everywhere-src-6.11.2.tar.xz";
+ sha256 = "17yd17qm0jxfimkqs843z5m86ciif1pcs8h66vdkqybbxh15wywn";
+ name = "qtmultimedia-everywhere-src-6.11.2.tar.xz";
};
};
qtnetworkauth = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtnetworkauth-everywhere-src-6.11.1.tar.xz";
- sha256 = "0gan2qjv97d1387jqaiis2gigm6lz5jbk1k10x13w0yc5kr5n7cz";
- name = "qtnetworkauth-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtnetworkauth-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0nx03zab9jrzkrwali45czswlniwbh0v0nx17wwj8y5bfwqc50qc";
+ name = "qtnetworkauth-everywhere-src-6.11.2.tar.xz";
};
};
qtopenapi = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtopenapi-everywhere-src-6.11.1.tar.xz";
- sha256 = "0nzl95w5pbfd6mfb6rzv6arz09pcm6siz1n07pgm9rrdr6z083a4";
- name = "qtopenapi-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtopenapi-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1873byinl4ikm3bncz869fjhn1z2jwj9s0bg3h9ncnn4kl0fp74b";
+ name = "qtopenapi-everywhere-src-6.11.2.tar.xz";
};
};
qtpositioning = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtpositioning-everywhere-src-6.11.1.tar.xz";
- sha256 = "1xbq1xjjbhb41lfp9mli8a5rgqf5pniswv0161v6wa5f04cbkrnm";
- name = "qtpositioning-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtpositioning-everywhere-src-6.11.2.tar.xz";
+ sha256 = "16blmv0plbh0l214q6phfp7jb18201cyqk66v8555cd38fnibkyq";
+ name = "qtpositioning-everywhere-src-6.11.2.tar.xz";
};
};
qtquick3d = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3d-everywhere-src-6.11.1.tar.xz";
- sha256 = "0vs5bcz62r32gin0g4lb6wdmqrv0ypzar1s9wsza98la7zg8asy7";
- name = "qtquick3d-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquick3d-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1d1pcy9ipjsipczrassn6h9jq2bx7v1457fg6wx3f9nvivqf3f1s";
+ name = "qtquick3d-everywhere-src-6.11.2.tar.xz";
};
};
qtquick3dphysics = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
- sha256 = "1bvrmjb6m0ynq00ybdghvkbmwm237vff23ng8n4njysf05pns26i";
- name = "qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquick3dphysics-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0vmqvr68qq0caglackln225xj3p8srdycykw3m44iz458b7j8nhw";
+ name = "qtquick3dphysics-everywhere-src-6.11.2.tar.xz";
};
};
qtquickeffectmaker = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
- sha256 = "0sqk8hkkdibv0ayxrvpcbgj3dcwfngpd6qjp2xm15pcbx1q3xrng";
- name = "qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquickeffectmaker-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1dswhg102b09x3p3iyldmwkhnkphcisl4jp2dbisacz9hirdq8vr";
+ name = "qtquickeffectmaker-everywhere-src-6.11.2.tar.xz";
};
};
qtquicktimeline = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquicktimeline-everywhere-src-6.11.1.tar.xz";
- sha256 = "09wcx83yxif8r4v81h2jfj3wlj60wnc9k4dsp7hlah4yzm1zclxg";
- name = "qtquicktimeline-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquicktimeline-everywhere-src-6.11.2.tar.xz";
+ sha256 = "05qxi1gqv02af28rlzlbmxc4v939i920gqblvrfh9i50002z22i5";
+ name = "qtquicktimeline-everywhere-src-6.11.2.tar.xz";
};
};
qtremoteobjects = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtremoteobjects-everywhere-src-6.11.1.tar.xz";
- sha256 = "06hiiyjpcgn8dp9jmgxj30nlrw73rqb869f0m63scccmqsarhqj0";
- name = "qtremoteobjects-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtremoteobjects-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1zbwg7pzswibjjx2vgcl3r4v47xhdwk0c9bik8bv3hlyg60rc32y";
+ name = "qtremoteobjects-everywhere-src-6.11.2.tar.xz";
};
};
qtscxml = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtscxml-everywhere-src-6.11.1.tar.xz";
- sha256 = "0gr0j09isxgii3aivfvr35x40d9n0kj0g2icc7g7bzniwm2m4jcf";
- name = "qtscxml-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtscxml-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1zrmxhf2a58dynbxij08vxa6x7b6jllcfwvrhlhgpgzqlyxw957m";
+ name = "qtscxml-everywhere-src-6.11.2.tar.xz";
};
};
qtsensors = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsensors-everywhere-src-6.11.1.tar.xz";
- sha256 = "13ygry3lybkgci6gkrd7k081l01icavzkiyy4g82drbvv9i70q93";
- name = "qtsensors-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtsensors-everywhere-src-6.11.2.tar.xz";
+ sha256 = "069ij142dvh4spqp9584pfqqj8265x659xb35wcf5s1jzd6y9j38";
+ name = "qtsensors-everywhere-src-6.11.2.tar.xz";
};
};
qtserialbus = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialbus-everywhere-src-6.11.1.tar.xz";
- sha256 = "02pj4jnxc4afl5ymv7w8asggpg0hdj3dbnwwcqd305b8il69qv64";
- name = "qtserialbus-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtserialbus-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1h9nvwhbfhb5js0458ha653n04d46m70j4gh8gn4bc7njnxcj1lg";
+ name = "qtserialbus-everywhere-src-6.11.2.tar.xz";
};
};
qtserialport = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialport-everywhere-src-6.11.1.tar.xz";
- sha256 = "0x1r5l3kx7riprf0b2api0bcg0z755fq9vbgmx7px6pxiy4imwws";
- name = "qtserialport-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtserialport-everywhere-src-6.11.2.tar.xz";
+ sha256 = "13md2wdypib4wjw3mai8hqfyjjs4l67232dnxjr32ks42qv76fnz";
+ name = "qtserialport-everywhere-src-6.11.2.tar.xz";
};
};
qtshadertools = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtshadertools-everywhere-src-6.11.1.tar.xz";
- sha256 = "1z42r414jid12jmhm1yf5kw44j886w01igav0kggkg13kcphax90";
- name = "qtshadertools-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtshadertools-everywhere-src-6.11.2.tar.xz";
+ sha256 = "070b41mzqf1b7xnxn2mh7ap79s2702a7bcwhd1c6axkmnyw4cl40";
+ name = "qtshadertools-everywhere-src-6.11.2.tar.xz";
};
};
qtspeech = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtspeech-everywhere-src-6.11.1.tar.xz";
- sha256 = "051z4yf22hkqhy3pkgxq8s77x06k4cd70i9jcmd8f99004cc6df0";
- name = "qtspeech-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtspeech-everywhere-src-6.11.2.tar.xz";
+ sha256 = "166bqmcffdncyr64zw4h99c9ng19nk30ys371br4j03ikpf0a7cw";
+ name = "qtspeech-everywhere-src-6.11.2.tar.xz";
};
};
qtsvg = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsvg-everywhere-src-6.11.1.tar.xz";
- sha256 = "154adaicyy5wyz6yc95g3lm4iw9v2zdsd7l5qp107gr490pz0g3z";
- name = "qtsvg-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtsvg-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0xhq64622f6iz42xj4dn0jjgs4jwd9gbi1zyczxjck58xizk756m";
+ name = "qtsvg-everywhere-src-6.11.2.tar.xz";
};
};
qttasktree = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttasktree-everywhere-src-6.11.1.tar.xz";
- sha256 = "1mjdwy3i24ggn2g82z5pg3grzhnaxmq7nmvdc7ba8dsdixzvjam2";
- name = "qttasktree-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttasktree-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1n1yq8hws4yq0raanfkjj2r4z671mic2dspg2p6sc5hny292jxn0";
+ name = "qttasktree-everywhere-src-6.11.2.tar.xz";
};
};
qttools = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttools-everywhere-src-6.11.1.tar.xz";
- sha256 = "03gmr9zpf0raqcvqk2cpw9lblw907hsl5cb5c2fgm4wwcxd86qcf";
- name = "qttools-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttools-everywhere-src-6.11.2.tar.xz";
+ sha256 = "07h4nhk02izczi1wz6dh7gab84vzk7rkm30wwq4pwbsibkrmm9wy";
+ name = "qttools-everywhere-src-6.11.2.tar.xz";
};
};
qttranslations = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttranslations-everywhere-src-6.11.1.tar.xz";
- sha256 = "0xsnxhiqc3ybwvyn1jbhdf1sjmcf7v4mma6w9sxwg535420jrh1p";
- name = "qttranslations-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttranslations-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0560cyg3j4fcsq7ikb7rraa8g5ymi9lscmmhqfmryylklz0q85h2";
+ name = "qttranslations-everywhere-src-6.11.2.tar.xz";
};
};
qtvirtualkeyboard = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
- sha256 = "073y02qmpwxxdqc4pkm6k9frghsjg1zppg2hip5b4hv269xrdim1";
- name = "qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtvirtualkeyboard-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0bvwci70c4ng5zgzj621a723p22v58cmzbprbz6llkjw99rjcsjc";
+ name = "qtvirtualkeyboard-everywhere-src-6.11.2.tar.xz";
};
};
qtwayland = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwayland-everywhere-src-6.11.1.tar.xz";
- sha256 = "1cyr5frhglp2krxvpnqk9q426rgp6nr34ngnxpa42m7p0ajqly4m";
- name = "qtwayland-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwayland-everywhere-src-6.11.2.tar.xz";
+ sha256 = "1pzr4a11dmlbpzfgcm7z95cvnm2r5pq71pg80vsi0aik75g63dwf";
+ name = "qtwayland-everywhere-src-6.11.2.tar.xz";
};
};
qtwebchannel = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebchannel-everywhere-src-6.11.1.tar.xz";
- sha256 = "10ld2nh6gd1v2ssbgqlf6w0lsjlqkjdfwqv85mn5krnnf45vbyv9";
- name = "qtwebchannel-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebchannel-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0pspql8j7yxjvvxwibavb4kw5lidh6a62rcjqbq8ga5xb2bi9czy";
+ name = "qtwebchannel-everywhere-src-6.11.2.tar.xz";
};
};
qtwebengine = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebengine-everywhere-src-6.11.1.tar.xz";
- sha256 = "10vhcvw8j60n0mf38bi3fjcx5v1i0cbfyn4wbqhzqn61qv66d737";
- name = "qtwebengine-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebengine-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0qy1lyykwwkp288v0y5kqnd1pmz8frzicpgfcldkv4zz02mc20b1";
+ name = "qtwebengine-everywhere-src-6.11.2.tar.xz";
};
};
qtwebsockets = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebsockets-everywhere-src-6.11.1.tar.xz";
- sha256 = "1gvgci383dfm4sljqlapdiva7jhks1i2z2ayck0wbj1436hklgi4";
- name = "qtwebsockets-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebsockets-everywhere-src-6.11.2.tar.xz";
+ sha256 = "18y9ycpmny1czkqz7c97hp7l89vxj34h56y5wf87czy3hg1jbzib";
+ name = "qtwebsockets-everywhere-src-6.11.2.tar.xz";
};
};
qtwebview = {
- version = "6.11.1";
+ version = "6.11.2";
src = fetchurl {
- url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebview-everywhere-src-6.11.1.tar.xz";
- sha256 = "0g8k4xs7b0s474x00ds4i8q9b164icdgrdg8ngln10nmf3pwhqld";
- name = "qtwebview-everywhere-src-6.11.1.tar.xz";
+ url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebview-everywhere-src-6.11.2.tar.xz";
+ sha256 = "0k0zi0pzbcvrrjfzhim55rbaar4xrdmpip9y5ppxxnl9xq4y28by";
+ name = "qtwebview-everywhere-src-6.11.2.tar.xz";
};
};
}
diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix
index eab3b229eda7..43d215a9ac97 100644
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -42,7 +42,6 @@
nettle,
libtasn1,
p11-kit,
- libidn,
libedit,
readline,
libGL,
@@ -160,7 +159,6 @@ clangStdenv.mkDerivation (finalAttrs: {
libgbm
libgcrypt
libgpg-error
- libidn
libintl
lcms2
libpthread-stubs
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index d1ade7177909..a400e4b60c63 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -161,6 +161,8 @@ stdenv.mkDerivation (finalAttrs: {
inherit minizip;
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://zlib.net";
description = "Lossless data-compression library";
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index f8e32d0a274f..bac3d44ed009 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -811,15 +811,15 @@ final: prev: {
}:
buildLuarocksPackage {
pname = "dkjson";
- version = "2.10-1";
+ version = "2.11-1";
knownRockspec =
(fetchurl {
- url = "mirror://luarocks/dkjson-2.10-1.rockspec";
- sha256 = "0h49fv93h6n32xwwgwvrhb6w5rzvgjzyls6m9xhmcd94pbkih8v2";
+ url = "mirror://luarocks/dkjson-2.11-1.rockspec";
+ sha256 = "0fkgsqfd0k7pq9j3d1hrhsiha7dc145fbf7hqw0r7lzmp03vjfai";
}).outPath;
src = fetchurl {
- url = "https://dkolf.de/dkjson-lua/dkjson-2.10.tar.gz";
- sha256 = "092v9m13h7zl89qfgywbs22wdvniwr2lr3shjqrn91f4nl39xiz8";
+ url = "https://dkolf.de/dkjson-lua/dkjson-2.11.tar.gz";
+ sha256 = "16725vrd5apdxapj641cc0x218vp0ylfcf0z24wfffxwh7v9l5ks";
};
disabled = luaOlder "5.1" || luaAtLeast "5.6";
diff --git a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch b/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch
deleted file mode 100644
index dd8492c60f21..000000000000
--- a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From ca70a73bb147549e62e74751d924b1dbb59d1707 Mon Sep 17 00:00:00 2001
-From: Stig Palmquist
-Date: Thu, 5 Jun 2025 03:45:50 +0200
-Subject: [PATCH] Fix CVE-2011-10007
-
----
- lib/File/Find/Rule.pm | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/File/Find/Rule.pm b/lib/File/Find/Rule.pm
-index feccc76..d4dc475 100644
---- a/lib/File/Find/Rule.pm
-+++ b/lib/File/Find/Rule.pm
-@@ -420,7 +420,7 @@ sub grep {
-
- $self->exec( sub {
- local *FILE;
-- open FILE, $_ or return;
-+ open FILE, '<', $_ or return;
- local ($_, $.);
- while () {
- for my $p (@pattern) {
---
-2.49.0
-
diff --git a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
deleted file mode 100644
index f1d258c12a3d..000000000000
--- a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- a/XS.xs 2025-09-06 08:34:51.376455632 -0300
-+++ b/XS.xs 2025-09-06 08:35:30.725873619 -0300
-@@ -253,16 +253,16 @@
- // if we recurse too deep, skip all remaining digits
- // to avoid a stack overflow attack
- if (expect_false (--maxdepth <= 0))
-- while (((U8)*s - '0') < 10)
-+ while ((U8)(*s - '0') < 10)
- ++s;
-
- for (;;)
- {
-- U8 dig = (U8)*s - '0';
-+ U8 dig = *s - '0';
-
- if (expect_false (dig >= 10))
- {
-- if (dig == (U8)((U8)'.' - (U8)'0'))
-+ if (dig == (U8)('.' - '0'))
- {
- ++s;
- json_atof_scan1 (s, accum, expo, 1, maxdepth);
-@@ -282,7 +282,7 @@
- else if (*s == '+')
- ++s;
-
-- while ((dig = (U8)*s - '0') < 10)
-+ while ((dig = (U8)(*s - '0')) < 10)
- exp2 = exp2 * 10 + *s++ - '0';
-
- *expo += neg ? -exp2 : exp2;
diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix
index 21552b076199..691665b8cd61 100644
--- a/pkgs/development/python-modules/absl-py/default.nix
+++ b/pkgs/development/python-modules/absl-py/default.nix
@@ -4,17 +4,16 @@
fetchFromGitHub,
hatchling,
}:
-
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
pname = "absl-py";
- version = "2.3.1";
+ version = "2.5.0";
pyproject = true;
src = fetchFromGitHub {
owner = "abseil";
repo = "abseil-py";
- tag = "v${version}";
- hash = "sha256-U8doys7SoOhtUkF0dsCFKnM9ItOoi5a6cK6zGOe/U8s=";
+ tag = "v${finalAttrs.version}";
+ hash = "sha256-BnR9QnZ5AaSlboQuQnX4UKGjAVVpyzMLZ68Do3VZrE0=";
};
build-system = [ hatchling ];
@@ -27,8 +26,8 @@ buildPythonPackage rec {
meta = {
description = "Abseil Python Common Libraries";
homepage = "https://github.com/abseil/abseil-py";
- changelog = "https://github.com/abseil/abseil-py/blob/${src.tag}/CHANGELOG.md";
+ changelog = "https://github.com/abseil/abseil-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
license = lib.licenses.asl20;
maintainers = [ ];
};
-}
+})
diff --git a/pkgs/development/python-modules/bootstrap/build/default.nix b/pkgs/development/python-modules/bootstrap/build/default.nix
index 0d693e2dde58..dbd713e10482 100644
--- a/pkgs/development/python-modules/bootstrap/build/default.nix
+++ b/pkgs/development/python-modules/bootstrap/build/default.nix
@@ -37,6 +37,9 @@ let
runHook postInstall
'';
+
+ strictDeps = true;
+ __structuredAttrs = true;
}
// attrs
);
diff --git a/pkgs/development/python-modules/bootstrap/flit-core/default.nix b/pkgs/development/python-modules/bootstrap/flit-core/default.nix
index 67b8a00ee0ee..5b5858e598cc 100644
--- a/pkgs/development/python-modules/bootstrap/flit-core/default.nix
+++ b/pkgs/development/python-modules/bootstrap/flit-core/default.nix
@@ -31,4 +31,7 @@ stdenv.mkDerivation {
runHook postInstall
'';
+
+ strictDeps = true;
+ __structuredAttrs = true;
}
diff --git a/pkgs/development/python-modules/bootstrap/installer/default.nix b/pkgs/development/python-modules/bootstrap/installer/default.nix
index 9f396bb6275a..2e0c1729bf4b 100644
--- a/pkgs/development/python-modules/bootstrap/installer/default.nix
+++ b/pkgs/development/python-modules/bootstrap/installer/default.nix
@@ -31,4 +31,7 @@ stdenv.mkDerivation {
runHook postInstall
'';
+
+ strictDeps = true;
+ __structuredAttrs = true;
}
diff --git a/pkgs/development/python-modules/bootstrap/packaging/default.nix b/pkgs/development/python-modules/bootstrap/packaging/default.nix
index 8f429e5f5c65..e0e067060641 100644
--- a/pkgs/development/python-modules/bootstrap/packaging/default.nix
+++ b/pkgs/development/python-modules/bootstrap/packaging/default.nix
@@ -28,4 +28,7 @@ stdenv.mkDerivation {
runHook postInstall
'';
+
+ strictDeps = true;
+ __structuredAttrs = true;
}
diff --git a/pkgs/development/python-modules/datamodel-code-generator/default.nix b/pkgs/development/python-modules/datamodel-code-generator/default.nix
index 875cb53d382d..4ab9cc01b5a9 100644
--- a/pkgs/development/python-modules/datamodel-code-generator/default.nix
+++ b/pkgs/development/python-modules/datamodel-code-generator/default.nix
@@ -123,6 +123,9 @@ buildPythonPackage (finalAttrs: {
"test_type_checking_imports_default_to_runtime_imports_for_modular_pydantic_ruff"
];
+ # Some of the tests use localhost networking.
+ __darwinAllowLocalNetworking = true;
+
pythonImportsCheck = [ "datamodel_code_generator" ];
meta = {
diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix
index ed518d645081..fc648cdf7d1d 100644
--- a/pkgs/development/python-modules/dbus-python/default.nix
+++ b/pkgs/development/python-modules/dbus-python/default.nix
@@ -14,85 +14,100 @@
# native dependencies
dbus,
dbus-glib,
+
+ # test dependencies
+ pygobject3,
}:
-lib.fix (
- finalPackage:
- buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
+ pname = "dbus-python";
+ version = "1.4.0";
+ pyproject = true;
+
+ disabled = isPyPy;
+
+ outputs = [
+ "out"
+ "dev"
+ ];
+
+ src = fetchPypi {
pname = "dbus-python";
- version = "1.4.0";
- pyproject = true;
+ inherit (finalAttrs) version;
+ hash = "sha256-mRZm5Jj2Db8+Sbi3Z49VWbimUDT99hquYs3s232Jx3A=";
+ };
- disabled = isPyPy;
+ patches = [
+ # reduce required dependencies
+ # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23
+ (fetchpatch {
+ url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch";
+ hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU=";
+ })
- outputs = [
- "out"
- "dev"
- ];
+ # Fix on Python 3.15, the patch did not achieve what it aimed for anyway.
+ # https://gitlab.freedesktop.org/dbus/dbus-python/-/work_items/59
+ (fetchpatch {
+ url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/ebecd1747c382a57ad8e47d0e32112cdbd454b40.patch";
+ hash = "sha256-Hg4o+FPJvQ1/RW9fd8UJg/YEeVOvbJCov7SS7bT0vvs=";
+ revert = true;
+ })
+ ];
- src = fetchPypi {
- inherit pname version;
- hash = "sha256-mRZm5Jj2Db8+Sbi3Z49VWbimUDT99hquYs3s232Jx3A=";
- };
+ postPatch = ''
+ # we provide patchelf natively, not through the python package
+ sed -i '/patchelf/d' pyproject.toml
- patches = [
- # reduce required dependencies
- # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23
- (fetchpatch {
- url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch";
- hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU=";
- })
- ];
+ patchShebangs test/*.sh
+ '';
- postPatch = ''
- # we provide patchelf natively, not through the python package
- sed -i '/patchelf/d' pyproject.toml
+ nativeBuildInputs = [
+ dbus # build systems checks for `dbus-run-session` in PATH
+ meson
+ meson-python
+ pkg-config
+ ];
- patchShebangs test/*.sh
- '';
+ buildInputs = [
+ dbus
+ dbus-glib
+ ];
- nativeBuildInputs = [
- dbus # build systems checks for `dbus-run-session` in PATH
- meson
- meson-python
- pkg-config
- ];
+ checkInputs = [
+ pygobject3
+ ];
- buildInputs = [
- dbus
- dbus-glib
- ];
+ mesonFlags = [
+ (lib.mesonEnable "tests" finalAttrs.finalPackage.doInstallCheck)
+ ];
- mesonFlags = [ (lib.mesonBool "tests" finalPackage.doInstallCheck) ];
+ # workaround bug in meson-python
+ # https://github.com/mesonbuild/meson-python/issues/240
+ postInstall = ''
+ mkdir -p $dev/lib
+ mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib
+ '';
- # workaround bug in meson-python
- # https://github.com/mesonbuild/meson-python/issues/240
- postInstall = ''
- mkdir -p $dev/lib
- mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib
- '';
+ # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible
+ postFixup = ''
+ ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0
+ '';
- # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible
- postFixup = ''
- ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0
- '';
+ nativeCheckInputs = [ dbus.out ];
- nativeCheckInputs = [ dbus.out ];
+ checkPhase = ''
+ runHook preCheck
- checkPhase = ''
- runHook preCheck
+ meson test -C build --no-rebuild --print-errorlogs --timeout-multiplier 0
- meson test -C build --no-rebuild --print-errorlogs --timeout-multiplier 0
+ runHook postCheck
+ '';
- runHook postCheck
- '';
-
- meta = {
- description = "Python DBus bindings";
- homepage = "https://gitlab.freedesktop.org/dbus/dbus-python";
- license = lib.licenses.mit;
- platforms = dbus.meta.platforms;
- maintainers = [ ];
- };
- }
-)
+ meta = {
+ description = "Python DBus bindings";
+ homepage = "https://gitlab.freedesktop.org/dbus/dbus-python";
+ license = lib.licenses.mit;
+ platforms = dbus.meta.platforms;
+ maintainers = [ ];
+ };
+})
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 1be0d0d05b02..dd805f9b5a4e 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -41,7 +41,7 @@
buildPythonPackage (finalAttrs: {
pname = "fastapi";
- version = "0.139.0";
+ version = "0.141.1";
pyproject = true;
__structuredAttrs = true;
@@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: {
owner = "tiangolo";
repo = "fastapi";
tag = finalAttrs.version;
- hash = "sha256-c4balkkmBv7zKRQnYRpRohVjP23m0HvtdiVrJtgNKYo=";
+ hash = "sha256-5P9aDMS7gLti2CBlrucvjgl4Od1mti9ityPdqxI1RIM=";
};
build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/geoip2/default.nix b/pkgs/development/python-modules/geoip2/default.nix
index b90d1c34edb5..d6dd6a5e6f2a 100644
--- a/pkgs/development/python-modules/geoip2/default.nix
+++ b/pkgs/development/python-modules/geoip2/default.nix
@@ -50,6 +50,8 @@ buildPythonPackage rec {
pythonImportsCheck = [ "geoip2" ];
+ __darwinAllowLocalNetworking = true;
+
meta = {
description = "GeoIP2 webservice client and database reader";
homepage = "https://github.com/maxmind/GeoIP2-python";
diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix
index 1934d3a14ea6..af6a9347b0e3 100644
--- a/pkgs/development/python-modules/gst-python/default.nix
+++ b/pkgs/development/python-modules/gst-python/default.nix
@@ -21,7 +21,7 @@
buildPythonPackage rec {
pname = "gst-python";
- version = "1.28.5";
+ version = "1.28.6";
pyproject = false;
@@ -32,7 +32,7 @@ buildPythonPackage rec {
src = fetchurl {
url = "https://gstreamer.freedesktop.org/src/gst-python/gst-python-${version}.tar.xz";
- hash = "sha256-CsRhtXALl2aZiqaGQ5BkyvWMpP2vhI39R3tadwCxdsw=";
+ hash = "sha256-NNWEQMU7VJWhI9Ckt7ervG6XkqWyGVTbhqB5Gxb24BI=";
};
patches = [
diff --git a/pkgs/development/python-modules/jenkins-job-builder/default.nix b/pkgs/development/python-modules/jenkins-job-builder/default.nix
index 83e64b65474b..ef3de8c5dee7 100644
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@@ -10,7 +10,7 @@
six,
stevedore,
pytestCheckHook,
- setuptools,
+ setuptools_80,
testtools,
pytest-mock,
nixosTests,
@@ -18,21 +18,21 @@
buildPythonPackage (finalAttrs: {
pname = "jenkins-job-builder";
- version = "6.4.4";
+ version = "6.5.0";
pyproject = true;
# forge at opendev.org does not provide release tarballs
src = fetchPypi {
pname = "jenkins_job_builder";
inherit (finalAttrs) version;
- hash = "sha256-7PpCDpe3KLRpt+R/Nu+qxdDxLKWVqTiCPK3j+nNaum8=";
+ hash = "sha256-9E3tWR9olpAZrloh/dxsIztz2PJJfRJrPUzMvpuLFJ0=";
};
postPatch = ''
export HOME=$(mktemp -d)
'';
- build-system = [ setuptools ];
+ build-system = [ setuptools_80 ];
dependencies = [
pbr
diff --git a/pkgs/development/python-modules/jsonpatch/default.nix b/pkgs/development/python-modules/jsonpatch/default.nix
index 962ab4d756c7..ebff042dfe12 100644
--- a/pkgs/development/python-modules/jsonpatch/default.nix
+++ b/pkgs/development/python-modules/jsonpatch/default.nix
@@ -4,21 +4,26 @@
fetchFromGitHub,
jsonpointer,
pytestCheckHook,
+ setuptools,
}:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
pname = "jsonpatch";
version = "1.33";
- format = "setuptools";
+
+ __structuredAttrs = true;
+ pyproject = true;
src = fetchFromGitHub {
owner = "stefankoegl";
repo = "python-json-patch";
- tag = "v${version}";
+ tag = "v${finalAttrs.version}";
hash = "sha256-JHBB64LExzHQVoFF2xcsqGlNWX/YeEBa1M/TmfeQLWI=";
};
- propagatedBuildInputs = [ jsonpointer ];
+ build-system = [ setuptools ];
+
+ dependencies = [ jsonpointer ];
nativeCheckInputs = [ pytestCheckHook ];
@@ -32,4 +37,4 @@ buildPythonPackage rec {
license = lib.licenses.bsd3;
maintainers = [ ];
};
-}
+})
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index eb6e218d354c..ca9677848d91 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -110,6 +110,7 @@ buildPythonPackage (finalAttrs: {
ffmpeg-headless
freetype
qhull
+ pybind11
libraqm
]
++ lib.optionals enableGtk3 [
@@ -123,7 +124,6 @@ buildPythonPackage (finalAttrs: {
build-system = [
certifi
numpy
- pybind11
meson-python
setuptools-scm
];
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index 41871cd05921..60af6eade212 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -21,11 +21,17 @@
aiohttp,
httpx-aiohttp,
+ # optional-dependencies (bedock)
+ botocore,
+
# optional-dependencies (datalib)
numpy,
pandas,
pandas-stubs,
+ # optional-dependencies (httpx2)
+ httpx2,
+
# optional-dependencies (realtime)
websockets,
@@ -36,29 +42,29 @@
pytestCheckHook,
dirty-equals,
inline-snapshot,
- nest-asyncio,
+ jsonschema,
pytest-asyncio,
pytest-mock,
pytest-xdist,
respx,
# optional-dependencies toggle
- withAiohttp ? true,
+ withAiohttp ? false,
withDatalib ? false,
- withRealtime ? true,
- withVoiceHelpers ? true,
+ withRealtime ? false,
+ withVoiceHelpers ? false,
}:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
pname = "openai";
- version = "2.41.1";
+ version = "2.53.0";
pyproject = true;
src = fetchFromGitHub {
owner = "openai";
repo = "openai-python";
- tag = "v${version}";
- hash = "sha256-jSkBxZY5POlrznhBwFMR2NcL92uGRSYI6BDDC3C7RfU=";
+ tag = "v${finalAttrs.version}";
+ hash = "sha256-XwiSIKjYD07zhx8uIO8wsPWdAASBCJ5KqFUgdk+uaUU=";
};
postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';
@@ -78,21 +84,29 @@ buildPythonPackage rec {
tqdm
typing-extensions
]
- ++ lib.optionals withAiohttp optional-dependencies.aiohttp
- ++ lib.optionals withDatalib optional-dependencies.datalib
- ++ lib.optionals withRealtime optional-dependencies.realtime
- ++ lib.optionals withVoiceHelpers optional-dependencies.voice-helpers;
+ ++ lib.optionals withAiohttp finalAttrs.passthru.optional-dependencies.aiohttp
+ ++ lib.optionals withDatalib finalAttrs.passthru.optional-dependencies.datalib
+ ++ lib.optionals withRealtime finalAttrs.passthru.optional-dependencies.realtime
+ ++ lib.optionals withVoiceHelpers finalAttrs.passthru.optional-dependencies.voice-helpers;
optional-dependencies = {
aiohttp = [
aiohttp
httpx-aiohttp
];
+ bedrock = [
+ botocore
+ ];
datalib = [
numpy
pandas
pandas-stubs
];
+ httpx2 = [
+ anyio
+ httpx
+ httpx2
+ ];
realtime = [
websockets
];
@@ -108,12 +122,14 @@ buildPythonPackage rec {
pytestCheckHook
dirty-equals
inline-snapshot
- nest-asyncio
+ jsonschema
pytest-asyncio
pytest-mock
pytest-xdist
respx
- ];
+ ]
+ # including pandas-stubs would cause infinite recursion
+ ++ lib.concatAttrValues (lib.removeAttrs finalAttrs.passthru.optional-dependencies [ "datalib" ]);
disabledTestPaths = [
# Test makes network requests
@@ -126,8 +142,8 @@ buildPythonPackage rec {
meta = {
description = "Python client library for the OpenAI API";
homepage = "https://github.com/openai/openai-python";
- changelog = "https://github.com/openai/openai-python/blob/${src.tag}/CHANGELOG.md";
+ changelog = "https://github.com/openai/openai-python/blob/${finalAttrs.src.tag}/CHANGELOG.md";
license = lib.licenses.asl20;
maintainers = [ lib.maintainers.malo ];
};
-}
+})
diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix
index d0ea8d49103c..48b2fad0aa8e 100644
--- a/pkgs/development/python-modules/pbr/default.nix
+++ b/pkgs/development/python-modules/pbr/default.nix
@@ -4,7 +4,7 @@
callPackage,
distutils,
fetchPypi,
- setuptools,
+ setuptools_80,
}:
buildPythonPackage rec {
@@ -17,11 +17,11 @@ buildPythonPackage rec {
hash = "sha256-tGAE7DClMkZyaD7ISK7Z6PxQCw0mHUCjIpwtK7/O3Ck=";
};
- build-system = [ setuptools ];
+ build-system = [ setuptools_80 ];
dependencies = [
distutils # for distutils.command in pbr/packaging.py
- setuptools # for pkg_resources
+ setuptools_80 # for pkg_resources
];
# check in passthru.tests.pytest to escape infinite recursion with fixtures
diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix
index f21dac9e39cc..d911cff61143 100644
--- a/pkgs/development/python-modules/pyarrow/default.nix
+++ b/pkgs/development/python-modules/pyarrow/default.nix
@@ -21,6 +21,7 @@
scikit-build-core,
setuptools,
setuptools-scm,
+ tzdata,
}:
let
@@ -121,8 +122,6 @@ buildPythonPackage rec {
"pyarrow/tests/test_csv.py::TestThreadedCSVTableRead::test_cancellation"
# expects arrow-cpp headers to be bundled.
"pyarrow/tests/test_cpp_internals.py::test_pyarrow_include"
- # Searches for TZDATA in /usr.
- "pyarrow/tests/test_orc.py::test_example_using_json"
# AssertionError: assert 'Europe/Monaco' == 'Europe/Paris'
"pyarrow/tests/test_types.py::test_dateutil_tzinfo_to_string"
# These fail with xxx_fixture not found.
@@ -168,6 +167,13 @@ buildPythonPackage rec {
disabledTests = [ "GcsFileSystem" ];
preCheck = ''
+ # Prepare r/w zoneinfo that test_orc can then copy and modify.
+ export TZDIR="$TMPDIR/zoneinfo"
+ cp -R "${tzdata}/${python.sitePackages}/tzdata/zoneinfo" "$TZDIR"
+ chmod -R u+w "$TZDIR"
+ substituteInPlace pyarrow/tests/test_orc.py \
+ --replace-fail "Path('/usr/share/zoneinfo')" "Path('$TZDIR')"
+
export PARQUET_TEST_DATA="${arrow-cpp.env.PARQUET_TEST_DATA}"
shopt -s extglob
rm -r pyarrow/!(conftest.py|tests)
diff --git a/pkgs/development/python-modules/python-jenkins/default.nix b/pkgs/development/python-modules/python-jenkins/default.nix
index 6c0edc0c21d9..98ab8be23a52 100644
--- a/pkgs/development/python-modules/python-jenkins/default.nix
+++ b/pkgs/development/python-modules/python-jenkins/default.nix
@@ -6,7 +6,6 @@
mock,
pbr,
pyyaml,
- setuptools,
six,
multi-key-dict,
testscenarios,
@@ -40,7 +39,6 @@ buildPythonPackage rec {
propagatedBuildInputs = [
pbr
pyyaml
- setuptools
six
multi-key-dict
requests
diff --git a/pkgs/development/python-modules/smmap/default.nix b/pkgs/development/python-modules/smmap/default.nix
index 27ae1788145f..a9d20b2e2bbc 100644
--- a/pkgs/development/python-modules/smmap/default.nix
+++ b/pkgs/development/python-modules/smmap/default.nix
@@ -8,12 +8,12 @@
buildPythonPackage rec {
pname = "smmap";
- version = "6.0.0";
+ version = "5.0.3";
pyproject = true;
src = fetchPypi {
inherit pname version;
- hash = "sha256-jXkCjqbMEx2l6rCZpdlamY1DxneZVv/+O0VQQJEQdto=";
+ hash = "sha256-TZ3ruLmQB65HFlq8CGcL10y3S1In3af2Q+zMTp61ZCw=";
};
build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/testscenarios/default.nix b/pkgs/development/python-modules/testscenarios/default.nix
index 1daf777f6ede..7cc142fd2344 100644
--- a/pkgs/development/python-modules/testscenarios/default.nix
+++ b/pkgs/development/python-modules/testscenarios/default.nix
@@ -5,7 +5,6 @@
# build-system
pbr,
- setuptools,
# dependencies
testtools,
@@ -32,7 +31,6 @@ buildPythonPackage rec {
nativeBuildInputs = [
pbr
- setuptools
];
propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix
index 0ea71bcbe6af..0ceb7f1b7db5 100644
--- a/pkgs/development/python-modules/testtools/default.nix
+++ b/pkgs/development/python-modules/testtools/default.nix
@@ -7,9 +7,6 @@
# build-system
hatchling,
hatch-vcs,
-
- # dependencies
- setuptools,
}:
buildPythonPackage rec {
@@ -29,8 +26,6 @@ buildPythonPackage rec {
pythonRemoveDeps = [ "fixtures" ];
- propagatedBuildInputs = lib.optionals (pythonAtLeast "3.12") [ setuptools ];
-
# testscenarios has a circular dependency on testtools
doCheck = false;
diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix
index 2da9cae3ad60..f763f5f68778 100644
--- a/pkgs/development/python-modules/typing-inspection/default.nix
+++ b/pkgs/development/python-modules/typing-inspection/default.nix
@@ -7,16 +7,16 @@
typing-extensions,
}:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
pname = "typing-inspection";
- version = "0.4.2";
+ version = "0.4.3";
pyproject = true;
src = fetchFromGitHub {
owner = "pydantic";
repo = "typing-inspection";
- tag = "v${version}";
- hash = "sha256-aGScO+FLEJ5IyI6hBqdsiKJRN7vEG36V5131nhVZEbc=";
+ tag = "v${finalAttrs.version}";
+ hash = "sha256-jNAMYV9mpUnClLOahQyLisBkOfELcmjKavKJgyxkQr4=";
};
build-system = [ hatchling ];
@@ -31,17 +31,11 @@ buildPythonPackage rec {
pytestCheckHook
];
- disabledTests = [
- # broken by intentional 3.14.7 behavior change
- # reported upstream: https://github.com/pydantic/typing-inspection/issues/55
- "test_literal_values_unhashable_type"
- ];
-
meta = {
- changelog = "https://github.com/pydantic/typing-inspection/blob/${src.tag}/HISTORY.md";
+ changelog = "https://github.com/pydantic/typing-inspection/blob/${finalAttrs.src.tag}/HISTORY.md";
description = "Runtime typing introspection tools";
homepage = "https://github.com/pydantic/typing-inspection";
license = lib.licenses.mit;
maintainers = with lib.maintainers; [ dotlambda ];
};
-}
+})
diff --git a/pkgs/development/python-modules/unicodedata2/default.nix b/pkgs/development/python-modules/unicodedata2/default.nix
index d4a809922cab..cdff4b2fc877 100644
--- a/pkgs/development/python-modules/unicodedata2/default.nix
+++ b/pkgs/development/python-modules/unicodedata2/default.nix
@@ -3,18 +3,21 @@
buildPythonPackage,
fetchPypi,
pytestCheckHook,
+ setuptools,
}:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
pname = "unicodedata2";
version = "17.0.1";
- format = "setuptools";
+ pyproject = true;
src = fetchPypi {
- inherit version pname;
+ inherit (finalAttrs) version pname;
sha256 = "sha256-15lD0VP19r++P1Wl7GEZhRhL2jf87bPsx1Mi2CrmrTs=";
};
+ build-system = [ setuptools ];
+
nativeCheckInputs = [ pytestCheckHook ];
pythonImportsCheck = [ "unicodedata2" ];
@@ -22,8 +25,8 @@ buildPythonPackage rec {
meta = {
description = "Backport and updates for the unicodedata module";
homepage = "https://github.com/mikekap/unicodedata2";
- changelog = "https://github.com/fonttools/unicodedata2/releases/tag/${version}";
+ changelog = "https://github.com/fonttools/unicodedata2/releases/tag/${finalAttrs.version}";
license = lib.licenses.asl20;
maintainers = with lib.maintainers; [ sternenseemann ];
};
-}
+})
diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix
index 046c885e9955..2c8f7fb75851 100644
--- a/pkgs/development/tools/misc/autoconf/2.69.nix
+++ b/pkgs/development/tools/misc/autoconf/2.69.nix
@@ -6,13 +6,13 @@
perl,
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "autoconf";
version = "2.69";
src = fetchurl {
- url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
- sha256 = "113nlmidxy9kjr45kg9x3ngar4951mvag1js2a3j8nxcz34wxsv4";
+ url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz";
+ hash = "sha256-ZOvOyfisWySHElqGp3YNJZGsnh09vVlIljP53mKldoQ=";
};
nativeBuildInputs = [
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
];
buildInputs = [ m4 ];
+ strictDeps = true;
+
# Work around a known issue in Cygwin. See
# http://thread.gmane.org/gmane.comp.sysutils.autoconf.bugs/6822 for
# details.
@@ -41,6 +43,8 @@ stdenv.mkDerivation rec {
doInstallCheck = false; # fails
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/autoconf/";
description = "Part of the GNU Build System";
@@ -59,4 +63,4 @@ stdenv.mkDerivation rec {
platforms = lib.platforms.all;
};
-}
+})
diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix
index 818117f1bb12..c311d32ac713 100644
--- a/pkgs/development/tools/misc/autoconf/default.nix
+++ b/pkgs/development/tools/misc/autoconf/default.nix
@@ -12,7 +12,7 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "autoconf";
version = "2.73";
outputs = [
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
];
src = fetchurl {
- url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz";
+ url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz";
hash = "sha256-n9ZyschCX6wvpn+gR3uZCYcmi5D/NtXwFtrle+DWtS4=";
};
@@ -57,6 +57,8 @@ stdenv.mkDerivation rec {
export TESTSUITEFLAGS="-j$NIX_BUILD_CORES"
'';
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/autoconf/";
description = "Part of the GNU Build System";
@@ -75,4 +77,4 @@ stdenv.mkDerivation rec {
platforms = lib.platforms.all;
};
-}
+})
diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 8751317729fa..11ca834015a7 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -7,13 +7,13 @@
updateAutotoolsGnuConfigScriptsHook,
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "automake";
version = "1.16.5";
src = fetchurl {
- url = "mirror://gnu/automake/automake-${version}.tar.xz";
- sha256 = "0sdl32qxdy7m06iggmkkvf7j520rmmgbsjzbm7fgnxwxdp6mh7gh";
+ url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz";
+ hash = "sha256-8B1YzW2dd/vcqetLvV6tGYgij9tz1veiAfX41rEYtGk=";
};
strictDeps = true;
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
# "fixed" path in generated files!
dontPatchShebangs = true;
+ __structuredAttrs = true;
+
meta = {
branch = "1.16";
homepage = "https://www.gnu.org/software/automake/";
@@ -48,4 +50,4 @@ stdenv.mkDerivation rec {
'';
platforms = lib.platforms.all;
};
-}
+})
diff --git a/pkgs/development/tools/misc/automake/automake-1.18.x.nix b/pkgs/development/tools/misc/automake/automake-1.18.x.nix
index 7d1a496081db..1149cf78bde1 100644
--- a/pkgs/development/tools/misc/automake/automake-1.18.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.18.x.nix
@@ -7,12 +7,12 @@
updateAutotoolsGnuConfigScriptsHook,
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "automake";
version = "1.18.1";
src = fetchurl {
- url = "mirror://gnu/automake/automake-${version}.tar.xz";
+ url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz";
hash = "sha256-FoqjYyeDUbia9WaERI9SWlvOUHnQtoQr2RD90/FkaIc=";
};
@@ -36,6 +36,8 @@ stdenv.mkDerivation rec {
# "fixed" path in generated files!
dontPatchShebangs = true;
+ __structuredAttrs = true;
+
meta = {
branch = "1.18";
homepage = "https://www.gnu.org/software/automake/";
@@ -48,4 +50,4 @@ stdenv.mkDerivation rec {
'';
platforms = lib.platforms.all;
};
-}
+})
diff --git a/pkgs/development/tools/misc/libtool/default.nix b/pkgs/development/tools/misc/libtool/default.nix
index 2fcc7a03626d..7258279ff072 100644
--- a/pkgs/development/tools/misc/libtool/default.nix
+++ b/pkgs/development/tools/misc/libtool/default.nix
@@ -6,23 +6,27 @@
perl,
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "libtool";
version = "1.5.26";
src = fetchurl {
- url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
+ url = "mirror://gnu/libtool/libtool-${finalAttrs.version}.tar.gz";
sha256 = "029ggq5kri1gjn6nfqmgw4w920gyfzscjjxbsxxidal5zqsawd8w";
};
nativeBuildInputs = [ m4 ];
buildInputs = [ perl ];
+ strictDeps = true;
+
# Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the
# "fixed" path in generated files!
dontPatchShebangs = true;
dontFixLibtool = true;
+ __structuredAttrs = true;
+
meta = {
description = "Generic library support script";
@@ -43,4 +47,4 @@ stdenv.mkDerivation rec {
mainProgram = "libtool";
};
-}
+})
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index 43bc3f4e4852..6f63c5a25249 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -13,12 +13,12 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "libtool";
version = "2.6.2";
src = fetchurl {
- url = "mirror://gnu/libtool/${pname}-${version}.tar.gz";
+ url = "mirror://gnu/libtool/libtool-${finalAttrs.version}.tar.gz";
hash = "sha256-JK2zqprgNccPq6NEr1fXMhXriSgQRa9sfM0wd1H4sL8=";
};
@@ -68,6 +68,8 @@ stdenv.mkDerivation rec {
enableParallelBuilding = true;
+ __structuredAttrs = true;
+
meta = {
description = "GNU Libtool, a generic library support script";
longDescription = ''
@@ -85,4 +87,4 @@ stdenv.mkDerivation rec {
platforms = lib.platforms.unix;
mainProgram = "libtool";
};
-}
+})
diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix
index 086e18e94185..041e18531cb9 100644
--- a/pkgs/development/tools/misc/patchelf/default.nix
+++ b/pkgs/development/tools/misc/patchelf/default.nix
@@ -9,13 +9,13 @@
# cgit) that are needed here should be included directly in Nixpkgs as
# files.
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "patchelf";
version = "0.15.2";
src = fetchurl {
- url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2";
- sha256 = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw=";
+ url = "https://github.com/NixOS/patchelf/releases/download/${finalAttrs.version}/patchelf-${finalAttrs.version}.tar.bz2";
+ hash = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw=";
};
strictDeps = true;
@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
# fails 8 out of 24 tests, problems when loading libc.so.6
doCheck = stdenv.name == "stdenv-linux";
+ __structuredAttrs = true;
+
meta = {
homepage = "https://github.com/NixOS/patchelf";
license = lib.licenses.gpl3Plus;
@@ -35,4 +37,4 @@ stdenv.mkDerivation rec {
maintainers = [ ];
platforms = lib.platforms.all;
};
-}
+})
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 00dd5a5811a5..7b406eb8bf00 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
patches =
patches
++ optional (
- interactive && versionAtLeast version "7.2"
+ interactive && versionAtLeast version "7.2" && versionOlder version "7.3"
) ./fix-test-suite-failures-with-perl-5.42.patch
++ optional crossBuildTools ./cross-tools-flags.patch;
@@ -141,6 +141,8 @@ stdenv.mkDerivation {
done
'';
+ __structuredAttrs = true;
+
meta = meta // {
branch = version;
};
diff --git a/pkgs/development/tools/misc/texinfo/packages.nix b/pkgs/development/tools/misc/texinfo/packages.nix
index c7c49d788643..5208d62ffb71 100644
--- a/pkgs/development/tools/misc/texinfo/packages.nix
+++ b/pkgs/development/tools/misc/texinfo/packages.nix
@@ -66,7 +66,7 @@ let
in
{
texinfo7 = buildTexinfo {
- version = "7.2";
- hash = "sha256-AynXeI++8RP6gsuAiJyhl6NEzg33ZG/gAJdMXXFDY6Y=";
+ version = "7.3";
+ hash = "sha256-UfdOsPUc+phzuFJk391dRuiVfslbiPD7di9j2eFkxy4=";
};
}
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index d80eb73a7e84..0d5558cc85ca 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -57,6 +57,18 @@ buildNodejs {
./use-correct-env-in-tests.patch
./bin-sh-node-run-v22.patch
./use-nix-codesign.patch
+
+ # TODO: remove when support for Ada 4.x has landed upstream
+ (fetchpatch2 {
+ url = "https://github.com/nodejs/node/commit/eb1a49b0aec9e05cbb59f093d38f0a92818b7de1.patch?full_index=1";
+ hash = "sha256-LmLbsRZKkOGXzqDQxNrK/B8TGIrsr4pXIUEv3P6C9Sc=";
+ excludes = [ "deps/*" ];
+ })
+ (fetchpatch2 {
+ url = "https://github.com/nodejs/node/commit/064e2eee1ec7b17c4bc6e36befc2935eee80d0f7.patch?full_index=1";
+ hash = "sha256-RcmWiTpWYwA952nNmhaiq4zw/iuVAXFnuTeuB6ltR1U=";
+ includes = [ "test/fixtures/wpt/url/resources/urltestdata.json" ];
+ })
]
++ lib.optionals (!stdenv.hostPlatform.isStatic) [
# Fix builds with shared llhttp
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 578c94262c53..61e2ce946883 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -53,6 +53,18 @@ buildNodejs {
./use-correct-env-in-tests.patch
./bin-sh-node-run-v22.patch
./use-nix-codesign.patch
+
+ # TODO: remove when support for Ada 4.x has landed upstream
+ (fetchpatch2 {
+ url = "https://github.com/nodejs/node/commit/eb1a49b0aec9e05cbb59f093d38f0a92818b7de1.patch?full_index=1";
+ hash = "sha256-LmLbsRZKkOGXzqDQxNrK/B8TGIrsr4pXIUEv3P6C9Sc=";
+ excludes = [ "deps/*" ];
+ })
+ (fetchpatch2 {
+ url = "https://github.com/nodejs/node/commit/064e2eee1ec7b17c4bc6e36befc2935eee80d0f7.patch?full_index=1";
+ hash = "sha256-RcmWiTpWYwA952nNmhaiq4zw/iuVAXFnuTeuB6ltR1U=";
+ includes = [ "test/fixtures/wpt/url/resources/urltestdata.json" ];
+ })
]
++ gypPatches
++ lib.optionals (!stdenv.buildPlatform.isDarwin) [
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index e5952533eb02..d74c405ca284 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -108,7 +108,7 @@ let
# Skip clean on darwin, case-sensitivity issues.
buildPhase =
lib.optionalString (!stdenvNoCC.buildPlatform.isDarwin) ''
- make mrproper $makeFlags
+ make mrproper "''${makeFlags[@]}"
''
+ (
if stdenvNoCC.hostPlatform.isAndroid then
@@ -118,12 +118,12 @@ let
''
else
''
- make headers $makeFlags
+ make headers "''${makeFlags[@]}"
''
);
checkPhase = ''
- make headers_check $makeFlags
+ make headers_check "''${makeFlags[@]}"
'';
# The following command requires rsync:
@@ -144,6 +144,8 @@ let
inherit passthru;
+ __structuredAttrs = true;
+
meta = {
description = "Header files and scripts for Linux kernel";
license = lib.licenses.gpl2Only;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
index eb34c121e9da..b87911c27e31 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
@@ -20,11 +20,11 @@ let
# Based on https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a1-static-binutils.nix
inherit (import ./common.nix { inherit lib; }) meta;
pname = "binutils";
- version = "2.46.0";
+ version = "2.47";
src = fetchurl {
url = "mirror://gnu/binutils/binutils-${version}.tar.xz";
- hash = "sha256-11qU9Nc+ekCG91E+Z+Q56Pzcu3Jv/mP0ZhdE5iVrLPI=";
+ hash = "sha256-FUqyO2AHDo8nATwil38RKUJdZ9HorNbhMBDmF4EeTP8=";
};
patches = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index 92f8e2dea338..740d286fe7a4 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -20,11 +20,11 @@
let
inherit (import ./common.nix { inherit lib; }) meta;
pname = "binutils-static";
- version = "2.46.0";
+ version = "2.47";
src = fetchurl {
url = "mirror://gnu/binutils/binutils-${version}.tar.xz";
- hash = "sha256-11qU9Nc+ekCG91E+Z+Q56Pzcu3Jv/mP0ZhdE5iVrLPI=";
+ hash = "sha256-FUqyO2AHDo8nATwil38RKUJdZ9HorNbhMBDmF4EeTP8=";
};
patches = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
index 1eb87b40cdae..e0ece9d12347 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
@@ -15,11 +15,11 @@
let
inherit (import ./common.nix { inherit lib; }) meta;
pname = "bootstrap-coreutils-musl";
- version = "9.10";
+ version = "9.11";
src = fetchurl {
url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
- hash = "sha256-4L3h+2hQlEf8cjzyUX6KjH+kZ2mRm7dJDtNQoukjhWI=";
+ hash = "sha256-IDO4owScBr/0mp486nK99Gg7zQy+uXUhHdVtuvi3Nq4=";
};
configureFlags = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
index 6c92f12bf58b..934510e9d8ac 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix
@@ -19,11 +19,11 @@
let
inherit (import ./common.nix { inherit lib; }) meta;
pname = "coreutils-static";
- version = "9.10";
+ version = "9.11";
src = fetchurl {
url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
- hash = "sha256-4L3h+2hQlEf8cjzyUX6KjH+kZ2mRm7dJDtNQoukjhWI=";
+ hash = "sha256-IDO4owScBr/0mp486nK99Gg7zQy+uXUhHdVtuvi3Nq4=";
};
configureFlags = [
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
index 96531fbbe67d..1025f6b246c0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
@@ -14,11 +14,11 @@
}:
let
pname = "findutils";
- version = "4.10.0";
+ version = "4.11.0";
src = fetchurl {
url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
- hash = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+ hash = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0=";
};
in
bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
index b183888ce033..23075374a189 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix
@@ -17,11 +17,11 @@
}:
let
pname = "findutils-static";
- version = "4.10.0";
+ version = "4.11.0";
src = fetchurl {
url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
- hash = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+ hash = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0=";
};
in
bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
index 551c2029bee0..91158c05a727 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
@@ -7,6 +7,7 @@
tinycc,
gnumake,
gnugrep,
+ gnupatch,
gnused,
gnutar,
gzip,
@@ -15,12 +16,16 @@
let
inherit (import ./common.nix { inherit lib; }) meta;
pname = "gawk";
- version = "5.3.2";
+
+ version = "5.4.1";
src = fetchurl {
url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
- hash = "sha256-hjmhqI+0EaG+AmY3OdA+kCptMTtcb+Ak0L/rM0GhmhE=";
+ hash = "sha256-izsOqDkwMRo/MJBdPOiY0yxhA8L+INapC0A0EXGxdN4=";
};
+ patches = [
+ ./node-struct-without-gmp-mpfr.patch
+ ];
in
bash.runCommand "${pname}-${version}"
{
@@ -28,6 +33,7 @@ bash.runCommand "${pname}-${version}"
nativeBuildInputs = [
tinycc.compiler
+ gnupatch
gnumake
gnused
gnugrep
@@ -48,6 +54,9 @@ bash.runCommand "${pname}-${version}"
tar xzf ${src}
cd gawk-${version}
+ # Patch
+ ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
# Configure
export CC="tcc -B ${tinycc.libs}/lib"
export AR="tcc -ar"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch b/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch
new file mode 100644
index 000000000000..01f660c191e8
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch
@@ -0,0 +1,79 @@
+From bf85f8a3175af703597082d4c7e0abc2066a44d3 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins"
+Date: Tue, 14 Jul 2026 10:14:50 +0300
+Subject: [PATCH] Workaround fix for systems without MPFR and GMP.
+
+---
+ ChangeLog | 8 ++++++++
+ awk.h | 23 ++++++++++++++---------
+ 2 files changed, 22 insertions(+), 9 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 6a955eed..42bd2c48 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -3,6 +3,14 @@
+ * builtin.c (do_dump_node): Add the size of each object to
+ the printout.
+
++ Unrelated: Make things works when built on systems without
++ the GMP and MPFR libraries. Thanks to Thomas Trepl
++ and Bruce Dubbs for the reports.
++
++ * awk.h (struct exp_node): Add alignment padding when we don't
++ have MPFR. This is a hack, pending a total refactoring of
++ the NODE structure.
++
+ 2026-07-08 Arnold D. Robbins
+
+ * 5.4.1: Release tar ball made.
+diff --git a/awk.h b/awk.h
+index dbad0d81..f4a84300 100644
+--- a/awk.h
++++ b/awk.h
+@@ -406,17 +406,24 @@ typedef struct exp_node {
+ } nodep;
+
+ struct {
+-#ifdef HAVE_MPFR
+ union {
+ AWKNUM fltnum;
++#ifdef HAVE_MPFR
+ mpfr_t mpnum;
+ mpz_t mpi;
+- } nm;
+- int rndmode;
+ #else
+- AWKNUM fltnum;
+- int for_alignment_only; // especially on 32-bit
+-#endif
++ // 7/2026:
++ // This is a workaround for systems that build
++ // gawk without MPFR and GMP. The NODE struct
++ // desperately needs to be refactored.
++#if SIZEOF_VOID_P == 4
++ char alignment[28];
++#else // SIZEOF_VOID_P != 4
++ char alignment[48];
++#endif // SIZEOF_VOID_P != 4
++#endif // HAVE_MPFR
++ } nm;
++ int rndmode; // only used for MPFR.
+ char *sp;
+ size_t slen;
+ int idx;
+@@ -561,10 +568,8 @@ typedef struct exp_node {
+ #ifdef HAVE_MPFR
+ #define mpg_numbr sub.val.nm.mpnum
+ #define mpg_i sub.val.nm.mpi
+-#define numbr sub.val.nm.fltnum
+-#else
+-#define numbr sub.val.fltnum
+ #endif
++#define numbr sub.val.nm.fltnum
+ #define typed_re sub.val.typre
+
+ /*
+--
+2.54.0
+
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
index d35bb47674d6..861d4a7f36b7 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix
@@ -6,6 +6,7 @@
bash,
gcc,
binutils,
+ gnupatch,
gnumake,
gnused,
gnugrep,
@@ -18,12 +19,15 @@
let
inherit (import ./common.nix { inherit lib; }) meta;
pname = "gawk-static";
- version = "5.3.2";
+ version = "5.4.1";
src = fetchurl {
url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
- hash = "sha256-hjmhqI+0EaG+AmY3OdA+kCptMTtcb+Ak0L/rM0GhmhE=";
+ hash = "sha256-izsOqDkwMRo/MJBdPOiY0yxhA8L+INapC0A0EXGxdN4=";
};
+ patches = [
+ ./node-struct-without-gmp-mpfr.patch
+ ];
in
bash.runCommand "${pname}-${version}"
{
@@ -32,6 +36,7 @@ bash.runCommand "${pname}-${version}"
nativeBuildInputs = [
gcc
binutils
+ gnupatch
gnumake
gnused
gnugrep
@@ -55,6 +60,9 @@ bash.runCommand "${pname}-${version}"
tar xf ${src}
cd gawk-${version}
+ # Patch
+ ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
# Configure
bash ./configure \
--prefix=$out \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
index 90346ee634ba..e8a39c7fbc67 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix
@@ -13,16 +13,17 @@
diffutils,
findutils,
gnutar,
+ linux-headers,
xz,
}:
let
inherit (import ./common.nix { inherit lib; }) meta;
pname = "gnused-static";
- version = "4.9";
+ version = "4.10";
src = fetchurl {
url = "mirror://gnu/sed/sed-${version}.tar.xz";
- hash = "sha256-biJrcy4c1zlGStaGK9Ghq6QteYKSLaelNRljHSSXUYE=";
+ hash = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
};
in
bash.runCommand "${pname}-${version}"
@@ -60,7 +61,8 @@ bash.runCommand "${pname}-${version}"
--build=${buildPlatform.config} \
--host=${hostPlatform.config} \
--disable-dependency-tracking \
- --disable-nls
+ --disable-nls \
+ CFLAGS="-I${linux-headers}/include"
# Build
make -j $NIX_BUILD_CORES
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
index 622dc2846468..b84c0ae20b28 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix
@@ -17,11 +17,11 @@
}:
let
pname = "patchelf-static";
- version = "0.18.0";
+ version = "0.19.1";
src = fetchurl {
url = "https://github.com/NixOS/patchelf/releases/download/${version}/patchelf-${version}.tar.gz";
- sha256 = "sha256-ZN4Q5Ma4uDedt+h/WAMPM26nR8BRXzgRMugQ2/hKhuc=";
+ sha256 = "sha256-SREIco8SDOBbU5k0tBp1AjUDGm34q8a0flev994VCU0=";
};
in
bash.runCommand "${pname}-${version}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
index ff04626a6336..0b870ca6d3d1 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix
@@ -19,11 +19,11 @@
}:
let
pname = "python";
- version = "3.14.4";
+ version = "3.14.6";
src = fetchurl {
url = "https://www.python.org/ftp/python/${version}/Python-${version}.tar.xz";
- hash = "sha256-2SPFEwPjjiSRNvwb3zVo1W7LAyFO/e9IUWF209f6rvg=";
+ hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM=";
};
patches = [
diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index cad8c516b766..719014c1a04c 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -5,13 +5,13 @@
fetchpatch,
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "net-tools";
version = "2.10";
src = fetchurl {
- url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.xz";
- sha256 = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk=";
+ url = "mirror://sourceforge/net-tools/net-tools-${finalAttrs.version}.tar.xz";
+ hash = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk=";
};
patches = [
@@ -44,10 +44,14 @@ stdenv.mkDerivation rec {
"man"
];
+ strictDeps = true;
+
+ __structuredAttrs = true;
+
meta = {
homepage = "http://net-tools.sourceforge.net/";
description = "Set of tools for controlling the network subsystem in Linux";
license = lib.licenses.gpl2Plus;
platforms = lib.platforms.linux;
};
-}
+})
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index ff53296d9aba..78374bdbbfb1 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -23,12 +23,12 @@
stdenv.mkDerivation (finalAttrs: {
pname = "procps";
- version = "4.0.6";
+ version = "4.0.7";
# The project's releases are on SF, but git repo on gitlab.
src = fetchurl {
url = "mirror://sourceforge/procps-ng/procps-ng-${finalAttrs.version}.tar.xz";
- hash = "sha256-Z76m+8OkKlNaAjDJ6JHl3ftNnTlCLUZWWimQ0azhUhY=";
+ hash = "sha256-nSAh9HpFAcZnhiyZQqktGVNpSyHRG80XAug+tZTj1n0=";
};
outputs = [
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index bb4013321646..4aa93a802e7e 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -5,6 +5,7 @@
pkgsCross,
testers,
fetchFromGitHub,
+ fetchpatch,
buildPackages,
makeBinaryWrapper,
ninja,
@@ -203,13 +204,13 @@ let
in
stdenv.mkDerivation (finalAttrs: {
inherit pname;
- version = "261.1";
+ version = "261.2";
src = fetchFromGitHub {
owner = "systemd";
repo = "systemd";
tag = "v${finalAttrs.version}";
- hash = "sha256-4iOitWGdRmGgJjEXGWtq2lEhPtGguma+qrjTShrps2g=";
+ hash = "sha256-w0Fxx+zYBs806whyaKBytGwSgn89ARdukAm6Hp+XlQQ=";
};
# PATCH POLICY
@@ -239,6 +240,13 @@ stdenv.mkDerivation (finalAttrs: {
./0003-add-rootprefix-to-lookup-dir-paths.patch
./0004-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
./0005-core-don-t-taint-on-unmerged-usr.patch
+ # Remove this with v262
+ # Fixes an issue for switch-to-configuration
+ (fetchpatch {
+ name = "postpone-d-bus-queue-dispatch.patch";
+ url = "https://github.com/systemd/systemd/commit/266b3e50218e2b27cd67d2371c165bf53ad3bf00.patch";
+ hash = "sha256-dEEzZUqicnmgDuXVBV1y0BxzgKbb6Q47Dmxj+O71bFE=";
+ })
]
++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [
./0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch
diff --git a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
index 02e24a2dae9d..8467c16d66e9 100644
--- a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
+++ b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
@@ -19,8 +19,6 @@ mkNginxPlugin (finalAttrs: {
buildInputs = [ luajit_openresty ];
- allowMemoryWriteExecute = true;
-
meta = {
description = "Expose Lua API to ngx_lua for Nginx upstreams";
homepage = "https://github.com/openresty/lua-upstream-nginx-module";
diff --git a/pkgs/servers/http/nginx/modules/lua/package.nix b/pkgs/servers/http/nginx/modules/lua/package.nix
index f8f45586e4ab..fff949d6a66c 100644
--- a/pkgs/servers/http/nginx/modules/lua/package.nix
+++ b/pkgs/servers/http/nginx/modules/lua/package.nix
@@ -23,8 +23,6 @@ mkNginxPlugin (finalAttrs: {
export LUAJIT_INC="$(realpath ${luajit_openresty}/include/luajit-*)"
'';
- allowMemoryWriteExecute = true;
-
meta = {
description = "Embed the Power of Lua";
homepage = "https://github.com/openresty/lua-nginx-module";
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 0501e150e708..7e3454207f77 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -21,7 +21,7 @@
zlib,
liburing,
gnutls,
- systemd,
+ systemdLibs,
samba,
talloc,
jansson,
@@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
]
++ optionals stdenv.hostPlatform.isLinux [
liburing
- systemd
+ systemdLibs
]
++ optionals stdenv.hostPlatform.isDarwin [ libiconv ]
++ optionals enableLDAP [
diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index 5ea0c5113225..96c05fdf54c6 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -40,14 +40,14 @@
stdenv.mkDerivation (finalAttrs: {
pname = "libpq";
- version = "18.4";
+ version = "18.6";
src = fetchFromGitHub {
owner = "postgres";
repo = "postgres";
# rev, not tag, on purpose: see generic.nix.
- rev = "refs/tags/REL_18_4";
- hash = "sha256-Ac/Dqcj8vjcW3my5vsnKaMiQqTq/HPtUzckJ3SMyrfA=";
+ rev = "refs/tags/REL_18_6";
+ hash = "sha256-ySffxlG7jlNyzx++BmIN+WuaQ9TMAJt/qER9wIjd6B8=";
};
__structuredAttrs = true;
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 5e89c04d4934..07726320556e 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -261,6 +261,8 @@ lib.warnIf (withDocs != null)
});
};
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/bash/";
description =
diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix
index 3948fc5f71ca..c0f33a9efde7 100644
--- a/pkgs/stdenv/linux/default.nix
+++ b/pkgs/stdenv/linux/default.nix
@@ -502,6 +502,7 @@ in
dontUnpack = true;
dontBuild = true;
strictDeps = true;
+ __structuredAttrs = true;
# We wouldn't need to *copy* all, but it's easier and the result is temporary anyway.
installPhase = ''
mkdir -p "$out"/bin
@@ -516,12 +517,13 @@ in
# TODO(amjoseph): It is not yet entirely clear why this is necessary.
# Something strange is going on with xgcc and libstdc++ on pkgsMusl.
- patchelf = super.patchelf.overrideAttrs (
- previousAttrs:
- lib.optionalAttrs super.stdenv.hostPlatform.isMusl {
- NIX_CFLAGS_COMPILE = (previousAttrs.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++";
- }
- );
+ patchelf = super.patchelf.overrideAttrs (previousAttrs: {
+ env =
+ previousAttrs.env or { }
+ // lib.optionalAttrs super.stdenv.hostPlatform.isMusl {
+ NIX_CFLAGS_COMPILE = (previousAttrs.env.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++";
+ };
+ });
};
}
@@ -850,7 +852,6 @@ in
inherit (self)
stdenv
runCommandLocal
- patchelf
libunistring
;
};
diff --git a/pkgs/stdenv/linux/stage0.nix b/pkgs/stdenv/linux/stage0.nix
index 9fa4bb162efd..e423f7208f05 100644
--- a/pkgs/stdenv/linux/stage0.nix
+++ b/pkgs/stdenv/linux/stage0.nix
@@ -70,6 +70,7 @@ if minbootSupported then
ln -s ${libcPackage}/lib $out/lib
ln -s ${libcPackage}/include $out/include
'';
+ __structuredAttrs = true;
passthru.isFromBootstrapFiles = true;
};
gcc-unwrapped = compilerPackage;
@@ -157,6 +158,7 @@ else
+ lib.optionalString (localSystem.libc == "musl") ''
ln -s ${bootstrapTools}/include-libc $out/include
'';
+ __structuredAttrs = true;
passthru.isFromBootstrapFiles = true;
};
gcc-unwrapped = bootstrapTools;
diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix b/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix
new file mode 100644
index 000000000000..1d1d93025ba9
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix
@@ -0,0 +1,88 @@
+{
+ lib,
+ stdenv,
+ tests,
+ autoPatchelfHook,
+ patchelf,
+ python3,
+}:
+
+let
+ foo = tests.stdenv-inputs.foo;
+
+ # Produce a tree containing lib/{baz.so,libs/foo.so},
+ # with src/lib/libbaz.so calling code from src/lib/libs/libfoo.so.
+ # These have absolute paths.
+ baz-bundle = stdenv.mkDerivation {
+ name = "baz-bundle";
+
+ buildCommand = ''
+ mkdir -p $out/lib/libs
+ cp ${(lib.getDev foo)}/lib/libfoo.so $out/lib/libs/
+
+ mkdir -p $out/lib/
+ $CC -shared -lfoo -L$out/lib/libs -o $out/lib/libbaz.so ${./lib-baz.c}
+ '';
+
+ # No references to the foo store path.
+ disallowedReferences = [
+ (lib.getDev foo)
+ ];
+ };
+
+ # Make baz-bundle relocatable, by running autopatchelf with the `--relativize-rpath` flag.
+ # This will replace the `RPATH` of `$out/lib/libbaz.so` from `$out/lib/libs` to `$ORIGIN/libs`.
+ baz-bundle-relocatable = stdenv.mkDerivation {
+ name = "baz-bundle-relocatable";
+
+ nativeBuildInputs = [
+ autoPatchelfHook
+ ];
+
+ autoPatchelfFlags = [ "--relativize-rpath" ];
+
+ dontUnpack = true;
+
+ # we don't set buildCommand because we want to ensure fixupPhase
+ # (containing autoPatchelfHook) is run.
+ installPhase = ''
+ mkdir -p $out
+ cp -R ${baz-bundle}/lib $out/lib
+ '';
+
+ # Now these two .so files refer neither to `baz-bundle`, nor contain self-references.
+ disallowedReferences = [
+ baz-bundle
+ "out"
+ ];
+ };
+
+in
+# Pretend a user consumed `baz-bundle-relocatable` as an artifact,
+# copied to ./libs/baz-bundle, and calls `baz` from `libbaz.so` from their code.
+# Ensure this works, which requires `baz()` to still be able to find `foo()`.
+stdenv.mkDerivation {
+ name = "auto-patchelf-hook-relativize-rpath";
+ nativeBuildInputs = [
+ patchelf
+ python3
+ ];
+
+ buildCommand = ''
+ mkdir -p libs/baz-bundle
+ cp -R ${baz-bundle-relocatable}/lib/* libs/baz-bundle/
+
+ echo "RPATHs:"
+ echo -n "libs/baz-bundle/libbaz.so: "
+ patchelf --print-rpath libs/baz-bundle/libbaz.so
+ echo -n "libs/baz-bundle/lib/libfoo.so: "
+ patchelf --print-rpath libs/baz-bundle/libs/libfoo.so
+
+ cp ${./main.py} main.py
+ python main.py |& tee /dev/stderr | grep -q "foo returned 42"
+
+ touch $out
+ '';
+
+ meta.platforms = lib.platforms.linux;
+}
diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c b/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c
new file mode 100644
index 000000000000..e1f62fc5979c
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c
@@ -0,0 +1,10 @@
+#include
+
+extern unsigned int foo(void);
+
+extern unsigned int baz(void)
+{
+ fprintf(stderr, "about to call foo()\n");
+ fprintf(stderr, "foo returned %d\n", foo());
+ return 0;
+}
diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py b/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py
new file mode 100644
index 000000000000..cae15e3da5f0
--- /dev/null
+++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py
@@ -0,0 +1,10 @@
+from pathlib import Path
+import ctypes
+
+lib_path = Path(__file__).parent / "libs/baz-bundle/libbaz.so"
+lib = ctypes.CDLL(str(lib_path))
+
+lib.baz.restype = ctypes.c_uint
+lib.baz.argtypes = []
+
+lib.baz()
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index a44e8de628c9..d872ec067a7c 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -247,6 +247,8 @@ in
auto-patchelf-hook-preserve-origin = callPackage ./auto-patchelf-hook-preserve-origin { };
+ auto-patchelf-hook-relativize-rpath = callPackage ./auto-patchelf-hook-relativize-rpath { };
+
# Accumulate all passthru.tests from arrayUtilities into a single attribute set.
arrayUtilities = recurseIntoAttrs (
concatMapAttrs (
diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix
index 6aafcf6481df..707a46ad6efe 100644
--- a/pkgs/tools/compression/gzip/default.nix
+++ b/pkgs/tools/compression/gzip/default.nix
@@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
];
buildInputs = [ runtimeShellPackage ];
+ strictDeps = true;
+
makeFlags = [
"SHELL=/bin/sh"
"GREP=grep"
@@ -87,6 +89,8 @@ stdenv.mkDerivation (finalAttrs: {
passthru.tests.makecheck = gzip.overrideAttrs { doCheck = true; };
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/gzip/";
description = "GNU zip compression program";
diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix
index 03d06ce67bcf..4000a273168d 100644
--- a/pkgs/tools/compression/zstd/default.nix
+++ b/pkgs/tools/compression/zstd/default.nix
@@ -38,13 +38,15 @@ stdenv.mkDerivation (finalAttrs: {
src = fetchFromGitHub {
owner = "facebook";
repo = "zstd";
- rev = "v${finalAttrs.version}";
+ tag = "v${finalAttrs.version}";
hash = "sha256-tNFWIT9ydfozB8dWcmTMuZLCQmQudTFJIkSr0aG7S44=";
};
nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
buildInputs = lib.optional stdenv.hostPlatform.isUnix bashNonInteractive;
+ strictDeps = true;
+
patches = [
# This patches makes sure we do not attempt to use the MD5 implementation
# of the host platform when running the tests
@@ -144,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: {
};
};
+ __structuredAttrs = true;
+
meta = {
description = "Zstandard real-time compression algorithm";
longDescription = ''
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 5e2d0fbe6f3c..7540239528f0 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
};
postPatch = ''
- substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";'
+ substituteInPlace xargs/xargs.c --replace-fail 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";'
'';
patches = [
@@ -31,6 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
buildInputs = [ coreutils ]; # bin/updatedb script needs to call sort
+ strictDeps = true;
+
# Since glibc-2.25 the i686 tests hang reliably right after test-sleep.
doCheck =
!stdenv.hostPlatform.isDarwin
@@ -79,6 +81,8 @@ stdenv.mkDerivation (finalAttrs: {
# or you can check libc/include/sys/cdefs.h in bionic source code
hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
+ __structuredAttrs = true;
+
meta = {
homepage = "https://www.gnu.org/software/findutils/";
changelog = "https://cgit.git.savannah.gnu.org/cgit/findutils.git/tree/NEWS?h=v${finalAttrs.version}";
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index 42c3bc93e405..b783fe1671d5 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -312,6 +312,7 @@ stdenv.mkDerivation (finalAttrs: {
propagatedBuildInputs = [
boehmgc
+ boost
nlohmann_json
];
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 1aadb3212d92..83280a2a6a4a 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -208,12 +208,12 @@ lib.makeExtensible (
src = fetchFromGitHub {
owner = "NixOS";
repo = "nix";
- rev = "f8bb823a23bf6d62f4c8feb792a77702d7a49fe1";
- hash = "sha256-eWBQ01zjUjTF6VyWzmt6fN6jI+vlCDtqYaJG1McIKpc=";
+ rev = "d8c24e6118d6fb323d4fcd2f311cda9c748452fa";
+ hash = "sha256-SbXYrP5NKa1ySGHvPWE0e39PMOczcyeiXTaxMFsv1vs=";
};
in
(nixDependencies.callPackage ./modular/packages.nix {
- version = "2.35pre20260619_${lib.substring 0 8 src.rev}";
+ version = "2.36pre20260804_${lib.substring 0 8 src.rev}";
inherit teams;
otherSplices = generateSplicesForNixComponents "nixComponents_git";
src = removeFunctionalTests commonDisabledTests src;
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 87d2946e6160..955c6b8d892f 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -2,7 +2,6 @@
lib,
stdenv,
fetchurl,
- fetchpatch,
removeReferencesTo,
runtimeShellPackage,
texinfo,
@@ -24,12 +23,12 @@
assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null;
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "gawk" + lib.optionalString interactive "-interactive";
version = "5.4.1";
src = fetchurl {
- url = "mirror://gnu/gawk/gawk-${version}.tar.xz";
+ url = "mirror://gnu/gawk/gawk-${finalAttrs.version}.tar.xz";
hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc=";
};
@@ -50,7 +49,9 @@ stdenv.mkDerivation rec {
]
++ lib.optional (!interactive) "man";
+ __structuredAttrs = true;
strictDeps = true;
+ enableParallelBuilding = true;
# no-pma fix
nativeBuildInputs = [
@@ -129,4 +130,4 @@ stdenv.mkDerivation rec {
];
mainProgram = "gawk";
};
-}
+})
diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 7f1cfe514425..ba45205c1359 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -6,13 +6,13 @@
perl,
}:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
pname = "gnused";
version = "4.10";
src = fetchurl {
- url = "mirror://gnu/sed/sed-${version}.tar.xz";
- sha256 = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
+ url = "mirror://gnu/sed/sed-${finalAttrs.version}.tar.xz";
+ hash = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc=";
};
outputs = [
@@ -24,6 +24,10 @@ stdenv.mkDerivation rec {
updateAutotoolsGnuConfigScriptsHook
perl
];
+
+ strictDeps = true;
+ __structuredAttrs = true;
+
preConfigure = "patchShebangs ./build-aux/help2man";
# Prevents attempts of running 'help2man' on cross-built binaries.
@@ -50,4 +54,4 @@ stdenv.mkDerivation rec {
maintainers = with lib.maintainers; [ mic92 ];
mainProgram = "sed";
};
-}
+})
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 02e6dde7a886..e5cb8fbb0737 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -116,11 +116,11 @@ with self;
ack = buildPerlPackage rec {
pname = "ack";
- version = "3.9.0";
+ version = "3.10.0";
src = fetchurl {
url = "mirror://cpan/authors/id/P/PE/PETDANCE/ack-v${version}.tar.gz";
- hash = "sha256-lO1Hfjs/lNEmzscynw6DmfHQzoLHxNiCqUrbFQ5//JA=";
+ hash = "sha256-Zeg8+zinH8pyXpoUqCAe6HHmKfxrECMeEwPdNQG6Vjo=";
};
outputs = [
@@ -3352,18 +3352,11 @@ with self;
CatalystAuthenticationCredentialHTTP = buildPerlModule {
pname = "Catalyst-Authentication-Credential-HTTP";
- version = "1.018";
+ version = "1.019";
src = fetchurl {
- url = "mirror://cpan/authors/id/E/ET/ETHER/Catalyst-Authentication-Credential-HTTP-1.018.tar.gz";
- hash = "sha256-b6GBbe5kSw216gzBXF5xHcLO0gg2JavOcJZSHx1lpSk=";
+ url = "mirror://cpan/authors/id/A/AB/ABRAXXA/Catalyst-Authentication-Credential-HTTP-1.019.tar.gz";
+ hash = "sha256-7IHpbCo/ZYbqQdCI6o6AGx80ABqxnMmmXe+KOMOaW9o=";
};
- patches = [
- (fetchpatch {
- name = "CVE-2025-40920.patch";
- url = "https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch";
- hash = "sha256-WI6JwvY6i3KkQO9HbbSvHPX8mgM8I2cF0UTjF1D14T4=";
- })
- ];
buildInputs = [
ModuleBuildTiny
TestException
@@ -3374,7 +3367,6 @@ with self;
CatalystPluginAuthentication
ClassAccessor
CryptSysRandom
- DataUUID
StringEscape
];
meta = {
@@ -4627,12 +4619,15 @@ with self;
CGISession = buildPerlModule {
pname = "CGI-Session";
- version = "4.48";
+ version = "4.49";
src = fetchurl {
- url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.48.tar.gz";
- hash = "sha256-RnVkYcJM52ZrgQjduW26thJpnfMBLIDvEQFmGf4VVPc=";
+ url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.49.tar.gz";
+ hash = "sha256-X9iKgwo19UUmeH8DauXkp9FLYcQUzSmthjG/RuaXEgc=";
};
- propagatedBuildInputs = [ CGI ];
+ propagatedBuildInputs = [
+ CGI
+ CryptSysRandom
+ ];
meta = {
description = "Persistent session data in CGI applications";
license = lib.licenses.artistic1;
@@ -7121,16 +7116,15 @@ with self;
CryptDSA = buildPerlPackage {
pname = "Crypt-DSA";
- version = "1.21";
+ version = "1.24";
src = fetchurl {
- url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.21.tar.gz";
- hash = "sha256-pGIB6DkOi6O75RER12SJ8x2v2g9qYLCrkxndUr0rMrA=";
+ url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.24.tar.gz";
+ hash = "sha256-ChY4tvK07+ktbuL0kBzKAtenBWf2uw9Iapu19pvnZ2Y=";
};
propagatedBuildInputs = [
ConvertASN1
ConvertPEM
CryptSysRandom
- CryptURandom
DataBuffer
FileWhich
];
@@ -7965,10 +7959,10 @@ with self;
CSSMinifierXS = buildPerlPackage {
pname = "CSS-Minifier-XS";
- version = "0.13";
+ version = "0.15";
src = fetchurl {
- url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.13.tar.gz";
- hash = "sha256-xBnjCM3IKvHCXWuNB7L/JjR6Yit6Y+wghWq+jbQFH4I=";
+ url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.15.tar.gz";
+ hash = "sha256-iprSIxYtpGceP4EsSlXyl3OUg70xar2kH0wn6K3XhVM=";
};
buildInputs = [ TestDiagINC ];
meta = {
@@ -8226,16 +8220,16 @@ with self;
DataEntropy = buildPerlPackage {
pname = "Data-Entropy";
- version = "0.008";
+ version = "0.010";
src = fetchurl {
- url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.008.tar.gz";
- hash = "sha256-GKUrE4boLGuM2zhKOYYdYCIKRCp5DgdwEL5y3YU7Z7M=";
+ url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.010.tar.gz";
+ hash = "sha256-0M8s2wKCAuidw2K42Qtw00WFApOwGQDZoYgqDG8g+Dc=";
};
propagatedBuildInputs = [
CryptRijndael
CryptURandom
DataFloat
- HTTPLite
+ DevelDeprecate
ParamsClassify
];
meta = {
@@ -9673,6 +9667,24 @@ with self;
};
};
+ DevelDeprecate = buildPerlPackage {
+ pname = "Devel-Deprecate";
+ version = "0.01";
+ src = fetchurl {
+ url = "mirror://cpan/authors/id/O/OV/OVID/Devel-Deprecate-0.01.tar.gz";
+ hash = "sha256-xQLEGoL+JU6XFRJ3ytOk8KQHrTydP2I9J3sDA6PhoS8=";
+ };
+ buildInputs = [ SubOverride ];
+ propagatedBuildInputs = [ DateTime ];
+ meta = {
+ description = "Create deprecation schedules in your code";
+ license = with lib.licenses; [
+ artistic1
+ gpl1Plus
+ ];
+ };
+ };
+
DevelDeprecationsEnvironmental = buildPerlPackage {
pname = "Devel-Deprecations-Environmental";
version = "1.101";
@@ -10113,11 +10125,11 @@ with self;
DBI = buildPerlPackage {
pname = "DBI";
- version = "1.648";
+ version = "1.651";
src = fetchurl {
- url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.648.tgz";
- hash = "sha256-7yZqrWAQzi6rt+Rl69c8owILxYFQ9pib2Jwrj5usaoY=";
+ url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.651.tgz";
+ hash = "sha256-2mIaI/po4eBPrIJM/T1B6P+6sqs+umQqEkmSQui+UlM=";
};
env = lib.optionalAttrs stdenv.cc.isGNU {
@@ -13614,14 +13626,11 @@ with self;
FileFindRule = buildPerlPackage {
pname = "File-Find-Rule";
- version = "0.34";
+ version = "0.35";
src = fetchurl {
- url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.34.tar.gz";
- hash = "sha256-fm8WzDPrHyn/Jb7lHVE/S4qElHu/oY7bLTzECi1kyv4=";
+ url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.35.tar.gz";
+ hash = "sha256-K9VWKJptRK0u50gDJYuwsAUNJG8egcqrCyY8MDrPDII=";
};
- patches = [
- ../development/perl-modules/FileFindRule-CVE-2011-10007.patch
- ];
propagatedBuildInputs = [
NumberCompare
TextGlob
@@ -16238,10 +16247,10 @@ with self;
HTMLGumbo = buildPerlModule {
pname = "HTML-Gumbo";
- version = "0.18";
+ version = "0.20";
src = fetchurl {
- url = "mirror://cpan/authors/id/R/RU/RUZ/HTML-Gumbo-0.18.tar.gz";
- hash = "sha256-v1C2HCRlbMP8lYYC2AqcfQFyR6842Nv6Dp3sW3VCXV8=";
+ url = "mirror://cpan/authors/id/B/BP/BPS/HTML-Gumbo-0.20.tar.gz";
+ hash = "sha256-ImEK+8bIfgZ92E9/EZo9J4Ie1kEwNFU8Ga694iEdiDU=";
};
propagatedBuildInputs = [ AlienLibGumbo ];
meta = {
@@ -16770,10 +16779,10 @@ with self;
HTTPDate = buildPerlPackage {
pname = "HTTP-Date";
- version = "6.06";
+ version = "6.08";
src = fetchurl {
- url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.06.tar.gz";
- hash = "sha256-e2hRkcasw+dz0fwCyV7h+frpT3d4MXX154wYHMktK1I=";
+ url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.08.tar.gz";
+ hash = "sha256-tX2Aym2CHGlJykiydGfUWrp6nHc0ZWIwb6zKeBoAPkQ=";
};
propagatedBuildInputs = [ TimeDate ];
meta = {
@@ -17200,10 +17209,10 @@ with self;
Imager = buildPerlPackage rec {
pname = "Imager";
- version = "1.031";
+ version = "1.034";
src = fetchurl {
url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz";
- hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE=";
+ hash = "sha256-hrWizXGna4QJJJFSGl1WI4Qo8sN1AYMsmVxaMxJg+AM=";
};
buildInputs = [
pkgs.freetype
@@ -18491,12 +18500,11 @@ with self;
JSONXS = buildPerlPackage {
pname = "JSON-XS";
- version = "4.03";
+ version = "4.04";
src = fetchurl {
- url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.03.tar.gz";
- hash = "sha256-UVU29F8voafojIgkUzdY0BIdJnq5y0U6G1iHyKVrkGg=";
+ url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.04.tar.gz";
+ hash = "sha256-jv8enzBMViW1mre0IlhBX20+NoHB3atrclUYoBin9eA=";
};
- patches = [ ../development/perl-modules/JSON-XS-CVE-2025-40928.patch ];
propagatedBuildInputs = [ TypesSerialiser ];
buildInputs = [ CanaryStability ];
meta = {
@@ -22710,10 +22718,10 @@ with self;
Mojolicious = buildPerlPackage {
pname = "Mojolicious";
- version = "9.46";
+ version = "9.48";
src = fetchurl {
- url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.46.tar.gz";
- hash = "sha256-/kc9LK5tLe/pUBgCggc2VoJa0F20TwvIxIQhXi1xaqw=";
+ url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.48.tar.gz";
+ hash = "sha256-Jv8EFSgR/VsaNrR9mewhnFiZW6jnsVugKzPQdwpe7pg=";
};
meta = {
description = "Real-time web framework";
@@ -23072,13 +23080,16 @@ with self;
MojoJWT = buildPerlModule {
pname = "Mojo-JWT";
- version = "0.09";
+ version = "1.02";
src = fetchurl {
- url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-0.09.tar.gz";
- hash = "sha256-wE4DmD4MbyvORdCOoucph5yWee+mNLDmjLa4t7SoWIY=";
+ url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-1.02.tar.gz";
+ hash = "sha256-yBHXkoWMJBFQNyDxJDbjNDZ0k2dUO/vCqV1PgDzmCHQ=";
};
buildInputs = [ ModuleBuildTiny ];
- propagatedBuildInputs = [ Mojolicious ];
+ propagatedBuildInputs = [
+ CryptX
+ Mojolicious
+ ];
meta = {
description = "JSON Web Token the Mojo way";
homepage = "https://github.com/jberger/Mojo-JWT";
@@ -32036,14 +32047,13 @@ with self;
};
};
- StringUtil = buildPerlModule {
+ StringUtil = buildPerlPackage {
pname = "String-Util";
- version = "1.34";
+ version = "1.36";
src = fetchurl {
- url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.34.tar.gz";
- hash = "sha256-MZzozWZTQeVlIfoVXZYqGTKOkNn3A2dlklzN4mclxGk=";
+ url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.36.tar.gz";
+ hash = "sha256-UXsasyVm/U1ei+I9mTOc47/+4pEsX/KfXclYcP9Pyw4=";
};
- buildInputs = [ ModuleBuildTiny ];
meta = {
description = "String processing utility functions";
homepage = "https://github.com/scottchiefbaker/String-Util";
@@ -39459,6 +39469,11 @@ with self;
MojoliciousPluginOpenAPI
RoleTiny
];
+ # Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these
+ # tests drive forms without a token and fail with 400 "CSRF token failure".
+ preCheck = ''
+ rm t/plugin/auth/github.t t/plugin/form/bootstrap4.t
+ '';
meta = {
homepage = "http://preaction.me/yancy/";
description = "Best Web Framework Deserves the Best CMS";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0492a6bbc13a..162ef02061f2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -20721,8 +20721,8 @@ self: super: with self; {
# Tcl/Tk 9.0 support in Tkinter is not quite ready yet:
# - https://github.com/python/cpython/issues/124111
# - https://github.com/python/cpython/issues/104568
- tcl = pkgs.tcl-8_6;
- tk = pkgs.tk-8_6;
+ tcl = if pythonAtLeast "3.14" then pkgs.tcl-9_0 else pkgs.tcl-8_6;
+ tk = if pythonAtLeast "3.14" then pkgs.tk-9_0 else pkgs.tk-8_6;
};
tkinter-gl = callPackage ../development/python-modules/tkinter-gl { };