From c6567abbf1cbb10c28c86e6c4d41ace920c58c68 Mon Sep 17 00:00:00 2001 From: Yiyu Zhou Date: Sun, 9 Nov 2025 20:05:06 -0800 Subject: [PATCH 001/318] aroccPackages.latest-unwrapped: 0-unstable-2025-03-05 -> 0-unstable-2025-11-09 --- pkgs/development/compilers/arocc/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/development/compilers/arocc/default.nix b/pkgs/development/compilers/arocc/default.nix index 2372e60c421d..47bb659cbde6 100644 --- a/pkgs/development/compilers/arocc/default.nix +++ b/pkgs/development/compilers/arocc/default.nix @@ -2,18 +2,18 @@ lib, fetchFromGitHub, callPackage, - zig_0_14, + zig, }: let versions = [ { - zig = zig_0_14; - version = "0-unstable-2025-03-05"; + inherit zig; + version = "0-unstable-2025-11-09"; src = fetchFromGitHub { owner = "Vexu"; repo = "arocc"; - rev = "8c6bab43ba351fc045a1d262d8a8da4a11215e37"; - hash = "sha256-J5Cj9UMwAMwH2JGby13FIKl5Qbj4N4XpSSY7zL21aoY="; + rev = "3fb778c201718bd82bf1f08cd46ea133c4697b76"; + hash = "sha256-Hac+rhf7wB3KTs2OIfdcGVq2+H/81yXMl3cq//LUeRk="; }; } ]; From 57410aee82a312b091f6c41c5044b13bd1baea65 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 23 Feb 2026 00:38:15 +0000 Subject: [PATCH 002/318] rdfind: 1.7.0 -> 1.8.0 --- pkgs/by-name/rd/rdfind/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/rd/rdfind/package.nix b/pkgs/by-name/rd/rdfind/package.nix index 107fc932af99..12c771fef7aa 100644 --- a/pkgs/by-name/rd/rdfind/package.nix +++ b/pkgs/by-name/rd/rdfind/package.nix @@ -7,11 +7,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "rdfind"; - version = "1.7.0"; + version = "1.8.0"; src = fetchurl { url = "https://rdfind.pauldreik.se/rdfind-${finalAttrs.version}.tar.gz"; - sha256 = "sha256-eMRjFS4dnk/Rv+uDuckt9ef8TF+Tx9Qm+x9++ivk3yk="; + sha256 = "sha256-Ci0NMgAswtwBNO57ZJvMgR7PsvjZ9nKqR2qFEVLnrzU="; }; buildInputs = [ nettle ]; From 7ddead5bd25692179e80f558a8d4cf6dd01ea063 Mon Sep 17 00:00:00 2001 From: Teddy Ni <3806110+tjni@users.noreply.github.com> Date: Mon, 18 May 2026 21:40:08 -0700 Subject: [PATCH 003/318] python3Packages.geoip2: allow local networking on Darwin Assisted-by: Codex (GPT-5.5) --- pkgs/development/python-modules/geoip2/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/python-modules/geoip2/default.nix b/pkgs/development/python-modules/geoip2/default.nix index b90d1c34edb5..d6dd6a5e6f2a 100644 --- a/pkgs/development/python-modules/geoip2/default.nix +++ b/pkgs/development/python-modules/geoip2/default.nix @@ -50,6 +50,8 @@ buildPythonPackage rec { pythonImportsCheck = [ "geoip2" ]; + __darwinAllowLocalNetworking = true; + meta = { description = "GeoIP2 webservice client and database reader"; homepage = "https://github.com/maxmind/GeoIP2-python"; From ddc2a75716e6d70da10aca91771f2dd66057cf5c Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Fri, 22 May 2026 02:27:36 +0300 Subject: [PATCH 004/318] python3Packages.unicodedata2: modernize and migrate to pyproject --- .../python-modules/unicodedata2/default.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/pkgs/development/python-modules/unicodedata2/default.nix b/pkgs/development/python-modules/unicodedata2/default.nix index d4a809922cab..cdff4b2fc877 100644 --- a/pkgs/development/python-modules/unicodedata2/default.nix +++ b/pkgs/development/python-modules/unicodedata2/default.nix @@ -3,18 +3,21 @@ buildPythonPackage, fetchPypi, pytestCheckHook, + setuptools, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "unicodedata2"; version = "17.0.1"; - format = "setuptools"; + pyproject = true; src = fetchPypi { - inherit version pname; + inherit (finalAttrs) version pname; sha256 = "sha256-15lD0VP19r++P1Wl7GEZhRhL2jf87bPsx1Mi2CrmrTs="; }; + build-system = [ setuptools ]; + nativeCheckInputs = [ pytestCheckHook ]; pythonImportsCheck = [ "unicodedata2" ]; @@ -22,8 +25,8 @@ buildPythonPackage rec { meta = { description = "Backport and updates for the unicodedata module"; homepage = "https://github.com/mikekap/unicodedata2"; - changelog = "https://github.com/fonttools/unicodedata2/releases/tag/${version}"; + changelog = "https://github.com/fonttools/unicodedata2/releases/tag/${finalAttrs.version}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ sternenseemann ]; }; -} +}) From 57a48d81f4739e7545cc0994af6a704fb4bc5ec6 Mon Sep 17 00:00:00 2001 From: Colin Date: Tue, 26 May 2026 22:33:14 +0000 Subject: [PATCH 005/318] libpcap: enable RDMA for all supported platforms --- pkgs/by-name/li/libpcap/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/li/libpcap/package.nix b/pkgs/by-name/li/libpcap/package.nix index fefde4c82aa9..5abab91f1a89 100644 --- a/pkgs/by-name/li/libpcap/package.nix +++ b/pkgs/by-name/li/libpcap/package.nix @@ -12,7 +12,7 @@ pkg-config, rdma-core, withBluez ? false, - withRdma ? false, + withRdma ? lib.meta.availableOn stdenv.hostPlatform rdma-core, withRemote ? false, # for passthru.tests From c346537ee0f56c1156b74eca98e86cafd91b5b2d Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Fri, 5 Jun 2026 06:19:12 +0300 Subject: [PATCH 006/318] cups: add `doc` output out: 10920K -> 9224K doc: 0K -> 1700K --- pkgs/by-name/cu/cups/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix index dd12a5dcef57..10abd55a5977 100644 --- a/pkgs/by-name/cu/cups/package.nix +++ b/pkgs/by-name/cu/cups/package.nix @@ -14,7 +14,6 @@ systemdLibs, acl, gmp, - darwin, libusb1 ? null, gnutls ? null, avahi ? null, @@ -40,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: { "lib" "dev" "man" + "doc" ]; postPatch = '' From 6c665fe667f08361bca4eb88450ca080809f6202 Mon Sep 17 00:00:00 2001 From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com> Date: Fri, 3 Jul 2026 16:47:18 +0000 Subject: [PATCH 007/318] python3Packages.absl-py: modernize --- pkgs/development/python-modules/absl-py/default.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix index 21552b076199..c5c8f206ac2d 100644 --- a/pkgs/development/python-modules/absl-py/default.nix +++ b/pkgs/development/python-modules/absl-py/default.nix @@ -4,8 +4,7 @@ fetchFromGitHub, hatchling, }: - -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "absl-py"; version = "2.3.1"; pyproject = true; @@ -13,7 +12,7 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "abseil"; repo = "abseil-py"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-U8doys7SoOhtUkF0dsCFKnM9ItOoi5a6cK6zGOe/U8s="; }; @@ -27,8 +26,8 @@ buildPythonPackage rec { meta = { description = "Abseil Python Common Libraries"; homepage = "https://github.com/abseil/abseil-py"; - changelog = "https://github.com/abseil/abseil-py/blob/${src.tag}/CHANGELOG.md"; + changelog = "https://github.com/abseil/abseil-py/blob/${finalAttrs.src.tag}/CHANGELOG.md"; license = lib.licenses.asl20; maintainers = [ ]; }; -} +}) From 9a13708a730b65a7bd62869951aa9023be61fd9d Mon Sep 17 00:00:00 2001 From: HigherOrderLogic <73709188+HigherOrderLogic@users.noreply.github.com> Date: Fri, 3 Jul 2026 16:49:02 +0000 Subject: [PATCH 008/318] python3Packages.absl-py: 2.3.1 -> 2.5.0 --- pkgs/development/python-modules/absl-py/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/absl-py/default.nix b/pkgs/development/python-modules/absl-py/default.nix index c5c8f206ac2d..691665b8cd61 100644 --- a/pkgs/development/python-modules/absl-py/default.nix +++ b/pkgs/development/python-modules/absl-py/default.nix @@ -6,14 +6,14 @@ }: buildPythonPackage (finalAttrs: { pname = "absl-py"; - version = "2.3.1"; + version = "2.5.0"; pyproject = true; src = fetchFromGitHub { owner = "abseil"; repo = "abseil-py"; tag = "v${finalAttrs.version}"; - hash = "sha256-U8doys7SoOhtUkF0dsCFKnM9ItOoi5a6cK6zGOe/U8s="; + hash = "sha256-BnR9QnZ5AaSlboQuQnX4UKGjAVVpyzMLZ68Do3VZrE0="; }; build-system = [ hatchling ]; From 0dd4000289edecb3ca42e82a4fa79417fca87334 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Sat, 11 Jul 2026 10:48:15 +0200 Subject: [PATCH 009/318] python3Packages.dbus-python: Switch to `finalAttrs` pattern It was not supported when 6ffea0de4c13c1987adec5e06f369514c1b15eb2 was introduced. --- .../python-modules/dbus-python/default.nix | 132 +++++++++--------- 1 file changed, 66 insertions(+), 66 deletions(-) diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix index ed518d645081..fe04c86a5a55 100644 --- a/pkgs/development/python-modules/dbus-python/default.nix +++ b/pkgs/development/python-modules/dbus-python/default.nix @@ -16,83 +16,83 @@ dbus-glib, }: -lib.fix ( - finalPackage: - buildPythonPackage rec { +buildPythonPackage (finalAttrs: { + pname = "dbus-python"; + version = "1.4.0"; + pyproject = true; + + disabled = isPyPy; + + outputs = [ + "out" + "dev" + ]; + + src = fetchPypi { pname = "dbus-python"; - version = "1.4.0"; - pyproject = true; + inherit (finalAttrs) version; + hash = "sha256-mRZm5Jj2Db8+Sbi3Z49VWbimUDT99hquYs3s232Jx3A="; + }; - disabled = isPyPy; + patches = [ + # reduce required dependencies + # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23 + (fetchpatch { + url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch"; + hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU="; + }) + ]; - outputs = [ - "out" - "dev" - ]; + postPatch = '' + # we provide patchelf natively, not through the python package + sed -i '/patchelf/d' pyproject.toml - src = fetchPypi { - inherit pname version; - hash = "sha256-mRZm5Jj2Db8+Sbi3Z49VWbimUDT99hquYs3s232Jx3A="; - }; + patchShebangs test/*.sh + ''; - patches = [ - # reduce required dependencies - # https://gitlab.freedesktop.org/dbus/dbus-python/-/merge_requests/23 - (fetchpatch { - url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch"; - hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU="; - }) - ]; + nativeBuildInputs = [ + dbus # build systems checks for `dbus-run-session` in PATH + meson + meson-python + pkg-config + ]; - postPatch = '' - # we provide patchelf natively, not through the python package - sed -i '/patchelf/d' pyproject.toml + buildInputs = [ + dbus + dbus-glib + ]; - patchShebangs test/*.sh - ''; + mesonFlags = [ + (lib.mesonBool "tests" finalAttrs.finalPackage.doInstallCheck) + ]; - nativeBuildInputs = [ - dbus # build systems checks for `dbus-run-session` in PATH - meson - meson-python - pkg-config - ]; + # workaround bug in meson-python + # https://github.com/mesonbuild/meson-python/issues/240 + postInstall = '' + mkdir -p $dev/lib + mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib + ''; - buildInputs = [ - dbus - dbus-glib - ]; + # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible + postFixup = '' + ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0 + ''; - mesonFlags = [ (lib.mesonBool "tests" finalPackage.doInstallCheck) ]; + nativeCheckInputs = [ dbus.out ]; - # workaround bug in meson-python - # https://github.com/mesonbuild/meson-python/issues/240 - postInstall = '' - mkdir -p $dev/lib - mv $out/${python.sitePackages}/.dbus_python.mesonpy.libs/pkgconfig/ $dev/lib - ''; + checkPhase = '' + runHook preCheck - # make sure the Cflags in the pkgconfig file are correct and make the structure backwards compatible - postFixup = '' - ln -s $dev/include/*/dbus_python/dbus-1.0/ $dev/include/dbus-1.0 - ''; + meson test -C build --no-rebuild --print-errorlogs --timeout-multiplier 0 - nativeCheckInputs = [ dbus.out ]; + runHook postCheck + ''; - checkPhase = '' - runHook preCheck - - meson test -C build --no-rebuild --print-errorlogs --timeout-multiplier 0 - - runHook postCheck - ''; - - meta = { - description = "Python DBus bindings"; - homepage = "https://gitlab.freedesktop.org/dbus/dbus-python"; - license = lib.licenses.mit; - platforms = dbus.meta.platforms; - maintainers = [ ]; - }; - } -) + meta = { + description = "Python DBus bindings"; + homepage = "https://gitlab.freedesktop.org/dbus/dbus-python"; + license = lib.licenses.mit; + platforms = dbus.meta.platforms; + maintainers = [ ]; + }; +}) From 8045ba2f61c0cf7f680d2c02059da539aa4da188 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Sat, 11 Jul 2026 02:17:02 +0200 Subject: [PATCH 010/318] python315Packages.dbus-python: Fix runtime error Using dbus-python on Python 3.15 would fail with: SystemError: type _dbus_bindings.Connection has the Py_TPFLAGS_MANAGED_WEAKREF flag but not Py_TPFLAGS_HAVE_GC flag See https://gitlab.freedesktop.org/dbus/dbus-python/-/work_items/59 This would also break tests, except we are not actually running them. --- pkgs/development/python-modules/dbus-python/default.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix index fe04c86a5a55..b17a32510ba5 100644 --- a/pkgs/development/python-modules/dbus-python/default.nix +++ b/pkgs/development/python-modules/dbus-python/default.nix @@ -41,6 +41,14 @@ buildPythonPackage (finalAttrs: { url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/d5e19698a8d6e1485f05b67a5b2daa2392819aaf.patch"; hash = "sha256-Rmj/ByRLiLnIF3JsMBElJugxsG8IARcBdixLhoWgIYU="; }) + + # Fix on Python 3.15, the patch did not achieve what it aimed for anyway. + # https://gitlab.freedesktop.org/dbus/dbus-python/-/work_items/59 + (fetchpatch { + url = "https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/ebecd1747c382a57ad8e47d0e32112cdbd454b40.patch"; + hash = "sha256-Hg4o+FPJvQ1/RW9fd8UJg/YEeVOvbJCov7SS7bT0vvs="; + revert = true; + }) ]; postPatch = '' From 0e7f37444a87d3004b7ad7f6a81d606f43393576 Mon Sep 17 00:00:00 2001 From: Jan Tojnar Date: Sat, 11 Jul 2026 02:03:51 +0200 Subject: [PATCH 011/318] python3Packages.dbus-python: Re-enable tests This was missed in f2355396eafb598a817bd8d86e45832fde18221e. `tests` option switched to `feature` type, which mapped the old `true` value to `auto`: https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/37c3f5a1f62bbaddbf49f28a3122bd406395d57a Additionally, a `pygobject3` dependency has been introduced, which causes the `auto`-enabled tests to be disabled when missing: https://gitlab.freedesktop.org/dbus/dbus-python/-/commit/1614ee768ea45ba87d9dc7ad4db2254efe51d0fd --- pkgs/development/python-modules/dbus-python/default.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/dbus-python/default.nix b/pkgs/development/python-modules/dbus-python/default.nix index b17a32510ba5..fc648cdf7d1d 100644 --- a/pkgs/development/python-modules/dbus-python/default.nix +++ b/pkgs/development/python-modules/dbus-python/default.nix @@ -14,6 +14,9 @@ # native dependencies dbus, dbus-glib, + + # test dependencies + pygobject3, }: buildPythonPackage (finalAttrs: { @@ -70,8 +73,12 @@ buildPythonPackage (finalAttrs: { dbus-glib ]; + checkInputs = [ + pygobject3 + ]; + mesonFlags = [ - (lib.mesonBool "tests" finalAttrs.finalPackage.doInstallCheck) + (lib.mesonEnable "tests" finalAttrs.finalPackage.doInstallCheck) ]; # workaround bug in meson-python From 18a0495c84a903589ff467b295ad7fd026f8568d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 16 Jul 2026 03:14:20 +0000 Subject: [PATCH 012/318] tree-sitter: 0.26.9 -> 0.26.11 --- pkgs/by-name/tr/tree-sitter/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix index 5c2f8655c625..657ec93f04f1 100644 --- a/pkgs/by-name/tr/tree-sitter/package.nix +++ b/pkgs/by-name/tr/tree-sitter/package.nix @@ -130,17 +130,17 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "tree-sitter"; - version = "0.26.9"; + version = "0.26.11"; src = fetchFromGitHub { owner = "tree-sitter"; repo = "tree-sitter"; tag = "v${finalAttrs.version}"; - hash = "sha256-ohVhW4AEKX5VspqBePtfxbJGkjmJnNkf5ntU3RUxF+0="; + hash = "sha256-YXnmVM90sEH8kqgqCygpeCAyvggMIsv+oXi0SJOvMRM="; fetchSubmodules = true; }; - cargoHash = "sha256-3egxdusYHQs8PadxGZ44+VWtlTcGBrcqlWMUyUzpWnY="; + cargoHash = "sha256-kHDjPRhBUYlxLWYSv6cn6U1QDIWwCgHeIz2A5yCi1yo="; cargoBuildFeatures = lib.optionals wasmSupport [ "wasm" ]; From cbb6959f319444d74f59a3b5de20ef2e652fc603 Mon Sep 17 00:00:00 2001 From: Alexis Hildebrandt Date: Mon, 2 Mar 2026 22:20:31 +0100 Subject: [PATCH 013/318] texinfo: 7.2 -> 7.3 --- pkgs/development/tools/misc/texinfo/common.nix | 2 +- pkgs/development/tools/misc/texinfo/packages.nix | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix index 00dd5a5811a5..e4439dc9a487 100644 --- a/pkgs/development/tools/misc/texinfo/common.nix +++ b/pkgs/development/tools/misc/texinfo/common.nix @@ -56,7 +56,7 @@ stdenv.mkDerivation { patches = patches ++ optional ( - interactive && versionAtLeast version "7.2" + interactive && versionAtLeast version "7.2" && versionOlder version "7.3" ) ./fix-test-suite-failures-with-perl-5.42.patch ++ optional crossBuildTools ./cross-tools-flags.patch; diff --git a/pkgs/development/tools/misc/texinfo/packages.nix b/pkgs/development/tools/misc/texinfo/packages.nix index c7c49d788643..5208d62ffb71 100644 --- a/pkgs/development/tools/misc/texinfo/packages.nix +++ b/pkgs/development/tools/misc/texinfo/packages.nix @@ -66,7 +66,7 @@ let in { texinfo7 = buildTexinfo { - version = "7.2"; - hash = "sha256-AynXeI++8RP6gsuAiJyhl6NEzg33ZG/gAJdMXXFDY6Y="; + version = "7.3"; + hash = "sha256-UfdOsPUc+phzuFJk391dRuiVfslbiPD7di9j2eFkxy4="; }; } From 8faec7a14645ab696e6631426e2cc4d915ae1202 Mon Sep 17 00:00:00 2001 From: Ihar Hrachyshka Date: Thu, 9 Jul 2026 21:04:28 -0400 Subject: [PATCH 014/318] git: fix darwin crashes when dealing with unicode filenames --- pkgs/by-name/gi/git/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix index a6fe8a13efc3..3aa66809b005 100644 --- a/pkgs/by-name/gi/git/package.nix +++ b/pkgs/by-name/gi/git/package.nix @@ -133,6 +133,12 @@ stdenv.mkDerivation (finalAttrs: { url = "https://lore.kernel.org/git/20260504101429.340123-1-joerg@thalheim.io/raw"; hash = "sha256-44EPfEJ39LjPWjqjFb52EKNaJGzYxZzJaJOis8QnazU="; }) + # Fix fortify darwin crashes when dealing with unicode filenames. + (fetchurl { + name = "darwin-unicode-filename-fix.patch"; + url = "https://lore.kernel.org/git/20260704233724.16928-1-ihar.hrachyshka@gmail.com/raw"; + hash = "sha256-lpGz3nFKQvFDtW2TtQLx/684ECJVBLGPGqip0XEtOdU="; + }) ] ++ lib.optionals withSsh [ # Hard-code the ssh executable to ${pkgs.openssh}/bin/ssh instead of From f424a73f4b9e26fe0f88e7922e6d6d04b1d663fc Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 22 Jul 2026 01:19:35 +0000 Subject: [PATCH 015/318] cryptsetup: 2.8.6 -> 2.8.7 --- pkgs/by-name/cr/cryptsetup/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/cr/cryptsetup/package.nix b/pkgs/by-name/cr/cryptsetup/package.nix index 21ae5fc76b40..0ff0e32e1742 100644 --- a/pkgs/by-name/cr/cryptsetup/package.nix +++ b/pkgs/by-name/cr/cryptsetup/package.nix @@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "cryptsetup"; - version = "2.8.6"; + version = "2.8.7"; outputs = [ "bin" @@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: { url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/" + "cryptsetup-${finalAttrs.version}.tar.xz"; - hash = "sha256-gAQmX9mTiF0I97Yz2+BWhR3hohAwdhOk693HQ/zO/lo="; + hash = "sha256-53bw04HobKYQQsRXBpSR/o4KwoZ4DHw7Hk+ZIavJYdo="; }; patches = [ From 5f2b39c55e6db61debb484b3e9c7ab568d308651 Mon Sep 17 00:00:00 2001 From: whispers Date: Wed, 24 Jun 2026 15:26:05 -0400 Subject: [PATCH 016/318] webkitgtk_{4_1,6_0}: drop unused libidn dependency This dependency was introduced in https://github.com/NixOS/nixpkgs/commit/3fa62094395bd89e7978f224eec2e31729fc26e5 in 2017. It appears to be unused, with the only reference in the WebKit source tree being in `Source/ThirdParty/libwebrtc/Source/third_party/yasm/ABOUT-NLS`. We are having some difficulty tracing why it was added at all, so we are not 100% sure this is correct, but `webkitgtk_6_0` still builds with this. --- pkgs/development/libraries/webkitgtk/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/development/libraries/webkitgtk/default.nix b/pkgs/development/libraries/webkitgtk/default.nix index eab3b229eda7..43d215a9ac97 100644 --- a/pkgs/development/libraries/webkitgtk/default.nix +++ b/pkgs/development/libraries/webkitgtk/default.nix @@ -42,7 +42,6 @@ nettle, libtasn1, p11-kit, - libidn, libedit, readline, libGL, @@ -160,7 +159,6 @@ clangStdenv.mkDerivation (finalAttrs: { libgbm libgcrypt libgpg-error - libidn libintl lcms2 libpthread-stubs From 15ee69f741133a6ffe57d1963917ac30c9ece52c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=A4=9C=E5=9D=82=E9=9B=85?= <23130178+ShadowRZ@users.noreply.github.com> Date: Fri, 24 Jul 2026 13:23:52 +0800 Subject: [PATCH 017/318] mjpegtools: disable building gtk2 programs --- pkgs/by-name/mj/mjpegtools/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mj/mjpegtools/package.nix b/pkgs/by-name/mj/mjpegtools/package.nix index 157948c85891..fb6511452c38 100644 --- a/pkgs/by-name/mj/mjpegtools/package.nix +++ b/pkgs/by-name/mj/mjpegtools/package.nix @@ -2,7 +2,6 @@ stdenv, lib, fetchurl, - gtk2, libdv, libjpeg, libpng, @@ -46,12 +45,13 @@ stdenv.mkDerivation (finalAttrs: { libpng ] ++ lib.optionals (!withMinimal) [ - gtk2 libx11 SDL SDL_gfx ]; + configureFlags = [ "--without-gtk" ]; + env.NIX_CFLAGS_COMPILE = lib.optionalString (!withMinimal) "-I${lib.getDev SDL}/include/SDL"; postPatch = '' From 778afcfd83cd0f469202fa8de9d790dd83b323bb Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 28 Jul 2026 15:10:32 +0000 Subject: [PATCH 018/318] libarchive: 3.8.8 -> 3.8.9 --- pkgs/by-name/li/libarchive/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix index fe81d018859c..ccc42c457d12 100644 --- a/pkgs/by-name/li/libarchive/package.nix +++ b/pkgs/by-name/li/libarchive/package.nix @@ -32,13 +32,13 @@ assert xarSupport -> libxml2 != null; stdenv.mkDerivation (finalAttrs: { pname = "libarchive"; - version = "3.8.8"; + version = "3.8.9"; src = fetchFromGitHub { owner = "libarchive"; repo = "libarchive"; rev = "v${finalAttrs.version}"; - hash = "sha256-l8xh+z6lP7VnxMIf9tfoSByerjwN6Z4dE3JNA9zS3LM="; + hash = "sha256-/CoInUlOiFvR83mEeV3Tx+2SQGywWDQ4nY+NstE/cP4="; }; outputs = [ From dd8369d9982ee5812c5c568f4539d383c1351b28 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 29 Jul 2026 14:43:33 +0000 Subject: [PATCH 019/318] libnghttp2: 1.69.0 -> 1.70.0 --- pkgs/by-name/ng/nghttp2/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ng/nghttp2/package.nix b/pkgs/by-name/ng/nghttp2/package.nix index 209717165a3b..0151aa916190 100644 --- a/pkgs/by-name/ng/nghttp2/package.nix +++ b/pkgs/by-name/ng/nghttp2/package.nix @@ -44,11 +44,11 @@ assert enableJemalloc -> enableApp; stdenv.mkDerivation rec { pname = "nghttp2"; - version = "1.69.0"; + version = "1.70.0"; src = fetchurl { url = "https://github.com/nghttp2/nghttp2/releases/download/v${version}/nghttp2-${version}.tar.bz2"; - hash = "sha256-PxhfWxw+d4heuc8/LE2ksan3OiS/WVe4KRg60Tf4Lcg="; + hash = "sha256-j6yh94qpmsO8F2ina34PazbY5qYsE4GHUbHSBfAvlAU="; }; outputs = [ From 106695500c7f595311b588720f6edc1be29f155a Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Mon, 15 Jun 2026 02:34:05 +0300 Subject: [PATCH 020/318] gawk: `finalAttrs` does not change the eval --- pkgs/tools/text/gawk/default.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix index 87d2946e6160..210c78f909c7 100644 --- a/pkgs/tools/text/gawk/default.nix +++ b/pkgs/tools/text/gawk/default.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchurl, - fetchpatch, removeReferencesTo, runtimeShellPackage, texinfo, @@ -24,12 +23,12 @@ assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null; -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "gawk" + lib.optionalString interactive "-interactive"; version = "5.4.1"; src = fetchurl { - url = "mirror://gnu/gawk/gawk-${version}.tar.xz"; + url = "mirror://gnu/gawk/gawk-${finalAttrs.version}.tar.xz"; hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc="; }; @@ -129,4 +128,4 @@ stdenv.mkDerivation rec { ]; mainProgram = "gawk"; }; -} +}) From d588d92eefc8e6ca3f8dfe4a1eecafe8eaa03d77 Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Mon, 15 Jun 2026 02:34:05 +0300 Subject: [PATCH 021/318] gawk: `__structuredAttrs` & `enableParallelBuilding` `nix store make-content-addressed` gives the same output before and after this change. --- pkgs/tools/text/gawk/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix index 210c78f909c7..955c6b8d892f 100644 --- a/pkgs/tools/text/gawk/default.nix +++ b/pkgs/tools/text/gawk/default.nix @@ -49,7 +49,9 @@ stdenv.mkDerivation (finalAttrs: { ] ++ lib.optional (!interactive) "man"; + __structuredAttrs = true; strictDeps = true; + enableParallelBuilding = true; # no-pma fix nativeBuildInputs = [ From 920d9cd88229240a65f38beccffcf06fe71f1071 Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Fri, 31 Jul 2026 20:57:31 +0300 Subject: [PATCH 022/318] minimal-bootstrap.binutils{,-static}: 2.46.0 -> 2.47 --- pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix | 4 ++-- pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix index eb34c121e9da..b87911c27e31 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix @@ -20,11 +20,11 @@ let # Based on https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a1-static-binutils.nix inherit (import ./common.nix { inherit lib; }) meta; pname = "binutils"; - version = "2.46.0"; + version = "2.47"; src = fetchurl { url = "mirror://gnu/binutils/binutils-${version}.tar.xz"; - hash = "sha256-11qU9Nc+ekCG91E+Z+Q56Pzcu3Jv/mP0ZhdE5iVrLPI="; + hash = "sha256-FUqyO2AHDo8nATwil38RKUJdZ9HorNbhMBDmF4EeTP8="; }; patches = [ diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix index e29e884a2dfd..7740d9ba05e2 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix @@ -20,11 +20,11 @@ let inherit (import ./common.nix { inherit lib; }) meta; pname = "binutils-static"; - version = "2.46.0"; + version = "2.47"; src = fetchurl { url = "mirror://gnu/binutils/binutils-${version}.tar.xz"; - hash = "sha256-11qU9Nc+ekCG91E+Z+Q56Pzcu3Jv/mP0ZhdE5iVrLPI="; + hash = "sha256-FUqyO2AHDo8nATwil38RKUJdZ9HorNbhMBDmF4EeTP8="; }; patches = [ From d5deacb2261ee1c05ce06e941b61b3b149ab542b Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Fri, 31 Jul 2026 20:50:36 +0300 Subject: [PATCH 023/318] minimal-bootstrap.coreutils-{musl,static}: 9.10 -> 9.11 --- pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix | 4 ++-- pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix index 1eb87b40cdae..e0ece9d12347 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix @@ -15,11 +15,11 @@ let inherit (import ./common.nix { inherit lib; }) meta; pname = "bootstrap-coreutils-musl"; - version = "9.10"; + version = "9.11"; src = fetchurl { url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz"; - hash = "sha256-4L3h+2hQlEf8cjzyUX6KjH+kZ2mRm7dJDtNQoukjhWI="; + hash = "sha256-IDO4owScBr/0mp486nK99Gg7zQy+uXUhHdVtuvi3Nq4="; }; configureFlags = [ diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix index 6c92f12bf58b..934510e9d8ac 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/static.nix @@ -19,11 +19,11 @@ let inherit (import ./common.nix { inherit lib; }) meta; pname = "coreutils-static"; - version = "9.10"; + version = "9.11"; src = fetchurl { url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz"; - hash = "sha256-4L3h+2hQlEf8cjzyUX6KjH+kZ2mRm7dJDtNQoukjhWI="; + hash = "sha256-IDO4owScBr/0mp486nK99Gg7zQy+uXUhHdVtuvi3Nq4="; }; configureFlags = [ From 9d91a0b8d87581bd053ec16f68e8eb70f91c78df Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Fri, 31 Jul 2026 20:51:26 +0300 Subject: [PATCH 024/318] minimal-bootstrap.findutils{,-static}: 4.10.0 -> 4.11.0 --- .../os-specific/linux/minimal-bootstrap/findutils/default.nix | 4 ++-- pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix index 96531fbbe67d..1025f6b246c0 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix @@ -14,11 +14,11 @@ }: let pname = "findutils"; - version = "4.10.0"; + version = "4.11.0"; src = fetchurl { url = "mirror://gnu/findutils/findutils-${version}.tar.xz"; - hash = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU="; + hash = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0="; }; in bash.runCommand "${pname}-${version}" diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix index b183888ce033..23075374a189 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/static.nix @@ -17,11 +17,11 @@ }: let pname = "findutils-static"; - version = "4.10.0"; + version = "4.11.0"; src = fetchurl { url = "mirror://gnu/findutils/findutils-${version}.tar.xz"; - hash = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU="; + hash = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0="; }; in bash.runCommand "${pname}-${version}" From be7d828eef866dd2d72a12684d29942f1e6a8c64 Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Fri, 31 Jul 2026 20:52:01 +0300 Subject: [PATCH 025/318] minimal-bootstrap.gawk{,-static}: 5.3.2 -> 5.4.1 Added the same patch that is also vendored for the top-level package. --- .../linux/minimal-bootstrap/gawk/default.nix | 13 ++- .../gawk/node-struct-without-gmp-mpfr.patch | 79 +++++++++++++++++++ .../linux/minimal-bootstrap/gawk/static.nix | 12 ++- 3 files changed, 100 insertions(+), 4 deletions(-) create mode 100644 pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix index 551c2029bee0..91158c05a727 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix @@ -7,6 +7,7 @@ tinycc, gnumake, gnugrep, + gnupatch, gnused, gnutar, gzip, @@ -15,12 +16,16 @@ let inherit (import ./common.nix { inherit lib; }) meta; pname = "gawk"; - version = "5.3.2"; + + version = "5.4.1"; src = fetchurl { url = "mirror://gnu/gawk/gawk-${version}.tar.gz"; - hash = "sha256-hjmhqI+0EaG+AmY3OdA+kCptMTtcb+Ak0L/rM0GhmhE="; + hash = "sha256-izsOqDkwMRo/MJBdPOiY0yxhA8L+INapC0A0EXGxdN4="; }; + patches = [ + ./node-struct-without-gmp-mpfr.patch + ]; in bash.runCommand "${pname}-${version}" { @@ -28,6 +33,7 @@ bash.runCommand "${pname}-${version}" nativeBuildInputs = [ tinycc.compiler + gnupatch gnumake gnused gnugrep @@ -48,6 +54,9 @@ bash.runCommand "${pname}-${version}" tar xzf ${src} cd gawk-${version} + # Patch + ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches} + # Configure export CC="tcc -B ${tinycc.libs}/lib" export AR="tcc -ar" diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch b/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch new file mode 100644 index 000000000000..01f660c191e8 --- /dev/null +++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/node-struct-without-gmp-mpfr.patch @@ -0,0 +1,79 @@ +From bf85f8a3175af703597082d4c7e0abc2066a44d3 Mon Sep 17 00:00:00 2001 +From: "Arnold D. Robbins" +Date: Tue, 14 Jul 2026 10:14:50 +0300 +Subject: [PATCH] Workaround fix for systems without MPFR and GMP. + +--- + ChangeLog | 8 ++++++++ + awk.h | 23 ++++++++++++++--------- + 2 files changed, 22 insertions(+), 9 deletions(-) + +diff --git a/ChangeLog b/ChangeLog +index 6a955eed..42bd2c48 100644 +--- a/ChangeLog ++++ b/ChangeLog +@@ -3,6 +3,14 @@ + * builtin.c (do_dump_node): Add the size of each object to + the printout. + ++ Unrelated: Make things works when built on systems without ++ the GMP and MPFR libraries. Thanks to Thomas Trepl ++ and Bruce Dubbs for the reports. ++ ++ * awk.h (struct exp_node): Add alignment padding when we don't ++ have MPFR. This is a hack, pending a total refactoring of ++ the NODE structure. ++ + 2026-07-08 Arnold D. Robbins + + * 5.4.1: Release tar ball made. +diff --git a/awk.h b/awk.h +index dbad0d81..f4a84300 100644 +--- a/awk.h ++++ b/awk.h +@@ -406,17 +406,24 @@ typedef struct exp_node { + } nodep; + + struct { +-#ifdef HAVE_MPFR + union { + AWKNUM fltnum; ++#ifdef HAVE_MPFR + mpfr_t mpnum; + mpz_t mpi; +- } nm; +- int rndmode; + #else +- AWKNUM fltnum; +- int for_alignment_only; // especially on 32-bit +-#endif ++ // 7/2026: ++ // This is a workaround for systems that build ++ // gawk without MPFR and GMP. The NODE struct ++ // desperately needs to be refactored. ++#if SIZEOF_VOID_P == 4 ++ char alignment[28]; ++#else // SIZEOF_VOID_P != 4 ++ char alignment[48]; ++#endif // SIZEOF_VOID_P != 4 ++#endif // HAVE_MPFR ++ } nm; ++ int rndmode; // only used for MPFR. + char *sp; + size_t slen; + int idx; +@@ -561,10 +568,8 @@ typedef struct exp_node { + #ifdef HAVE_MPFR + #define mpg_numbr sub.val.nm.mpnum + #define mpg_i sub.val.nm.mpi +-#define numbr sub.val.nm.fltnum +-#else +-#define numbr sub.val.fltnum + #endif ++#define numbr sub.val.nm.fltnum + #define typed_re sub.val.typre + + /* +-- +2.54.0 + diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix index d35bb47674d6..861d4a7f36b7 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/static.nix @@ -6,6 +6,7 @@ bash, gcc, binutils, + gnupatch, gnumake, gnused, gnugrep, @@ -18,12 +19,15 @@ let inherit (import ./common.nix { inherit lib; }) meta; pname = "gawk-static"; - version = "5.3.2"; + version = "5.4.1"; src = fetchurl { url = "mirror://gnu/gawk/gawk-${version}.tar.gz"; - hash = "sha256-hjmhqI+0EaG+AmY3OdA+kCptMTtcb+Ak0L/rM0GhmhE="; + hash = "sha256-izsOqDkwMRo/MJBdPOiY0yxhA8L+INapC0A0EXGxdN4="; }; + patches = [ + ./node-struct-without-gmp-mpfr.patch + ]; in bash.runCommand "${pname}-${version}" { @@ -32,6 +36,7 @@ bash.runCommand "${pname}-${version}" nativeBuildInputs = [ gcc binutils + gnupatch gnumake gnused gnugrep @@ -55,6 +60,9 @@ bash.runCommand "${pname}-${version}" tar xf ${src} cd gawk-${version} + # Patch + ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches} + # Configure bash ./configure \ --prefix=$out \ From 985bc462dac0af1721c0dc6048560453e1603869 Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Fri, 31 Jul 2026 20:52:21 +0300 Subject: [PATCH 026/318] minimal-bootstrap.glibc: 2.42 -> 2.44 --- pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix index f156f862ecc0..cf71f17513f1 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix @@ -20,11 +20,11 @@ }: let pname = "glibc"; - version = "2.42"; + version = "2.44"; src = fetchurl { url = "mirror://gnu/libc/glibc-${version}.tar.xz"; - hash = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8="; + hash = "sha256-N/YA8r7zxegwAUcFlWiyouQKetbMxlzpQlVtSUKcxmc="; }; linkerFile = From 4af58188ea8c21ac34cf72dd9a5ba2b8deb448ed Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Fri, 31 Jul 2026 20:52:45 +0300 Subject: [PATCH 027/318] minimal-bootstrap.gnused-static: 4.9 -> 4.10 Added linux-headers to the include path, the new version of the vendored gnulib depends on a few headers. --- .../os-specific/linux/minimal-bootstrap/gnused/static.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix index 90346ee634ba..e8a39c7fbc67 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/static.nix @@ -13,16 +13,17 @@ diffutils, findutils, gnutar, + linux-headers, xz, }: let inherit (import ./common.nix { inherit lib; }) meta; pname = "gnused-static"; - version = "4.9"; + version = "4.10"; src = fetchurl { url = "mirror://gnu/sed/sed-${version}.tar.xz"; - hash = "sha256-biJrcy4c1zlGStaGK9Ghq6QteYKSLaelNRljHSSXUYE="; + hash = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc="; }; in bash.runCommand "${pname}-${version}" @@ -60,7 +61,8 @@ bash.runCommand "${pname}-${version}" --build=${buildPlatform.config} \ --host=${hostPlatform.config} \ --disable-dependency-tracking \ - --disable-nls + --disable-nls \ + CFLAGS="-I${linux-headers}/include" # Build make -j $NIX_BUILD_CORES From e8532079faacabf96c1ab9162cd46b9558aa43f1 Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Fri, 31 Jul 2026 20:53:09 +0300 Subject: [PATCH 028/318] minimal-bootstrap.patchelf-static: 0.18.0 -> 0.19.1 --- pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix index 622dc2846468..b84c0ae20b28 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/patchelf/static.nix @@ -17,11 +17,11 @@ }: let pname = "patchelf-static"; - version = "0.18.0"; + version = "0.19.1"; src = fetchurl { url = "https://github.com/NixOS/patchelf/releases/download/${version}/patchelf-${version}.tar.gz"; - sha256 = "sha256-ZN4Q5Ma4uDedt+h/WAMPM26nR8BRXzgRMugQ2/hKhuc="; + sha256 = "sha256-SREIco8SDOBbU5k0tBp1AjUDGm34q8a0flev994VCU0="; }; in bash.runCommand "${pname}-${version}" From 1f15a58e9671545ad638c0ce21ab36009a3638a6 Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Fri, 31 Jul 2026 20:53:22 +0300 Subject: [PATCH 029/318] minimal-bootstrap.python: 3.14.4 -> 3.14.6 --- pkgs/os-specific/linux/minimal-bootstrap/python/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix index ff04626a6336..0b870ca6d3d1 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/python/default.nix @@ -19,11 +19,11 @@ }: let pname = "python"; - version = "3.14.4"; + version = "3.14.6"; src = fetchurl { url = "https://www.python.org/ftp/python/${version}/Python-${version}.tar.xz"; - hash = "sha256-2SPFEwPjjiSRNvwb3zVo1W7LAyFO/e9IUWF209f6rvg="; + hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM="; }; patches = [ From b7970fa66e050e0ce2c3783ba1775073375cc676 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20=22Capypara=22=20K=C3=B6pcke?= Date: Sun, 2 Aug 2026 13:55:47 +0200 Subject: [PATCH 030/318] vala: 0.56.18 -> 0.56.19 --- pkgs/development/compilers/vala/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/vala/default.nix b/pkgs/development/compilers/vala/default.nix index 47d32565ac18..17847cb1ae04 100644 --- a/pkgs/development/compilers/vala/default.nix +++ b/pkgs/development/compilers/vala/default.nix @@ -127,8 +127,8 @@ let in rec { vala_0_56 = generic { - version = "0.56.18"; - hash = "sha256-8q/+fUCrY9uOe57MP2vcnC/H4xNMhP8teV9IL+kmo4I="; + version = "0.56.19"; + hash = "sha256-WtfLv8wN5htAPWeXye9gRVv769jhYq7DO1sLCXrfudU="; }; vala = vala_0_56; From 64927122870a0587642a82bd40b808e3c109f77f Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 20:01:05 +0200 Subject: [PATCH 031/318] linuxHeaders: enable structuredAttrs --- pkgs/os-specific/linux/kernel-headers/default.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix index e5952533eb02..d74c405ca284 100644 --- a/pkgs/os-specific/linux/kernel-headers/default.nix +++ b/pkgs/os-specific/linux/kernel-headers/default.nix @@ -108,7 +108,7 @@ let # Skip clean on darwin, case-sensitivity issues. buildPhase = lib.optionalString (!stdenvNoCC.buildPlatform.isDarwin) '' - make mrproper $makeFlags + make mrproper "''${makeFlags[@]}" '' + ( if stdenvNoCC.hostPlatform.isAndroid then @@ -118,12 +118,12 @@ let '' else '' - make headers $makeFlags + make headers "''${makeFlags[@]}" '' ); checkPhase = '' - make headers_check $makeFlags + make headers_check "''${makeFlags[@]}" ''; # The following command requires rsync: @@ -144,6 +144,8 @@ let inherit passthru; + __structuredAttrs = true; + meta = { description = "Header files and scripts for Linux kernel"; license = lib.licenses.gpl2Only; From 39953932fe81c37cc02b3a321dd439c79af487d7 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 20:11:26 +0200 Subject: [PATCH 032/318] glibc: enable structuredAttrs --- pkgs/development/libraries/glibc/common.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix index 5e391970a271..972250e1a894 100644 --- a/pkgs/development/libraries/glibc/common.nix +++ b/pkgs/development/libraries/glibc/common.nix @@ -347,6 +347,8 @@ stdenv.mkDerivation ( doCheck = false; # fails + __structuredAttrs = true; + meta = { From a6df78ba9b0295f37e6aff63d971b6901160f57c Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 21:01:49 +0200 Subject: [PATCH 033/318] xz: enable structuredAttrs --- pkgs/by-name/xz/xz/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/xz/xz/package.nix b/pkgs/by-name/xz/xz/package.nix index 62460c88acd4..1313bc1779a2 100644 --- a/pkgs/by-name/xz/xz/package.nix +++ b/pkgs/by-name/xz/xz/package.nix @@ -77,6 +77,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { changelog = "https://github.com/tukaani-project/xz/releases/tag/v${finalAttrs.version}"; description = "General-purpose data compression software, successor of LZMA"; From 04155a77f60f5f8ab14436d7742d40d3dc22001f Mon Sep 17 00:00:00 2001 From: Arthur Gautier Date: Sun, 2 Aug 2026 19:43:12 +0000 Subject: [PATCH 034/318] lix: boost is required to build against lix/libutil This fixes compilation errors like: ``` In file included from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/error-trace.hh:11, from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/error.hh:18, from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/async.hh:4, from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/async-io.hh:4, from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/archive.hh:4, from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/hash.hh:6, from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libstore/realisation.hh:6, from /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libstore/build-result.hh:4, from ../src/plugin.cc:3: /nix/store/1p6r4w8943g0cklmsdmsm4pdvvldw8ja-lix-2.95.2-dev/include/lix/libutil/fmt.hh:6:10: fatal error: boost/format.hpp: No such file or directory 6 | #include | ^~~~~~~~~~~~~~~~~~ compilation terminated. ``` --- pkgs/tools/package-management/lix/common-lix.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix index fdd550e8c8d1..c3de69bbf779 100644 --- a/pkgs/tools/package-management/lix/common-lix.nix +++ b/pkgs/tools/package-management/lix/common-lix.nix @@ -311,6 +311,7 @@ stdenv.mkDerivation (finalAttrs: { propagatedBuildInputs = [ boehmgc + boost nlohmann_json ]; From aafeee7fba2cfb77debd7260b8baccc687e56bb7 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 21:54:04 +0200 Subject: [PATCH 035/318] gnu-config: enable structuredAttrs --- pkgs/by-name/gn/gnu-config/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gn/gnu-config/package.nix b/pkgs/by-name/gn/gnu-config/package.nix index 80baba133a06..fc52ff2e9b6d 100644 --- a/pkgs/by-name/gn/gnu-config/package.nix +++ b/pkgs/by-name/gn/gnu-config/package.nix @@ -67,6 +67,8 @@ stdenv.mkDerivation { strictDeps = true; + __structuredAttrs = true; + meta = { description = "Attempt to guess a canonical system name"; homepage = "https://savannah.gnu.org/projects/config"; From 1cd690ae5471ccd59a6858df17f51bd6c317e908 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 22:55:15 +0200 Subject: [PATCH 036/318] coreutils: enable strictDeps --- pkgs/by-name/co/coreutils/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/co/coreutils/package.nix b/pkgs/by-name/co/coreutils/package.nix index 9a47b436ae3d..54a1e1ff3f49 100644 --- a/pkgs/by-name/co/coreutils/package.nix +++ b/pkgs/by-name/co/coreutils/package.nix @@ -162,6 +162,8 @@ stdenv.mkDerivation (finalAttrs: { # TODO(@Ericson2314): Investigate whether Darwin could benefit too ++ optional (isCross && stdenv.hostPlatform.libc != "glibc") libiconv; + strictDeps = true; + hardeningDisable = [ "trivialautovarinit" ]; configureFlags = [ From 876cd695b696d82d1b151e62d2a9eae03428683d Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 22:55:38 +0200 Subject: [PATCH 037/318] coreutils: enable structuredAttrs, use --replace-fail --- pkgs/by-name/co/coreutils/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/co/coreutils/package.nix b/pkgs/by-name/co/coreutils/package.nix index 54a1e1ff3f49..696a0844475e 100644 --- a/pkgs/by-name/co/coreutils/package.nix +++ b/pkgs/by-name/co/coreutils/package.nix @@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: { # sandbox does not allow setgid sed '2i echo Skipping chmod setgid test && exit 77' -i ./tests/chmod/setgid.sh substituteInPlace ./tests/install/install-C.sh \ - --replace 'mode3=2755' 'mode3=1755' + --replace-fail 'mode3=2755' 'mode3=1755' # Fails on systems with a rootfs. Looks like a bug in the test, see # https://lists.gnu.org/archive/html/bug-coreutils/2019-12/msg00000.html @@ -273,6 +273,8 @@ stdenv.mkDerivation (finalAttrs: { ''; }; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/coreutils/"; description = "GNU Core Utilities"; From aa9c93970fedc5dd068ce79bfbdb11155aafba5b Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 22:57:32 +0200 Subject: [PATCH 038/318] autoconf269: enable structuredAttrs, use finalAttrs --- pkgs/development/tools/misc/autoconf/2.69.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix index 046c885e9955..ca2f881db326 100644 --- a/pkgs/development/tools/misc/autoconf/2.69.nix +++ b/pkgs/development/tools/misc/autoconf/2.69.nix @@ -6,12 +6,12 @@ perl, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "autoconf"; version = "2.69"; src = fetchurl { - url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz"; + url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz"; sha256 = "113nlmidxy9kjr45kg9x3ngar4951mvag1js2a3j8nxcz34wxsv4"; }; @@ -41,6 +41,8 @@ stdenv.mkDerivation rec { doInstallCheck = false; # fails + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/autoconf/"; description = "Part of the GNU Build System"; @@ -59,4 +61,4 @@ stdenv.mkDerivation rec { platforms = lib.platforms.all; }; -} +}) From 4869f0e3d6a5352b1a9536df832b40c507ed045a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 22:57:47 +0200 Subject: [PATCH 039/318] autoconf: enable structuredAttrs, use finalAttrs --- pkgs/development/tools/misc/autoconf/default.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix index 818117f1bb12..c311d32ac713 100644 --- a/pkgs/development/tools/misc/autoconf/default.nix +++ b/pkgs/development/tools/misc/autoconf/default.nix @@ -12,7 +12,7 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "autoconf"; version = "2.73"; outputs = [ @@ -21,7 +21,7 @@ stdenv.mkDerivation rec { ]; src = fetchurl { - url = "mirror://gnu/autoconf/autoconf-${version}.tar.xz"; + url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz"; hash = "sha256-n9ZyschCX6wvpn+gR3uZCYcmi5D/NtXwFtrle+DWtS4="; }; @@ -57,6 +57,8 @@ stdenv.mkDerivation rec { export TESTSUITEFLAGS="-j$NIX_BUILD_CORES" ''; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/autoconf/"; description = "Part of the GNU Build System"; @@ -75,4 +77,4 @@ stdenv.mkDerivation rec { platforms = lib.platforms.all; }; -} +}) From 733fcf93e58e2644158713acff7feda59dfea030 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 22:58:41 +0200 Subject: [PATCH 040/318] automake116x: enable structuredAttrs, use finalAttrs --- pkgs/development/tools/misc/automake/automake-1.16.x.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix index 8751317729fa..308ebc9e9f3f 100644 --- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix +++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix @@ -7,12 +7,12 @@ updateAutotoolsGnuConfigScriptsHook, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "automake"; version = "1.16.5"; src = fetchurl { - url = "mirror://gnu/automake/automake-${version}.tar.xz"; + url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz"; sha256 = "0sdl32qxdy7m06iggmkkvf7j520rmmgbsjzbm7fgnxwxdp6mh7gh"; }; @@ -36,6 +36,8 @@ stdenv.mkDerivation rec { # "fixed" path in generated files! dontPatchShebangs = true; + __structuredAttrs = true; + meta = { branch = "1.16"; homepage = "https://www.gnu.org/software/automake/"; @@ -48,4 +50,4 @@ stdenv.mkDerivation rec { ''; platforms = lib.platforms.all; }; -} +}) From 0043d4fbc70882acde1d150ccc17ac95e884266a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 22:58:53 +0200 Subject: [PATCH 041/318] automake: enable structuredAttrs, use finalAttrs --- pkgs/development/tools/misc/automake/automake-1.18.x.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/misc/automake/automake-1.18.x.nix b/pkgs/development/tools/misc/automake/automake-1.18.x.nix index 7d1a496081db..1149cf78bde1 100644 --- a/pkgs/development/tools/misc/automake/automake-1.18.x.nix +++ b/pkgs/development/tools/misc/automake/automake-1.18.x.nix @@ -7,12 +7,12 @@ updateAutotoolsGnuConfigScriptsHook, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "automake"; version = "1.18.1"; src = fetchurl { - url = "mirror://gnu/automake/automake-${version}.tar.xz"; + url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz"; hash = "sha256-FoqjYyeDUbia9WaERI9SWlvOUHnQtoQr2RD90/FkaIc="; }; @@ -36,6 +36,8 @@ stdenv.mkDerivation rec { # "fixed" path in generated files! dontPatchShebangs = true; + __structuredAttrs = true; + meta = { branch = "1.18"; homepage = "https://www.gnu.org/software/automake/"; @@ -48,4 +50,4 @@ stdenv.mkDerivation rec { ''; platforms = lib.platforms.all; }; -} +}) From 4f61d6c8e9967e36f853348b930254f74f02ab3b Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:07:59 +0200 Subject: [PATCH 042/318] findutils: enable strictDeps --- pkgs/tools/misc/findutils/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix index 5e2d0fbe6f3c..366d5f3431d3 100644 --- a/pkgs/tools/misc/findutils/default.nix +++ b/pkgs/tools/misc/findutils/default.nix @@ -31,6 +31,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ]; buildInputs = [ coreutils ]; # bin/updatedb script needs to call sort + strictDeps = true; + # Since glibc-2.25 the i686 tests hang reliably right after test-sleep. doCheck = !stdenv.hostPlatform.isDarwin From 48a056c33cfeb3f5cc174e544d56adc75f253f04 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:08:08 +0200 Subject: [PATCH 043/318] findutils: enable structuredAttrs --- pkgs/tools/misc/findutils/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix index 366d5f3431d3..b52fb1c5bd1d 100644 --- a/pkgs/tools/misc/findutils/default.nix +++ b/pkgs/tools/misc/findutils/default.nix @@ -81,6 +81,8 @@ stdenv.mkDerivation (finalAttrs: { # or you can check libc/include/sys/cdefs.h in bionic source code hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify"; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/findutils/"; changelog = "https://cgit.git.savannah.gnu.org/cgit/findutils.git/tree/NEWS?h=v${finalAttrs.version}"; From 53400743749740cbb266557070ad1fa9339021db Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:12:27 +0200 Subject: [PATCH 044/318] gnused: enable strictDeps --- pkgs/tools/text/gnused/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix index 7f1cfe514425..a1e793e6eba5 100644 --- a/pkgs/tools/text/gnused/default.nix +++ b/pkgs/tools/text/gnused/default.nix @@ -24,6 +24,9 @@ stdenv.mkDerivation rec { updateAutotoolsGnuConfigScriptsHook perl ]; + + strictDeps = true; + preConfigure = "patchShebangs ./build-aux/help2man"; # Prevents attempts of running 'help2man' on cross-built binaries. From 75af460bdbd16c197469a5502bcd72b80e90b2e1 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:20:40 +0200 Subject: [PATCH 045/318] patchelf: enable structuredAttrs, modernize --- pkgs/development/tools/misc/patchelf/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/development/tools/misc/patchelf/default.nix b/pkgs/development/tools/misc/patchelf/default.nix index 086e18e94185..041e18531cb9 100644 --- a/pkgs/development/tools/misc/patchelf/default.nix +++ b/pkgs/development/tools/misc/patchelf/default.nix @@ -9,13 +9,13 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "patchelf"; version = "0.15.2"; src = fetchurl { - url = "https://github.com/NixOS/${pname}/releases/download/${version}/${pname}-${version}.tar.bz2"; - sha256 = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw="; + url = "https://github.com/NixOS/patchelf/releases/download/${finalAttrs.version}/patchelf-${finalAttrs.version}.tar.bz2"; + hash = "sha256-F3RfVkFZyOIo/EEtplogSLhGxLa0Igt3y/IkFuAvLXw="; }; strictDeps = true; @@ -27,6 +27,8 @@ stdenv.mkDerivation rec { # fails 8 out of 24 tests, problems when loading libc.so.6 doCheck = stdenv.name == "stdenv-linux"; + __structuredAttrs = true; + meta = { homepage = "https://github.com/NixOS/patchelf"; license = lib.licenses.gpl3Plus; @@ -35,4 +37,4 @@ stdenv.mkDerivation rec { maintainers = [ ]; platforms = lib.platforms.all; }; -} +}) From 1938a54c07a338678f53a1098dd18a17790cee8c Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:29:41 +0200 Subject: [PATCH 046/318] findutils: use --replace-fail --- pkgs/tools/misc/findutils/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix index b52fb1c5bd1d..7540239528f0 100644 --- a/pkgs/tools/misc/findutils/default.nix +++ b/pkgs/tools/misc/findutils/default.nix @@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: { }; postPatch = '' - substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";' + substituteInPlace xargs/xargs.c --replace-fail 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";' ''; patches = [ From 195fd12e68f7e2e83f2f7df102503b1fb47f2579 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:40:10 +0200 Subject: [PATCH 047/318] diffutils: enable strictDeps --- pkgs/by-name/di/diffutils/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/di/diffutils/package.nix b/pkgs/by-name/di/diffutils/package.nix index ecbd00ec0094..0bd3a9f3cf97 100644 --- a/pkgs/by-name/di/diffutils/package.nix +++ b/pkgs/by-name/di/diffutils/package.nix @@ -42,6 +42,8 @@ stdenv.mkDerivation rec { # If no explicit coreutils is given, use the one from stdenv. buildInputs = [ coreutils ]; + strictDeps = true; + # Disable stack-related gnulib tests on x86_64-darwin because they have problems running under # Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow and test-sigaction fail. # Disable all gnulib tests when building on Darwin due to test-nl_langinfo-mt failure From b5c3bd029bf468da96331f737aca74b4a77965fb Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:40:21 +0200 Subject: [PATCH 048/318] diffutils: enable structuredAttrs, use finalAttrs --- pkgs/by-name/di/diffutils/package.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/di/diffutils/package.nix b/pkgs/by-name/di/diffutils/package.nix index 0bd3a9f3cf97..ad36dd91eed9 100644 --- a/pkgs/by-name/di/diffutils/package.nix +++ b/pkgs/by-name/di/diffutils/package.nix @@ -12,12 +12,12 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "diffutils"; version = "3.12"; src = fetchurl { - url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz"; + url = "mirror://gnu/diffutils/diffutils-${finalAttrs.version}.tar.xz"; hash = "sha256-fIt/n8hgkUH96pzs6FJJ0whiQ5H/Yd7a9Sj8szdyff0="; }; @@ -80,6 +80,8 @@ stdenv.mkDerivation rec { # Test failure on QEMU only (#300550) doCheck = !stdenv.buildPlatform.isRiscV64; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/diffutils/diffutils.html"; description = "Commands for showing the differences between files (diff, cmp, etc.)"; @@ -90,4 +92,4 @@ stdenv.mkDerivation rec { helsinki-Jo ]; }; -} +}) From 2dd210f97759d908eb12aeb001c9e6957f3e23ee Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:41:23 +0200 Subject: [PATCH 049/318] gnum4: enable structuredAttrs --- pkgs/by-name/gn/gnum4/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gn/gnum4/package.nix b/pkgs/by-name/gn/gnum4/package.nix index 73c5be0ac04e..78e02d2698fa 100644 --- a/pkgs/by-name/gn/gnum4/package.nix +++ b/pkgs/by-name/gn/gnum4/package.nix @@ -47,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: { ] ++ lib.optional stdenv.hostPlatform.isMinGW "CFLAGS=-fno-stack-protector"; + __structuredAttrs = true; + meta = { description = "GNU M4, a macro processor"; longDescription = '' From 5fb27e0291facb7a80e7c091944952efffb7dc11 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:45:19 +0200 Subject: [PATCH 050/318] gettext: enable structuredAttrs, use finalAttrs --- pkgs/development/libraries/gettext/default.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix index 6814348c1d24..7c3333a95d17 100644 --- a/pkgs/development/libraries/gettext/default.nix +++ b/pkgs/development/libraries/gettext/default.nix @@ -12,12 +12,12 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "gettext"; version = "1.0"; src = fetchurl { - url = "mirror://gnu/gettext/${pname}-${version}.tar.gz"; + url = "mirror://gnu/gettext/gettext-${finalAttrs.version}.tar.gz"; hash = "sha256-hdmbecmBpASHTALgNCF2z3XHaY4rUf5BAxz2Um2XTxo="; }; patches = [ @@ -103,6 +103,8 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; enableParallelChecking = false; # fails sometimes + __structuredAttrs = true; + meta = { description = "Well integrated set of translation tools and documentation"; @@ -135,4 +137,4 @@ stdenv.mkDerivation rec { // lib.optionalAttrs stdenv.hostPlatform.isDarwin { makeFlags = [ "CFLAGS=-D_FORTIFY_SOURCE=0" ]; -} +}) From 5530de9cca3fb9f3c17d5bc87a9bfdae5da5734b Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:48:27 +0200 Subject: [PATCH 051/318] bison: enable structuredAttrs --- pkgs/by-name/bi/bison/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/bi/bison/package.nix b/pkgs/by-name/bi/bison/package.nix index db0d43a5a3ca..ec4c397b80ab 100644 --- a/pkgs/by-name/bi/bison/package.nix +++ b/pkgs/by-name/bi/bison/package.nix @@ -50,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: { # TODO: enable doInstallCheck unconditionally when fixed upstream. doInstallCheck = !stdenv.cc.isClang; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/bison/"; description = "Yacc-compatible parser generator"; From 3211eabb3132faa5621c179ee1bd7afbcb9a3620 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:51:46 +0200 Subject: [PATCH 052/318] gettext: move makeFlags into the main attrset This saves a big reformatting with finalAttrs and is maybe a bit cleaner? --- pkgs/development/libraries/gettext/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix index 7c3333a95d17..aa242f4e262a 100644 --- a/pkgs/development/libraries/gettext/default.nix +++ b/pkgs/development/libraries/gettext/default.nix @@ -45,6 +45,10 @@ stdenv.mkDerivation (finalAttrs: { "gl_cv_func_wcwidth_works=yes" ]; + makeFlags = lib.optionals stdenv.hostPlatform.isDarwin [ + "CFLAGS=-D_FORTIFY_SOURCE=0" + ]; + postPatch = '' # Older versions of gettext come with a copy of `extern-inline.m4` that is not compatible with clang 18. # When a project uses gettext + autoreconfPhase, autoreconfPhase will invoke `autopoint -f`, which will @@ -133,8 +137,4 @@ stdenv.mkDerivation (finalAttrs: { license = lib.licenses.gpl2Plus; platforms = lib.platforms.all; }; -} - -// lib.optionalAttrs stdenv.hostPlatform.isDarwin { - makeFlags = [ "CFLAGS=-D_FORTIFY_SOURCE=0" ]; }) From 67d950f1b9c6b4aa3ab4c97a1accaa4133e5bb2b Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 00:03:32 +0200 Subject: [PATCH 053/318] gmp: enable structuredAttrs, use finalAttrs The flags "--disable-static --enable-shared" must be split for structuredAttrs, the other changes to configureFlags are cosmetic (but consistent). --- pkgs/development/libraries/gmp/6.x.nix | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/pkgs/development/libraries/gmp/6.x.nix b/pkgs/development/libraries/gmp/6.x.nix index 76b54b479c5d..6a81bdf49c04 100644 --- a/pkgs/development/libraries/gmp/6.x.nix +++ b/pkgs/development/libraries/gmp/6.x.nix @@ -14,19 +14,19 @@ # files. let - inherit (lib) optional; + inherit (lib) optionals; in let - self = stdenv.mkDerivation rec { + self = stdenv.mkDerivation (finalAttrs: { pname = "gmp${lib.optionalString cxx "-with-cxx"}"; version = "6.3.0"; src = fetchurl { # we need to use bz2, others aren't in bootstrapping stdenv urls = [ - "mirror://gnu/gmp/gmp-${version}.tar.bz2" - "ftp://ftp.gmplib.org/pub/gmp-${version}/gmp-${version}.tar.bz2" + "mirror://gnu/gmp/gmp-${finalAttrs.version}.tar.bz2" + "ftp://ftp.gmplib.org/pub/gmp-${finalAttrs.version}/gmp-${finalAttrs.version}.tar.bz2" ]; hash = "sha256-rCghGnz7YJuuLiyNYFjWbI/pZDT3QM9v4uR7AA0cIMs="; }; @@ -65,11 +65,18 @@ let # broken on multicore CPUs). Avoid this impurity. "--build=${stdenv.buildPlatform.config}" ] - ++ optional (cxx && stdenv.hostPlatform.isDarwin) "CPPFLAGS=-fexceptions" - ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) "ABI=64" + ++ optionals (cxx && stdenv.hostPlatform.isDarwin) [ + "CPPFLAGS=-fexceptions" + ] + ++ optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) [ + "ABI=64" + ] # to build a .dll on windows, we need --disable-static + --enable-shared # see https://gmplib.org/manual/Notes-for-Particular-Systems.html - ++ optional (!withStatic && stdenv.hostPlatform.isPE) "--disable-static --enable-shared"; + ++ optionals (!withStatic && stdenv.hostPlatform.isPE) [ + "--disable-static" + "--enable-shared" + ]; doCheck = true; # not cross; @@ -77,6 +84,8 @@ let enableParallelBuilding = true; + __structuredAttrs = true; + meta = { homepage = "https://gmplib.org/"; description = "GNU multiple precision arithmetic library"; @@ -112,6 +121,6 @@ let platforms = lib.platforms.all; maintainers = with lib.maintainers; [ coolcuber ]; }; - }; + }); in self From 2e412b377ae5686d64f6e5b8a800ba492c6f7db3 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 00:12:50 +0200 Subject: [PATCH 054/318] libmpc: enable structuredAttrs --- pkgs/by-name/li/libmpc/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libmpc/package.nix b/pkgs/by-name/li/libmpc/package.nix index 4bfea7b7bd24..d29fcc4dc70b 100644 --- a/pkgs/by-name/li/libmpc/package.nix +++ b/pkgs/by-name/li/libmpc/package.nix @@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: { doCheck = true; # not cross; + __structuredAttrs = true; + meta = { description = "Library for multiprecision complex arithmetic with exact rounding"; From a2f8d03cf5d4a93d99affdd2fd714630dd7eddb6 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 00:38:46 +0200 Subject: [PATCH 055/318] mpfr: enable structuredAttrs, use finalAttrs --- pkgs/by-name/mp/mpfr/package.nix | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/mp/mpfr/package.nix b/pkgs/by-name/mp/mpfr/package.nix index f9db385a11cb..579523e45309 100644 --- a/pkgs/by-name/mp/mpfr/package.nix +++ b/pkgs/by-name/mp/mpfr/package.nix @@ -12,14 +12,14 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { version = "4.2.2"; pname = "mpfr"; src = fetchurl { urls = [ - "https://www.mpfr.org/${pname}-${version}/${pname}-${version}.tar.xz" - "mirror://gnu/mpfr/${pname}-${version}.tar.xz" + "https://www.mpfr.org/mpfr-${finalAttrs.version}/mpfr-${finalAttrs.version}.tar.xz" + "mirror://gnu/mpfr/mpfr-${finalAttrs.version}.tar.xz" ]; hash = "sha256-tnugOD736KhWNzTi6InvXsPDuJigHQD6CmhprYHGzgE="; }; @@ -67,10 +67,12 @@ stdenv.mkDerivation rec { # Expect the text in format of 'GNU MPFR version 4.1.1' new_version="$(curl -s https://www.mpfr.org/mpfr-current/ | pcre2grep -o1 'GNU MPFR version ([0-9.]+)')" - update-source-version ${pname} "$new_version" + update-source-version ${finalAttrs.pname} "$new_version" ''; }; + __structuredAttrs = true; + meta = { homepage = "https://www.mpfr.org/"; description = "Library for multiple-precision floating-point arithmetic"; @@ -92,4 +94,4 @@ stdenv.mkDerivation rec { maintainers = [ ]; platforms = lib.platforms.all; }; -} +}) From 56f1baddcabcd18431e340e6f372bcc1016e1163 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 00:50:21 +0200 Subject: [PATCH 056/318] zlib: enable structuredAttrs --- pkgs/development/libraries/zlib/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix index d1ade7177909..a400e4b60c63 100644 --- a/pkgs/development/libraries/zlib/default.nix +++ b/pkgs/development/libraries/zlib/default.nix @@ -161,6 +161,8 @@ stdenv.mkDerivation (finalAttrs: { inherit minizip; }; + __structuredAttrs = true; + meta = { homepage = "https://zlib.net"; description = "Lossless data-compression library"; From 48e25ca7b0604842834caac87129dc27e15b51ac Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 00:54:53 +0200 Subject: [PATCH 057/318] texinfo: enable structuredAttrs --- pkgs/development/tools/misc/texinfo/common.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix index 00dd5a5811a5..590a98b73fdf 100644 --- a/pkgs/development/tools/misc/texinfo/common.nix +++ b/pkgs/development/tools/misc/texinfo/common.nix @@ -141,6 +141,8 @@ stdenv.mkDerivation { done ''; + __structuredAttrs = true; + meta = meta // { branch = version; }; From 88a48995c2ceca3321f8b8992020ac84be2a4549 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 00:58:51 +0200 Subject: [PATCH 058/318] bash: enable structuredAttrs --- pkgs/shells/bash/5.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix index 5e89c04d4934..07726320556e 100644 --- a/pkgs/shells/bash/5.nix +++ b/pkgs/shells/bash/5.nix @@ -261,6 +261,8 @@ lib.warnIf (withDocs != null) }); }; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/bash/"; description = From bbb94bc73cb8bd7323535648a9b51f016a5e2666 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 01:04:39 +0200 Subject: [PATCH 059/318] isl_0_{20,23,24,27}: enable structuredAttrs --- pkgs/development/libraries/isl/generic.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/isl/generic.nix b/pkgs/development/libraries/isl/generic.nix index 8988e8faf982..232057fe03e7 100644 --- a/pkgs/development/libraries/isl/generic.nix +++ b/pkgs/development/libraries/isl/generic.nix @@ -44,6 +44,8 @@ stdenv.mkDerivation { makeFlags = lib.optional stdenv.hostPlatform.isPE "LDFLAGS=-no-undefined"; + __structuredAttrs = true; + meta = { homepage = "https://libisl.sourceforge.io/"; license = lib.licenses.lgpl21; From 5d290f6ac16f8f5bbc608776ac7a36de4fbcf955 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 01:10:42 +0200 Subject: [PATCH 060/318] gnugrep: enable strictDeps --- pkgs/by-name/gn/gnugrep/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gn/gnugrep/package.nix b/pkgs/by-name/gn/gnugrep/package.nix index 9f0ecedd8792..de2964c6b781 100644 --- a/pkgs/by-name/gn/gnugrep/package.nix +++ b/pkgs/by-name/gn/gnugrep/package.nix @@ -63,6 +63,8 @@ stdenv.mkDerivation { ] ++ lib.optional (!stdenv.hostPlatform.isWindows) runtimeShellPackage; + strictDeps = true; + # cygwin: FAIL: multibyte-white-space # freebsd: FAIL mb-non-UTF8-performance # x86_64-darwin: fails 'stack-overflow' tests on Rosetta 2 emulator From 877c99aeb3a2ab0e2315a6daa22fefe9d90935f1 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 01:10:54 +0200 Subject: [PATCH 061/318] gnugrep: enable structuredAttrs --- pkgs/by-name/gn/gnugrep/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gn/gnugrep/package.nix b/pkgs/by-name/gn/gnugrep/package.nix index de2964c6b781..e5ae6241a47b 100644 --- a/pkgs/by-name/gn/gnugrep/package.nix +++ b/pkgs/by-name/gn/gnugrep/package.nix @@ -99,6 +99,8 @@ stdenv.mkDerivation { NIX_CFLAGS_COMPILE = "-Wno-error=format-security"; }; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/grep/"; description = "GNU implementation of the Unix grep command"; From acd187492f929376d6d024985543a3c8fbcca23b Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 02:02:31 +0200 Subject: [PATCH 062/318] attr: enable strictDeps --- pkgs/development/libraries/attr/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix index 10891ece56a8..f47b57212062 100644 --- a/pkgs/development/libraries/attr/default.nix +++ b/pkgs/development/libraries/attr/default.nix @@ -29,6 +29,8 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ gettext ]; + strictDeps = true; + postPatch = '' for script in install-sh include/install-sh; do patchShebangs $script From 00262951342b4157cb1c83d0fadeee44cfa6ba40 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 02:02:39 +0200 Subject: [PATCH 063/318] attr: enable structuredAttrs, use finalAttrs --- pkgs/development/libraries/attr/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix index f47b57212062..fbab3ffe14c2 100644 --- a/pkgs/development/libraries/attr/default.nix +++ b/pkgs/development/libraries/attr/default.nix @@ -10,12 +10,12 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "attr"; version = "2.6.0"; src = fetchurl { - url = "mirror://savannah/attr/attr-${version}.tar.gz"; + url = "mirror://savannah/attr/attr-${finalAttrs.version}.tar.gz"; hash = "sha256-1C+jdFExgLtIyxGkZpb0iCQOUST/HmrYiwq/9waYVhI="; }; @@ -40,6 +40,8 @@ stdenv.mkDerivation rec { # See nixos/tests/attr.nix doCheck = false; + __structuredAttrs = true; + meta = { homepage = "https://savannah.nongnu.org/projects/attr/"; description = "Library and tools for manipulating extended attributes"; @@ -47,6 +49,6 @@ stdenv.mkDerivation rec { badPlatforms = lib.platforms.microblaze; license = lib.licenses.gpl2Plus; teams = [ lib.teams.security-review ]; - identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" version; + identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" finalAttrs.version; }; -} +}) From 4bbf95ce5360b96edb196de61f2ae2d3967dec02 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 00:45:41 +0200 Subject: [PATCH 064/318] bintools-wrapper: enable structuredAttrs Required substitutions are either explicitly exported in bash code or live in env, so this should just work (?) --- pkgs/build-support/bintools-wrapper/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/build-support/bintools-wrapper/default.nix b/pkgs/build-support/bintools-wrapper/default.nix index 1a9ce996c0dd..69dc6afc9f93 100644 --- a/pkgs/build-support/bintools-wrapper/default.nix +++ b/pkgs/build-support/bintools-wrapper/default.nix @@ -478,6 +478,8 @@ stdenvNoCC.mkDerivation { apple-sdk.__spliced.buildTarget or apple-sdk; }; + __structuredAttrs = true; + meta = let bintools_ = optionalAttrs (bintools != null) bintools; From da2e58bdb3c12c1369480c95dfc56c3663f26120 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 3 Aug 2026 19:15:56 +0000 Subject: [PATCH 065/318] ada: 3.4.4 -> 4.0.0 --- pkgs/by-name/ad/ada/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ad/ada/package.nix b/pkgs/by-name/ad/ada/package.nix index 79878f5a553b..4afbdecb59de 100644 --- a/pkgs/by-name/ad/ada/package.nix +++ b/pkgs/by-name/ad/ada/package.nix @@ -14,13 +14,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "ada"; - version = "3.4.4"; + version = "4.0.0"; src = fetchFromGitHub { owner = "ada-url"; repo = "ada"; tag = "v${finalAttrs.version}"; - hash = "sha256-kfUbsqQ+CsqnySKgeL1GFJLcDe1Irivp4CoZG93BZYg="; + hash = "sha256-TvjoLUKO2+YgS1mlyglLb+rBLTO/SWSBVA2S34Z6kMI="; }; nativeBuildInputs = [ From 15c5c3bfd639ac53e597ee45b60de531fa3e371e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ga=C3=ABl=20James?= Date: Mon, 3 Aug 2026 15:36:02 +0200 Subject: [PATCH 066/318] python3Packages.fastapi: 0.139.0 -> 0.141.1 --- pkgs/development/python-modules/fastapi/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix index 1be0d0d05b02..dd805f9b5a4e 100644 --- a/pkgs/development/python-modules/fastapi/default.nix +++ b/pkgs/development/python-modules/fastapi/default.nix @@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: { pname = "fastapi"; - version = "0.139.0"; + version = "0.141.1"; pyproject = true; __structuredAttrs = true; @@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: { owner = "tiangolo"; repo = "fastapi"; tag = finalAttrs.version; - hash = "sha256-c4balkkmBv7zKRQnYRpRohVjP23m0HvtdiVrJtgNKYo="; + hash = "sha256-5P9aDMS7gLti2CBlrucvjgl4Od1mti9ityPdqxI1RIM="; }; build-system = [ pdm-backend ]; From 6e8d3200c15ed8bf00dd1a30a95154ceefaa573b Mon Sep 17 00:00:00 2001 From: Peder Bergebakken Sundt Date: Tue, 4 Aug 2026 01:17:35 +0200 Subject: [PATCH 067/318] sdl3: 3.4.12 -> 3.4.14 Changelog: https://github.com/libsdl-org/SDL/releases/tag/release-3.4.14 --- pkgs/by-name/sd/sdl3/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix index 9345096f3fa7..c3c6c7af9c6f 100644 --- a/pkgs/by-name/sd/sdl3/package.nix +++ b/pkgs/by-name/sd/sdl3/package.nix @@ -70,7 +70,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to stdenv.mkDerivation (finalAttrs: { pname = "sdl3"; - version = "3.4.12"; + version = "3.4.14"; outputs = [ "lib" @@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "libsdl-org"; repo = "SDL"; tag = "release-${finalAttrs.version}"; - hash = "sha256-b6l3HgdhqIe9LazJmLivbCJgbKPAS8S54fuB9xvgalI="; + hash = "sha256-HzV5Fq+PhJr/dQBCVm2WL1BdaI4GG+W+B0scttjdRuQ="; }; postPatch = From 0e2ae96228d85c31335f6e224bda30280e042f3d Mon Sep 17 00:00:00 2001 From: Yifei Sun Date: Wed, 5 Aug 2026 16:38:08 +0200 Subject: [PATCH 068/318] nixVersions.git: 2.35pre20260619 -> 2.36pre20260804 --- pkgs/tools/package-management/nix/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix index f4e16059c591..e5759acb7273 100644 --- a/pkgs/tools/package-management/nix/default.nix +++ b/pkgs/tools/package-management/nix/default.nix @@ -208,12 +208,12 @@ lib.makeExtensible ( src = fetchFromGitHub { owner = "NixOS"; repo = "nix"; - rev = "f8bb823a23bf6d62f4c8feb792a77702d7a49fe1"; - hash = "sha256-eWBQ01zjUjTF6VyWzmt6fN6jI+vlCDtqYaJG1McIKpc="; + rev = "d8c24e6118d6fb323d4fcd2f311cda9c748452fa"; + hash = "sha256-SbXYrP5NKa1ySGHvPWE0e39PMOczcyeiXTaxMFsv1vs="; }; in (nixDependencies.callPackage ./modular/packages.nix { - version = "2.35pre20260619_${lib.substring 0 8 src.rev}"; + version = "2.36pre20260804_${lib.substring 0 8 src.rev}"; inherit teams; otherSplices = generateSplicesForNixComponents "nixComponents_git"; src = removeFunctionalTests commonDisabledTests src; From ffa600c96f16cf8a244fa71de6acedd095aacd64 Mon Sep 17 00:00:00 2001 From: Austin Horstman Date: Wed, 5 Aug 2026 12:10:18 -0500 Subject: [PATCH 069/318] luaPackages.dkjson: 2.10-1 -> 2.11-1 --- pkgs/development/lua-modules/generated-packages.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix index 12eb150be38c..4b3e5339398c 100644 --- a/pkgs/development/lua-modules/generated-packages.nix +++ b/pkgs/development/lua-modules/generated-packages.nix @@ -811,15 +811,15 @@ final: prev: { }: buildLuarocksPackage { pname = "dkjson"; - version = "2.10-1"; + version = "2.11-1"; knownRockspec = (fetchurl { - url = "mirror://luarocks/dkjson-2.10-1.rockspec"; - sha256 = "0h49fv93h6n32xwwgwvrhb6w5rzvgjzyls6m9xhmcd94pbkih8v2"; + url = "mirror://luarocks/dkjson-2.11-1.rockspec"; + sha256 = "0fkgsqfd0k7pq9j3d1hrhsiha7dc145fbf7hqw0r7lzmp03vjfai"; }).outPath; src = fetchurl { - url = "https://dkolf.de/dkjson-lua/dkjson-2.10.tar.gz"; - sha256 = "092v9m13h7zl89qfgywbs22wdvniwr2lr3shjqrn91f4nl39xiz8"; + url = "https://dkolf.de/dkjson-lua/dkjson-2.11.tar.gz"; + sha256 = "16725vrd5apdxapj641cc0x218vp0ylfcf0z24wfffxwh7v9l5ks"; }; disabled = luaOlder "5.1" || luaAtLeast "5.6"; From f6ad1dd41af3db5f3bcd89d92c74bca768377ae8 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 6 Aug 2026 02:36:41 +0000 Subject: [PATCH 070/318] libblake3: 1.8.5 -> 1.8.6 --- pkgs/by-name/li/libblake3/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libblake3/package.nix b/pkgs/by-name/li/libblake3/package.nix index 08740597b3a3..74cc4afc1445 100644 --- a/pkgs/by-name/li/libblake3/package.nix +++ b/pkgs/by-name/li/libblake3/package.nix @@ -10,7 +10,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "libblake3"; - version = "1.8.5"; + version = "1.8.6"; outputs = [ "out" @@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "BLAKE3-team"; repo = "BLAKE3"; tag = finalAttrs.version; - hash = "sha256-4Oany3uk0759YIZgD1gsONSFU1Mn/GAMvsSeP33J9Ts="; + hash = "sha256-dCRtXHTJnDSJQ2T5bux+ND4e+5uRIoUFn5gYXvMfZi8="; }; sourceRoot = finalAttrs.src.name + "/c"; From 49f78952ada9a4260c3c90f54ed467de5f55196f Mon Sep 17 00:00:00 2001 From: r0chd Date: Thu, 9 Jul 2026 00:26:42 +0200 Subject: [PATCH 071/318] polkit: use finalAttrs instead of rec, drop unused fetchpatch --- pkgs/by-name/po/polkit/package.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix index 723f80bcdc74..62a872bcd4cd 100644 --- a/pkgs/by-name/po/polkit/package.nix +++ b/pkgs/by-name/po/polkit/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchFromGitHub, - fetchpatch, pkg-config, glib, expat, @@ -40,7 +39,7 @@ let system = "/run/current-system/sw"; setuid = "/run/wrappers/bin"; in -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "polkit"; version = "127"; @@ -54,7 +53,7 @@ stdenv.mkDerivation rec { src = fetchFromGitHub { owner = "polkit-org"; repo = "polkit"; - rev = version; + rev = finalAttrs.version; hash = "sha256-YTugETy0rqu/bv53jV1UeGqSK79bRXR52EJNcTblvzo="; }; @@ -193,4 +192,4 @@ stdenv.mkDerivation rec { ]; teams = [ lib.teams.freedesktop ]; }; -} +}) From 42bcfc615e27531473411f03163a042b61e6e9f6 Mon Sep 17 00:00:00 2001 From: r0chd Date: Thu, 9 Jul 2026 00:29:43 +0200 Subject: [PATCH 072/318] polkit: add useConsoleKit option for session tracking --- pkgs/by-name/po/polkit/package.nix | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix index 62a872bcd4cd..381463f368af 100644 --- a/pkgs/by-name/po/polkit/package.nix +++ b/pkgs/by-name/po/polkit/package.nix @@ -21,6 +21,7 @@ docbook_xml_dtd_412, gtk-doc, coreutils, + useConsoleKit ? false, useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs, systemdLibs, elogind, @@ -43,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: { pname = "polkit"; version = "127"; + disallowedReferences = lib.optional useConsoleKit systemdLibs; + outputs = [ "bin" "dev" @@ -94,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: { dbus duktape ] - ++ lib.optionals stdenv.hostPlatform.isLinux [ + ++ lib.optionals (stdenv.hostPlatform.isLinux && !useConsoleKit) [ # On Linux, fall back to elogind when systemd support is off. (if useSystemd then systemdLibs else elogind) ]; @@ -145,7 +148,14 @@ stdenv.mkDerivation (finalAttrs: { "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system" ] ++ lib.optionals stdenv.hostPlatform.isLinux [ - "-Dsession_tracking=${if useSystemd then "logind" else "elogind"}" + "-Dsession_tracking=${ + if useSystemd then + "logind" + else if useConsoleKit then + "ConsoleKit" + else + "elogind" + }" ]; inherit doCheck; From 935889d0981ce4128e6489bc1c9fc834ca649001 Mon Sep 17 00:00:00 2001 From: Ben Siraphob Date: Thu, 6 Aug 2026 16:38:07 -0700 Subject: [PATCH 073/318] duckdb: fix cross compilation Assisted-by: Codex (GPT-5.6-Sol) --- pkgs/by-name/du/duckdb/package.nix | 41 ++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 13 deletions(-) diff --git a/pkgs/by-name/du/duckdb/package.nix b/pkgs/by-name/du/duckdb/package.nix index 9c86d318fa57..555ba3a1cf12 100644 --- a/pkgs/by-name/du/duckdb/package.nix +++ b/pkgs/by-name/du/duckdb/package.nix @@ -5,15 +5,33 @@ cmake, ninja, openssl, - openjdk11, python3, - unixodbc, - withJdbc ? false, - withOdbc ? false, versionCheckHook, }: let + canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform; + # Keep this in sync with DuckDBPlatform() in DuckDB's platform.hpp. + duckdbPlatform = + let + os = + if stdenv.hostPlatform.isWindows then + "windows" + else if stdenv.hostPlatform.isDarwin then + "osx" + else if stdenv.hostPlatform.isFreeBSD then + "freebsd" + else + "linux"; + arch = + if stdenv.hostPlatform.isAarch64 then + "arm64" + else if stdenv.hostPlatform.is64bit then + "amd64" + else + "i686"; + in + "${os}_${arch}${lib.optionalString stdenv.hostPlatform.isMusl "_musl"}${lib.optionalString stdenv.hostPlatform.isMinGW "_mingw"}"; versions = lib.importJSON ./versions.json; in stdenv.mkDerivation (finalAttrs: { @@ -40,22 +58,19 @@ stdenv.mkDerivation (finalAttrs: { ninja python3 ]; - buildInputs = [ - openssl - ] - ++ lib.optionals withJdbc [ openjdk11 ] - ++ lib.optionals withOdbc [ unixodbc ]; + buildInputs = [ openssl ]; cmakeFlags = [ (lib.cmakeFeature "DUCKDB_EXTENSION_CONFIGS" "${finalAttrs.src}/.github/config/in_tree_extensions.cmake") - (lib.cmakeBool "BUILD_ODBC_DRIVER" withOdbc) - (lib.cmakeBool "JDBC_DRIVER" withJdbc) (lib.cmakeFeature "OVERRIDE_GIT_DESCRIBE" "v${finalAttrs.version}-0-g${finalAttrs.rev}") # development settings - (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.doInstallCheck) + (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.finalPackage.doInstallCheck) + ] + ++ lib.optionals (!canExecute) [ + (lib.cmakeFeature "DUCKDB_EXPLICIT_PLATFORM" duckdbPlatform) ]; - doInstallCheck = true; + doInstallCheck = canExecute; nativeInstallCheckInputs = [ versionCheckHook ]; From 35bf5426bff1a58d31ca08dcb4b0876ec727c01e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 7 Aug 2026 06:56:20 +0000 Subject: [PATCH 074/318] unbound: 1.25.2 -> 1.26.0 --- pkgs/by-name/un/unbound/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix index a90eb0b1d364..2dba1d12c66d 100644 --- a/pkgs/by-name/un/unbound/package.nix +++ b/pkgs/by-name/un/unbound/package.nix @@ -63,13 +63,13 @@ assert lib.assertMsg ( ) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)"; stdenv.mkDerivation (finalAttrs: { pname = "unbound"; - version = "1.25.2"; + version = "1.26.0"; src = fetchFromGitHub { owner = "NLnetLabs"; repo = "unbound"; tag = "release-${finalAttrs.version}"; - hash = "sha256-zt0JpVmct7w6ay+p8CdH6SGt/rL/v//e7K3MT8KZfOY="; + hash = "sha256-ESRboc5vwsNZ/Yynl2JGRWhH1QEYZumoTzgSvN3NbSU="; }; outputs = [ From a8c66f9011e8714ade1458b2ad44ab1b679acd4d Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Fri, 7 Aug 2026 08:56:26 +0200 Subject: [PATCH 075/318] python3Packages.python-jenkins: Drop setuptools dependency setuptools isn't used, so drop it. Signed-off-by: Felix Singer --- pkgs/development/python-modules/python-jenkins/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/development/python-modules/python-jenkins/default.nix b/pkgs/development/python-modules/python-jenkins/default.nix index 85ee49cea231..a2a41863d7be 100644 --- a/pkgs/development/python-modules/python-jenkins/default.nix +++ b/pkgs/development/python-modules/python-jenkins/default.nix @@ -6,7 +6,6 @@ mock, pbr, pyyaml, - setuptools, six, multi-key-dict, testscenarios, @@ -40,7 +39,6 @@ buildPythonPackage rec { propagatedBuildInputs = [ pbr pyyaml - setuptools six multi-key-dict requests From c32b01ce6dacf9d1f24e2d96f6fc7081bf16d03d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= Date: Sat, 11 Jul 2026 10:29:10 +0200 Subject: [PATCH 076/318] python3Packages.pbr: use setuptools_80 For jenkins-job-builder. --- pkgs/development/python-modules/pbr/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/pbr/default.nix b/pkgs/development/python-modules/pbr/default.nix index d0ea8d49103c..48b2fad0aa8e 100644 --- a/pkgs/development/python-modules/pbr/default.nix +++ b/pkgs/development/python-modules/pbr/default.nix @@ -4,7 +4,7 @@ callPackage, distutils, fetchPypi, - setuptools, + setuptools_80, }: buildPythonPackage rec { @@ -17,11 +17,11 @@ buildPythonPackage rec { hash = "sha256-tGAE7DClMkZyaD7ISK7Z6PxQCw0mHUCjIpwtK7/O3Ck="; }; - build-system = [ setuptools ]; + build-system = [ setuptools_80 ]; dependencies = [ distutils # for distutils.command in pbr/packaging.py - setuptools # for pkg_resources + setuptools_80 # for pkg_resources ]; # check in passthru.tests.pytest to escape infinite recursion with fixtures From 95fc5507b78df8940ecc247bf780c9101045f34d Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Fri, 7 Aug 2026 08:04:51 +0200 Subject: [PATCH 077/318] python3Packages.testscenarios: Drop setuptools dependency setuptools isn't used, so drop it. Signed-off-by: Felix Singer --- pkgs/development/python-modules/testscenarios/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/development/python-modules/testscenarios/default.nix b/pkgs/development/python-modules/testscenarios/default.nix index 1daf777f6ede..7cc142fd2344 100644 --- a/pkgs/development/python-modules/testscenarios/default.nix +++ b/pkgs/development/python-modules/testscenarios/default.nix @@ -5,7 +5,6 @@ # build-system pbr, - setuptools, # dependencies testtools, @@ -32,7 +31,6 @@ buildPythonPackage rec { nativeBuildInputs = [ pbr - setuptools ]; propagatedBuildInputs = [ From b8c70d6f18afa014d22ec98ef7ca34f13ef677eb Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Fri, 7 Aug 2026 08:57:06 +0200 Subject: [PATCH 078/318] python3Packages.testtools: Drop setuptools dependency setuptools isn't used, so drop it. Signed-off-by: Felix Singer --- pkgs/development/python-modules/testtools/default.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/pkgs/development/python-modules/testtools/default.nix b/pkgs/development/python-modules/testtools/default.nix index 0ea71bcbe6af..0ceb7f1b7db5 100644 --- a/pkgs/development/python-modules/testtools/default.nix +++ b/pkgs/development/python-modules/testtools/default.nix @@ -7,9 +7,6 @@ # build-system hatchling, hatch-vcs, - - # dependencies - setuptools, }: buildPythonPackage rec { @@ -29,8 +26,6 @@ buildPythonPackage rec { pythonRemoveDeps = [ "fixtures" ]; - propagatedBuildInputs = lib.optionals (pythonAtLeast "3.12") [ setuptools ]; - # testscenarios has a circular dependency on testtools doCheck = false; From 96a11d00505a49b5a328651bdd41c26e6187f8af Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Wed, 5 Aug 2026 19:43:36 +0200 Subject: [PATCH 079/318] jenkins-job-builder: 6.4.4 -> 6.5.0 Signed-off-by: Felix Singer --- .../python-modules/jenkins-job-builder/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/jenkins-job-builder/default.nix b/pkgs/development/python-modules/jenkins-job-builder/default.nix index 83e64b65474b..ef3de8c5dee7 100644 --- a/pkgs/development/python-modules/jenkins-job-builder/default.nix +++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix @@ -10,7 +10,7 @@ six, stevedore, pytestCheckHook, - setuptools, + setuptools_80, testtools, pytest-mock, nixosTests, @@ -18,21 +18,21 @@ buildPythonPackage (finalAttrs: { pname = "jenkins-job-builder"; - version = "6.4.4"; + version = "6.5.0"; pyproject = true; # forge at opendev.org does not provide release tarballs src = fetchPypi { pname = "jenkins_job_builder"; inherit (finalAttrs) version; - hash = "sha256-7PpCDpe3KLRpt+R/Nu+qxdDxLKWVqTiCPK3j+nNaum8="; + hash = "sha256-9E3tWR9olpAZrloh/dxsIztz2PJJfRJrPUzMvpuLFJ0="; }; postPatch = '' export HOME=$(mktemp -d) ''; - build-system = [ setuptools ]; + build-system = [ setuptools_80 ]; dependencies = [ pbr From aeac5f8550eee870bfce858ab9b5a717571bad1b Mon Sep 17 00:00:00 2001 From: Eamon Caton Date: Mon, 27 Jul 2026 09:26:29 +0900 Subject: [PATCH 080/318] poppler: fix mat2 build on Darwin by backporting upstream bugfix --- pkgs/development/libraries/poppler/default.nix | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix index c0a00366eac2..cff1f3cbff63 100644 --- a/pkgs/development/libraries/poppler/default.nix +++ b/pkgs/development/libraries/poppler/default.nix @@ -3,6 +3,7 @@ stdenv, fetchurl, fetchFromGitLab, + fetchpatch, cairo, clang-tools, cmake, @@ -62,7 +63,7 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "poppler-${suffix}"; - version = "26.06.0"; # beware: updates often break cups-filters build, check scribus too! + version = "26.06.0"; outputs = [ "out" @@ -74,6 +75,16 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-TLTlo9yMte7HUciiPIuhn2H5be3AzQfSruawyOLPa6Q="; }; + patches = [ + # Backports Darwin crash fix from upstream + # https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1743 + (fetchpatch { + name = "darwin-mutex-lock-crash.patch"; + url = "https://gitlab.freedesktop.org/poppler/poppler/-/commit/08f4bca6a669f9fce75dbab743db559a86591738.patch"; + hash = "sha256-+eWqVK/v3Ys9k2+z/dCoS2o82m039UER1StMUW4PIgM="; + }) + ]; + nativeBuildInputs = [ cmake ninja From 0d6d1e535f58b354b262bc56c96a365bcbb21d2c Mon Sep 17 00:00:00 2001 From: Eamon Caton Date: Wed, 29 Jul 2026 12:51:19 +0900 Subject: [PATCH 081/318] poppler: add gtk3 to test closure for unit tests --- pkgs/development/libraries/poppler/default.nix | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/poppler/default.nix b/pkgs/development/libraries/poppler/default.nix index cff1f3cbff63..580d1fbfb73e 100644 --- a/pkgs/development/libraries/poppler/default.nix +++ b/pkgs/development/libraries/poppler/default.nix @@ -40,6 +40,7 @@ cups-filters, gdal, gegl, + gtk3, inkscape, scribus, vips, @@ -195,9 +196,17 @@ stdenv.mkDerivation (finalAttrs: { gdal = gdal.override { usePoppler = true; }; python-poppler-qt5 = python3.pkgs.poppler-qt5; - pkg-config = testers.hasPkgConfigModules { - package = finalAttrs.finalPackage; - }; + pkg-config = + testers.hasPkgConfigModules { + package = finalAttrs.finalPackage; + } + // lib.optionalAttrs (!minimal) { + # Poppler skips tests unless GTK3 is detected; add to closure + poppler-with-gtk-tests = finalAttrs.finalPackage.overrideAttrs (old: { + pname = "${old.pname}-gtk-tests"; + buildInputs = old.buildInputs ++ [ gtk3 ]; + }); + }; }; }; From ea6542782d73f7a516052acfc458a78869e53df6 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 2 Aug 2026 14:52:55 +0200 Subject: [PATCH 082/318] nixos/nginx: generally turn off MemoryDenyWriteExecute See #384302 for the issues associated with it. --- nixos/modules/services/web-servers/nginx/default.nix | 6 +----- pkgs/servers/http/nginx/modules/lua-upstream/package.nix | 2 -- pkgs/servers/http/nginx/modules/lua/package.nix | 2 -- 3 files changed, 1 insertion(+), 9 deletions(-) diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix index 0a0ccf403ebc..6bf841a0c527 100644 --- a/nixos/modules/services/web-servers/nginx/default.nix +++ b/nixos/modules/services/web-servers/nginx/default.nix @@ -1614,11 +1614,7 @@ in ]; RestrictNamespaces = true; LockPersonality = true; - MemoryDenyWriteExecute = - !( - (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules) - || (lib.getName cfg.package == "openresty") - ); + MemoryDenyWriteExecute = false; # for pcre2 & several plugins RestrictRealtime = true; RestrictSUIDSGID = true; RemoveIPC = true; diff --git a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix index 02e24a2dae9d..8467c16d66e9 100644 --- a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix +++ b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix @@ -19,8 +19,6 @@ mkNginxPlugin (finalAttrs: { buildInputs = [ luajit_openresty ]; - allowMemoryWriteExecute = true; - meta = { description = "Expose Lua API to ngx_lua for Nginx upstreams"; homepage = "https://github.com/openresty/lua-upstream-nginx-module"; diff --git a/pkgs/servers/http/nginx/modules/lua/package.nix b/pkgs/servers/http/nginx/modules/lua/package.nix index f8f45586e4ab..fff949d6a66c 100644 --- a/pkgs/servers/http/nginx/modules/lua/package.nix +++ b/pkgs/servers/http/nginx/modules/lua/package.nix @@ -23,8 +23,6 @@ mkNginxPlugin (finalAttrs: { export LUAJIT_INC="$(realpath ${luajit_openresty}/include/luajit-*)" ''; - allowMemoryWriteExecute = true; - meta = { description = "Embed the Power of Lua"; homepage = "https://github.com/openresty/lua-nginx-module"; From 9ace30d98e53f0a54f897262d0247437274db244 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 2 Aug 2026 14:53:42 +0200 Subject: [PATCH 083/318] nixos/{gitea,forgejo}: remove MemoryDenyWriteExecute We don't use the experimental pcre2 allocator anymore that originally hid the problem. --- nixos/modules/services/misc/forgejo.nix | 2 +- nixos/modules/services/misc/gitea.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix index 6834ca2008ea..5ed68d6df619 100644 --- a/nixos/modules/services/misc/forgejo.nix +++ b/nixos/modules/services/misc/forgejo.nix @@ -777,7 +777,7 @@ in ]; RestrictNamespaces = true; LockPersonality = true; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit RestrictRealtime = true; RestrictSUIDSGID = true; RemoveIPC = true; diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix index 3a0f637c5ca6..6c334776462a 100644 --- a/nixos/modules/services/misc/gitea.nix +++ b/nixos/modules/services/misc/gitea.nix @@ -953,7 +953,7 @@ in ++ lib.optional (useSendmail && config.services.postfix.enable) "AF_NETLINK"; RestrictNamespaces = true; LockPersonality = true; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit RestrictRealtime = true; RestrictSUIDSGID = true; RemoveIPC = true; From 009945d81e58f62d708948506f32df3faadb004a Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 4 Aug 2026 00:22:17 +0200 Subject: [PATCH 084/318] nixos/mympd: rm MemoryDenyWriteExecute This package has a direct dependency on pcre2. By removing the sealloc allocator, which allows MemoryDenyWriteExecute, but is experimental and not recommended for production, this option needs to be turned off again. --- nixos/modules/services/audio/mympd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/audio/mympd.nix b/nixos/modules/services/audio/mympd.nix index 3e728abaa4de..5f0b027d33bf 100644 --- a/nixos/modules/services/audio/mympd.nix +++ b/nixos/modules/services/audio/mympd.nix @@ -108,7 +108,7 @@ in DynamicUser = true; ExecStart = lib.getExe cfg.package; LockPersonality = true; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit PrivateDevices = true; ProtectClock = true; ProtectControlGroups = true; From 202b9427162d400954dbf6bb6fb385bdafb5a6b3 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 4 Aug 2026 00:23:10 +0200 Subject: [PATCH 085/318] nixos/mysql: rm MemoryDenyWriteExecute This package has a direct dependency on pcre2. By removing the sealloc allocator, which allows MemoryDenyWriteExecute, but is experimental and not recommended for production, this option needs to be turned off again. --- nixos/modules/services/databases/mysql.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix index cfd7c8c76af3..9c3d31ea0616 100644 --- a/nixos/modules/services/databases/mysql.nix +++ b/nixos/modules/services/databases/mysql.nix @@ -752,7 +752,7 @@ in "AF_INET6" ]; LockPersonality = true; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit RestrictRealtime = true; RestrictSUIDSGID = true; PrivateMounts = true; From 10f3e6999aecc8119ec12ad7a3b9704bde0d0ce2 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 4 Aug 2026 00:23:31 +0200 Subject: [PATCH 086/318] nixos/cyrus-imap: rm MemoryDenyWriteExecute This package has a direct dependency on pcre2. By removing the sealloc allocator, which allows MemoryDenyWriteExecute, but is experimental and not recommended for production, this option needs to be turned off again. --- nixos/modules/services/mail/cyrus-imap.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/mail/cyrus-imap.nix b/nixos/modules/services/mail/cyrus-imap.nix index 32a9869dd3c7..94b7d35850a8 100644 --- a/nixos/modules/services/mail/cyrus-imap.nix +++ b/nixos/modules/services/mail/cyrus-imap.nix @@ -355,7 +355,7 @@ in PrivateDevices = true; ProtectSystem = "full"; CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ]; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit ProtectKernelModules = true; ProtectKernelTunables = true; ProtectControlGroups = true; From bff0736024ebf610dc6bd298ab0e5eb7ea7e0c01 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 4 Aug 2026 00:23:46 +0200 Subject: [PATCH 087/318] nixos/dovecot: rm MemoryDenyWriteExecute This package has a direct dependency on pcre2. By removing the sealloc allocator, which allows MemoryDenyWriteExecute, but is experimental and not recommended for production, this option needs to be turned off again. --- nixos/modules/services/mail/dovecot.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/mail/dovecot.nix b/nixos/modules/services/mail/dovecot.nix index 48b0795c53c1..950ac5859b62 100644 --- a/nixos/modules/services/mail/dovecot.nix +++ b/nixos/modules/services/mail/dovecot.nix @@ -1061,7 +1061,7 @@ in "CAP_SYS_RESOURCE" ]; LockPersonality = true; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit NoNewPrivileges = false; # e.g for sendmail OOMPolicy = "continue"; PrivateTmp = true; From 8bddb1da20c473bbad815632af120e388cc78c55 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 4 Aug 2026 00:23:58 +0200 Subject: [PATCH 088/318] nixos/postfix: rm MemoryDenyWriteExecute This package has a direct dependency on pcre2. By removing the sealloc allocator, which allows MemoryDenyWriteExecute, but is experimental and not recommended for production, this option needs to be turned off again. --- nixos/modules/services/mail/postfix.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix index 7839796f1a91..758e8c95c470 100644 --- a/nixos/modules/services/mail/postfix.nix +++ b/nixos/modules/services/mail/postfix.nix @@ -1011,7 +1011,7 @@ in PrivateDevices = true; ProtectSystem = "full"; CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ]; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit ProtectKernelModules = true; ProtectKernelTunables = true; ProtectControlGroups = true; From 3f216b4311b2a5531ce91eb10d370dc3335e028b Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 4 Aug 2026 00:24:12 +0200 Subject: [PATCH 089/318] nixos/suricata: rm MemoryDenyWriteExecute This package has a direct dependency on pcre2. By removing the sealloc allocator, which allows MemoryDenyWriteExecute, but is experimental and not recommended for production, this option needs to be turned off again. --- nixos/modules/services/networking/suricata/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/suricata/default.nix b/nixos/modules/services/networking/suricata/default.nix index 2e17655fc1e8..68b44b9d753d 100644 --- a/nixos/modules/services/networking/suricata/default.nix +++ b/nixos/modules/services/networking/suricata/default.nix @@ -270,7 +270,7 @@ in ProtectSystem = "strict"; DevicePolicy = "closed"; LockPersonality = true; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit ProtectHostname = true; ProtectProc = true; ProtectKernelLogs = true; From 1c1d9c499dfd4d82537d333b85bcb818f8eed49d Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Tue, 4 Aug 2026 00:24:35 +0200 Subject: [PATCH 090/318] nixos/unit: rm MemoryDenyWriteExecute This package has a direct dependency on pcre2. By removing the sealloc allocator, which allows MemoryDenyWriteExecute, but is experimental and not recommended for production, this option needs to be turned off again. --- nixos/modules/services/web-servers/unit/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-servers/unit/default.nix b/nixos/modules/services/web-servers/unit/default.nix index 301f01b5cf48..a1f6be076e2f 100644 --- a/nixos/modules/services/web-servers/unit/default.nix +++ b/nixos/modules/services/web-servers/unit/default.nix @@ -139,7 +139,7 @@ in "AF_INET6" ]; LockPersonality = true; - MemoryDenyWriteExecute = true; + MemoryDenyWriteExecute = false; # pcre2 jit RestrictRealtime = true; RestrictSUIDSGID = true; PrivateMounts = true; From 1e9bd5d98ffecc4401b30b13b99e0c3945273e7b Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 2 Aug 2026 14:51:49 +0200 Subject: [PATCH 091/318] pcre2: remove withJitSealloc Replaces/Closes #384302 The problem with this allocator is that it's unstable not recommended for general use. Remove it entirely. This means that software using pcre2 and MemoryDenyWriteExecute=yes in their units is broken with this commit. --- pkgs/by-name/pc/pcre2/package.nix | 7 +------ pkgs/development/interpreters/php/default.nix | 3 --- 2 files changed, 1 insertion(+), 9 deletions(-) diff --git a/pkgs/by-name/pc/pcre2/package.nix b/pkgs/by-name/pc/pcre2/package.nix index d846f87c0e42..91f18224b430 100644 --- a/pkgs/by-name/pc/pcre2/package.nix +++ b/pkgs/by-name/pc/pcre2/package.nix @@ -3,9 +3,6 @@ stdenv, fetchurl, updateAutotoolsGnuConfigScriptsHook, - # Causes consistent segfaults on ELFv1 PPC64 when trying to use Perl regex in gnugrep - # https://github.com/PCRE2Project/pcre2/issues/762 - withJitSealloc ? !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isAbiElfv1), }: stdenv.mkDerivation (finalAttrs: { @@ -28,9 +25,7 @@ stdenv.mkDerivation (finalAttrs: { "--enable-pcre2-32" # only enable jit on supported platforms which excludes Apple Silicon, see https://github.com/zherczeg/sljit/issues/51 "--enable-jit=${if stdenv.hostPlatform.isS390x then "no" else "auto"}" - ] - # fix pcre jit in systemd units that set MemoryDenyWriteExecute=true like gitea - ++ lib.optional withJitSealloc "--enable-jit-sealloc"; + ]; outputs = [ "bin" diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix index 28d68b002166..2222676354bd 100644 --- a/pkgs/development/interpreters/php/default.nix +++ b/pkgs/development/interpreters/php/default.nix @@ -12,9 +12,6 @@ let let base = callPackage ./generic.nix { stdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv; - pcre2 = pcre2.override { - withJitSealloc = false; # See https://bugs.php.net/bug.php?id=78927 and https://bugs.php.net/bug.php?id=78630 - }; inherit version hash; }; in From b8633aab225ee3848c8273e95bdd0d754f8a6123 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Fri, 7 Aug 2026 21:59:18 -0400 Subject: [PATCH 092/318] libcanberra: replace systemd dependency with systemdLibs --- pkgs/by-name/li/libcanberra/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/li/libcanberra/package.nix b/pkgs/by-name/li/libcanberra/package.nix index c9148035ba31..95edb352b9bf 100644 --- a/pkgs/by-name/li/libcanberra/package.nix +++ b/pkgs/by-name/li/libcanberra/package.nix @@ -12,8 +12,8 @@ gst_all_1, libvorbis, libcap, - withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, - systemd, + withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs, + systemdLibs, withAlsa ? stdenv.hostPlatform.isLinux, alsa-lib, }: @@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optional (gtkSupport == "gtk2") gtk2-x11 ++ lib.optional (gtkSupport == "gtk3") gtk3-x11 ++ lib.optional stdenv.hostPlatform.isLinux libcap - ++ lib.optional withSystemd systemd + ++ lib.optional withSystemd systemdLibs ++ lib.optional withAlsa alsa-lib; configureFlags = [ From 27d2abf6dda2494b19095ea6ba9cd05ff71bd8f9 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Fri, 7 Aug 2026 22:07:52 -0400 Subject: [PATCH 093/318] appstream: replace systemd dependency with systemdLibs --- pkgs/development/libraries/appstream/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/appstream/default.nix b/pkgs/development/libraries/appstream/default.nix index 095a87c4d853..61d93622913e 100644 --- a/pkgs/development/libraries/appstream/default.nix +++ b/pkgs/development/libraries/appstream/default.nix @@ -32,13 +32,13 @@ pango, librsvg, bash-completion, - systemd, + systemdLibs, nixosTests, testers, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages, - withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, + withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs, }: stdenv.mkDerivation (finalAttrs: { @@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: { bash-completion ] ++ lib.optionals withSystemd [ - systemd + systemdLibs ]; mesonFlags = [ From 062b060406e488282234810378a438e205d8404c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 8 Aug 2026 07:29:58 +0000 Subject: [PATCH 094/318] graphviz: 15.1.0 -> 15.1.1 --- pkgs/by-name/gr/graphviz/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gr/graphviz/package.nix b/pkgs/by-name/gr/graphviz/package.nix index 6eae0490bca2..1a0439dbe8cc 100644 --- a/pkgs/by-name/gr/graphviz/package.nix +++ b/pkgs/by-name/gr/graphviz/package.nix @@ -40,13 +40,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "graphviz"; - version = "15.1.0"; + version = "15.1.1"; src = fetchFromGitLab { owner = "graphviz"; repo = "graphviz"; tag = finalAttrs.version; - hash = "sha256-5v/ib8hwqHrJLs+jvDGvg0aJiKIt8ipXEd1EUzew7XU="; + hash = "sha256-nDuLQfYu0fzJXS8/oH6Bv9gGuLK+FwwgbPQE+nVKelw="; }; nativeBuildInputs = [ From 72ae5b355f3c9d9d101e4cfd18d47007228b0c0d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 8 Aug 2026 08:31:34 +0000 Subject: [PATCH 095/318] libsodium: 1.0.22-unstable-2026-07-08 -> 1.0.22-unstable-2026-07-31 --- pkgs/by-name/li/libsodium/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/li/libsodium/package.nix b/pkgs/by-name/li/libsodium/package.nix index 4b27cbb4c759..240617b896eb 100644 --- a/pkgs/by-name/li/libsodium/package.nix +++ b/pkgs/by-name/li/libsodium/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libsodium"; - version = "1.0.22-unstable-2026-07-08"; + version = "1.0.22-unstable-2026-07-31"; src = fetchFromGitHub { owner = "jedisct1"; repo = "libsodium"; - rev = "77a422c85a3b8b487de50c811b38d18394831ba6"; - hash = "sha256-Ahka2PnrmYvTLjZMzik5mFsxhDpMLRMKT/I5ftUb0Xc="; + rev = "701aa826b97dc84a353d70a551d49dc26da539c5"; + hash = "sha256-vJK7nuvy22EWCdau9cn4HOvO8XDiVQXwf/zwhq9R9Jg="; }; outputs = [ From 14f4b7af5a50acfeac4814d0554576a3f8d43ec4 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 8 Aug 2026 09:44:26 +0000 Subject: [PATCH 096/318] geoclue2: 2.8.1 -> 2.8.2 --- pkgs/by-name/ge/geoclue2/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ge/geoclue2/package.nix b/pkgs/by-name/ge/geoclue2/package.nix index 951d6e1444c1..a2cf3a7ee8ee 100644 --- a/pkgs/by-name/ge/geoclue2/package.nix +++ b/pkgs/by-name/ge/geoclue2/package.nix @@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "geoclue"; - version = "2.8.1"; + version = "2.8.2"; outputs = [ "out" @@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "geoclue"; repo = "geoclue"; tag = finalAttrs.version; - hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg="; + hash = "sha256-fjF0yd3+b+q3gTW2PpPNFE6zQafilj/g9rXWSgs/XGE="; }; patches = [ From 4a7534d8a03f667c3cb2e29f047e9d8adf1f6f77 Mon Sep 17 00:00:00 2001 From: K900 Date: Sat, 8 Aug 2026 16:29:59 +0300 Subject: [PATCH 097/318] fmt: unconditionalize patch --- pkgs/development/libraries/fmt/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix index 641a91d75629..a3bcaac532e9 100644 --- a/pkgs/development/libraries/fmt/default.nix +++ b/pkgs/development/libraries/fmt/default.nix @@ -106,7 +106,7 @@ in version = "12.2.0"; hash = "sha256-Tc7PmNxUv7ajw6GaHPGEEtrD/fl6is7RB8TPestJa1o="; - patches = lib.optionals stdenv.is32bit [ + patches = [ # fix build on 32-bit targets # FIXME: remove in next update (fetchpatch { From f8629eeb4bd1f78b65bad68576a6d560a10f47ce Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:45:13 +0000 Subject: [PATCH 098/318] perlPackages.CSSMinifierXS: 0.13 -> 0.15 Fixes CVE-2026-13593. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 34f6193bc6a3..42bf62c3f28c 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -7965,10 +7965,10 @@ with self; CSSMinifierXS = buildPerlPackage { pname = "CSS-Minifier-XS"; - version = "0.13"; + version = "0.15"; src = fetchurl { - url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.13.tar.gz"; - hash = "sha256-xBnjCM3IKvHCXWuNB7L/JjR6Yit6Y+wghWq+jbQFH4I="; + url = "mirror://cpan/authors/id/G/GT/GTERMARS/CSS-Minifier-XS-0.15.tar.gz"; + hash = "sha256-iprSIxYtpGceP4EsSlXyl3OUg70xar2kH0wn6K3XhVM="; }; buildInputs = [ TestDiagINC ]; meta = { From 27574bbdf94ffde412ac7343ae367dca5785e4d8 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:47:39 +0000 Subject: [PATCH 099/318] perlPackages.CGISession: 4.48 -> 4.49 Fixes CVE-2026-56016 in CGI::Session::ID::md5. The fix replaces rand() with Crypt::SysRandom. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 42bf62c3f28c..6ad90958887a 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -4627,12 +4627,15 @@ with self; CGISession = buildPerlModule { pname = "CGI-Session"; - version = "4.48"; + version = "4.49"; src = fetchurl { - url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.48.tar.gz"; - hash = "sha256-RnVkYcJM52ZrgQjduW26thJpnfMBLIDvEQFmGf4VVPc="; + url = "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-4.49.tar.gz"; + hash = "sha256-X9iKgwo19UUmeH8DauXkp9FLYcQUzSmthjG/RuaXEgc="; }; - propagatedBuildInputs = [ CGI ]; + propagatedBuildInputs = [ + CGI + CryptSysRandom + ]; meta = { description = "Persistent session data in CGI applications"; license = lib.licenses.artistic1; From aa5e047da036ff9e1165a1323e09e49b438537c8 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:48:17 +0000 Subject: [PATCH 100/318] perlPackages.HTMLGumbo: 0.18 -> 0.20 Fixes CVE-2025-15646. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 6ad90958887a..71ceeeb645a2 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -16376,10 +16376,10 @@ with self; HTMLGumbo = buildPerlModule { pname = "HTML-Gumbo"; - version = "0.18"; + version = "0.20"; src = fetchurl { - url = "mirror://cpan/authors/id/R/RU/RUZ/HTML-Gumbo-0.18.tar.gz"; - hash = "sha256-v1C2HCRlbMP8lYYC2AqcfQFyR6842Nv6Dp3sW3VCXV8="; + url = "mirror://cpan/authors/id/B/BP/BPS/HTML-Gumbo-0.20.tar.gz"; + hash = "sha256-ImEK+8bIfgZ92E9/EZo9J4Ie1kEwNFU8Ga694iEdiDU="; }; propagatedBuildInputs = [ AlienLibGumbo ]; meta = { From 9f90bb0e193dab691d56860e75aa226e9013e7cc Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Sat, 8 Aug 2026 17:36:40 +0200 Subject: [PATCH 101/318] python3Packages.unittestCheckHook: make discover optional --- .../interpreters/python/hooks/unittest-check-hook.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh index 3ee947e278e6..151ea81cf134 100644 --- a/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh +++ b/pkgs/development/interpreters/python/hooks/unittest-check-hook.sh @@ -10,11 +10,16 @@ unittestCheckPhase() { local -a flagsArray=() # Compatibility layer to the obsolete unittestFlagsArray + if [[ -z "${dontUseUnittestDiscover-}" ]]; then + flagsArray+=("discover") + fi + eval "flagsArray+=(${unittestFlagsArray[*]-})" concatTo flagsArray unittestFlags + echoCmd 'unittest flags' "${flagsArray[@]}" - @pythonCheckInterpreter@ -m unittest discover "${flagsArray[@]}" + @pythonCheckInterpreter@ -m unittest "${flagsArray[@]}" runHook postCheck echo "Finished executing unittestCheckPhase" From 11acdf3f307c8aa708e62655b7eab4832ac732eb Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:49:28 +0000 Subject: [PATCH 102/318] perlPackages.StringUtil: 1.34 -> 1.36 Fixes CVE-2026-14895. Upstream switched from Module::Build to ExtUtils::MakeMaker in 1.35. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 71ceeeb645a2..7b34c7e62275 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -32174,14 +32174,13 @@ with self; }; }; - StringUtil = buildPerlModule { + StringUtil = buildPerlPackage { pname = "String-Util"; - version = "1.34"; + version = "1.36"; src = fetchurl { - url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.34.tar.gz"; - hash = "sha256-MZzozWZTQeVlIfoVXZYqGTKOkNn3A2dlklzN4mclxGk="; + url = "mirror://cpan/authors/id/B/BA/BAKERSCOT/String-Util-1.36.tar.gz"; + hash = "sha256-UXsasyVm/U1ei+I9mTOc47/+4pEsX/KfXclYcP9Pyw4="; }; - buildInputs = [ ModuleBuildTiny ]; meta = { description = "String processing utility functions"; homepage = "https://github.com/scottchiefbaker/String-Util"; From d3988cb7a81aa4dd16169f0d7db4c99513033c48 Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Fri, 5 Jun 2026 06:24:46 +0300 Subject: [PATCH 103/318] iproute2: add `man` output out: 5112K -> 4460K man: 0K -> 652K --- pkgs/by-name/ip/iproute2/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix index 2ad8fa7c8a26..e43cf30bec6b 100644 --- a/pkgs/by-name/ip/iproute2/package.nix +++ b/pkgs/by-name/ip/iproute2/package.nix @@ -34,6 +34,7 @@ stdenv.mkDerivation rec { "out" "dev" "scripts" + "man" ]; configureFlags = [ From d24d4b22cf1283f86b9b7ab9119f8b7745b6684b Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Fri, 5 Jun 2026 06:24:46 +0300 Subject: [PATCH 104/318] iproute2: remove seemingly useless `DOCDIR` also use `--replace-fail` instead of `--replace` `nix store make-content-addressed` gives the same output before and after this change --- pkgs/by-name/ip/iproute2/package.nix | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix index e43cf30bec6b..886f42955dd2 100644 --- a/pkgs/by-name/ip/iproute2/package.nix +++ b/pkgs/by-name/ip/iproute2/package.nix @@ -27,7 +27,7 @@ stdenv.mkDerivation rec { postPatch = '' substituteInPlace Makefile \ - --replace "CC := gcc" "CC ?= $CC" + --replace-fail "CC := gcc" "CC ?= $CC" ''; outputs = [ @@ -45,7 +45,6 @@ stdenv.mkDerivation rec { makeFlags = [ "PREFIX=$(out)" "SBINDIR=$(out)/sbin" - "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs "HDRDIR=$(dev)/include/iproute2" ] ++ lib.optionals stdenv.hostPlatform.isStatic [ From 03c97e7c65791fb395d90c5ed530d354d7180518 Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Thu, 11 Jun 2026 01:50:52 +0300 Subject: [PATCH 105/318] iproute2: use `finalAttrs` does not change the derivation --- pkgs/by-name/ip/iproute2/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix index 886f42955dd2..ba4c27edf6ff 100644 --- a/pkgs/by-name/ip/iproute2/package.nix +++ b/pkgs/by-name/ip/iproute2/package.nix @@ -16,12 +16,12 @@ pkgsStatic, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "iproute2"; version = "7.1.0"; src = fetchurl { - url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${version}.tar.xz"; + url = "mirror://kernel/linux/utils/net/iproute2/iproute2-${finalAttrs.version}.tar.xz"; hash = "sha256-/Z+huVgJQXFXyoPdcpV+MmG9vOiWNTy5NvgK8LM6S1w="; }; @@ -105,4 +105,4 @@ stdenv.mkDerivation rec { fpletz ]; }; -} +}) From f4d68ec73cb33eccd8edbf5e4b69c169c7fa2175 Mon Sep 17 00:00:00 2001 From: SandaruKasa Date: Thu, 11 Jun 2026 01:38:17 +0300 Subject: [PATCH 106/318] iproute2: `strictDeps` & `__structuredAttrs` `nix store make-content-addressed` gives the same output before and after this change --- pkgs/by-name/ip/iproute2/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ip/iproute2/package.nix b/pkgs/by-name/ip/iproute2/package.nix index ba4c27edf6ff..dd3baede3a0f 100644 --- a/pkgs/by-name/ip/iproute2/package.nix +++ b/pkgs/by-name/ip/iproute2/package.nix @@ -86,6 +86,8 @@ stdenv.mkDerivation (finalAttrs: { libbpf ]; + __structuredAttrs = true; + strictDeps = true; enableParallelBuilding = true; passthru.updateScript = gitUpdater { From 33aaeca55443b2db97567b97ea26b700953a12ea Mon Sep 17 00:00:00 2001 From: Michael Daniels Date: Sat, 8 Aug 2026 17:24:20 -0400 Subject: [PATCH 107/318] shadow: 4.20.0 -> 4.20.2 Diff: https://github.com/shadow-maint/shadow/compare/4.20.0...4.20.2 --- pkgs/by-name/sh/shadow/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/sh/shadow/package.nix b/pkgs/by-name/sh/shadow/package.nix index f47476196c2a..5c3c506ca15f 100644 --- a/pkgs/by-name/sh/shadow/package.nix +++ b/pkgs/by-name/sh/shadow/package.nix @@ -33,13 +33,13 @@ in stdenv.mkDerivation (finalAttrs: { pname = "shadow"; - version = "4.20.0"; + version = "4.20.2"; src = fetchFromGitHub { owner = "shadow-maint"; repo = "shadow"; tag = finalAttrs.version; - hash = "sha256-UafTyfK+pmW2wyAQnvHov9KIorf1HSc6haskfv7auHs="; + hash = "sha256-uZQHIRjuXl1QQE5VCbdT6c+NEhFzb06WbjhH2wplU1E="; }; outputs = [ From 5aacebcd9eca53ef64b5eba79121dab6e36cb459 Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Sun, 9 Aug 2026 05:40:55 +0200 Subject: [PATCH 108/318] python3Packages.jsonpatch: migrate to pyproject --- pkgs/development/python-modules/jsonpatch/default.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/jsonpatch/default.nix b/pkgs/development/python-modules/jsonpatch/default.nix index 962ab4d756c7..2255e6fc1e36 100644 --- a/pkgs/development/python-modules/jsonpatch/default.nix +++ b/pkgs/development/python-modules/jsonpatch/default.nix @@ -4,12 +4,13 @@ fetchFromGitHub, jsonpointer, pytestCheckHook, + setuptools, }: buildPythonPackage rec { pname = "jsonpatch"; version = "1.33"; - format = "setuptools"; + pyproject = true; src = fetchFromGitHub { owner = "stefankoegl"; @@ -18,7 +19,9 @@ buildPythonPackage rec { hash = "sha256-JHBB64LExzHQVoFF2xcsqGlNWX/YeEBa1M/TmfeQLWI="; }; - propagatedBuildInputs = [ jsonpointer ]; + build-system = [ setuptools ]; + + dependencies = [ jsonpointer ]; nativeCheckInputs = [ pytestCheckHook ]; From b35f431c0db72720057c30a247c847ccad84846f Mon Sep 17 00:00:00 2001 From: Sigmanificient Date: Sun, 9 Aug 2026 05:41:50 +0200 Subject: [PATCH 109/318] python3Packages.jsonpatch: use finalAttrs, __structuredAttrs --- pkgs/development/python-modules/jsonpatch/default.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/jsonpatch/default.nix b/pkgs/development/python-modules/jsonpatch/default.nix index 2255e6fc1e36..ebff042dfe12 100644 --- a/pkgs/development/python-modules/jsonpatch/default.nix +++ b/pkgs/development/python-modules/jsonpatch/default.nix @@ -7,15 +7,17 @@ setuptools, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "jsonpatch"; version = "1.33"; + + __structuredAttrs = true; pyproject = true; src = fetchFromGitHub { owner = "stefankoegl"; repo = "python-json-patch"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-JHBB64LExzHQVoFF2xcsqGlNWX/YeEBa1M/TmfeQLWI="; }; @@ -35,4 +37,4 @@ buildPythonPackage rec { license = lib.licenses.bsd3; maintainers = [ ]; }; -} +}) From a1f52543006d25261136adff8917b5743ac9887a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 9 Aug 2026 11:08:04 +0000 Subject: [PATCH 110/318] libffi: 3.7.1 -> 3.8.0 --- pkgs/by-name/li/libffiReal/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix index 069f6508d0ce..3d34ab9f068a 100644 --- a/pkgs/by-name/li/libffiReal/package.nix +++ b/pkgs/by-name/li/libffiReal/package.nix @@ -13,13 +13,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "libffi"; - version = "3.7.1"; + version = "3.8.0"; src = fetchurl { url = with finalAttrs; "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz"; - hash = "sha256-1emmY43b0lE921RRjrZ+S75vpwe8wBwQ9iEvCgiNgZ0="; + hash = "sha256-faPi2aFx6woDj1kuytP/K7JVDzSW2Hs7Ka0M9EMMDbQ="; }; # Note: this package is used for bootstrapping fetchurl, and thus From 670a1650c2b924f116a77b493b306bbf2ec7f104 Mon Sep 17 00:00:00 2001 From: robin Date: Sun, 9 Aug 2026 13:52:17 +0200 Subject: [PATCH 111/318] luajit_2_1: 2.1.1774638290 -> 2.1.1785577137 closes https://github.com/NixOS/nixpkgs/issues/548383 Co-authored-by: june --- pkgs/development/interpreters/luajit/2.1.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/interpreters/luajit/2.1.nix b/pkgs/development/interpreters/luajit/2.1.nix index 84c188166673..e7f48f19a432 100644 --- a/pkgs/development/interpreters/luajit/2.1.nix +++ b/pkgs/development/interpreters/luajit/2.1.nix @@ -8,13 +8,13 @@ callPackage ./default.nix { # The patch version is the timestamp of the git commit, # obtain via `cat $(nix-build -A luajit_2_1.src)/.relver` - version = "2.1.1774638290"; + version = "2.1.1785577137"; src = fetchFromGitHub { owner = "LuaJIT"; repo = "LuaJIT"; - rev = "fbb36bb6bfa88716a47c58bcf9ce9f2ef752abac"; - hash = "sha256-BqH66q38mJpIYJgPiSPt7I0B3VLBvuDRRTiMJ7ldkBI="; + rev = "4886b676a698acc4bbdf54adfabb3e33a8c020e8"; + hash = "sha256-3nTyPcphBQN2segb5bxBgvrWHodN/ckRy4AGS8lDL44="; }; inherit self passthruFun; From 933765c9ecd54627caeaf66de401bed8a2ddb7c9 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sun, 9 Aug 2026 13:42:10 +0200 Subject: [PATCH 112/318] nspr: 4.39 -> 4.40 https://github.com/mozilla/nspr/releases/tag/NSPR_4_40_RTM --- pkgs/by-name/ns/nspr/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix index 372a7b3f067f..9784147f643b 100644 --- a/pkgs/by-name/ns/nspr/package.nix +++ b/pkgs/by-name/ns/nspr/package.nix @@ -8,11 +8,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "nspr"; - version = "4.39"; + version = "4.40"; src = fetchurl { url = "mirror://mozilla/nspr/releases/v${finalAttrs.version}/src/nspr-${finalAttrs.version}.tar.gz"; - hash = "sha256-u9Au6HpVZ2Bjpj5byBngIn3iZmtHMHsqATRBTN9CNo4="; + hash = "sha256-wMGITGJ/Pbeng/fHMUxpUiayBDaWeR0VUZ5+BXjBm9w="; }; patches = [ @@ -53,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: { }; meta = { + changelog = "https://github.com/mozilla/nspr/releases/tag/NSPR_${lib.concatStringsSep "_" (lib.splitVersion finalAttrs.version)}_RTM"; homepage = "https://firefox-source-docs.mozilla.org/nspr/index.html"; description = "Netscape Portable Runtime, a platform-neutral API for system-level and libc-like functions"; maintainers = with lib.maintainers; [ From a617c0f9ec4a370e7dd74ae403089c4da733cfe9 Mon Sep 17 00:00:00 2001 From: Tom Hunze Date: Sun, 9 Aug 2026 17:48:30 +0200 Subject: [PATCH 113/318] python3Packages.tkinter: build with tcl/tk 9.0 for python 3.14+ Upstream Python 3.14 ships with tcl/tk 9.0 since Python 3.14.7 [1]. For Python 3.15+, also the tkinter documentation states that binary releases are bundled with tcl/tk 9.0 [2]. [1] https://github.com/python/cpython/issues/124111 [2] https://docs.python.org/3.15/library/tkinter.html --- pkgs/top-level/python-packages.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 733cdd484cf1..760f75e394dd 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -20458,8 +20458,8 @@ self: super: with self; { # Tcl/Tk 9.0 support in Tkinter is not quite ready yet: # - https://github.com/python/cpython/issues/124111 # - https://github.com/python/cpython/issues/104568 - tcl = pkgs.tcl-8_6; - tk = pkgs.tk-8_6; + tcl = if pythonAtLeast "3.14" then pkgs.tcl-9_0 else pkgs.tcl-8_6; + tk = if pythonAtLeast "3.14" then pkgs.tk-9_0 else pkgs.tk-8_6; }; tkinter-gl = callPackage ../development/python-modules/tkinter-gl { }; From 416c8cc9a08bf3dac7e51a1c49aea1c23a54721f Mon Sep 17 00:00:00 2001 From: averyv Date: Sat, 16 May 2026 22:38:33 +0100 Subject: [PATCH 114/318] mbedtls: enable __structuredAttrs --- pkgs/by-name/mb/mbedtls/generic.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/mb/mbedtls/generic.nix b/pkgs/by-name/mb/mbedtls/generic.nix index b74fe03e288e..8204cd73e95f 100644 --- a/pkgs/by-name/mb/mbedtls/generic.nix +++ b/pkgs/by-name/mb/mbedtls/generic.nix @@ -19,6 +19,7 @@ stdenv.mkDerivation rec { pname = "mbedtls"; inherit version; + __structuredAttrs = true; src = fetchFromGitHub { owner = "Mbed-TLS"; From 5a2bdee423b8107ee7f157c3158b407610b426ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 9 Aug 2026 09:04:52 -0700 Subject: [PATCH 115/318] python3Packages.openai: 2.41.1 -> 2.53.0 Diff: https://github.com/openai/openai-python/compare/v2.41.1...v2.53.0 Changelog: https://github.com/openai/openai-python/blob/v2.53.0/CHANGELOG.md --- .../python-modules/openai/default.nix | 42 +++++++++++++------ 1 file changed, 29 insertions(+), 13 deletions(-) diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix index 41871cd05921..b1dbf302ec82 100644 --- a/pkgs/development/python-modules/openai/default.nix +++ b/pkgs/development/python-modules/openai/default.nix @@ -21,11 +21,17 @@ aiohttp, httpx-aiohttp, + # optional-dependencies (bedock) + botocore, + # optional-dependencies (datalib) numpy, pandas, pandas-stubs, + # optional-dependencies (httpx2) + httpx2, + # optional-dependencies (realtime) websockets, @@ -36,7 +42,7 @@ pytestCheckHook, dirty-equals, inline-snapshot, - nest-asyncio, + jsonschema, pytest-asyncio, pytest-mock, pytest-xdist, @@ -49,16 +55,16 @@ withVoiceHelpers ? true, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "openai"; - version = "2.41.1"; + version = "2.53.0"; pyproject = true; src = fetchFromGitHub { owner = "openai"; repo = "openai-python"; - tag = "v${version}"; - hash = "sha256-jSkBxZY5POlrznhBwFMR2NcL92uGRSYI6BDDC3C7RfU="; + tag = "v${finalAttrs.version}"; + hash = "sha256-XwiSIKjYD07zhx8uIO8wsPWdAASBCJ5KqFUgdk+uaUU="; }; postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"''; @@ -78,21 +84,29 @@ buildPythonPackage rec { tqdm typing-extensions ] - ++ lib.optionals withAiohttp optional-dependencies.aiohttp - ++ lib.optionals withDatalib optional-dependencies.datalib - ++ lib.optionals withRealtime optional-dependencies.realtime - ++ lib.optionals withVoiceHelpers optional-dependencies.voice-helpers; + ++ lib.optionals withAiohttp finalAttrs.passthru.optional-dependencies.aiohttp + ++ lib.optionals withDatalib finalAttrs.passthru.optional-dependencies.datalib + ++ lib.optionals withRealtime finalAttrs.passthru.optional-dependencies.realtime + ++ lib.optionals withVoiceHelpers finalAttrs.passthru.optional-dependencies.voice-helpers; optional-dependencies = { aiohttp = [ aiohttp httpx-aiohttp ]; + bedrock = [ + botocore + ]; datalib = [ numpy pandas pandas-stubs ]; + httpx2 = [ + anyio + httpx + httpx2 + ]; realtime = [ websockets ]; @@ -108,12 +122,14 @@ buildPythonPackage rec { pytestCheckHook dirty-equals inline-snapshot - nest-asyncio + jsonschema pytest-asyncio pytest-mock pytest-xdist respx - ]; + ] + # including pandas-stubs would cause infinite recursion + ++ lib.concatAttrValues (lib.removeAttrs finalAttrs.passthru.optional-dependencies [ "datalib" ]); disabledTestPaths = [ # Test makes network requests @@ -126,8 +142,8 @@ buildPythonPackage rec { meta = { description = "Python client library for the OpenAI API"; homepage = "https://github.com/openai/openai-python"; - changelog = "https://github.com/openai/openai-python/blob/${src.tag}/CHANGELOG.md"; + changelog = "https://github.com/openai/openai-python/blob/${finalAttrs.src.tag}/CHANGELOG.md"; license = lib.licenses.asl20; maintainers = [ lib.maintainers.malo ]; }; -} +}) From cd5bb46c12bebc844ee81cbb8a3068bd2c90d18b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Sun, 9 Aug 2026 09:20:36 -0700 Subject: [PATCH 116/318] python3Packages.openai: don't propagate optional dependencies --- pkgs/development/python-modules/openai/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix index b1dbf302ec82..60af6eade212 100644 --- a/pkgs/development/python-modules/openai/default.nix +++ b/pkgs/development/python-modules/openai/default.nix @@ -49,10 +49,10 @@ respx, # optional-dependencies toggle - withAiohttp ? true, + withAiohttp ? false, withDatalib ? false, - withRealtime ? true, - withVoiceHelpers ? true, + withRealtime ? false, + withVoiceHelpers ? false, }: buildPythonPackage (finalAttrs: { From 4c66635ceb0fc92946ddd287558cb3440c6d0e41 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 16:44:35 +0200 Subject: [PATCH 117/318] bison: enable strictDeps, rework hack --- pkgs/by-name/bi/bison/package.nix | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/bi/bison/package.nix b/pkgs/by-name/bi/bison/package.nix index ec4c397b80ab..b108cc896905 100644 --- a/pkgs/by-name/bi/bison/package.nix +++ b/pkgs/by-name/bi/bison/package.nix @@ -28,10 +28,7 @@ stdenv.mkDerivation (finalAttrs: { "host" ]; - # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell - # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong - # cannot add bash to buildInputs due to infinite recursion - strictDeps = stdenv.hostPlatform != stdenv.buildPlatform; + strictDeps = true; nativeBuildInputs = [ m4 @@ -40,6 +37,13 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optional stdenv.hostPlatform.isSunOS help2man; propagatedBuildInputs = [ m4 ]; + # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell + # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong + # cannot add bash to buildInputs due to infinite recursion + postFixup = lib.optionalString (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) '' + patchShebangs --build $out/bin/yacc + ''; + enableParallelBuilding = true; # tests are flaky / timing sensitive on FreeBSD enableParallelChecking = !stdenv.hostPlatform.isFreeBSD; From 82f41ea74450c3dada7bc877f6b43578883b036f Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 15:33:14 +0200 Subject: [PATCH 118/318] gnugrep: use finalAttrs, substituteInPlace --- pkgs/by-name/gn/gnugrep/package.nix | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-) diff --git a/pkgs/by-name/gn/gnugrep/package.nix b/pkgs/by-name/gn/gnugrep/package.nix index e5ae6241a47b..03b965b7268b 100644 --- a/pkgs/by-name/gn/gnugrep/package.nix +++ b/pkgs/by-name/gn/gnugrep/package.nix @@ -15,16 +15,12 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -let - version = "3.12"; -in - -stdenv.mkDerivation { +stdenv.mkDerivation (finalAttrs: { pname = "gnugrep"; - inherit version; + version = "3.12"; src = fetchurl { - url = "mirror://gnu/grep/grep-${version}.tar.xz"; + url = "mirror://gnu/grep/grep-${finalAttrs.version}.tar.xz"; hash = "sha256-JkmyfA6Q5jLq3NdXvgbG6aT0jZQd5R58D4P/dkCKB7k="; }; @@ -39,13 +35,9 @@ stdenv.mkDerivation { # - on Musl: https://github.com/NixOS/nixpkgs/pull/228714 # - on x86_64-darwin: https://github.com/NixOS/nixpkgs/pull/228714#issuecomment-1576826330 # - when building on Darwin (cross-compilation): test-nl_langinfo-mt fails - postPatch = - if stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin then - '' - sed -i 's:gnulib-tests::g' Makefile.in - '' - else - null; + postPatch = lib.optionalString (stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin) '' + substituteInPlace Makefile.in --replace-fail "gnulib-tests" "" + ''; nativeCheckInputs = [ perl @@ -120,7 +112,7 @@ stdenv.mkDerivation { teams = [ lib.teams.security-review ]; platforms = lib.platforms.all; mainProgram = "grep"; - identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version // { + identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version // { product = "grep"; }; }; @@ -128,4 +120,4 @@ stdenv.mkDerivation { passthru = { inherit pcre2; }; -} +}) From 2c27e0e3ae83b81425193d5b4951584e43265798 Mon Sep 17 00:00:00 2001 From: Johan Herland Date: Mon, 10 Aug 2026 10:02:24 +0000 Subject: [PATCH 119/318] hdrhistogram_c: fix pkgsStatic build pkgsStatic uses a fully static musl toolchain (crtbeginT.o) which cannot link shared objects. The upstream CMakeLists uses its own HDR_HISTOGRAM_BUILD_SHARED option (not BUILD_SHARED_LIBS) to build both libraries unconditionally, causing a linker failure. Disable shared library and programs builds for static targets. Add a postInstall symlink libhdr_histogram.a -> libhdr_histogram_static.a so that the installed pkg-config file (-lhdr_histogram) resolves correctly. Fixes: https://github.com/NixOS/nixpkgs/issues/549561 Assisted-by: Claude Sonnet 4.6 --- pkgs/by-name/hd/hdrhistogram_c/package.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/pkgs/by-name/hd/hdrhistogram_c/package.nix b/pkgs/by-name/hd/hdrhistogram_c/package.nix index 3ebcbe73e089..4c0f3a16cfeb 100644 --- a/pkgs/by-name/hd/hdrhistogram_c/package.nix +++ b/pkgs/by-name/hd/hdrhistogram_c/package.nix @@ -32,6 +32,20 @@ stdenv.mkDerivation (finalAttrs: { validatePkgConfig ]; + cmakeFlags = lib.optionals stdenv.hostPlatform.isStatic [ + (lib.cmakeBool "HDR_HISTOGRAM_BUILD_SHARED" false) + # Examples and tests depend on the shared library target; skip them in + # static builds (tests still run for the regular pkgs.hdrhistogram_c build). + (lib.cmakeBool "HDR_HISTOGRAM_BUILD_PROGRAMS" false) + ]; + + # The .pc file always references -lhdr_histogram, but in static builds only + # libhdr_histogram_static.a is produced. Provide a symlink so pkg-config + # consumers find the right archive. + postInstall = lib.optionalString stdenv.hostPlatform.isStatic '' + ln -s $out/lib/libhdr_histogram_static.a $out/lib/libhdr_histogram.a + ''; + doCheck = true; passthru = { From 54d7f724c55705fcf4d39967d30891074ae9cbbb Mon Sep 17 00:00:00 2001 From: Tom Hunze Date: Mon, 10 Aug 2026 19:01:05 +0200 Subject: [PATCH 120/318] python3Packages.typing-inspection: 0.4.2 -> 0.4.3 Changelog: https://github.com/pydantic/typing-inspection/blob/v0.4.3/HISTORY.md Diff: https://github.com/pydantic/typing-inspection/compare/v0.4.2...v0.4.3 --- .../python-modules/typing-inspection/default.nix | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix index 2da9cae3ad60..5237c7d7ee01 100644 --- a/pkgs/development/python-modules/typing-inspection/default.nix +++ b/pkgs/development/python-modules/typing-inspection/default.nix @@ -9,14 +9,14 @@ buildPythonPackage rec { pname = "typing-inspection"; - version = "0.4.2"; + version = "0.4.3"; pyproject = true; src = fetchFromGitHub { owner = "pydantic"; repo = "typing-inspection"; tag = "v${version}"; - hash = "sha256-aGScO+FLEJ5IyI6hBqdsiKJRN7vEG36V5131nhVZEbc="; + hash = "sha256-jNAMYV9mpUnClLOahQyLisBkOfELcmjKavKJgyxkQr4="; }; build-system = [ hatchling ]; @@ -31,12 +31,6 @@ buildPythonPackage rec { pytestCheckHook ]; - disabledTests = [ - # broken by intentional 3.14.7 behavior change - # reported upstream: https://github.com/pydantic/typing-inspection/issues/55 - "test_literal_values_unhashable_type" - ]; - meta = { changelog = "https://github.com/pydantic/typing-inspection/blob/${src.tag}/HISTORY.md"; description = "Runtime typing introspection tools"; From 7b6d7a9c5b4a2838f2a25ab4ffdf1326491ad822 Mon Sep 17 00:00:00 2001 From: Tom Hunze Date: Mon, 10 Aug 2026 19:01:40 +0200 Subject: [PATCH 121/318] python3Packages.typing-inspection: use finalAttrs --- .../python-modules/typing-inspection/default.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix index 5237c7d7ee01..f763f5f68778 100644 --- a/pkgs/development/python-modules/typing-inspection/default.nix +++ b/pkgs/development/python-modules/typing-inspection/default.nix @@ -7,7 +7,7 @@ typing-extensions, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "typing-inspection"; version = "0.4.3"; pyproject = true; @@ -15,7 +15,7 @@ buildPythonPackage rec { src = fetchFromGitHub { owner = "pydantic"; repo = "typing-inspection"; - tag = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-jNAMYV9mpUnClLOahQyLisBkOfELcmjKavKJgyxkQr4="; }; @@ -32,10 +32,10 @@ buildPythonPackage rec { ]; meta = { - changelog = "https://github.com/pydantic/typing-inspection/blob/${src.tag}/HISTORY.md"; + changelog = "https://github.com/pydantic/typing-inspection/blob/${finalAttrs.src.tag}/HISTORY.md"; description = "Runtime typing introspection tools"; homepage = "https://github.com/pydantic/typing-inspection"; license = lib.licenses.mit; maintainers = with lib.maintainers; [ dotlambda ]; }; -} +}) From 28d2b87c1bcb39bb60d1e5c08a66b02f11c404f2 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Sat, 8 Aug 2026 21:53:21 -0400 Subject: [PATCH 122/318] libinput: specify propagatedBuildOutputs to keep `bin` out of `dev` output --- pkgs/development/libraries/libinput/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix index 17ef7da85270..924696025cf1 100644 --- a/pkgs/development/libraries/libinput/default.nix +++ b/pkgs/development/libraries/libinput/default.nix @@ -61,6 +61,8 @@ stdenv.mkDerivation rec { "dev" ]; + propagatedBuildOutputs = [ "out" ]; + src = fetchFromGitLab { domain = "gitlab.freedesktop.org"; owner = "libinput"; From 58abfa5c4a15ddbe2d9bf6b466d7775ac0409b43 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 11 Aug 2026 11:18:07 +0000 Subject: [PATCH 123/318] mimalloc: 3.3.2 -> 3.4.5 --- pkgs/by-name/mi/mimalloc/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mi/mimalloc/package.nix b/pkgs/by-name/mi/mimalloc/package.nix index 6f4c2362a33e..810596fdfe03 100644 --- a/pkgs/by-name/mi/mimalloc/package.nix +++ b/pkgs/by-name/mi/mimalloc/package.nix @@ -12,13 +12,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "mimalloc"; - version = "3.3.2"; + version = "3.4.5"; src = fetchFromGitHub { owner = "microsoft"; repo = "mimalloc"; tag = "v${finalAttrs.version}"; - hash = "sha256-GZ37qQVDe9jgMb4Coe5oKvgaLTspZDlSkS5rdy1MfUU="; + hash = "sha256-vNVZw2YsDkf0GcdFTNb/fXMQLQYvoc8P425LupPShpo="; }; doCheck = !stdenv.hostPlatform.isStatic; From 16cf4a503d4016ccbd43276cf0da4baf8fc00b51 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 12:20:45 +0200 Subject: [PATCH 124/318] elfutils: enable strictDeps --- pkgs/by-name/el/elfutils/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix index a66af1cb091b..e101ea7cf1ad 100644 --- a/pkgs/by-name/el/elfutils/package.nix +++ b/pkgs/by-name/el/elfutils/package.nix @@ -113,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: { propagatedNativeBuildInputs = [ setupDebugInfoDirs ]; + strictDeps = true; + hardeningDisable = [ "strictflexarrays3" ]; configureFlags = [ From 79a0d9bcb3d0c9fa33cd0de36faea4520e5282e9 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 12:21:03 +0200 Subject: [PATCH 125/318] elfutils: enable structuredAttrs --- pkgs/by-name/el/elfutils/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/el/elfutils/package.nix b/pkgs/by-name/el/elfutils/package.nix index e101ea7cf1ad..b0124617be22 100644 --- a/pkgs/by-name/el/elfutils/package.nix +++ b/pkgs/by-name/el/elfutils/package.nix @@ -146,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: { rev-prefix = "elfutils-"; }; + __structuredAttrs = true; + meta = { homepage = "https://sourceware.org/elfutils/"; description = "Set of utilities to handle ELF objects"; From 522dff49c09ccd06162a42757cd113ddef9a44f2 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 12:26:35 +0200 Subject: [PATCH 126/318] gnutls: enable strictDeps --- pkgs/by-name/gn/gnutls/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gn/gnutls/package.nix b/pkgs/by-name/gn/gnutls/package.nix index c132697abbd7..257b36c69775 100644 --- a/pkgs/by-name/gn/gnutls/package.nix +++ b/pkgs/by-name/gn/gnutls/package.nix @@ -173,6 +173,8 @@ stdenv.mkDerivation rec { propagatedBuildInputs = [ nettle ]; + strictDeps = true; + inherit doCheck; # stdenv's `NIX_SSL_CERT_FILE=/no-cert-file.crt` breaks tests. # Also empty files won't work, and we want to avoid potentially impure /etc/ From 34ed5d8fcf1f744d282f5c0f398d6c35d99d9287 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 12:26:52 +0200 Subject: [PATCH 127/318] gnutls: enable structuredAttrs, use finalAttrs --- pkgs/by-name/gn/gnutls/package.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/gn/gnutls/package.nix b/pkgs/by-name/gn/gnutls/package.nix index 257b36c69775..df21d5943035 100644 --- a/pkgs/by-name/gn/gnutls/package.nix +++ b/pkgs/by-name/gn/gnutls/package.nix @@ -58,12 +58,12 @@ let util-linux = util-linuxMinimal; in -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "gnutls"; version = "3.8.13"; src = fetchurl { - url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor version}/gnutls-${version}.tar.xz"; + url = "mirror://gnupg/gnutls/v${lib.versions.majorMinor finalAttrs.version}/gnutls-${finalAttrs.version}.tar.xz"; hash = "sha256-/+2Owb8JwkJtTxSq43feR1O1PlN9aF5gTpmosWypyX4="; }; @@ -217,6 +217,8 @@ stdenv.mkDerivation rec { static = pkgsStatic.gnutls; }; + __structuredAttrs = true; + meta = { description = "GNU Transport Layer Security Library"; @@ -238,6 +240,6 @@ stdenv.mkDerivation rec { license = lib.licenses.lgpl21Plus; maintainers = with lib.maintainers; [ vcunat ]; platforms = lib.platforms.all; - identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version; + identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version; }; -} +}) From ab0d16db059bf354c8a3d8d154131b4e1137250d Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 13:04:08 +0200 Subject: [PATCH 128/318] ed: enable structuredAttrs --- pkgs/by-name/ed/ed/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ed/ed/package.nix b/pkgs/by-name/ed/ed/package.nix index 8d97434a822d..11d4f49f4742 100644 --- a/pkgs/by-name/ed/ed/package.nix +++ b/pkgs/by-name/ed/ed/package.nix @@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/ed/"; description = "GNU implementation of the standard Unix editor"; From 49076b4ec84292406e66262a7ed7d028dcfe6a6c Mon Sep 17 00:00:00 2001 From: whispers Date: Mon, 10 Aug 2026 21:26:20 -0400 Subject: [PATCH 129/318] expat: 2.8.2 -> 2.8.3 changelog: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes diff: https://github.com/libexpat/libexpat/compare/R_2_8_2...R_2_8_3 Fixes: CVE-2026-72522 --- pkgs/by-name/ex/expat/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix index 2e831ef025da..d0d13e37da6f 100644 --- a/pkgs/by-name/ex/expat/package.nix +++ b/pkgs/by-name/ex/expat/package.nix @@ -23,13 +23,13 @@ in stdenv.mkDerivation (finalAttrs: { pname = "expat"; - version = "2.8.2"; + version = "2.8.3"; src = fetchurl { url = with finalAttrs; "https://github.com/libexpat/libexpat/releases/download/${tagFor version}/${pname}-${version}.tar.xz"; - hash = "sha256-OtibhYjmZEvU5JmBSA1IshKJ7rvNTwoaSvscKfmbarQ="; + hash = "sha256-9iVt+QyQZ3PTRNoIRAK30+TyLtQbGlnJiQmKg9PqDIU="; }; strictDeps = true; From b85b77fdb06f04a41b24f11c887f960ba244df17 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 13:04:36 +0200 Subject: [PATCH 130/318] libtool_1_5: enable strictDeps --- pkgs/development/tools/misc/libtool/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/tools/misc/libtool/default.nix b/pkgs/development/tools/misc/libtool/default.nix index 2fcc7a03626d..648340ad081a 100644 --- a/pkgs/development/tools/misc/libtool/default.nix +++ b/pkgs/development/tools/misc/libtool/default.nix @@ -18,6 +18,8 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ m4 ]; buildInputs = [ perl ]; + strictDeps = true; + # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the # "fixed" path in generated files! dontPatchShebangs = true; From 7231d4909aea12f3639ff43bb7d9d856963730e9 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 13:04:52 +0200 Subject: [PATCH 131/318] libtool_1_5: enable structuredAttrs, use finalAttrs --- pkgs/development/tools/misc/libtool/default.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/misc/libtool/default.nix b/pkgs/development/tools/misc/libtool/default.nix index 648340ad081a..7258279ff072 100644 --- a/pkgs/development/tools/misc/libtool/default.nix +++ b/pkgs/development/tools/misc/libtool/default.nix @@ -6,12 +6,12 @@ perl, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "libtool"; version = "1.5.26"; src = fetchurl { - url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz"; + url = "mirror://gnu/libtool/libtool-${finalAttrs.version}.tar.gz"; sha256 = "029ggq5kri1gjn6nfqmgw4w920gyfzscjjxbsxxidal5zqsawd8w"; }; @@ -25,6 +25,8 @@ stdenv.mkDerivation rec { dontPatchShebangs = true; dontFixLibtool = true; + __structuredAttrs = true; + meta = { description = "Generic library support script"; @@ -45,4 +47,4 @@ stdenv.mkDerivation rec { mainProgram = "libtool"; }; -} +}) From d9d827b829edfa651b86542c34e2a1bfb4e27002 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 13:05:49 +0200 Subject: [PATCH 132/318] libtool: enable structuredAttrs, use finalAttrs --- pkgs/development/tools/misc/libtool/libtool2.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix index 43bc3f4e4852..6f63c5a25249 100644 --- a/pkgs/development/tools/misc/libtool/libtool2.nix +++ b/pkgs/development/tools/misc/libtool/libtool2.nix @@ -13,12 +13,12 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "libtool"; version = "2.6.2"; src = fetchurl { - url = "mirror://gnu/libtool/${pname}-${version}.tar.gz"; + url = "mirror://gnu/libtool/libtool-${finalAttrs.version}.tar.gz"; hash = "sha256-JK2zqprgNccPq6NEr1fXMhXriSgQRa9sfM0wd1H4sL8="; }; @@ -68,6 +68,8 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; + __structuredAttrs = true; + meta = { description = "GNU Libtool, a generic library support script"; longDescription = '' @@ -85,4 +87,4 @@ stdenv.mkDerivation rec { platforms = lib.platforms.unix; mainProgram = "libtool"; }; -} +}) From c651e6c110948c81ea7ec5c86e46e9fa6fdd93a2 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 13:16:14 +0200 Subject: [PATCH 133/318] libiconv: enable strictDeps --- pkgs/development/libraries/libiconv/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix index 294e7a81d5e4..a90ea21d6cfb 100644 --- a/pkgs/development/libraries/libiconv/default.nix +++ b/pkgs/development/libraries/libiconv/default.nix @@ -25,6 +25,8 @@ stdenv.mkDerivation rec { # https://git.savannah.gnu.org/cgit/config.git/commit/?id=e4786449e1c26716e3f9ea182caf472e4dbc96e0 nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ]; + strictDeps = true; + # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593 hardeningDisable = lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify"; From a3a46b2ed29773f210a0afa433f43c0ff8357cb8 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 13:18:39 +0200 Subject: [PATCH 134/318] gnupatch: enable structuredAttrs --- pkgs/by-name/gn/gnupatch/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gn/gnupatch/package.nix b/pkgs/by-name/gn/gnupatch/package.nix index e32573c05048..361365accfb3 100644 --- a/pkgs/by-name/gn/gnupatch/package.nix +++ b/pkgs/by-name/gn/gnupatch/package.nix @@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: { strictDeps = true; + __structuredAttrs = true; + meta = { description = "GNU Patch, a program to apply differences to files"; mainProgram = "patch"; From 7d70798391429da7a7911a5fc07b6e0de84dd413 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 14:09:24 +0200 Subject: [PATCH 135/318] gnumake: enable structuredAttrs, use hash --- pkgs/by-name/gn/gnumake/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/gn/gnumake/package.nix b/pkgs/by-name/gn/gnumake/package.nix index 9f2aa3d764e9..bde1af39133b 100644 --- a/pkgs/by-name/gn/gnumake/package.nix +++ b/pkgs/by-name/gn/gnumake/package.nix @@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "mirror://gnu/make/make-${finalAttrs.version}.tar.gz"; - sha256 = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M="; + hash = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M="; }; # To update patches: @@ -82,6 +82,8 @@ stdenv.mkDerivation (finalAttrs: { gnumakeWithGuile = gnumake.override { guileSupport = true; }; }; + __structuredAttrs = true; + meta = { description = "Tool to control the generation of non-source files from sources"; longDescription = '' From 3bda6b678a764205b2437d761d3ca05a345f0e26 Mon Sep 17 00:00:00 2001 From: Kyle Chui Date: Tue, 14 Jul 2026 17:17:43 +0200 Subject: [PATCH 136/318] auto-patchelf: add --relativize-rpath argument for inferring `$ORIGIN` This adds a `--relativize-rpath` flag, which infers `$ORIGIN` for a shared object's RUNPATH entries if the object and entry both fall under a path provided to auto-patchelf via `--paths`. Sometimes Python wheels distribute shared objects in multiple directories, where the objects in one directory depend on shared objects in another directory. The RUNPATH entries that declare where to find the dependent objects are usually provided as absolute paths, which breaks if the objects are moved around. --- .../au/auto-patchelf/source/auto-patchelf.py | 70 +++++++++++++++++-- 1 file changed, 66 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py index bda5329a1df3..b16c98096360 100644 --- a/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py +++ b/pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py @@ -240,6 +240,35 @@ def find_first_matching_rpath_with_origin(binary: Path, lib_dir: Path, rpaths: l return Path(rpath) return None + +def relativize_rpath_to_origin(*, binary_path: Path, rpath_entries: list[Path], containing_path: Path) -> list[Path]: + """ + Rewrite absolute RPATH entries to use $ORIGIN when the entry sits + under containing_path (the --paths entry the binary was found + under). + + The resulting RPATH is relocatable: as long as the directory layout + within containing_path is preserved, the whole tree can be moved + and the binary will still find its dependencies. + + Entries that already contain $ORIGIN are left untouched. + Entries outside containing_path are also left absolute. + """ + containing_norm: Path = Path(os.path.normpath(containing_path)) + new_rpath_entries: list[Path] = [] + for entry in rpath_entries: + if "$ORIGIN" in entry.as_posix(): + new_rpath_entries.append(entry) + continue + entry_norm: Path = Path(os.path.normpath(entry)) + if not entry_norm.is_relative_to(containing_norm): + new_rpath_entries.append(entry) + continue + rel = os.path.relpath(entry_norm, binary_path.parent) + new_rpath_entries.append(Path("$ORIGIN") / rel) + return new_rpath_entries + + class Event(Protocol): """Protocol for loggable events that occur during the auto-patchelf process.""" def to_human_readable_str(self) -> str: ... @@ -317,7 +346,18 @@ class Logger: -def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], append_rpaths: list[Path] = [], keep_libc: bool = False, preserve_origin: bool = False, extra_args: list[str] = []) -> list[Dependency]: +def auto_patchelf_file( + *, + logger: Logger, + runtime_deps: list[Path], + append_rpaths: list[Path] = [], + keep_libc: bool = False, + preserve_origin: bool = False, + relativize_rpath: bool = False, + extra_args: list[str] = [], + path: Path, + containing_path: Path +) -> list[Dependency]: try: with open_elf(path) as elf: @@ -436,6 +476,9 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app if "$ORIGIN" in existing_rpath: rpath.append(Path(existing_rpath)) + if relativize_rpath: + rpath = relativize_rpath_to_origin(binary_path=path, rpath_entries=rpath, containing_path=containing_path) + # Dedup the rpath rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath))) @@ -458,6 +501,7 @@ def auto_patchelf( append_rpaths: list[Path] = [], keep_libc: bool = False, preserve_origin: bool = False, + relativize_rpath: bool = False, add_existing: bool = True, extra_args: list[str] = []) -> None: @@ -472,9 +516,20 @@ def auto_patchelf( populate_cache(lib_dirs) dependencies = [] - for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch): - if not path.is_symlink() and path.is_file(): - dependencies += auto_patchelf_file(logger, path, runtime_deps, append_rpaths, keep_libc, preserve_origin, extra_args) + for containing_path in paths_to_patch: + for path in glob(containing_path, '*', recursive): + if not path.is_symlink() and path.is_file(): + dependencies += auto_patchelf_file( + logger=logger, + runtime_deps=runtime_deps, + append_rpaths=append_rpaths, + keep_libc=keep_libc, + preserve_origin=preserve_origin, + relativize_rpath=relativize_rpath, + extra_args=extra_args, + path=path, + containing_path=containing_path + ) missing = [dep for dep in dependencies if not dep.found] @@ -560,6 +615,12 @@ def main() -> None: action="store_true", help="When possible, replace absolute RPATH entries with original $ORIGIN entries that resolve to the same directory.", ) + parser.add_argument( + "--relativize-rpath", + dest="relativize_rpath", + action="store_true", + help="Rewrite absolute RPATH entries to use $ORIGIN when the binary and the entry live under the same --paths root, so the patched tree is relocatable.", + ) parser.add_argument( "--ignore-existing", dest="add_existing", @@ -597,6 +658,7 @@ def main() -> None: append_rpaths=args.append_rpaths, keep_libc=args.keep_libc, preserve_origin=args.preserve_origin, + relativize_rpath=args.relativize_rpath, add_existing=args.add_existing, extra_args=args.extra_args) From 191fb7ce4035608c2d56a1750d0acd9aa3582b1c Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Tue, 11 Aug 2026 13:06:05 +0300 Subject: [PATCH 137/318] tests.auto-patchelf-hook-relativize-rpath: init This adds a test for the introduced --relativize-rpath cmdline arg. --- .../default.nix | 88 +++++++++++++++++++ .../lib-baz.c | 10 +++ .../main.py | 10 +++ pkgs/test/default.nix | 2 + 4 files changed, 110 insertions(+) create mode 100644 pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix create mode 100644 pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c create mode 100644 pkgs/test/auto-patchelf-hook-relativize-rpath/main.py diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix b/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix new file mode 100644 index 000000000000..1d1d93025ba9 --- /dev/null +++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/default.nix @@ -0,0 +1,88 @@ +{ + lib, + stdenv, + tests, + autoPatchelfHook, + patchelf, + python3, +}: + +let + foo = tests.stdenv-inputs.foo; + + # Produce a tree containing lib/{baz.so,libs/foo.so}, + # with src/lib/libbaz.so calling code from src/lib/libs/libfoo.so. + # These have absolute paths. + baz-bundle = stdenv.mkDerivation { + name = "baz-bundle"; + + buildCommand = '' + mkdir -p $out/lib/libs + cp ${(lib.getDev foo)}/lib/libfoo.so $out/lib/libs/ + + mkdir -p $out/lib/ + $CC -shared -lfoo -L$out/lib/libs -o $out/lib/libbaz.so ${./lib-baz.c} + ''; + + # No references to the foo store path. + disallowedReferences = [ + (lib.getDev foo) + ]; + }; + + # Make baz-bundle relocatable, by running autopatchelf with the `--relativize-rpath` flag. + # This will replace the `RPATH` of `$out/lib/libbaz.so` from `$out/lib/libs` to `$ORIGIN/libs`. + baz-bundle-relocatable = stdenv.mkDerivation { + name = "baz-bundle-relocatable"; + + nativeBuildInputs = [ + autoPatchelfHook + ]; + + autoPatchelfFlags = [ "--relativize-rpath" ]; + + dontUnpack = true; + + # we don't set buildCommand because we want to ensure fixupPhase + # (containing autoPatchelfHook) is run. + installPhase = '' + mkdir -p $out + cp -R ${baz-bundle}/lib $out/lib + ''; + + # Now these two .so files refer neither to `baz-bundle`, nor contain self-references. + disallowedReferences = [ + baz-bundle + "out" + ]; + }; + +in +# Pretend a user consumed `baz-bundle-relocatable` as an artifact, +# copied to ./libs/baz-bundle, and calls `baz` from `libbaz.so` from their code. +# Ensure this works, which requires `baz()` to still be able to find `foo()`. +stdenv.mkDerivation { + name = "auto-patchelf-hook-relativize-rpath"; + nativeBuildInputs = [ + patchelf + python3 + ]; + + buildCommand = '' + mkdir -p libs/baz-bundle + cp -R ${baz-bundle-relocatable}/lib/* libs/baz-bundle/ + + echo "RPATHs:" + echo -n "libs/baz-bundle/libbaz.so: " + patchelf --print-rpath libs/baz-bundle/libbaz.so + echo -n "libs/baz-bundle/lib/libfoo.so: " + patchelf --print-rpath libs/baz-bundle/libs/libfoo.so + + cp ${./main.py} main.py + python main.py |& tee /dev/stderr | grep -q "foo returned 42" + + touch $out + ''; + + meta.platforms = lib.platforms.linux; +} diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c b/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c new file mode 100644 index 000000000000..e1f62fc5979c --- /dev/null +++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/lib-baz.c @@ -0,0 +1,10 @@ +#include + +extern unsigned int foo(void); + +extern unsigned int baz(void) +{ + fprintf(stderr, "about to call foo()\n"); + fprintf(stderr, "foo returned %d\n", foo()); + return 0; +} diff --git a/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py b/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py new file mode 100644 index 000000000000..cae15e3da5f0 --- /dev/null +++ b/pkgs/test/auto-patchelf-hook-relativize-rpath/main.py @@ -0,0 +1,10 @@ +from pathlib import Path +import ctypes + +lib_path = Path(__file__).parent / "libs/baz-bundle/libbaz.so" +lib = ctypes.CDLL(str(lib_path)) + +lib.baz.restype = ctypes.c_uint +lib.baz.argtypes = [] + +lib.baz() diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix index 35f3f2c8aa82..6acbd0ea637f 100644 --- a/pkgs/test/default.nix +++ b/pkgs/test/default.nix @@ -247,6 +247,8 @@ in auto-patchelf-hook-preserve-origin = callPackage ./auto-patchelf-hook-preserve-origin { }; + auto-patchelf-hook-relativize-rpath = callPackage ./auto-patchelf-hook-relativize-rpath { }; + # Accumulate all passthru.tests from arrayUtilities into a single attribute set. arrayUtilities = recurseIntoAttrs ( concatMapAttrs ( From 312c732c5e94977dc03be5fb159fde6a27af7f61 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Tue, 11 Aug 2026 15:31:35 -0400 Subject: [PATCH 138/318] samba: replace systemd dependency with systemdLibs --- pkgs/servers/samba/4.x.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix index 5ca73ec6c351..8e4e3fa43eda 100644 --- a/pkgs/servers/samba/4.x.nix +++ b/pkgs/servers/samba/4.x.nix @@ -21,7 +21,7 @@ zlib, liburing, gnutls, - systemd, + systemdLibs, samba, talloc, jansson, @@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: { ] ++ optionals stdenv.hostPlatform.isLinux [ liburing - systemd + systemdLibs ] ++ optionals stdenv.hostPlatform.isDarwin [ libiconv ] ++ optionals enableLDAP [ From e74710c0a2d413cafb017d807cb695b887c14351 Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Tue, 11 Aug 2026 15:35:43 -0400 Subject: [PATCH 139/318] udisks: replace systemd dependency with systemdLibs --- pkgs/by-name/ud/udisks/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ud/udisks/package.nix b/pkgs/by-name/ud/udisks/package.nix index bcbb9d450506..1ef578029cf0 100644 --- a/pkgs/by-name/ud/udisks/package.nix +++ b/pkgs/by-name/ud/udisks/package.nix @@ -8,7 +8,7 @@ autoreconfHook, gtk-doc, acl, - systemd, + systemdLibs, glib, libatasmart, polkit, @@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: { libgudev libblockdev acl - systemd + systemdLibs glib libatasmart polkit From 16f4316b147f18e0752c5fd85c8a395fb5386188 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:23:43 +0200 Subject: [PATCH 140/318] libedit: enable strictDeps --- pkgs/by-name/li/libedit/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libedit/package.nix b/pkgs/by-name/li/libedit/package.nix index b74e107981a8..0b585969d1e6 100644 --- a/pkgs/by-name/li/libedit/package.nix +++ b/pkgs/by-name/li/libedit/package.nix @@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: { ncurses ]; + strictDeps = true; + # GCC automatically include `stdc-predefs.h` while Clang does not do this by # default. While Musl is ISO 10646 compliant, it does not define # __STDC_ISO_10646__. From 40495abefe7c80ae88500626d79ca385d23461c9 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:23:56 +0200 Subject: [PATCH 141/318] libedit: enable structuredAttrs --- pkgs/by-name/li/libedit/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libedit/package.nix b/pkgs/by-name/li/libedit/package.nix index 0b585969d1e6..fd14cb442404 100644 --- a/pkgs/by-name/li/libedit/package.nix +++ b/pkgs/by-name/li/libedit/package.nix @@ -52,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: { xargs sed -i -e 's,-lncurses[a-z]*,-L${ncurses.out}/lib -lncursesw,g' ''; + __structuredAttrs = true; + meta = { homepage = "http://www.thrysoee.dk/editline/"; changelog = "https://www.thrysoee.dk/editline/#changelog"; From 338dc981d72996a3cf6b8b4e5ebcb2e3578745d5 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:24:04 +0200 Subject: [PATCH 142/318] libev: enable strictDeps --- pkgs/by-name/li/libev/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libev/package.nix b/pkgs/by-name/li/libev/package.nix index e51b04890ee6..eee649862706 100644 --- a/pkgs/by-name/li/libev/package.nix +++ b/pkgs/by-name/li/libev/package.nix @@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ]; + strictDeps = true; + configureFlags = lib.optional static "LDFLAGS=-static"; makeFlags = From 30197d3e6e665fdffe5d31878f1e07b7786333a8 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:24:23 +0200 Subject: [PATCH 143/318] libev: enable structuredAttrs --- pkgs/by-name/li/libev/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libev/package.nix b/pkgs/by-name/li/libev/package.nix index eee649862706..cdb8e7264232 100644 --- a/pkgs/by-name/li/libev/package.nix +++ b/pkgs/by-name/li/libev/package.nix @@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: { "LDFLAGS+=-lws2_32" ]); + __structuredAttrs = true; + meta = { description = "High-performance event loop/event model with lots of features"; homepage = "https://software.schmorp.de/pkg/libev.html"; From c73a39460b19ba377bed99e588edb81ebbe64942 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:24:41 +0200 Subject: [PATCH 144/318] rhash: enable strictDeps --- pkgs/by-name/rh/rhash/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix index e8ef05814fee..8bfe6af91648 100644 --- a/pkgs/by-name/rh/rhash/package.nix +++ b/pkgs/by-name/rh/rhash/package.nix @@ -21,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ which ]; buildInputs = lib.optionals stdenv.hostPlatform.isFreeBSD [ gettext ]; + strictDeps = true; + # configure script is not autotools-based, doesn't support these options dontAddStaticConfigureFlags = true; From 088ba535bbc5de88b49f33a27e2af7c531e9cc78 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:24:55 +0200 Subject: [PATCH 145/318] rhash: enable structuredAttrs, use tag/hash --- pkgs/by-name/rh/rhash/package.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix index 8bfe6af91648..29adb0a1e712 100644 --- a/pkgs/by-name/rh/rhash/package.nix +++ b/pkgs/by-name/rh/rhash/package.nix @@ -14,8 +14,8 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "rhash"; repo = "RHash"; - rev = "v${finalAttrs.version}"; - sha256 = "sha256-9/kFI38PG3AKsdDqEV/wEzSel9IlQQ/pvOyhU/N/aV0="; + tag = "v${finalAttrs.version}"; + hash = "sha256-9/kFI38PG3AKsdDqEV/wEzSel9IlQQ/pvOyhU/N/aV0="; }; nativeBuildInputs = [ which ]; @@ -48,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: { "install-lib-so-link" ]; + __structuredAttrs = true; + meta = { homepage = "https://rhash.sourceforge.net/"; description = "Console utility and library for computing and verifying hash sums of files"; From e3fe4e8207d622547c821dacdbc88fdd93daea0a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:25:04 +0200 Subject: [PATCH 146/318] nettle: enable strictDeps --- pkgs/development/libraries/nettle/generic.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/nettle/generic.nix b/pkgs/development/libraries/nettle/generic.nix index b626e137c427..9f45e01cd93b 100644 --- a/pkgs/development/libraries/nettle/generic.nix +++ b/pkgs/development/libraries/nettle/generic.nix @@ -25,6 +25,8 @@ stdenv.mkDerivation { nativeBuildInputs = [ gnum4 ]; propagatedBuildInputs = [ gmp ]; + strictDeps = true; + configureFlags = # runtime selection of HW-accelerated code; it's default since 3.7 [ "--enable-fat" ] From 911921f0a3251222124e5bc09963451148e8cce3 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:25:14 +0200 Subject: [PATCH 147/318] nettle: enable structuredAttrs --- pkgs/development/libraries/nettle/generic.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/nettle/generic.nix b/pkgs/development/libraries/nettle/generic.nix index 9f45e01cd93b..9494a282a1df 100644 --- a/pkgs/development/libraries/nettle/generic.nix +++ b/pkgs/development/libraries/nettle/generic.nix @@ -42,6 +42,8 @@ stdenv.mkDerivation { patches = lib.optional (stdenv.hostPlatform.system == "i686-cygwin") ./cygwin.patch; + __structuredAttrs = true; + meta = { description = "Cryptographic library"; From 9b751352cb50a6544ccdcd0af906e385da421052 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:27:23 +0200 Subject: [PATCH 148/318] mpdecimal: enable strictDeps --- pkgs/by-name/mp/mpdecimal/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/mp/mpdecimal/package.nix b/pkgs/by-name/mp/mpdecimal/package.nix index ca1d0bba4969..a814f21c13e9 100644 --- a/pkgs/by-name/mp/mpdecimal/package.nix +++ b/pkgs/by-name/mp/mpdecimal/package.nix @@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ autoreconfHook ]; + strictDeps = true; + enableParallelBuilding = true; postInstall = '' From 96635cdcabe8f58e2d2f6f7825d1ba48f71f9e93 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 16:27:34 +0200 Subject: [PATCH 149/318] mpdecimal: enable structuredAttrs --- pkgs/by-name/mp/mpdecimal/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/mp/mpdecimal/package.nix b/pkgs/by-name/mp/mpdecimal/package.nix index a814f21c13e9..0d90dec4f5aa 100644 --- a/pkgs/by-name/mp/mpdecimal/package.nix +++ b/pkgs/by-name/mp/mpdecimal/package.nix @@ -34,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: { echo -n $cxx >> $dev/nix-support/propagated-build-inputs ''; + __structuredAttrs = true; + meta = { description = "Library for arbitrary precision decimal floating point arithmetic"; From 53c7fb0c804e8b8a5cad426dca1cebcb8b508409 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 24 Jul 2026 15:17:12 +0200 Subject: [PATCH 150/318] asciidoc: enable structuredAttrs, use tag --- pkgs/by-name/as/asciidoc/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/as/asciidoc/package.nix b/pkgs/by-name/as/asciidoc/package.nix index 5aee5a2d9108..8ceb6a06a487 100644 --- a/pkgs/by-name/as/asciidoc/package.nix +++ b/pkgs/by-name/as/asciidoc/package.nix @@ -151,7 +151,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: { src = fetchFromGitHub { owner = "asciidoc-py"; repo = "asciidoc-py"; - rev = finalAttrs.version; + tag = finalAttrs.version; hash = "sha256-td3C7xTWfSzdo9Bbz0dHW2oPaCQYmUE9H2sUFfg5HH0="; }; @@ -320,6 +320,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: { runHook postCheck ''; + __structuredAttrs = true; + meta = { description = "Text-based document generation system"; longDescription = '' From bb25905f349f181c434fb8e097dd82dbea1ae2a6 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 24 Jul 2026 15:17:28 +0200 Subject: [PATCH 151/318] auto-patchelf: enable structuredAttrs --- pkgs/by-name/au/auto-patchelf/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/au/auto-patchelf/package.nix b/pkgs/by-name/au/auto-patchelf/package.nix index 7823a55c72e5..031e780f89c9 100644 --- a/pkgs/by-name/au/auto-patchelf/package.nix +++ b/pkgs/by-name/au/auto-patchelf/package.nix @@ -33,6 +33,8 @@ stdenv.mkDerivation { runHook postInstall ''; + __structuredAttrs = true; + meta = { description = "Automatically patch ELF binaries using patchelf"; mainProgram = "auto-patchelf"; From 672b952591dc27ba2f02758e56f934e69d1aa785 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 24 Jul 2026 15:17:45 +0200 Subject: [PATCH 152/318] gtest: enable structuredAttrs, use tag --- pkgs/by-name/gt/gtest/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/gt/gtest/package.nix b/pkgs/by-name/gt/gtest/package.nix index 49d5de368f04..0dc51ba9446a 100644 --- a/pkgs/by-name/gt/gtest/package.nix +++ b/pkgs/by-name/gt/gtest/package.nix @@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "google"; repo = "googletest"; - rev = "v${finalAttrs.version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-HIHMxAUR4bjmFLoltJeIAVSulVQ6kVuIT2Ku+lwAx/4="; }; @@ -64,6 +64,8 @@ stdenv.mkDerivation (finalAttrs: { ] ++ lib.optional withAbseil "-DGTEST_HAS_ABSL=ON"; + __structuredAttrs = true; + meta = { description = "Google's framework for writing C++ tests"; homepage = "https://github.com/google/googletest"; From 0c23120b99ee6476766835928a96c550dd66d780 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 24 Jul 2026 15:18:10 +0200 Subject: [PATCH 153/318] gtk-doc: enable structuredAttrs, use finalAttrs --- pkgs/by-name/gt/gtk-doc/package.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/gt/gtk-doc/package.nix b/pkgs/by-name/gt/gtk-doc/package.nix index 9f58e9fb8f75..475149609a7b 100644 --- a/pkgs/by-name/gt/gtk-doc/package.nix +++ b/pkgs/by-name/gt/gtk-doc/package.nix @@ -14,7 +14,7 @@ dblatex, }: -python3.pkgs.buildPythonApplication rec { +python3.pkgs.buildPythonApplication (finalAttrs: { pname = "gtk-doc"; version = "1.36.1"; @@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec { domain = "gitlab.gnome.org"; owner = "GNOME"; repo = "gtk-doc"; - tag = version; + tag = finalAttrs.version; hash = "sha256-8hB43BCAtT1B7/ak2i0FAlYD3Kb4rNCWfsJ+wqGu3FA="; }; @@ -85,12 +85,14 @@ python3.pkgs.buildPythonApplication rec { }; }; + __structuredAttrs = true; + meta = { - changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${src.tag}/NEWS"; + changelog = "https://gitlab.gnome.org/GNOME/gtk-doc/-/blob/${finalAttrs.src.tag}/NEWS"; description = "Tools to extract documentation embedded in GTK and GNOME source code"; homepage = "https://gitlab.gnome.org/GNOME/gtk-doc"; license = lib.licenses.gpl2Plus; maintainers = with lib.maintainers; [ pSub ]; teams = [ lib.teams.gnome ]; }; -} +}) From 72b0888cd3b54840fc92394e02279f678c267cae Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 24 Jul 2026 15:18:48 +0200 Subject: [PATCH 154/318] ninja: enable structuredAttrs --- pkgs/by-name/ni/ninja/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ni/ninja/package.nix b/pkgs/by-name/ni/ninja/package.nix index 29196bd5db6a..d1d05942e316 100644 --- a/pkgs/by-name/ni/ninja/package.nix +++ b/pkgs/by-name/ni/ninja/package.nix @@ -114,6 +114,8 @@ stdenv.mkDerivation (finalAttrs: { passthru.updateScript = nix-update-script { }; + __structuredAttrs = true; + meta = { description = "Small build system with a focus on speed"; mainProgram = "ninja"; From fa5bcd11712a0db9676124a3a7752cc49fa6471d Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 24 Jul 2026 15:19:03 +0200 Subject: [PATCH 155/318] zlib-ng: enable structuredAttrs, use tag --- pkgs/by-name/zl/zlib-ng/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/zl/zlib-ng/package.nix b/pkgs/by-name/zl/zlib-ng/package.nix index 6d813b919db7..5bf6295a3e2c 100644 --- a/pkgs/by-name/zl/zlib-ng/package.nix +++ b/pkgs/by-name/zl/zlib-ng/package.nix @@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "zlib-ng"; repo = "zlib-ng"; - rev = finalAttrs.version; + tag = finalAttrs.version; hash = "sha256-6GlHCnx9dQtmViPnvHnMS+l9Z+g6M8ynrSxLhLtmAKU="; }; @@ -46,6 +46,8 @@ stdenv.mkDerivation (finalAttrs: { ] ++ lib.optionals withZlibCompat [ "-DZLIB_COMPAT=ON" ]; + __structuredAttrs = true; + meta = { description = "Zlib data compression library for the next generation systems"; homepage = "https://github.com/zlib-ng/zlib-ng"; From ac0e8148b7b637728b832f03b0d400c0b17f63fe Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 24 Jul 2026 20:32:01 +0200 Subject: [PATCH 156/318] ngtcp2{,-gnutls}: enable structuredAttrs, use finalAttrs --- pkgs/development/libraries/ngtcp2/default.nix | 2 ++ pkgs/development/libraries/ngtcp2/gnutls.nix | 8 +++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix index a7f342c6eaf7..da1b9559dda0 100644 --- a/pkgs/development/libraries/ngtcp2/default.nix +++ b/pkgs/development/libraries/ngtcp2/default.nix @@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: { inherit curl; }; + __structuredAttrs = true; + meta = { homepage = "https://github.com/ngtcp2/ngtcp2"; changelog = "https://github.com/ngtcp2/ngtcp2/releases/tag/v${finalAttrs.version}"; diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix index 3de8d611a9d4..92b39359eae1 100644 --- a/pkgs/development/libraries/ngtcp2/gnutls.nix +++ b/pkgs/development/libraries/ngtcp2/gnutls.nix @@ -11,14 +11,14 @@ curlWithGnuTls, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "ngtcp2"; version = "1.25.0"; src = fetchFromGitHub { owner = "ngtcp2"; repo = "ngtcp2"; - rev = "v${version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-BBV4nNtSWQOFuwVOeH3LJEUeF7v4LVhGbfcrkroBAvc="; }; @@ -43,6 +43,8 @@ stdenv.mkDerivation rec { inherit curlWithGnuTls; }; + __structuredAttrs = true; + meta = { homepage = "https://github.com/ngtcp2/ngtcp2"; description = "Effort to implement RFC9000 QUIC protocol"; @@ -52,7 +54,7 @@ stdenv.mkDerivation rec { vcunat # for knot-dns ]; }; -} +}) /* Why split from ./default.nix? From a146e75868551d71b6a8ee9ca3df650afdfdb0e6 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:07:26 +0200 Subject: [PATCH 157/318] ninja: enable strictDeps --- pkgs/by-name/ni/ninja/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ni/ninja/package.nix b/pkgs/by-name/ni/ninja/package.nix index d1d05942e316..39a2ada4da2a 100644 --- a/pkgs/by-name/ni/ninja/package.nix +++ b/pkgs/by-name/ni/ninja/package.nix @@ -52,6 +52,8 @@ stdenv.mkDerivation (finalAttrs: { libxslt.bin ]; + strictDeps = true; + patches = [ ./0001-spawn-sh-instead-of-bin-sh.patch ] From 9bcd63e541f8700682f3892a57aef4862317f08d Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:56:21 +0200 Subject: [PATCH 158/318] gtest: enable strictDeps --- pkgs/by-name/gt/gtest/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gt/gtest/package.nix b/pkgs/by-name/gt/gtest/package.nix index 0dc51ba9446a..fec50046d186 100644 --- a/pkgs/by-name/gt/gtest/package.nix +++ b/pkgs/by-name/gt/gtest/package.nix @@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: { re2 ]; + strictDeps = true; + cmakeFlags = [ "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}" ] From 4645c076877016315471eef418289eb40ac165fc Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 10:38:29 +0200 Subject: [PATCH 159/318] autoconf269: enable strictDeps --- pkgs/development/tools/misc/autoconf/2.69.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix index ca2f881db326..147dcd16ad7e 100644 --- a/pkgs/development/tools/misc/autoconf/2.69.nix +++ b/pkgs/development/tools/misc/autoconf/2.69.nix @@ -21,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: { ]; buildInputs = [ m4 ]; + strictDeps = true; + # Work around a known issue in Cygwin. See # http://thread.gmane.org/gmane.comp.sysutils.autoconf.bugs/6822 for # details. From e86ec915a5d377c51027944647d31961e9aa4636 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 10:38:43 +0200 Subject: [PATCH 160/318] autoconf269: use sri hash --- pkgs/development/tools/misc/autoconf/2.69.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/tools/misc/autoconf/2.69.nix b/pkgs/development/tools/misc/autoconf/2.69.nix index 147dcd16ad7e..2c8f7fb75851 100644 --- a/pkgs/development/tools/misc/autoconf/2.69.nix +++ b/pkgs/development/tools/misc/autoconf/2.69.nix @@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "mirror://gnu/autoconf/autoconf-${finalAttrs.version}.tar.xz"; - sha256 = "113nlmidxy9kjr45kg9x3ngar4951mvag1js2a3j8nxcz34wxsv4"; + hash = "sha256-ZOvOyfisWySHElqGp3YNJZGsnh09vVlIljP53mKldoQ="; }; nativeBuildInputs = [ From bef5e44caf45df44d7ce3857b0dfc3edcd9d664f Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 10:42:38 +0200 Subject: [PATCH 161/318] automake116x: use sri hash --- pkgs/development/tools/misc/automake/automake-1.16.x.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix index 308ebc9e9f3f..11ca834015a7 100644 --- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix +++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix @@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz"; - sha256 = "0sdl32qxdy7m06iggmkkvf7j520rmmgbsjzbm7fgnxwxdp6mh7gh"; + hash = "sha256-8B1YzW2dd/vcqetLvV6tGYgij9tz1veiAfX41rEYtGk="; }; strictDeps = true; From 2f81cc90301d0bb3a2876ce3fc95617398d23d3e Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 15:07:46 +0200 Subject: [PATCH 162/318] ngtcp2{,-gnutls}: enable strictDeps --- pkgs/development/libraries/ngtcp2/default.nix | 2 ++ pkgs/development/libraries/ngtcp2/gnutls.nix | 2 ++ 2 files changed, 4 insertions(+) diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix index da1b9559dda0..20dac13831d2 100644 --- a/pkgs/development/libraries/ngtcp2/default.nix +++ b/pkgs/development/libraries/ngtcp2/default.nix @@ -36,6 +36,8 @@ stdenv.mkDerivation (finalAttrs: { ] ++ lib.optional withJemalloc jemalloc; + strictDeps = true; + cmakeFlags = [ # The examples try to link against `ngtcp2_crypto_ossl` and `ngtcp2` libraries. # This works in the dynamic case where the targets have the same name, but not here where they're suffixed with `_static`. diff --git a/pkgs/development/libraries/ngtcp2/gnutls.nix b/pkgs/development/libraries/ngtcp2/gnutls.nix index 92b39359eae1..476334552e79 100644 --- a/pkgs/development/libraries/ngtcp2/gnutls.nix +++ b/pkgs/development/libraries/ngtcp2/gnutls.nix @@ -33,6 +33,8 @@ stdenv.mkDerivation (finalAttrs: { ]; buildInputs = [ gnutls ]; + strictDeps = true; + configureFlags = [ "--with-gnutls=yes" ]; enableParallelBuilding = true; From 5baff07c874a068ca598dfacf36f9e0b213c9efa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Wed, 12 Aug 2026 09:54:05 +0200 Subject: [PATCH 163/318] luajit_2_1: 2.1.1785577137 -> 2.1.1785763465 I saw some fixes for changes done in the parent commit in nixpkgs. --- pkgs/development/interpreters/luajit/2.1.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/interpreters/luajit/2.1.nix b/pkgs/development/interpreters/luajit/2.1.nix index e7f48f19a432..a227695f2cc4 100644 --- a/pkgs/development/interpreters/luajit/2.1.nix +++ b/pkgs/development/interpreters/luajit/2.1.nix @@ -8,13 +8,13 @@ callPackage ./default.nix { # The patch version is the timestamp of the git commit, # obtain via `cat $(nix-build -A luajit_2_1.src)/.relver` - version = "2.1.1785577137"; + version = "2.1.1785763465"; src = fetchFromGitHub { owner = "LuaJIT"; repo = "LuaJIT"; - rev = "4886b676a698acc4bbdf54adfabb3e33a8c020e8"; - hash = "sha256-3nTyPcphBQN2segb5bxBgvrWHodN/ckRy4AGS8lDL44="; + rev = "1edc3e52b67eaf6ce5f809be8e17d6862594b8bc"; + hash = "sha256-mcOvVJ7AaoHrbEXxznpOkFoY7Kbd2aWMoOmyx5B4FIg="; }; inherit self passthruFun; From 7d3b01a9ffa51e7b71a0ff0021f55d0ce711a69f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Wed, 12 Aug 2026 10:45:06 +0200 Subject: [PATCH 164/318] lmdb: 0.9.35 -> 0.9.36 https://github.com/LMDB/lmdb/blob/LMDB_0.9.36/libraries/liblmdb/CHANGES Let's avoid 1.0 for now. For example, some projects/users have issues because 1.0 can't use 0.9 DBs and vice versa. --- pkgs/by-name/lm/lmdb/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/lm/lmdb/package.nix b/pkgs/by-name/lm/lmdb/package.nix index 41c92ea0c8b6..f228bf12fd4f 100644 --- a/pkgs/by-name/lm/lmdb/package.nix +++ b/pkgs/by-name/lm/lmdb/package.nix @@ -7,14 +7,14 @@ stdenv.mkDerivation rec { pname = "lmdb"; - version = "0.9.35"; + version = "0.9.36"; src = fetchFromGitLab { domain = "git.openldap.org"; owner = "openldap"; repo = "openldap"; rev = "LMDB_${version}"; - sha256 = "sha256-XkOeVqzKojRLojBLkXB0V9lypJnL5ZmGAwutn6aRQIU="; + sha256 = "sha256-iOwjUqR2ChCEUDsIFEetVktCD7Mx3R5JgHE+qIhBd5I="; }; postUnpack = "sourceRoot=\${sourceRoot}/libraries/liblmdb"; From 137c05240f839a0084fc1e60427ebf9a34fe5aec Mon Sep 17 00:00:00 2001 From: whoomee Date: Thu, 6 Aug 2026 13:55:46 +0200 Subject: [PATCH 165/318] gstreamer: 1.28.5 -> 1.28.6 --- pkgs/development/libraries/gstreamer/bad/default.nix | 4 ++-- pkgs/development/libraries/gstreamer/base/default.nix | 4 ++-- pkgs/development/libraries/gstreamer/core/default.nix | 4 ++-- pkgs/development/libraries/gstreamer/devtools/default.nix | 4 ++-- pkgs/development/libraries/gstreamer/ges/default.nix | 4 ++-- pkgs/development/libraries/gstreamer/good/default.nix | 4 ++-- pkgs/development/libraries/gstreamer/libav/default.nix | 4 ++-- pkgs/development/libraries/gstreamer/rtsp-server/default.nix | 4 ++-- pkgs/development/libraries/gstreamer/ugly/default.nix | 4 ++-- 9 files changed, 18 insertions(+), 18 deletions(-) diff --git a/pkgs/development/libraries/gstreamer/bad/default.nix b/pkgs/development/libraries/gstreamer/bad/default.nix index f470d9e7f161..d91572296421 100644 --- a/pkgs/development/libraries/gstreamer/bad/default.nix +++ b/pkgs/development/libraries/gstreamer/bad/default.nix @@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "gst-plugins-bad"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "out" @@ -125,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad-${finalAttrs.version}.tar.xz"; - hash = "sha256-2K9V+u8pWMGoZjdRR17kb1Fkh3z02MWRPqkG7xgK63E="; + hash = "sha256-Zjbywiic7aUsSrqXEzjIHitXgNM4G9NnPBwRbsh1h8M="; }; patches = [ diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix index 4415abbd5931..2f1f0f06feea 100644 --- a/pkgs/development/libraries/gstreamer/base/default.nix +++ b/pkgs/development/libraries/gstreamer/base/default.nix @@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "gst-plugins-base"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "out" @@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-plugins-base/gst-plugins-base-${finalAttrs.version}.tar.xz"; - hash = "sha256-d28ZIo+R/SW79U2YUFl+FYUH9ZSHKlK5toFOJCm0Pqo="; + hash = "sha256-C6aZx8bGb0umQL54yziiRxWt2Wg/PjoZn1Np3FpPBKw="; }; __structuredAttrs = true; diff --git a/pkgs/development/libraries/gstreamer/core/default.nix b/pkgs/development/libraries/gstreamer/core/default.nix index fcc1de6d9920..0c959452333b 100644 --- a/pkgs/development/libraries/gstreamer/core/default.nix +++ b/pkgs/development/libraries/gstreamer/core/default.nix @@ -40,7 +40,7 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "gstreamer"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "bin" @@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gstreamer/gstreamer-${finalAttrs.version}.tar.xz"; - hash = "sha256-pan3g4CbF6jrd09KdpWyy4y6axVSASmQb4fq8w5/hGk="; + hash = "sha256-Yra58K0xR6bdZCCsZKkRgLFOmQaVvd01O5YEFhHQUso="; }; depsBuildBuild = [ diff --git a/pkgs/development/libraries/gstreamer/devtools/default.nix b/pkgs/development/libraries/gstreamer/devtools/default.nix index e1e8cf9e4637..2dbcdc766ad8 100644 --- a/pkgs/development/libraries/gstreamer/devtools/default.nix +++ b/pkgs/development/libraries/gstreamer/devtools/default.nix @@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "gst-devtools"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "out" @@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-devtools/gst-devtools-${finalAttrs.version}.tar.xz"; - hash = "sha256-dFkEXbMdbkRgC8vgEdySV1AmiHDnuQ9+ego69KIcCeU="; + hash = "sha256-FNQfquA2GSUflZWdPVe/ZcYQaDiztUIY3JXHE14euhM="; }; cargoDeps = rustPlatform.fetchCargoVendor { diff --git a/pkgs/development/libraries/gstreamer/ges/default.nix b/pkgs/development/libraries/gstreamer/ges/default.nix index 005a3f90c3a9..0bef33df0348 100644 --- a/pkgs/development/libraries/gstreamer/ges/default.nix +++ b/pkgs/development/libraries/gstreamer/ges/default.nix @@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "gst-editing-services"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "out" @@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-editing-services/gst-editing-services-${finalAttrs.version}.tar.xz"; - hash = "sha256-0C+d99108qUCQ6b6XjJ8+71cEhKc57bnPXDAhTJJGog="; + hash = "sha256-PRUeUJfWhsWJCudvFMV+4ZU4/WHGz2NxcfkLMJyv1Tw="; }; separateDebugInfo = true; diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix index 987295f7ac0a..ab6bf03ba581 100644 --- a/pkgs/development/libraries/gstreamer/good/default.nix +++ b/pkgs/development/libraries/gstreamer/good/default.nix @@ -78,7 +78,7 @@ assert raspiCameraSupport -> hostSupportsRaspiCamera; stdenv.mkDerivation (finalAttrs: { pname = "gst-plugins-good"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "out" @@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-plugins-good/gst-plugins-good-${finalAttrs.version}.tar.xz"; - hash = "sha256-WLRdJKHXeznXu32czG4tdrvyhhiZjDNcFj8Y5vlKkyQ="; + hash = "sha256-sMYgpLGLbukxtMQ7vxdg0whmbcN/cwp+fxrTJ+Wc4t8="; }; patches = [ diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix index 3714fb286d9c..6731f09fb1e9 100644 --- a/pkgs/development/libraries/gstreamer/libav/default.nix +++ b/pkgs/development/libraries/gstreamer/libav/default.nix @@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "gst-libav"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "out" @@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz"; - hash = "sha256-RShUZWBW8LFlEaHZrU8mef9eWofIn5DPfuXewAXdseQ="; + hash = "sha256-cebq+0//KmbRuwuo0HgiTf5+M5cwfYwLuj3CNgbgj1E="; }; separateDebugInfo = true; diff --git a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix index 5fdb31e1ddd8..742fbc362821 100644 --- a/pkgs/development/libraries/gstreamer/rtsp-server/default.nix +++ b/pkgs/development/libraries/gstreamer/rtsp-server/default.nix @@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "gst-rtsp-server"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "out" @@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-rtsp-server/gst-rtsp-server-${finalAttrs.version}.tar.xz"; - hash = "sha256-fhn93rEmG+vD7Dl4V/7dXHcSm2arUniP2trQURdWYiU="; + hash = "sha256-DLclsTUfdeiIA8Vd3eofJ74JUj3c1/KasYJw4YKipGM="; }; separateDebugInfo = true; diff --git a/pkgs/development/libraries/gstreamer/ugly/default.nix b/pkgs/development/libraries/gstreamer/ugly/default.nix index b524bc2fac7f..4ad03256c94e 100644 --- a/pkgs/development/libraries/gstreamer/ugly/default.nix +++ b/pkgs/development/libraries/gstreamer/ugly/default.nix @@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "gst-plugins-ugly"; - version = "1.28.5"; + version = "1.28.6"; outputs = [ "out" @@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-plugins-ugly/gst-plugins-ugly-${finalAttrs.version}.tar.xz"; - hash = "sha256-DvTPnDyaXndqbKjRkKMYYzkbaBmAJSFDuCKymqgx4SA="; + hash = "sha256-7iedoTp0D9fwYNYxpnMiP6O8yMM9NQyNAmS9Myok7Ng="; }; separateDebugInfo = true; From a0ea1f703ad59e366a2a4df1ccb47aef3e107a51 Mon Sep 17 00:00:00 2001 From: whoomee Date: Thu, 6 Aug 2026 17:02:41 +0200 Subject: [PATCH 166/318] python3Packages.gst-python: 1.28.5 -> 1.28.6 --- pkgs/development/python-modules/gst-python/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/gst-python/default.nix b/pkgs/development/python-modules/gst-python/default.nix index 1934d3a14ea6..af6a9347b0e3 100644 --- a/pkgs/development/python-modules/gst-python/default.nix +++ b/pkgs/development/python-modules/gst-python/default.nix @@ -21,7 +21,7 @@ buildPythonPackage rec { pname = "gst-python"; - version = "1.28.5"; + version = "1.28.6"; pyproject = false; @@ -32,7 +32,7 @@ buildPythonPackage rec { src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-python/gst-python-${version}.tar.xz"; - hash = "sha256-CsRhtXALl2aZiqaGQ5BkyvWMpP2vhI39R3tadwCxdsw="; + hash = "sha256-NNWEQMU7VJWhI9Ckt7ervG6XkqWyGVTbhqB5Gxb24BI="; }; patches = [ From 8b008fc26835247a527558d4e125f482f937499e Mon Sep 17 00:00:00 2001 From: whoomee Date: Wed, 12 Aug 2026 12:24:45 +0200 Subject: [PATCH 167/318] gst_all_1.gst-plugins-base: refactor mesonFlags --- .../libraries/gstreamer/base/default.nix | 104 +++++++++++------- 1 file changed, 67 insertions(+), 37 deletions(-) diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix index 2f1f0f06feea..087c8c50b3d1 100644 --- a/pkgs/development/libraries/gstreamer/base/default.nix +++ b/pkgs/development/libraries/gstreamer/base/default.nix @@ -129,37 +129,48 @@ stdenv.mkDerivation (finalAttrs: { libdrm ]; - mesonFlags = [ - "-Dglib_debug=disabled" # cast checks should be disabled on stable releases - "-Dexamples=disabled" # requires many dependencies and probably not useful for our users - # See https://github.com/GStreamer/gst-plugins-base/blob/d64a4b7a69c3462851ff4dcfa97cc6f94cd64aef/meson_options.txt#L15 for a list of choices - "-Dgl_winsys=${ - lib.concatStringsSep "," ( + mesonFlags = + let + # For a list of choices, see + # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/d529453528a5dd11c15eab788cce6676141134b7/subprojects/gst-plugins-base/meson.options#L14-1 + # unsupported platforms: win32, winrt, android + # deprecated/ancient platforms: dispmanx, eagl + # TODO: should we add egl, surfaceless, viv-fb, gbm? + # (on Linux, autodiscovery would automatically add egl and surfaceless) + # 'egl', 'surfaceless', 'viv-fb', 'gbm', + enabledGlWinSys = lib.optional enableX11 "x11" ++ lib.optional enableWayland "wayland" - ++ lib.optional enableCocoa "cocoa" - ) - }" - (lib.mesonEnable "introspection" withIntrospection) - (lib.mesonEnable "doc" enableDocumentation) - (lib.mesonEnable "libvisual" false) - (lib.mesonEnable "tremor" false) # unmaintained in nixpkgs, just use regular libvorbis instead - (lib.mesonEnable "vorbis" true) - ] - ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ - "-Dtests=disabled" - ] - ++ lib.optionals (!enableX11) [ - "-Dx11=disabled" - "-Dxi=disabled" - "-Dxshm=disabled" - "-Dxvideo=disabled" - ] - # TODO How to disable Wayland? - ++ lib.optional (!enableGl) "-Dgl=disabled" - ++ lib.optional (!enableAlsa) "-Dalsa=disabled" - ++ lib.optional (!enableCdparanoia) "-Dcdparanoia=disabled" - ++ lib.optional stdenv.hostPlatform.isDarwin "-Ddrm=disabled"; + ++ lib.optional enableCocoa "cocoa"; + in + lib.mapAttrsToList lib.mesonEnable { + orc = true; + orc-compiler = true; + nls = true; + + glib_debug = false; # cast checks should be disabled on stable releases + examples = false; # requires many dependencies and probably not useful for our users + introspection = withIntrospection; + doc = enableDocumentation; + + tests = finalAttrs.finalPackage.doCheck; + + libvisual = false; + tremor = false; # unmaintained in nixpkgs, just use regular libvorbis instead + vorbis = true; + + x11 = enableX11; + xi = enableX11; + xshm = enableX11; + xvideo = enableX11; + + # TODO How to disable Wayland? + gl = enableGl; + alsa = enableAlsa; + cdparanoia = enableCdparanoia; + drm = !stdenv.hostPlatform.isDarwin; + } + ++ [ (lib.mesonOption "gl_winsys" (lib.concatStringsSep "," enabledGlWinSys)) ]; postPatch = '' patchShebangs \ @@ -194,20 +205,39 @@ stdenv.mkDerivation (finalAttrs: { waylandEnabled = enableWayland; updateScript = directoryListingUpdater { odd-unstable = true; }; - }; - passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; + tests.pkg-config = testers.hasPkgConfigModules { + package = finalAttrs.finalPackage; + versionCheck = true; + }; + }; meta = { description = "Base GStreamer plug-ins and helper libraries"; homepage = "https://gstreamer.freedesktop.org"; license = lib.licenses.lgpl2Plus; - pkgConfigModules = [ - "gstreamer-audio-1.0" - "gstreamer-base-1.0" - "gstreamer-net-1.0" - "gstreamer-video-1.0" - ]; + pkgConfigModules = lib.map (m: "gstreamer-${m}-1.0") ( + [ + "allocators" + "app" + "audio" + "fft" + "pbutils" + "plugins-base" + "riff" + "rtp" + "rtsp" + "sdp" + "tag" + ] + ++ lib.optionals enableGl [ + "gl" + "gl-egl" + "gl-prototypes" + ] + ++ lib.optional (enableGl && enableWayland) "gl-wayland" + ++ lib.optional (enableGl && enableX11) "gl-x11" + ); platforms = lib.platforms.unix; maintainers = with lib.maintainers; [ tmarkus ]; }; From 3c13877d44d36f7c6f3f8c4ad3e76602d197d7b3 Mon Sep 17 00:00:00 2001 From: whoomee Date: Tue, 11 Aug 2026 17:46:51 +0200 Subject: [PATCH 168/318] gst_all_1.gst-plugins-good: refactor mesonFlags --- .../libraries/gstreamer/good/default.nix | 85 +++++++++---------- 1 file changed, 41 insertions(+), 44 deletions(-) diff --git a/pkgs/development/libraries/gstreamer/good/default.nix b/pkgs/development/libraries/gstreamer/good/default.nix index ab6bf03ba581..00b47201a47e 100644 --- a/pkgs/development/libraries/gstreamer/good/default.nix +++ b/pkgs/development/libraries/gstreamer/good/default.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchurl, - fetchpatch, replaceVars, meson, nasm, @@ -16,8 +15,6 @@ libGL, libv4l, libdv, - libavc1394, - libiec61883, libvpx, libdrm, speex, @@ -53,6 +50,10 @@ libxext, libxdamage, ncurses, + enableFireWire ? stdenv.hostPlatform.isLinux, + libavc1394, + libiec61883, + enableOSS ? stdenv.hostPlatform.isLinux, enableWayland ? stdenv.hostPlatform.isLinux, wayland, wayland-protocols, @@ -200,9 +201,11 @@ stdenv.mkDerivation (finalAttrs: { libGL libv4l libpulseaudio + libgudev + ] + ++ lib.optionals enableFireWire [ libavc1394 libiec61883 - libgudev ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_gstreamer @@ -214,45 +217,38 @@ stdenv.mkDerivation (finalAttrs: { libjack2 ]; - mesonFlags = [ - "-Dexamples=disabled" # requires many dependencies and probably not useful for our users - "-Dglib_debug=disabled" # cast checks should be disabled on stable releases - (lib.mesonEnable "doc" enableDocumentation) - (lib.mesonEnable "asm" true) - ] - ++ lib.optionals (!qt5Support) [ - "-Dqt5=disabled" - ] - ++ lib.optionals (!qt6Support) [ - "-Dqt6=disabled" - ] - ++ lib.optionals (!gtkSupport) [ - "-Dgtk3=disabled" - ] - ++ lib.optionals (!enableX11) [ - "-Dximagesrc=disabled" # Linux-only - ] - ++ lib.optionals (!enableJack) [ - "-Djack=disabled" - ] - ++ lib.optionals (!stdenv.hostPlatform.isLinux) [ - "-Ddv1394=disabled" # Linux only - "-Doss4=disabled" # Linux only - "-Doss=disabled" # Linux only - "-Dpulse=disabled" # TODO check if we can keep this enabled - "-Dv4l2-gudev=disabled" # Linux-only - "-Dv4l2=disabled" # Linux-only - ] - ++ ( - if raspiCameraSupport then - [ - "-Drpi-lib-dir=${libraspberrypi}/lib" - ] - else - [ - "-Drpicamsrc=disabled" - ] - ); + mesonFlags = + lib.mapAttrsToList lib.mesonEnable { + orc = true; + orc-compiler = true; + nls = true; + + tests = finalAttrs.finalPackage.doCheck; + + examples = false; # requires many dependencies and probably not useful for our users + glib_debug = false; # cast checks should be disabled on stable releases + doc = enableDocumentation; + asm = true; + qt5 = qt5Support; + qt6 = qt6Support; + gtk3 = gtkSupport; + ximagesrc = enableX11; # Linux-only + jack = enableJack; + + # Linux only + dv1394 = enableFireWire; + oss = enableOSS; + oss4 = enableOSS; + pulse = stdenv.hostPlatform.isLinux; # TODO check if we can keep this enabled + v4l2 = stdenv.hostPlatform.isLinux; + v4l2-gudev = stdenv.hostPlatform.isLinux; + + rpicamsrc = raspiCameraSupport; + } + ++ lib.optionals raspiCameraSupport [ + (lib.mesonOption "rpi-header-dir" "${lib.getDev libraspberrypi}/include") + (lib.mesonOption "rpi-lib-dir" "${lib.getLib libraspberrypi}/lib") + ]; postPatch = '' patchShebangs \ @@ -264,7 +260,7 @@ stdenv.mkDerivation (finalAttrs: { NIX_LDFLAGS = # linking error on Darwin # https://github.com/NixOS/nixpkgs/pull/70690#issuecomment-553694896 - "-lncurses"; + lib.optionalString stdenv.hostPlatform.isDarwin "-lncurses"; }; # fails 1 tests with "Unexpected critical/warning: g_object_set_is_valid_property: object class 'GstRtpStorage' has no property named ''" @@ -273,6 +269,7 @@ stdenv.mkDerivation (finalAttrs: { # must be explicitly set since 5590e365 dontWrapQtApps = true; + # Note: gst-plugins-good produces no pkg-config files unless building static libraries preFixup = '' moveToOutput "lib/gstreamer-1.0/pkgconfig" "$dev" ''; From 1dc7c8fac4dce2a3d07c15271ab83510a868eb28 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 23:01:37 +0200 Subject: [PATCH 169/318] libffi: enable structuredAttrs --- pkgs/by-name/li/libffiReal/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libffiReal/package.nix b/pkgs/by-name/li/libffiReal/package.nix index 3d34ab9f068a..89031a595b68 100644 --- a/pkgs/by-name/li/libffiReal/package.nix +++ b/pkgs/by-name/li/libffiReal/package.nix @@ -73,6 +73,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { description = "Foreign function call interface library"; longDescription = '' From 6ac83a376257ad84178d59e76d1fd72ee49c6937 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 13:23:49 +0200 Subject: [PATCH 170/318] minimal-bootstrap: stage0: enable structuredAttrs for libc in dummyStdenv --- pkgs/stdenv/linux/stage0.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/stdenv/linux/stage0.nix b/pkgs/stdenv/linux/stage0.nix index 9fa4bb162efd..e423f7208f05 100644 --- a/pkgs/stdenv/linux/stage0.nix +++ b/pkgs/stdenv/linux/stage0.nix @@ -70,6 +70,7 @@ if minbootSupported then ln -s ${libcPackage}/lib $out/lib ln -s ${libcPackage}/include $out/include ''; + __structuredAttrs = true; passthru.isFromBootstrapFiles = true; }; gcc-unwrapped = compilerPackage; @@ -157,6 +158,7 @@ else + lib.optionalString (localSystem.libc == "musl") '' ln -s ${bootstrapTools}/include-libc $out/include ''; + __structuredAttrs = true; passthru.isFromBootstrapFiles = true; }; gcc-unwrapped = bootstrapTools; From e8434ae083d0cb4182b5e511d823dae31299aad5 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 14:23:09 +0200 Subject: [PATCH 171/318] minimal-bootstrap: stage2: move NIX_CFLAGS_COMPILE override into env --- pkgs/stdenv/linux/default.nix | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix index c9b64c3086e8..80ffaef377d3 100644 --- a/pkgs/stdenv/linux/default.nix +++ b/pkgs/stdenv/linux/default.nix @@ -519,12 +519,13 @@ in # TODO(amjoseph): It is not yet entirely clear why this is necessary. # Something strange is going on with xgcc and libstdc++ on pkgsMusl. - patchelf = super.patchelf.overrideAttrs ( - previousAttrs: - lib.optionalAttrs super.stdenv.hostPlatform.isMusl { - NIX_CFLAGS_COMPILE = (previousAttrs.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++"; - } - ); + patchelf = super.patchelf.overrideAttrs (previousAttrs: { + env = + previousAttrs.env or { } + // lib.optionalAttrs super.stdenv.hostPlatform.isMusl { + NIX_CFLAGS_COMPILE = (previousAttrs.env.NIX_CFLAGS_COMPILE or "") + " -static-libstdc++"; + }; + }); }; } From 9b7c6984563be8b629e9532c31de800bf06bca0c Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 14:13:23 +0200 Subject: [PATCH 172/318] libidn2: enable structuredAttrs, use finalAttrs --- pkgs/development/libraries/libidn2/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/development/libraries/libidn2/default.nix b/pkgs/development/libraries/libidn2/default.nix index 3d06a7410c5e..8b34a2842082 100644 --- a/pkgs/development/libraries/libidn2/default.nix +++ b/pkgs/development/libraries/libidn2/default.nix @@ -14,12 +14,12 @@ # cgit) that are needed here should be included directly in Nixpkgs as # files. -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "libidn2"; version = "2.3.8"; src = fetchurl { - url = "https://ftp.gnu.org/gnu/libidn/libidn2-${version}.tar.gz"; + url = "https://ftp.gnu.org/gnu/libidn/libidn2-${finalAttrs.version}.tar.gz"; hash = "sha256-9VeRG/YXFiHh9y/zX1sYJbs1tS7UUyXc3ukx5dPAeHo="; }; @@ -44,6 +44,8 @@ stdenv.mkDerivation rec { buildInputs = [ libunistring ] ++ lib.optional stdenv.hostPlatform.isDarwin libiconv; depsBuildBuild = [ buildPackages.stdenv.cc ]; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/libidn/#libidn2"; description = "Free software implementation of IDNA2008 and TR46"; @@ -65,6 +67,6 @@ stdenv.mkDerivation rec { ]; platforms = lib.platforms.all; maintainers = with lib.maintainers; [ fpletz ]; - identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version; + identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version; }; -} +}) From 67f2ae770a79ca7e3adee6f62300ebf1d538b33a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 14:40:22 +0200 Subject: [PATCH 173/318] libidn2: remove unused argument --- pkgs/development/libraries/libidn2/no-bootstrap-reference.nix | 1 - pkgs/stdenv/linux/default.nix | 1 - 2 files changed, 2 deletions(-) diff --git a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix index ff8c47915067..773dfb6efe0f 100644 --- a/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix +++ b/pkgs/development/libraries/libidn2/no-bootstrap-reference.nix @@ -4,7 +4,6 @@ libidn2, libunistring, runCommandLocal, - patchelf, }: # Construct a copy of libidn2.* where all (transitive) libc references (in .bin) # get replaced by a new one, so that there's no reference to bootstrap tools. diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix index c9b64c3086e8..64070e7747f6 100644 --- a/pkgs/stdenv/linux/default.nix +++ b/pkgs/stdenv/linux/default.nix @@ -853,7 +853,6 @@ in inherit (self) stdenv runCommandLocal - patchelf libunistring ; }; From 7611d6ee9aa7518c29a4a86dc6732b5af15377c4 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 14:22:37 +0200 Subject: [PATCH 174/318] binutils-patchelfed-ld: enable structuredAttrs --- pkgs/stdenv/linux/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/stdenv/linux/default.nix b/pkgs/stdenv/linux/default.nix index c9b64c3086e8..002380ca3e03 100644 --- a/pkgs/stdenv/linux/default.nix +++ b/pkgs/stdenv/linux/default.nix @@ -505,6 +505,7 @@ in dontUnpack = true; dontBuild = true; strictDeps = true; + __structuredAttrs = true; # We wouldn't need to *copy* all, but it's easier and the result is temporary anyway. installPhase = '' mkdir -p "$out"/bin From 8f933eda6c2aecd109ce1005dcce431983a36647 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 14:58:41 +0200 Subject: [PATCH 175/318] gzip: enable strictDeps --- pkgs/tools/compression/gzip/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix index 6aafcf6481df..badf811447c0 100644 --- a/pkgs/tools/compression/gzip/default.nix +++ b/pkgs/tools/compression/gzip/default.nix @@ -44,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: { ]; buildInputs = [ runtimeShellPackage ]; + strictDeps = true; + makeFlags = [ "SHELL=/bin/sh" "GREP=grep" From 3fff8a9301dc1d382776cb44483e777204cdb68f Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 14:58:52 +0200 Subject: [PATCH 176/318] gzip: enable structuredAttrs --- pkgs/tools/compression/gzip/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/compression/gzip/default.nix b/pkgs/tools/compression/gzip/default.nix index badf811447c0..707a46ad6efe 100644 --- a/pkgs/tools/compression/gzip/default.nix +++ b/pkgs/tools/compression/gzip/default.nix @@ -89,6 +89,8 @@ stdenv.mkDerivation (finalAttrs: { passthru.tests.makecheck = gzip.overrideAttrs { doCheck = true; }; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/gzip/"; description = "GNU zip compression program"; From 242747fe8a8c16368471b9339f77f531d4b2525e Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 18:20:17 +0200 Subject: [PATCH 177/318] autoconf-archive: enable structuredAttrs --- pkgs/by-name/au/autoconf-archive/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/au/autoconf-archive/package.nix b/pkgs/by-name/au/autoconf-archive/package.nix index 8a3e537001e7..deca81bdad53 100644 --- a/pkgs/by-name/au/autoconf-archive/package.nix +++ b/pkgs/by-name/au/autoconf-archive/package.nix @@ -28,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ xz ]; + __structuredAttrs = true; + meta = { description = "Archive of autoconf m4 macros"; homepage = "https://www.gnu.org/software/autoconf-archive/"; From 4101a91e99d5927bd40a99f844026331f080885e Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 18:20:37 +0200 Subject: [PATCH 178/318] dns-root-data: enable strictDeps, enable structuredAttrs --- pkgs/by-name/dn/dns-root-data/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/dn/dns-root-data/package.nix b/pkgs/by-name/dn/dns-root-data/package.nix index 88499b9fba9d..87517dc95c4e 100644 --- a/pkgs/by-name/dn/dns-root-data/package.nix +++ b/pkgs/by-name/dn/dns-root-data/package.nix @@ -27,6 +27,9 @@ stdenv.mkDerivation { cp ${./root.ds} $out/root.ds ''; + strictDeps = true; + __structuredAttrs = true; + meta = { homepage = "https://www.iana.org/domains/root/files"; description = "DNS root data including root hints and DNSSEC root trust anchor + key"; From 7c6ad2e2ca8c860df9fce06ed8f5f2b8860d6327 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:33:36 +0200 Subject: [PATCH 179/318] libuv: enable strictDeps --- pkgs/by-name/li/libuv/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix index bcbf5472a7e2..2a29d1bc79d9 100644 --- a/pkgs/by-name/li/libuv/package.nix +++ b/pkgs/by-name/li/libuv/package.nix @@ -162,6 +162,8 @@ stdenv.mkDerivation (finalAttrs: { pkg-config ]; + strictDeps = true; + # This is part of the Darwin bootstrap, so we don’t always get # `libutil.dylib` automatically propagated through the SDK. buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ From 9c7408f7726d53c754e3ec488ebd210c58863631 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:34:22 +0200 Subject: [PATCH 180/318] expat: enable structuredAttrs --- pkgs/by-name/ex/expat/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix index d0d13e37da6f..cbc79fe484c8 100644 --- a/pkgs/by-name/ex/expat/package.nix +++ b/pkgs/by-name/ex/expat/package.nix @@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { changelog = "https://github.com/libexpat/libexpat/blob/${tagFor finalAttrs.version}/expat/Changes"; homepage = "https://libexpat.github.io/"; From 723fcbddfc2c2777a2551891afc558d7d87187e2 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:34:58 +0200 Subject: [PATCH 181/318] libssh2: enable strictDeps --- pkgs/by-name/li/libssh2/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix index b7c88dfc5eb7..2f8a48adcf06 100644 --- a/pkgs/by-name/li/libssh2/package.nix +++ b/pkgs/by-name/li/libssh2/package.nix @@ -114,6 +114,8 @@ stdenv.mkDerivation (finalAttrs: { propagatedBuildInputs = [ openssl ]; # see Libs: in libssh2.pc buildInputs = [ zlib ] ++ lib.optional stdenv.hostPlatform.isMinGW windows.mingw_w64; + strictDeps = true; + passthru.tests = { inherit aria2 From 802b74024344bacc11a737db3f72bc2d7d289945 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:35:05 +0200 Subject: [PATCH 182/318] libssh2: enable structuredAttrs --- pkgs/by-name/li/libssh2/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix index 2f8a48adcf06..1e2299e9075e 100644 --- a/pkgs/by-name/li/libssh2/package.nix +++ b/pkgs/by-name/li/libssh2/package.nix @@ -126,6 +126,8 @@ stdenv.mkDerivation (finalAttrs: { curl = (curl.override { scpSupport = true; }).tests.withCheck; }; + __structuredAttrs = true; + meta = { description = "Client-side C library implementing the SSH2 protocol"; homepage = "https://www.libssh2.org"; From 2d8dde5339215717a4e83eac00c48cc9bc09dbd1 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:38:50 +0200 Subject: [PATCH 183/318] cunit: enable strictDeps --- pkgs/by-name/cu/cunit/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/cu/cunit/package.nix b/pkgs/by-name/cu/cunit/package.nix index 7d9ee6b0f51d..6d7c7a30255f 100644 --- a/pkgs/by-name/cu/cunit/package.nix +++ b/pkgs/by-name/cu/cunit/package.nix @@ -19,6 +19,8 @@ stdenv.mkDerivation (finalAttrs: { ]; buildInputs = [ libtool ]; + strictDeps = true; + src = fetchurl { url = "mirror://sourceforge/cunit/CUnit/${finalAttrs.version}/CUnit-${finalAttrs.version}.tar.bz2"; sha256 = "057j82da9vv4li4z5ri3227ybd18nzyq81f6gsvhifs5z0vr3cpm"; From 6328665df8135963ff9b29b74cc72dbef5757bbd Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:38:56 +0200 Subject: [PATCH 184/318] cunit: enable structuredAttrs --- pkgs/by-name/cu/cunit/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/cu/cunit/package.nix b/pkgs/by-name/cu/cunit/package.nix index 6d7c7a30255f..8c8db5d947bd 100644 --- a/pkgs/by-name/cu/cunit/package.nix +++ b/pkgs/by-name/cu/cunit/package.nix @@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: { sha256 = "057j82da9vv4li4z5ri3227ybd18nzyq81f6gsvhifs5z0vr3cpm"; }; + __structuredAttrs = true; + meta = { description = "Unit Testing Framework for C"; From f3dc70c259c80eca1c86a1aaa21ab4220f52d367 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:41:40 +0200 Subject: [PATCH 185/318] gdbm: enable strictDeps --- pkgs/by-name/gd/gdbm/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gd/gdbm/package.nix b/pkgs/by-name/gd/gdbm/package.nix index a31390c4ea3b..1ad4a0bf2f95 100644 --- a/pkgs/by-name/gd/gdbm/package.nix +++ b/pkgs/by-name/gd/gdbm/package.nix @@ -17,6 +17,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ]; + strictDeps = true; + hardeningDisable = [ "strictflexarrays3" ]; configureFlags = [ (lib.enableFeature true "libgdbm-compat") ]; From b79b63239a611d9fcd98683e4a7cd1691d7c69c0 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:41:52 +0200 Subject: [PATCH 186/318] gdbm: enable structuredAttrs --- pkgs/by-name/gd/gdbm/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gd/gdbm/package.nix b/pkgs/by-name/gd/gdbm/package.nix index 1ad4a0bf2f95..df4c6eae1247 100644 --- a/pkgs/by-name/gd/gdbm/package.nix +++ b/pkgs/by-name/gd/gdbm/package.nix @@ -65,6 +65,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/gdbm/"; description = "GNU dbm key/value database library"; From c13c277dbde4ed41bea290522a3c53d46fd61f48 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 21:09:13 +0200 Subject: [PATCH 187/318] libevent: enable strictDeps --- pkgs/by-name/li/libevent/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libevent/package.nix b/pkgs/by-name/li/libevent/package.nix index d220a63c4963..35f8e2ceb62c 100644 --- a/pkgs/by-name/li/libevent/package.nix +++ b/pkgs/by-name/li/libevent/package.nix @@ -59,6 +59,8 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = lib.optional sslSupport openssl ++ lib.optional stdenv.hostPlatform.isCygwin findutils; + strictDeps = true; + doCheck = false; # needs the net postInstall = lib.optionalString sslSupport '' From 6c859e663663292c93358380d240ffc248372edd Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 21:09:31 +0200 Subject: [PATCH 188/318] libevent: enable structuredAttrs, use hash --- pkgs/by-name/li/libevent/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/li/libevent/package.nix b/pkgs/by-name/li/libevent/package.nix index 35f8e2ceb62c..05d16036ed14 100644 --- a/pkgs/by-name/li/libevent/package.nix +++ b/pkgs/by-name/li/libevent/package.nix @@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: { # Don't define BIO_get_init() for LibreSSL 3.5+ (fetchpatch { url = "https://github.com/libevent/libevent/commit/883630f76cbf512003b81de25cd96cb75c6cf0f9.patch"; - sha256 = "sha256-VPJqJUAovw6V92jpqIXkIR1xYGbxIWxaHr8cePWI2SU="; + hash = "sha256-VPJqJUAovw6V92jpqIXkIR1xYGbxIWxaHr8cePWI2SU="; }) ]; @@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: { enableParallelBuilding = true; + __structuredAttrs = true; + meta = { description = "Event notification library"; mainProgram = "event_rpcgen.py"; From fd87d300945c8f0179de468eac34df32e32296d3 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 21:15:48 +0200 Subject: [PATCH 189/318] libtasn1: enable strictDeps --- pkgs/by-name/li/libtasn1/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libtasn1/package.nix b/pkgs/by-name/li/libtasn1/package.nix index 7de5f9bc2b74..5516233d7ccc 100644 --- a/pkgs/by-name/li/libtasn1/package.nix +++ b/pkgs/by-name/li/libtasn1/package.nix @@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: { perl ]; + strictDeps = true; + doCheck = true; preCheck = if stdenv.hostPlatform.isDarwin then "export DYLD_LIBRARY_PATH=`pwd`/lib/.libs" else null; From 64ebebdab1d4c7ff231777ea904211bd345d6294 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 21:16:04 +0200 Subject: [PATCH 190/318] libtasn1: enable structuredAttrs --- pkgs/by-name/li/libtasn1/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libtasn1/package.nix b/pkgs/by-name/li/libtasn1/package.nix index 5516233d7ccc..3bd5a828f519 100644 --- a/pkgs/by-name/li/libtasn1/package.nix +++ b/pkgs/by-name/li/libtasn1/package.nix @@ -42,6 +42,8 @@ stdenv.mkDerivation (finalAttrs: { inherit gnutls samba qemu; }; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/libtasn1/"; description = "ASN.1 library"; From 64856d04debcb459cfbaeb7957f6fc8b2885714d Mon Sep 17 00:00:00 2001 From: Johan Herland Date: Wed, 5 Aug 2026 11:06:46 +0200 Subject: [PATCH 191/318] python3Packages.datamodel-code-generator: fix failing test on Darwin --- .../python-modules/datamodel-code-generator/default.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/development/python-modules/datamodel-code-generator/default.nix b/pkgs/development/python-modules/datamodel-code-generator/default.nix index 875cb53d382d..4ab9cc01b5a9 100644 --- a/pkgs/development/python-modules/datamodel-code-generator/default.nix +++ b/pkgs/development/python-modules/datamodel-code-generator/default.nix @@ -123,6 +123,9 @@ buildPythonPackage (finalAttrs: { "test_type_checking_imports_default_to_runtime_imports_for_modular_pydantic_ruff" ]; + # Some of the tests use localhost networking. + __darwinAllowLocalNetworking = true; + pythonImportsCheck = [ "datamodel_code_generator" ]; meta = { From ab0b6d2c82044a68c6d895d4b80a44016a9bb927 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 21:17:49 +0200 Subject: [PATCH 192/318] net-tools: enable strictDeps --- pkgs/os-specific/linux/net-tools/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix index cad8c516b766..3916b6186501 100644 --- a/pkgs/os-specific/linux/net-tools/default.nix +++ b/pkgs/os-specific/linux/net-tools/default.nix @@ -44,6 +44,8 @@ stdenv.mkDerivation rec { "man" ]; + strictDeps = true; + meta = { homepage = "http://net-tools.sourceforge.net/"; description = "Set of tools for controlling the network subsystem in Linux"; From a66df804a468a6c922c75f45bcc87b02d6d4043d Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 21:18:09 +0200 Subject: [PATCH 193/318] net-tools: enable structuredAttrs, use finalAttrs, hash --- pkgs/os-specific/linux/net-tools/default.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix index 3916b6186501..719014c1a04c 100644 --- a/pkgs/os-specific/linux/net-tools/default.nix +++ b/pkgs/os-specific/linux/net-tools/default.nix @@ -5,13 +5,13 @@ fetchpatch, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "net-tools"; version = "2.10"; src = fetchurl { - url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.xz"; - sha256 = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk="; + url = "mirror://sourceforge/net-tools/net-tools-${finalAttrs.version}.tar.xz"; + hash = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk="; }; patches = [ @@ -46,10 +46,12 @@ stdenv.mkDerivation rec { strictDeps = true; + __structuredAttrs = true; + meta = { homepage = "http://net-tools.sourceforge.net/"; description = "Set of tools for controlling the network subsystem in Linux"; license = lib.licenses.gpl2Plus; platforms = lib.platforms.linux; }; -} +}) From 2ffabbce38775c46ea2ad3b48ed7c082c33d0f24 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 21:27:08 +0200 Subject: [PATCH 194/318] libxml2: enable structuredAttrs --- pkgs/development/libraries/libxml2/common.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/libraries/libxml2/common.nix b/pkgs/development/libraries/libxml2/common.nix index 61c40a95ffe3..6fbae9218df3 100644 --- a/pkgs/development/libraries/libxml2/common.nix +++ b/pkgs/development/libraries/libxml2/common.nix @@ -153,6 +153,8 @@ stdenv'.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { homepage = "https://gitlab.gnome.org/GNOME/libxml2"; description = "XML parsing library for C"; From b7fc755c29d91e82925cd41e16a69d4b7c43cee2 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 02:21:11 +0200 Subject: [PATCH 195/318] zstd: enable strictDeps --- pkgs/tools/compression/zstd/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix index 03d06ce67bcf..07b04ddf69f1 100644 --- a/pkgs/tools/compression/zstd/default.nix +++ b/pkgs/tools/compression/zstd/default.nix @@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames; buildInputs = lib.optional stdenv.hostPlatform.isUnix bashNonInteractive; + strictDeps = true; + patches = [ # This patches makes sure we do not attempt to use the MD5 implementation # of the host platform when running the tests From 61a3d2b3c016c7c865d321b1156e878ffb6b6bd6 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 02:21:24 +0200 Subject: [PATCH 196/318] zstd: enable structuredAttrs, use tag --- pkgs/tools/compression/zstd/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/tools/compression/zstd/default.nix b/pkgs/tools/compression/zstd/default.nix index 07b04ddf69f1..4000a273168d 100644 --- a/pkgs/tools/compression/zstd/default.nix +++ b/pkgs/tools/compression/zstd/default.nix @@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "facebook"; repo = "zstd"; - rev = "v${finalAttrs.version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-tNFWIT9ydfozB8dWcmTMuZLCQmQudTFJIkSr0aG7S44="; }; @@ -146,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { description = "Zstandard real-time compression algorithm"; longDescription = '' From 223da789c8100732b67ac8c7bcfa0a046608a37e Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 02:55:44 +0200 Subject: [PATCH 197/318] libgcrypt: enable structuredAttrs, use finalAttrs --- pkgs/by-name/li/libgcrypt/package.nix | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix index 20f8cad0a141..e50f8656c1c0 100644 --- a/pkgs/by-name/li/libgcrypt/package.nix +++ b/pkgs/by-name/li/libgcrypt/package.nix @@ -16,12 +16,12 @@ assert enableCapabilities -> stdenv.hostPlatform.isLinux; -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "libgcrypt"; version = "1.12.2"; src = fetchurl { - url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2"; + url = "mirror://gnupg/libgcrypt/libgcrypt-${finalAttrs.version}.tar.bz2"; hash = "sha256-fOM8JJIiGgQ2+WqFACFenz49y1/SanV81BXnqEO6vV4="; }; @@ -118,13 +118,15 @@ stdenv.mkDerivation rec { inherit gnupg libotr rsyslog; }; + __structuredAttrs = true; + meta = { homepage = "https://www.gnu.org/software/libgcrypt/"; - changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=${pname}.git;a=blob;f=NEWS;hb=refs/tags/${pname}-${version}"; + changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=NEWS;hb=refs/tags/libgcrypt-${finalAttrs.version}"; description = "General-purpose cryptographic library"; license = lib.licenses.lgpl2Plus; platforms = lib.platforms.all; maintainers = [ ]; - identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" version; + identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" finalAttrs.version; }; -} +}) From 978442edde457484a4c04618927532399d08c3cc Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:06:11 +0200 Subject: [PATCH 198/318] tzdata: enable strictDeps, enable structuredAttrs --- pkgs/by-name/tz/tzdata/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/tz/tzdata/package.nix b/pkgs/by-name/tz/tzdata/package.nix index 75cb3cc49134..7e3f8f38535d 100644 --- a/pkgs/by-name/tz/tzdata/package.nix +++ b/pkgs/by-name/tz/tzdata/package.nix @@ -35,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: { ]; propagatedBuildOutputs = [ ]; + strictDeps = true; + makeFlags = [ "TOPDIR=${placeholder "out"}" "TZDIR=${placeholder "out"}/share/zoneinfo" @@ -113,6 +115,8 @@ stdenv.mkDerivation (finalAttrs: { # minor releases. passthru.tests = postgresql; + __structuredAttrs = true; + meta = { homepage = "http://www.iana.org/time-zones"; description = "Database of current and historical time zones"; From 515a68fad06e1025e930a6b4916e78faeb3e1413 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:07:43 +0200 Subject: [PATCH 199/318] swig: enable structuredAttrs, use tag --- pkgs/by-name/sw/swig/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/sw/swig/package.nix b/pkgs/by-name/sw/swig/package.nix index 7b7b7e01a8f3..6afb32b575f8 100644 --- a/pkgs/by-name/sw/swig/package.nix +++ b/pkgs/by-name/sw/swig/package.nix @@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "swig"; repo = "swig"; - rev = "v${finalAttrs.version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-jsi83v9sg0n5kUfDACqdNAS2VuLSyxv+pe2LRcO4Khc="; }; @@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: { enableParallelBuilding = true; + __structuredAttrs = true; + meta = { changelog = "https://github.com/swig/swig/blob/${finalAttrs.src.rev}/CHANGES.current"; description = "Interface compiler that connects C/C++ code to higher-level languages"; From f53d3b8607a3cd5d713521a13892043535a2ce20 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:12:38 +0200 Subject: [PATCH 200/318] publicsuffix-list: enable strictDeps, enable structuredAttrs --- pkgs/by-name/pu/publicsuffix-list/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix index d6c15745fa64..4484241146d4 100644 --- a/pkgs/by-name/pu/publicsuffix-list/package.nix +++ b/pkgs/by-name/pu/publicsuffix-list/package.nix @@ -18,6 +18,8 @@ stdenvNoCC.mkDerivation { dontBuild = true; + strictDeps = true; + installPhase = '' runHook preInstall @@ -28,6 +30,8 @@ stdenvNoCC.mkDerivation { passthru.updateScript = unstableGitUpdater { }; + __structuredAttrs = true; + meta = { homepage = "https://publicsuffix.org/"; description = "Cross-vendor public domain suffix database"; From 4a2272cd68b28ea803a23ef42fc04da00858bbd7 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:15:52 +0200 Subject: [PATCH 201/318] lzo: enable structuredAttrs --- pkgs/by-name/lz/lzo/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/lz/lzo/package.nix b/pkgs/by-name/lz/lzo/package.nix index a3ecb16bb807..c5deccd3be13 100644 --- a/pkgs/by-name/lz/lzo/package.nix +++ b/pkgs/by-name/lz/lzo/package.nix @@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: { "doc" ]; + __structuredAttrs = true; + meta = { description = "Real-time data (de)compression library"; longDescription = '' From 8f6f404a44bf4b56835b6338c34463b2f0120a37 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:16:01 +0200 Subject: [PATCH 202/318] lzo: use sri hash --- pkgs/by-name/lz/lzo/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/lz/lzo/package.nix b/pkgs/by-name/lz/lzo/package.nix index c5deccd3be13..da806c6a1e24 100644 --- a/pkgs/by-name/lz/lzo/package.nix +++ b/pkgs/by-name/lz/lzo/package.nix @@ -11,7 +11,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://www.oberhumer.com/opensource/lzo/download/lzo-${finalAttrs.version}.tar.gz"; - sha256 = "0wm04519pd3g8hqpjqhfr72q8qmbiwqaxcs3cndny9h86aa95y60"; + hash = "sha256-wPiSlDIIJm+bZUOzrjCPq2KExckOYnkxRG+0m0IhoHI="; }; nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ]; From 49e12b0826d421d2c77ff5ab4b65a5bfc747c0ac Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:17:06 +0200 Subject: [PATCH 203/318] libxslt: enable structuredAttrs --- pkgs/by-name/li/libxslt/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libxslt/package.nix b/pkgs/by-name/li/libxslt/package.nix index da39812157a4..e0303ba11235 100644 --- a/pkgs/by-name/li/libxslt/package.nix +++ b/pkgs/by-name/li/libxslt/package.nix @@ -97,6 +97,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { homepage = "https://gitlab.gnome.org/GNOME/libxslt"; description = "C library and tools to do XSL transformations"; From 7072d88d5e8593a9e4aecbee46bcc39e7a76f6a0 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:26:09 +0200 Subject: [PATCH 204/318] nghttp2: enable strictDeps --- pkgs/by-name/ng/nghttp2/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ng/nghttp2/package.nix b/pkgs/by-name/ng/nghttp2/package.nix index 0151aa916190..9c0c5dedfbef 100644 --- a/pkgs/by-name/ng/nghttp2/package.nix +++ b/pkgs/by-name/ng/nghttp2/package.nix @@ -77,6 +77,8 @@ stdenv.mkDerivation rec { ] ++ lib.optionals enablePython [ python3 ]; + strictDeps = true; + enableParallelBuilding = true; configureFlags = [ From a2b20fc065590f34f82a9e81d71568466c883bba Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:26:20 +0200 Subject: [PATCH 205/318] nghttp2: enable structuredAttrs, use finalAttrs --- pkgs/by-name/ng/nghttp2/package.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/ng/nghttp2/package.nix b/pkgs/by-name/ng/nghttp2/package.nix index 9c0c5dedfbef..68a42a1826af 100644 --- a/pkgs/by-name/ng/nghttp2/package.nix +++ b/pkgs/by-name/ng/nghttp2/package.nix @@ -42,12 +42,12 @@ assert enableHpack -> enableApp; assert enableHttp3 -> enableApp; assert enableJemalloc -> enableApp; -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "nghttp2"; version = "1.70.0"; src = fetchurl { - url = "https://github.com/nghttp2/nghttp2/releases/download/v${version}/nghttp2-${version}.tar.bz2"; + url = "https://github.com/nghttp2/nghttp2/releases/download/v${finalAttrs.version}/nghttp2-${finalAttrs.version}.tar.bz2"; hash = "sha256-j6yh94qpmsO8F2ina34PazbY5qYsE4GHUbHSBfAvlAU="; }; @@ -118,6 +118,8 @@ stdenv.mkDerivation rec { inherit curl libsoup_3; }; + __structuredAttrs = true; + meta = { description = "HTTP/2 C library and tools"; longDescription = '' @@ -131,10 +133,10 @@ stdenv.mkDerivation rec { ''; homepage = "https://nghttp2.org/"; - changelog = "https://github.com/nghttp2/nghttp2/releases/tag/v${version}"; + changelog = "https://github.com/nghttp2/nghttp2/releases/tag/v${finalAttrs.version}"; # News articles with changes summary can be found here: https://nghttp2.org/blog/archives/ license = lib.licenses.mit; maintainers = [ ]; platforms = lib.platforms.all; }; -} +}) From 24a79c448adbafabce5dab7a879fd7bdd00216ce Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:27:56 +0200 Subject: [PATCH 206/318] musl-fts: enable strictDeps --- pkgs/by-name/mu/musl-fts/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/mu/musl-fts/package.nix b/pkgs/by-name/mu/musl-fts/package.nix index 09c7cedb009b..ba9b64c3515f 100644 --- a/pkgs/by-name/mu/musl-fts/package.nix +++ b/pkgs/by-name/mu/musl-fts/package.nix @@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: { pkg-config ]; + strictDeps = true; + enableParallelBuilding = true; meta = { From 72103b68c4cb3570d65339f6f5228800a19ed86a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:28:10 +0200 Subject: [PATCH 207/318] musl-fts: enable structuredAttrs, use tag --- pkgs/by-name/mu/musl-fts/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/mu/musl-fts/package.nix b/pkgs/by-name/mu/musl-fts/package.nix index ba9b64c3515f..6ba3b321df29 100644 --- a/pkgs/by-name/mu/musl-fts/package.nix +++ b/pkgs/by-name/mu/musl-fts/package.nix @@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "void-linux"; repo = "musl-fts"; - rev = "v${finalAttrs.version}"; + tag = "v${finalAttrs.version}"; sha256 = "Azw5qrz6OKDcpYydE6jXzVxSM5A8oYWAztrHr+O/DOE="; }; @@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: { enableParallelBuilding = true; + __structuredAttrs = true; + meta = { homepage = "https://github.com/void-linux/musl-fts"; description = "Implementation of fts(3) for musl-libc"; From bef44b5305824f6c055ac6833d2fe371e8681b38 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:28:35 +0200 Subject: [PATCH 208/318] musl-obstack: enable strictDeps --- pkgs/by-name/mu/musl-obstack/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/mu/musl-obstack/package.nix b/pkgs/by-name/mu/musl-obstack/package.nix index e0172eb8aab9..8915e8b452b5 100644 --- a/pkgs/by-name/mu/musl-obstack/package.nix +++ b/pkgs/by-name/mu/musl-obstack/package.nix @@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: { pkg-config ]; + strictDeps = true; + enableParallelBuilding = true; meta = { From b8ce44e58235e158993a474b3fd01dca5f383aef Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:28:44 +0200 Subject: [PATCH 209/318] musl-obstack: enable structuredAttrs, use tag --- pkgs/by-name/mu/musl-obstack/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/mu/musl-obstack/package.nix b/pkgs/by-name/mu/musl-obstack/package.nix index 8915e8b452b5..cbd56e5bb559 100644 --- a/pkgs/by-name/mu/musl-obstack/package.nix +++ b/pkgs/by-name/mu/musl-obstack/package.nix @@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "void-linux"; repo = "musl-obstack"; - rev = "v${finalAttrs.version}"; + tag = "v${finalAttrs.version}"; sha256 = "sha256-oydS7FubUniMHAUWfg84OH9+CZ0JCrTXy7jzwOyJzC8="; }; @@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: { enableParallelBuilding = true; + __structuredAttrs = true; + meta = { homepage = "https://github.com/void-linux/musl-obstack"; description = "Extraction of the obstack functions and macros from GNU libiberty for use with musl-libc"; From 0e99956984de69eb3697918b3eed08b1a32be120 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:31:54 +0200 Subject: [PATCH 210/318] nghttp3: enable strictDeps --- pkgs/by-name/ng/nghttp3/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix index 852ebfce6194..d6f5302983c8 100644 --- a/pkgs/by-name/ng/nghttp3/package.nix +++ b/pkgs/by-name/ng/nghttp3/package.nix @@ -23,6 +23,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ cmake ]; + strictDeps = true; + cmakeFlags = [ (lib.cmakeBool "ENABLE_SHARED_LIB" (!stdenv.hostPlatform.isStatic)) (lib.cmakeBool "ENABLE_STATIC_LIB" stdenv.hostPlatform.isStatic) From 6d8416f4edb57e05b18b65400b4fc6ec2fb387eb Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:32:10 +0200 Subject: [PATCH 211/318] nghttp3: enable structuredAttrs --- pkgs/by-name/ng/nghttp3/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ng/nghttp3/package.nix b/pkgs/by-name/ng/nghttp3/package.nix index d6f5302983c8..94cbf454b4d2 100644 --- a/pkgs/by-name/ng/nghttp3/package.nix +++ b/pkgs/by-name/ng/nghttp3/package.nix @@ -37,6 +37,8 @@ stdenv.mkDerivation (finalAttrs: { inherit curl; }; + __structuredAttrs = true; + meta = { homepage = "https://github.com/ngtcp2/nghttp3"; changelog = "https://github.com/ngtcp2/nghttp3/releases/tag/v${finalAttrs.version}"; From 68ee3c81244ca4758ac07ed08ce248579e444db4 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:34:01 +0200 Subject: [PATCH 212/318] libarchive: enable strictDeps --- pkgs/by-name/li/libarchive/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix index fe81d018859c..0f587a6260ac 100644 --- a/pkgs/by-name/li/libarchive/package.nix +++ b/pkgs/by-name/li/libarchive/package.nix @@ -108,6 +108,8 @@ stdenv.mkDerivation (finalAttrs: { acl ]; + strictDeps = true; + hardeningDisable = [ "strictflexarrays3" ] From 27ff9592b5b79aabcc68f38b38546b339a25af71 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:34:08 +0200 Subject: [PATCH 213/318] libarchive: enable structuredAttrs --- pkgs/by-name/li/libarchive/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libarchive/package.nix b/pkgs/by-name/li/libarchive/package.nix index 0f587a6260ac..7c0d0c9459e5 100644 --- a/pkgs/by-name/li/libarchive/package.nix +++ b/pkgs/by-name/li/libarchive/package.nix @@ -142,6 +142,8 @@ stdenv.mkDerivation (finalAttrs: { enableParallelBuilding = true; + __structuredAttrs = true; + meta = { homepage = "http://libarchive.org"; description = "Multi-format archive and compression library"; From 1637d349797dc8e7fc6848c2d4dd6859469a4366 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:55:32 +0200 Subject: [PATCH 214/318] brotli: enable strictDeps --- pkgs/by-name/br/brotli/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/br/brotli/package.nix b/pkgs/by-name/br/brotli/package.nix index c6cc9bc0e8bb..d4d4467c1fa6 100644 --- a/pkgs/by-name/br/brotli/package.nix +++ b/pkgs/by-name/br/brotli/package.nix @@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ cmake ]; + strictDeps = true; + cmakeFlags = lib.optional staticOnly "-DBUILD_SHARED_LIBS=OFF"; outputs = [ From 89aa16b64250fc43ec2b6a933ac79b4ddcd0aaf0 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 11:55:40 +0200 Subject: [PATCH 215/318] brotli: enable structuredAttrs --- pkgs/by-name/br/brotli/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/br/brotli/package.nix b/pkgs/by-name/br/brotli/package.nix index d4d4467c1fa6..6d26a2de5ac5 100644 --- a/pkgs/by-name/br/brotli/package.nix +++ b/pkgs/by-name/br/brotli/package.nix @@ -62,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: { updateScript = nix-update-script { }; }; + __structuredAttrs = true; + meta = { homepage = "https://github.com/google/brotli"; changelog = "https://github.com/google/brotli/blob/${finalAttrs.src.tag}/CHANGELOG.md"; From 75bd101d2665506521cdbd83f13931f33c64c332 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 14:58:16 +0200 Subject: [PATCH 216/318] util-linux: enable strictDeps --- pkgs/by-name/ut/util-linux/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix index bfabdf565486..55d629c08d0a 100644 --- a/pkgs/by-name/ut/util-linux/package.nix +++ b/pkgs/by-name/ut/util-linux/package.nix @@ -171,6 +171,8 @@ stdenv.mkDerivation (finalAttrs: { ++ lib.optionals ncursesSupport [ ncurses ] ++ lib.optionals systemdSupport [ systemdLibs ]; + strictDeps = true; + enableParallelBuilding = true; postInstall = '' From 3fc9dda8d5a113be2ea0dc2b55a0db59d9c03916 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 14:58:26 +0200 Subject: [PATCH 217/318] util-linux: enable structuredAttrs --- pkgs/by-name/ut/util-linux/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix index 55d629c08d0a..46c428876cac 100644 --- a/pkgs/by-name/ut/util-linux/package.nix +++ b/pkgs/by-name/ut/util-linux/package.nix @@ -231,6 +231,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { homepage = "https://www.kernel.org/pub/linux/utils/util-linux/"; description = "Set of system utilities for Linux"; From cc022802b463ba3e11fed6426e007205eba2ef64 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 15:12:39 +0200 Subject: [PATCH 218/318] python3: enable strictDeps --- pkgs/development/interpreters/python/cpython/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix index e9440614cf34..895394823001 100644 --- a/pkgs/development/interpreters/python/cpython/default.nix +++ b/pkgs/development/interpreters/python/cpython/default.nix @@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: { ] ++ buildInputs; + strictDeps = true; + prePatch = optionalString stdenv.hostPlatform.isDarwin '' substituteInPlace configure --replace-fail '`/usr/bin/arch`' '"i386"' ''; From 6699a477c8a29f824f1190c9c48ae1907465432a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 15:37:49 +0200 Subject: [PATCH 219/318] python3-bootstrap: enable strictDeps, enable structuredAttrs --- pkgs/development/python-modules/bootstrap/build/default.nix | 3 +++ .../development/python-modules/bootstrap/flit-core/default.nix | 3 +++ .../development/python-modules/bootstrap/installer/default.nix | 3 +++ .../development/python-modules/bootstrap/packaging/default.nix | 3 +++ 4 files changed, 12 insertions(+) diff --git a/pkgs/development/python-modules/bootstrap/build/default.nix b/pkgs/development/python-modules/bootstrap/build/default.nix index 0d693e2dde58..dbd713e10482 100644 --- a/pkgs/development/python-modules/bootstrap/build/default.nix +++ b/pkgs/development/python-modules/bootstrap/build/default.nix @@ -37,6 +37,9 @@ let runHook postInstall ''; + + strictDeps = true; + __structuredAttrs = true; } // attrs ); diff --git a/pkgs/development/python-modules/bootstrap/flit-core/default.nix b/pkgs/development/python-modules/bootstrap/flit-core/default.nix index 67b8a00ee0ee..5b5858e598cc 100644 --- a/pkgs/development/python-modules/bootstrap/flit-core/default.nix +++ b/pkgs/development/python-modules/bootstrap/flit-core/default.nix @@ -31,4 +31,7 @@ stdenv.mkDerivation { runHook postInstall ''; + + strictDeps = true; + __structuredAttrs = true; } diff --git a/pkgs/development/python-modules/bootstrap/installer/default.nix b/pkgs/development/python-modules/bootstrap/installer/default.nix index 9f396bb6275a..2e0c1729bf4b 100644 --- a/pkgs/development/python-modules/bootstrap/installer/default.nix +++ b/pkgs/development/python-modules/bootstrap/installer/default.nix @@ -31,4 +31,7 @@ stdenv.mkDerivation { runHook postInstall ''; + + strictDeps = true; + __structuredAttrs = true; } diff --git a/pkgs/development/python-modules/bootstrap/packaging/default.nix b/pkgs/development/python-modules/bootstrap/packaging/default.nix index 8f429e5f5c65..e0e067060641 100644 --- a/pkgs/development/python-modules/bootstrap/packaging/default.nix +++ b/pkgs/development/python-modules/bootstrap/packaging/default.nix @@ -28,4 +28,7 @@ stdenv.mkDerivation { runHook postInstall ''; + + strictDeps = true; + __structuredAttrs = true; } From c330f7459666d77c6d5866a47eec640669397a1c Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 15:15:53 +0200 Subject: [PATCH 220/318] help2man: enable structuredAttrs --- pkgs/by-name/he/help2man/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/he/help2man/package.nix b/pkgs/by-name/he/help2man/package.nix index aee62e34cb57..7e19937f788d 100644 --- a/pkgs/by-name/he/help2man/package.nix +++ b/pkgs/by-name/he/help2man/package.nix @@ -56,6 +56,8 @@ stdenv.mkDerivation (finalAttrs: { chmod +x $out/bin/help2man ''; + __structuredAttrs = true; + meta = { description = "Generate man pages from `--help' output"; mainProgram = "help2man"; From 76e94ff2d0220b29ebb12223b732f9c8e0d115c7 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:26:39 +0200 Subject: [PATCH 221/318] argp-standalone: enable strictDeps --- pkgs/by-name/ar/argp-standalone/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ar/argp-standalone/package.nix b/pkgs/by-name/ar/argp-standalone/package.nix index 3064c3c94f83..470d33de7454 100644 --- a/pkgs/by-name/ar/argp-standalone/package.nix +++ b/pkgs/by-name/ar/argp-standalone/package.nix @@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: { ninja ]; + strictDeps = true; + doCheck = true; meta = { From 0d1ecdbf033355eeffa9b0f9f959fcd9640c87b0 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:30:26 +0200 Subject: [PATCH 222/318] argp-standalone: enable structuredAttrs --- pkgs/by-name/ar/argp-standalone/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ar/argp-standalone/package.nix b/pkgs/by-name/ar/argp-standalone/package.nix index 470d33de7454..a0aacd8ca60b 100644 --- a/pkgs/by-name/ar/argp-standalone/package.nix +++ b/pkgs/by-name/ar/argp-standalone/package.nix @@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: { doCheck = true; + __structuredAttrs = true; + meta = { homepage = "https://github.com/argp-standalone/argp-standalone"; description = "Standalone version of arguments parsing functions from Glibc"; From 5f3cc208a38376e196c3259a2186371e9dd0bb8a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:50:28 +0200 Subject: [PATCH 223/318] dash: enable structuredAttrs --- pkgs/by-name/da/dash/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/da/dash/package.nix b/pkgs/by-name/da/dash/package.nix index 1b1e6ceeef9d..916d5e54daa3 100644 --- a/pkgs/by-name/da/dash/package.nix +++ b/pkgs/by-name/da/dash/package.nix @@ -63,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { homepage = "http://gondor.apana.org.au/~herbert/dash/"; description = "POSIX-compliant implementation of /bin/sh that aims to be as small as possible"; From 8afda891b48915ece358dbf2d8cdb5b4e07a17f9 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:56:04 +0200 Subject: [PATCH 224/318] getopt: enable strictDeps --- pkgs/by-name/ge/getopt/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ge/getopt/package.nix b/pkgs/by-name/ge/getopt/package.nix index 27014776c148..a92d820f0323 100644 --- a/pkgs/by-name/ge/getopt/package.nix +++ b/pkgs/by-name/ge/getopt/package.nix @@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: { # attempt to use C library functions without declaring them, which is raised as an error. env.NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__"; + strictDeps = true; + makeFlags = [ "WITHOUT_GETTEXT=1" "LIBCGETOPT=0" From d9df72fe201997739b39878191e9f3795b12a6bc Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:56:13 +0200 Subject: [PATCH 225/318] getopt: enable structuredAttrs --- pkgs/by-name/ge/getopt/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ge/getopt/package.nix b/pkgs/by-name/ge/getopt/package.nix index a92d820f0323..866ce3db12ee 100644 --- a/pkgs/by-name/ge/getopt/package.nix +++ b/pkgs/by-name/ge/getopt/package.nix @@ -25,6 +25,8 @@ stdenv.mkDerivation (finalAttrs: { "CC:=$(CC)" ]; + __structuredAttrs = true; + meta = { platforms = lib.platforms.unix; homepage = "http://frodo.looijaard.name/project/getopt"; From 363309e1b8697370a9f42bdd905246a669a78b93 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:56:31 +0200 Subject: [PATCH 226/318] libpfm: enable strictDeps --- pkgs/by-name/li/libpfm/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libpfm/package.nix b/pkgs/by-name/li/libpfm/package.nix index 87dcac45923c..f5eafce1fe89 100644 --- a/pkgs/by-name/li/libpfm/package.nix +++ b/pkgs/by-name/li/libpfm/package.nix @@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = lib.optional stdenv.hostPlatform.isMinGW windows.libgnurx; + strictDeps = true; + meta = { description = "Helper library to program the performance monitoring events"; longDescription = '' From f2d074fb4c6b58eff64d48feece0df871fa9e38a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:56:47 +0200 Subject: [PATCH 227/318] libpfm: enable structuredAttrs --- pkgs/by-name/li/libpfm/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/li/libpfm/package.nix b/pkgs/by-name/li/libpfm/package.nix index f5eafce1fe89..d68516dcec02 100644 --- a/pkgs/by-name/li/libpfm/package.nix +++ b/pkgs/by-name/li/libpfm/package.nix @@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: { strictDeps = true; + __structuredAttrs = true; + meta = { description = "Helper library to program the performance monitoring events"; longDescription = '' From 107cb3287c2a51ff1434dfd2429c4c2006d4cc98 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:57:38 +0200 Subject: [PATCH 228/318] nss-cacert: enable strictDeps --- pkgs/by-name/ca/cacert/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix index c4052964cd91..46b8321e3dba 100644 --- a/pkgs/by-name/ca/cacert/package.nix +++ b/pkgs/by-name/ca/cacert/package.nix @@ -70,6 +70,8 @@ stdenv.mkDerivation { nativeBuildInputs = [ buildcatrust ]; + strictDeps = true; + buildPhase = '' mkdir unbundled hashed buildcatrust \ From 0e72b80587d46282c9b1a7f5ea8f5a9a98a1c9ab Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 5 Aug 2026 16:57:47 +0200 Subject: [PATCH 229/318] nss-cacert: enable structuredAttrs --- pkgs/by-name/ca/cacert/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix index 46b8321e3dba..9ee779721bf0 100644 --- a/pkgs/by-name/ca/cacert/package.nix +++ b/pkgs/by-name/ca/cacert/package.nix @@ -249,5 +249,7 @@ stdenv.mkDerivation { }; }; + __structuredAttrs = true; + inherit meta; } From 65e0685245cc06ba6db5aaa457f6aed0b03de104 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Wed, 12 Aug 2026 21:53:07 +0200 Subject: [PATCH 230/318] libtasn1: use optionalString, newer $(...) bash syntax --- pkgs/by-name/li/libtasn1/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libtasn1/package.nix b/pkgs/by-name/li/libtasn1/package.nix index 3bd5a828f519..8e27bac39404 100644 --- a/pkgs/by-name/li/libtasn1/package.nix +++ b/pkgs/by-name/li/libtasn1/package.nix @@ -35,8 +35,9 @@ stdenv.mkDerivation (finalAttrs: { strictDeps = true; doCheck = true; - preCheck = - if stdenv.hostPlatform.isDarwin then "export DYLD_LIBRARY_PATH=`pwd`/lib/.libs" else null; + preCheck = lib.optionalString stdenv.hostPlatform.isDarwin '' + export DYLD_LIBRARY_PATH=$(pwd)/lib/.libs + ''; passthru.tests = { inherit gnutls samba qemu; From 709a758bfcd66bdecf728767aa69714b7c35e8ad Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Wed, 12 Aug 2026 22:20:24 +0100 Subject: [PATCH 231/318] zvbi: 0.2.44 -> 0.2.45 Changes: https://github.com/zapping-vbi/zvbi/compare/v0.2.44...v0.2.45 --- pkgs/by-name/zv/zvbi/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/zv/zvbi/package.nix b/pkgs/by-name/zv/zvbi/package.nix index 50c58744efab..ea33b1e12e8e 100644 --- a/pkgs/by-name/zv/zvbi/package.nix +++ b/pkgs/by-name/zv/zvbi/package.nix @@ -13,13 +13,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "zvbi"; - version = "0.2.44"; + version = "0.2.45"; src = fetchFromGitHub { owner = "zapping-vbi"; repo = "zvbi"; rev = "v${finalAttrs.version}"; - hash = "sha256-knc9PejugU6K4EQflfz91keZr3ZJqZu2TKFQFFJrxiI="; + hash = "sha256-Nkg/Y7tHYAEi3ndbiJwwutVrGCOIE5RUCNQW3j12BkM="; }; configureFlags = lib.optionals (!lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) [ From 1b5674a21ba58a9366a8af6256c60dfd43ed52f3 Mon Sep 17 00:00:00 2001 From: Aleksi Hannula Date: Thu, 13 Aug 2026 13:12:40 +0300 Subject: [PATCH 232/318] Revert "minimal-bootstrap.glibc: 2.42 -> 2.44" This reverts commit 985bc462dac0af1721c0dc6048560453e1603869. --- pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix index cf71f17513f1..f156f862ecc0 100644 --- a/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix +++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix @@ -20,11 +20,11 @@ }: let pname = "glibc"; - version = "2.44"; + version = "2.42"; src = fetchurl { url = "mirror://gnu/libc/glibc-${version}.tar.xz"; - hash = "sha256-N/YA8r7zxegwAUcFlWiyouQKetbMxlzpQlVtSUKcxmc="; + hash = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8="; }; linkerFile = From efef4deb458e5d0234c7ebf3b15e3abf984019a9 Mon Sep 17 00:00:00 2001 From: Leon Klingele Date: Thu, 13 Aug 2026 21:46:55 +0200 Subject: [PATCH 233/318] go_1_26: 1.26.5 -> 1.26.6 --- pkgs/development/compilers/go/1.26.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix index b9c04a91729c..9f52b27211ef 100644 --- a/pkgs/development/compilers/go/1.26.nix +++ b/pkgs/development/compilers/go/1.26.nix @@ -25,11 +25,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "go"; - version = "1.26.5"; + version = "1.26.6"; src = fetchurl { url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz"; - hash = "sha256-SVvkvIcXasVnOS5bQRar2YRm0z17SdQedkzMaXay3EI="; + hash = "sha256-oHIcVMaIkBRI13rZs+x+p8R0cwdV/4kTgukuy5P/LLE="; }; strictDeps = true; From 31775096ecdabf36a6b14d7aa411bfd36ff27dbc Mon Sep 17 00:00:00 2001 From: Ryan Burns Date: Wed, 10 Jun 2026 17:06:48 -0700 Subject: [PATCH 234/318] libcamera: 0.7.0 -> 0.7.1 Release notes: https://git.libcamera.org/libcamera/libcamera.git/tag/?h=v0.7.1 Lots of new features which require changes to the meson configuration. In particular, SDL2 depends on libcamera, so that option is currently gated behind the qcam option (even though it applies to the cam app as well) to break the cycle. Since jpeg is dependent on SDL2, it's gated the same way. --- pkgs/by-name/li/libcamera/package.nix | 35 ++++++++++++++++++--------- 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix index 8930cd4d6aee..6da854a41368 100644 --- a/pkgs/by-name/li/libcamera/package.nix +++ b/pkgs/by-name/li/libcamera/package.nix @@ -18,21 +18,26 @@ python3Packages, udev, libpisp, + libglvnd, withTracing ? lib.meta.availableOn stdenv.hostPlatform lttng-ust, lttng-ust, # withTracing - withQcam ? false, - qt6, # withQcam - libtiff, # withQcam + withSoftispGPU ? true, # software ISP GPU acceleration + withQcam ? false, # cannot be enabled per default as it causes infinite recursion + # withQcam + qt6, + libjpeg, + libtiff, + SDL2, }: stdenv.mkDerivation rec { pname = "libcamera"; - version = "0.7.0"; + version = "0.7.1"; src = fetchgit { url = "https://git.libcamera.org/libcamera/libcamera.git"; rev = "v${version}"; - hash = "sha256-W9pRE8/0Cf2EEP5bbvy4FsDSeKKSklfJb6T48ZN4dzE="; + hash = "sha256-JE0OuhsCL9DAYrVC0/6RlvgOdy+ehO6Bv9M8NtgolkI="; }; outputs = [ @@ -87,10 +92,13 @@ stdenv.mkDerivation rec { ] ++ lib.optionals stdenv.hostPlatform.isAarch [ libpisp ] ++ lib.optionals withTracing [ lttng-ust ] + ++ lib.optionals withSoftispGPU [ libglvnd ] ++ lib.optionals withQcam [ + libjpeg libtiff qt6.qtbase qt6.qttools + SDL2 ]; nativeBuildInputs = [ @@ -109,22 +117,27 @@ stdenv.mkDerivation rec { ++ lib.optional withQcam qt6.wrapQtAppsHook; mesonFlags = [ - "-Dv4l2=true" + (lib.mesonEnable "v4l2" true) (lib.mesonEnable "tracing" withTracing) (lib.mesonEnable "qcam" withQcam) - "-Dlibunwind=disabled" - "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled + (lib.mesonEnable "apps-output-dng" withQcam) + (lib.mesonEnable "cam-output-sdl2" withQcam) + (lib.mesonEnable "cam-jpeg" withQcam) + (lib.mesonEnable "softisp-gpu" withSoftispGPU) + (lib.mesonEnable "libunwind" false) + (lib.mesonEnable "libdw" false) + (lib.mesonEnable "lc-compliance" false) # tries unconditionally to download gtest when enabled # Avoid blanket -Werror to evade build failures on less # tested compilers. - "-Dwerror=false" + (lib.mesonBool "werror" false) # Documentation breaks binary compatibility. # Given that upstream also provides public documentation, # we can disable it here. - "-Ddocumentation=disabled" + (lib.mesonEnable "documentation" false) ] ++ lib.optionals stdenv.hostPlatform.isAarch [ # we don't have tensorflow-lite to build this - "-Drpi-awb-nn=disabled" + (lib.mesonEnable "rpi-awb-nn" false) ]; env = { From 038675afe21c6abaf00a1954160fb90a1f35b9c5 Mon Sep 17 00:00:00 2001 From: Ryan Burns Date: Mon, 13 Jul 2026 08:16:24 -0700 Subject: [PATCH 235/318] libcamera: 0.7.1 -> 0.7.2 Changelog: https://gitlab.freedesktop.org/camera/libcamera/-/releases/v0.7.2 --- pkgs/by-name/li/libcamera/package.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libcamera/package.nix b/pkgs/by-name/li/libcamera/package.nix index 6da854a41368..403a2f70c0bf 100644 --- a/pkgs/by-name/li/libcamera/package.nix +++ b/pkgs/by-name/li/libcamera/package.nix @@ -10,6 +10,7 @@ libdrm, libevent, libyaml, + libyuv, gst_all_1, gtest, graphviz, @@ -32,12 +33,12 @@ stdenv.mkDerivation rec { pname = "libcamera"; - version = "0.7.1"; + version = "0.7.2"; src = fetchgit { url = "https://git.libcamera.org/libcamera/libcamera.git"; rev = "v${version}"; - hash = "sha256-JE0OuhsCL9DAYrVC0/6RlvgOdy+ehO6Bv9M8NtgolkI="; + hash = "sha256-vhFkeT1j2KKm+CVvGrtH5BEYJSEdaX7N7DRdA0a9EWk="; }; outputs = [ @@ -85,6 +86,8 @@ stdenv.mkDerivation rec { # pycamera python3Packages.pybind11 + libyuv + # yamlparser libyaml From 0524a6c5bbd4d88b1f85fcb4ead061918b0aae26 Mon Sep 17 00:00:00 2001 From: Colin Date: Fri, 29 May 2026 22:23:58 +0000 Subject: [PATCH 236/318] rsync: enable strictDeps `nix-build -A rsync` on x86_64-linux is bit-for-bit identical before and after this change. same with `pkgsMusl.rsync`. --- pkgs/by-name/rs/rsync/package.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix index a39a47765b4d..7d29c5995e63 100644 --- a/pkgs/by-name/rs/rsync/package.nix +++ b/pkgs/by-name/rs/rsync/package.nix @@ -5,6 +5,7 @@ fetchpatch, updateAutotoolsGnuConfigScriptsHook, + bashNonInteractive, perl, python3, libiconv, @@ -58,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: { ]; buildInputs = [ + bashNonInteractive libiconv zlib popt @@ -109,6 +111,7 @@ stdenv.mkDerivation (finalAttrs: { ''; doCheck = true; + strictDeps = true; __darwinAllowLocalNetworking = true; From 65e9f2c04429a9f8787f2d376092a2829ec5d307 Mon Sep 17 00:00:00 2001 From: Jamie Magee Date: Sat, 1 Aug 2026 19:41:49 -0700 Subject: [PATCH 237/318] libpisp: 1.2.1 -> 1.7.0 --- pkgs/by-name/li/libpisp/package.nix | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/pkgs/by-name/li/libpisp/package.nix b/pkgs/by-name/li/libpisp/package.nix index 6ee36b13ea8a..01f247bf2650 100644 --- a/pkgs/by-name/li/libpisp/package.nix +++ b/pkgs/by-name/li/libpisp/package.nix @@ -7,28 +7,19 @@ ninja, boost, nlohmann_json, - fetchpatch, }: stdenv.mkDerivation (finalAttrs: { pname = "libpisp"; - version = "1.2.1"; + version = "1.7.0"; src = fetchFromGitHub { owner = "raspberrypi"; repo = "libpisp"; tag = "v${finalAttrs.version}"; - hash = "sha256-YshU7G5Rov67CVwFbf5ENp2j5ptAvkVrlMu85KmnEpk="; + hash = "sha256-hzJA8hoOXf2Lswwz9t0StJ9JJP8ICWJlstzSsli4Yqs="; }; - patches = [ - # fix build with glibc 2.42 & -Werror - (fetchpatch { - url = "https://github.com/raspberrypi/libpisp/commit/f2bbf7e000d3f11cac235b8ea1291722080a016c.patch"; - hash = "sha256-vrdmVadyjlAnZtmBahOs/hlKPrkh/BF3LvrTPM9D15Q="; - }) - ]; - nativeBuildInputs = [ pkg-config meson From 278d4d59cf8b300aa63ca22905d3d563ebf6273d Mon Sep 17 00:00:00 2001 From: Aaron Jheng Date: Fri, 14 Aug 2026 13:03:58 +0800 Subject: [PATCH 238/318] ffmpeg_9: 9.0 -> 9.0.1 --- pkgs/development/libraries/ffmpeg/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix index 9a37a2d12637..492830ac3f5d 100644 --- a/pkgs/development/libraries/ffmpeg/default.nix +++ b/pkgs/development/libraries/ffmpeg/default.nix @@ -36,8 +36,8 @@ let }; v9 = { - version = "9.0"; - hash = "sha256-LbHwxvylAPh5lb/H+o+9eMVTB9X+tphrxYYX0cqAL0k="; + version = "9.0.1"; + hash = "sha256-9Vnryl9jSSXRfvt2jPsNp7vHWL0KYdWA29D2zDRAZ+0="; }; in From 64710d6cc7c15eb7c25d7cc1de01fc3e6ecfed30 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Fri, 14 Aug 2026 12:23:25 +0200 Subject: [PATCH 239/318] nodejs_22,nodejs_24: fix builds with Ada 4.x --- pkgs/development/web/nodejs/v22.nix | 12 ++++++++++++ pkgs/development/web/nodejs/v24.nix | 12 ++++++++++++ 2 files changed, 24 insertions(+) diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix index d80eb73a7e84..0d5558cc85ca 100644 --- a/pkgs/development/web/nodejs/v22.nix +++ b/pkgs/development/web/nodejs/v22.nix @@ -57,6 +57,18 @@ buildNodejs { ./use-correct-env-in-tests.patch ./bin-sh-node-run-v22.patch ./use-nix-codesign.patch + + # TODO: remove when support for Ada 4.x has landed upstream + (fetchpatch2 { + url = "https://github.com/nodejs/node/commit/eb1a49b0aec9e05cbb59f093d38f0a92818b7de1.patch?full_index=1"; + hash = "sha256-LmLbsRZKkOGXzqDQxNrK/B8TGIrsr4pXIUEv3P6C9Sc="; + excludes = [ "deps/*" ]; + }) + (fetchpatch2 { + url = "https://github.com/nodejs/node/commit/064e2eee1ec7b17c4bc6e36befc2935eee80d0f7.patch?full_index=1"; + hash = "sha256-RcmWiTpWYwA952nNmhaiq4zw/iuVAXFnuTeuB6ltR1U="; + includes = [ "test/fixtures/wpt/url/resources/urltestdata.json" ]; + }) ] ++ lib.optionals (!stdenv.hostPlatform.isStatic) [ # Fix builds with shared llhttp diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix index 262990f1826e..ad0cdcc637b7 100644 --- a/pkgs/development/web/nodejs/v24.nix +++ b/pkgs/development/web/nodejs/v24.nix @@ -62,6 +62,18 @@ buildNodejs { ./use-correct-env-in-tests.patch ./bin-sh-node-run-v22.patch ./use-nix-codesign.patch + + # TODO: remove when support for Ada 4.x has landed upstream + (fetchpatch2 { + url = "https://github.com/nodejs/node/commit/eb1a49b0aec9e05cbb59f093d38f0a92818b7de1.patch?full_index=1"; + hash = "sha256-LmLbsRZKkOGXzqDQxNrK/B8TGIrsr4pXIUEv3P6C9Sc="; + excludes = [ "deps/*" ]; + }) + (fetchpatch2 { + url = "https://github.com/nodejs/node/commit/064e2eee1ec7b17c4bc6e36befc2935eee80d0f7.patch?full_index=1"; + hash = "sha256-RcmWiTpWYwA952nNmhaiq4zw/iuVAXFnuTeuB6ltR1U="; + includes = [ "test/fixtures/wpt/url/resources/urltestdata.json" ]; + }) ] ++ gypPatches ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [ From 8e1d4e81b470df70bf12a775082d3ba20ca6666f Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 2 Aug 2026 23:12:37 +0200 Subject: [PATCH 240/318] gnused: enable structuredAttrs, use finalAttrs, hash --- pkgs/tools/text/gnused/default.nix | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix index a1e793e6eba5..ba45205c1359 100644 --- a/pkgs/tools/text/gnused/default.nix +++ b/pkgs/tools/text/gnused/default.nix @@ -6,13 +6,13 @@ perl, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "gnused"; version = "4.10"; src = fetchurl { - url = "mirror://gnu/sed/sed-${version}.tar.xz"; - sha256 = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc="; + url = "mirror://gnu/sed/sed-${finalAttrs.version}.tar.xz"; + hash = "sha256-uOchgrLslqNXTimYxHt6qmTMIM4ADY6awxPMB87PKMc="; }; outputs = [ @@ -26,6 +26,7 @@ stdenv.mkDerivation rec { ]; strictDeps = true; + __structuredAttrs = true; preConfigure = "patchShebangs ./build-aux/help2man"; @@ -53,4 +54,4 @@ stdenv.mkDerivation rec { maintainers = with lib.maintainers; [ mic92 ]; mainProgram = "sed"; }; -} +}) From 1716f7964658f9a9987398b6405c87dcfa711234 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 18:47:18 +0200 Subject: [PATCH 241/318] jq: enable structuredAttrs --- pkgs/by-name/jq/jq/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/jq/jq/package.nix b/pkgs/by-name/jq/jq/package.nix index 762562f1c7b3..fdd171b08316 100644 --- a/pkgs/by-name/jq/jq/package.nix +++ b/pkgs/by-name/jq/jq/package.nix @@ -59,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: { ''; strictDeps = true; + __structuredAttrs = true; enableParallelBuilding = true; buildInputs = lib.optionals onigurumaSupport [ oniguruma ]; From e1a664891adcca96b92b78a1a3edc3d6d79c5b38 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Tue, 4 Aug 2026 20:33:47 +0200 Subject: [PATCH 242/318] libuv: enable structuredAttrs, use tag, reorder args pkgsStatic is also only used for passthru.tests --- pkgs/by-name/li/libuv/package.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix index 2a29d1bc79d9..a3c6476bd7fb 100644 --- a/pkgs/by-name/li/libuv/package.nix +++ b/pkgs/by-name/li/libuv/package.nix @@ -7,7 +7,6 @@ darwin, libtool, pkg-config, - pkgsStatic, # for passthru.tests bind, @@ -19,6 +18,7 @@ neovim, nodejs, ocamlPackages, + pkgsStatic, python3, testers, }: @@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "libuv"; repo = "libuv"; - rev = "v${finalAttrs.version}"; + tag = "v${finalAttrs.version}"; hash = "sha256-Y9Nph2LkT1qnOYTW3WCumWWwORnI4P7HxzBjUlGaL7M="; }; @@ -211,6 +211,8 @@ stdenv.mkDerivation (finalAttrs: { pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; }; + __structuredAttrs = true; + meta = { description = "Multi-platform support library with a focus on asynchronous I/O"; homepage = "https://libuv.org/"; From fdb44f23c76087dd7b34d45147071250bc21197a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 15:46:13 +0200 Subject: [PATCH 243/318] libuv: remove test hack All instances of "-lutil" in https://github.com/libuv/libuv/blob/v1.52.1/Makefile.am are already followed by "-lm" --- pkgs/by-name/li/libuv/package.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix index a3c6476bd7fb..c16084e0ac39 100644 --- a/pkgs/by-name/li/libuv/package.nix +++ b/pkgs/by-name/li/libuv/package.nix @@ -151,8 +151,6 @@ stdenv.mkDerivation (finalAttrs: { in lib.optionalString (finalAttrs.finalPackage.doCheck) '' sed '/${tdRegexp}/d' -i test/test-list.h - # https://github.com/libuv/libuv/issues/4794 - substituteInPlace Makefile.am --replace-fail -lutil "-lutil -lm" ''; nativeBuildInputs = [ From a3c24cd214fea98863b733343c7ee8b21740fd96 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Thu, 13 Aug 2026 23:09:40 +0200 Subject: [PATCH 244/318] git: enable strictDeps --- pkgs/by-name/gi/git/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix index 3aa66809b005..98938fd81afb 100644 --- a/pkgs/by-name/gi/git/package.nix +++ b/pkgs/by-name/gi/git/package.nix @@ -213,6 +213,8 @@ stdenv.mkDerivation (finalAttrs: { buildPackages.stdenv.cc ]; + strictDeps = true; + env = { # required to support pthread_cancel() NIX_LDFLAGS = From c0c3749ea6d3f7597613b6428fddffad1c30cd54 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 17:26:31 +0200 Subject: [PATCH 245/318] git: remove uses of *FlagsArray Since structuredAttrs are enabled, the *Flags variables already are arrays. --- pkgs/by-name/gi/git/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix index 98938fd81afb..f20fdd8eaf3e 100644 --- a/pkgs/by-name/gi/git/package.nix +++ b/pkgs/by-name/gi/git/package.nix @@ -236,7 +236,7 @@ stdenv.mkDerivation (finalAttrs: { ]; preBuild = '' - makeFlagsArray+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') ) + makeFlags+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') ) ''; makeFlags = [ @@ -282,7 +282,7 @@ stdenv.mkDerivation (finalAttrs: { ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}} SHELL="$SHELL" ) - concatTo flagsArray makeFlags makeFlagsArray buildFlags buildFlagsArray + concatTo flagsArray makeFlags buildFlags echoCmd 'build flags' "''${flagsArray[@]}" '' + lib.optionalString withManual '' @@ -343,7 +343,7 @@ stdenv.mkDerivation (finalAttrs: { ''${enableParallelInstalling:+-j''${NIX_BUILD_CORES}} SHELL="$SHELL" ) - concatTo flagsArray makeFlags makeFlagsArray installFlags installFlagsArray + concatTo flagsArray makeFlags installFlags echoCmd 'install flags' "''${flagsArray[@]}" # Install git-subtree. @@ -486,7 +486,7 @@ stdenv.mkDerivation (finalAttrs: { installCheckTarget = "test"; - # see also installCheckFlagsArray + # see also installCheckFlags in preInstallCheck installCheckFlags = [ "DEFAULT_TEST_TARGET=prove" "PERL_PATH=${buildPackages.perl}/bin/perl" @@ -510,7 +510,7 @@ stdenv.mkDerivation (finalAttrs: { NIX_BUILD_CORES=32 fi - installCheckFlagsArray+=( + installCheckFlags+=( GIT_PROVE_OPTS="--jobs $NIX_BUILD_CORES --failures --state=failed,save" GIT_TEST_INSTALLED=$out/bin ${lib.optionalString (!svnSupport) "NO_SVN_TESTS=y"} From e70344ac2d05ef5864c06b91b7933a0c28544c87 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:16:23 +0200 Subject: [PATCH 246/318] abseil*: enable structuredAttrs --- pkgs/by-name/ab/abseil-cpp_202505/package.nix | 2 ++ pkgs/by-name/ab/abseil-cpp_202508/package.nix | 2 ++ pkgs/by-name/ab/abseil-cpp_202601/package.nix | 2 ++ 3 files changed, 6 insertions(+) diff --git a/pkgs/by-name/ab/abseil-cpp_202505/package.nix b/pkgs/by-name/ab/abseil-cpp_202505/package.nix index 9dd41332758e..2485b170ce43 100644 --- a/pkgs/by-name/ab/abseil-cpp_202505/package.nix +++ b/pkgs/by-name/ab/abseil-cpp_202505/package.nix @@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { description = "Open-source collection of C++ code designed to augment the C++ standard library"; homepage = "https://abseil.io/"; diff --git a/pkgs/by-name/ab/abseil-cpp_202508/package.nix b/pkgs/by-name/ab/abseil-cpp_202508/package.nix index 4c5a7b415cfe..c15d08514b2d 100644 --- a/pkgs/by-name/ab/abseil-cpp_202508/package.nix +++ b/pkgs/by-name/ab/abseil-cpp_202508/package.nix @@ -50,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { description = "Open-source collection of C++ code designed to augment the C++ standard library"; homepage = "https://abseil.io/"; diff --git a/pkgs/by-name/ab/abseil-cpp_202601/package.nix b/pkgs/by-name/ab/abseil-cpp_202601/package.nix index f71a2aedf920..15d8d2a42a22 100644 --- a/pkgs/by-name/ab/abseil-cpp_202601/package.nix +++ b/pkgs/by-name/ab/abseil-cpp_202601/package.nix @@ -39,6 +39,8 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ gtest ]; + __structuredAttrs = true; + meta = { description = "Open-source collection of C++ code designed to augment the C++ standard library"; homepage = "https://abseil.io/"; From 2a0f4fb6e574840e844943f173c2bd8a058ccf22 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:16:37 +0200 Subject: [PATCH 247/318] boost-build: enable strictDeps --- pkgs/by-name/bo/boost-build/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/bo/boost-build/package.nix b/pkgs/by-name/bo/boost-build/package.nix index de41ba27871a..2c5ed9507a89 100644 --- a/pkgs/by-name/bo/boost-build/package.nix +++ b/pkgs/by-name/bo/boost-build/package.nix @@ -58,6 +58,8 @@ stdenv.mkDerivation { bison ]; + strictDeps = true; + buildPhase = '' runHook preBuild ./bootstrap.sh From 6f695ecc0ae5df297890dcfa0a1265406ae747f4 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:16:55 +0200 Subject: [PATCH 248/318] boost-build: enable structuredAttrs, use tag --- pkgs/by-name/bo/boost-build/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/bo/boost-build/package.nix b/pkgs/by-name/bo/boost-build/package.nix index 2c5ed9507a89..732b35fd8fda 100644 --- a/pkgs/by-name/bo/boost-build/package.nix +++ b/pkgs/by-name/bo/boost-build/package.nix @@ -23,7 +23,7 @@ stdenv.mkDerivation { useBoost.src or (fetchFromGitHub { owner = "boostorg"; repo = "build"; - rev = defaultVersion; + tag = defaultVersion; sha256 = "1r4rwlq87ydmsdqrik4ly5iai796qalvw7603mridg2nwcbbnf54"; }); @@ -78,6 +78,8 @@ stdenv.mkDerivation { runHook postInstall ''; + __structuredAttrs = true; + meta = { homepage = "https://www.boost.org/build/"; license = lib.licenses.boost; From b970e996081be10e3c41ba6b2ac80bb2ce8090bd Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:17:10 +0200 Subject: [PATCH 249/318] catch2: enable strictDeps --- pkgs/by-name/ca/catch2/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ca/catch2/package.nix b/pkgs/by-name/ca/catch2/package.nix index 5d8315120c08..3e45188b1c63 100644 --- a/pkgs/by-name/ca/catch2/package.nix +++ b/pkgs/by-name/ca/catch2/package.nix @@ -18,6 +18,8 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ cmake ]; + strictDeps = true; + cmakeFlags = [ "-H.." ]; meta = { From a512cc03d66083c8ea983b7c9c22381a12cb0199 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:17:23 +0200 Subject: [PATCH 250/318] catch2: enable structuredAttrs, use tag/hash --- pkgs/by-name/ca/catch2/package.nix | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ca/catch2/package.nix b/pkgs/by-name/ca/catch2/package.nix index 3e45188b1c63..1565a2d1ae73 100644 --- a/pkgs/by-name/ca/catch2/package.nix +++ b/pkgs/by-name/ca/catch2/package.nix @@ -12,8 +12,8 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "catchorg"; repo = "Catch2"; - rev = "v${finalAttrs.version}"; - sha256 = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU="; + tag = "v${finalAttrs.version}"; + hash = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU="; }; nativeBuildInputs = [ cmake ]; @@ -22,6 +22,8 @@ stdenv.mkDerivation (finalAttrs: { cmakeFlags = [ "-H.." ]; + __structuredAttrs = true; + meta = { description = "Multi-paradigm automated test framework for C++ and Objective-C (and, maybe, C)"; homepage = "http://catch-lib.net"; From 63c29e785dc57df76a0923c0bce3223b552d3121 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:17:31 +0200 Subject: [PATCH 251/318] eigen: enable strictDeps --- pkgs/by-name/ei/eigen/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ei/eigen/package.nix b/pkgs/by-name/ei/eigen/package.nix index c127636f24c3..811cfc4414ac 100644 --- a/pkgs/by-name/ei/eigen/package.nix +++ b/pkgs/by-name/ei/eigen/package.nix @@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: { ctestCheckHook ]; + strictDeps = true; + cmakeFlags = [ (lib.cmakeBool "EIGEN_LEAVE_TEST_IN_ALL_TARGET" true) # Build tests in parallel ]; From ccad2c35cc6e36eff126dbba35a4a49b9120d35a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:17:40 +0200 Subject: [PATCH 252/318] eigen: enable structuredAttrs --- pkgs/by-name/ei/eigen/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ei/eigen/package.nix b/pkgs/by-name/ei/eigen/package.nix index 811cfc4414ac..8b1c86f12fd8 100644 --- a/pkgs/by-name/ei/eigen/package.nix +++ b/pkgs/by-name/ei/eigen/package.nix @@ -49,6 +49,8 @@ stdenv.mkDerivation (finalAttrs: { # too many flaky tests doCheck = false; + __structuredAttrs = true; + meta = { homepage = "https://eigen.tuxfamily.org"; description = "C++ template library for linear algebra: vectors, matrices, and related algorithms"; From 643d4dd16962eef129e6ccb3924e1810391c8366 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:17:48 +0200 Subject: [PATCH 253/318] gbenchmark: enable strictDeps --- pkgs/by-name/gb/gbenchmark/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix index fffc36fdfbbf..ad99c1ee5b0e 100644 --- a/pkgs/by-name/gb/gbenchmark/package.nix +++ b/pkgs/by-name/gb/gbenchmark/package.nix @@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: { nativeCheckInputs = lib.optionals (glibcLocales != null) [ glibcLocales ]; + strictDeps = true; + cmakeFlags = [ (lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false) (lib.cmakeBool "BENCHMARK_ENABLE_WERROR" false) From 9bf76edf5a200c2b4c4e514caf341f3df062284b Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:18:03 +0200 Subject: [PATCH 254/318] gbenchmark: enable structuredAttrs --- pkgs/by-name/gb/gbenchmark/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix index ad99c1ee5b0e..d9440337a1a2 100644 --- a/pkgs/by-name/gb/gbenchmark/package.nix +++ b/pkgs/by-name/gb/gbenchmark/package.nix @@ -75,6 +75,8 @@ stdenv.mkDerivation (finalAttrs: { inherit prometheus-cpp; }; + __structuredAttrs = true; + meta = { description = "Microbenchmark support library"; homepage = "https://github.com/google/benchmark"; From 9c865cbc73b4a308ca5da4ca15e14ffd5809731c Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:18:47 +0200 Subject: [PATCH 255/318] maturin: enable structuredAttrs --- pkgs/by-name/ma/maturin/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix index fae97effb3b9..4576351fb4b2 100644 --- a/pkgs/by-name/ma/maturin/package.nix +++ b/pkgs/by-name/ma/maturin/package.nix @@ -48,6 +48,8 @@ rustPlatform.buildRustPackage (finalAttrs: { updateScript = nix-update-script { }; }; + __structuredAttrs = true; + meta = { description = "Build and publish Rust crates Python packages"; longDescription = '' From b46d3023494e8bb95fc550a731005896d63fa655 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:18:56 +0200 Subject: [PATCH 256/318] re2: enable strictDeps --- pkgs/by-name/re/re2/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/re/re2/package.nix b/pkgs/by-name/re/re2/package.nix index 06249cd01c8f..22b4a96df6fa 100644 --- a/pkgs/by-name/re/re2/package.nix +++ b/pkgs/by-name/re/re2/package.nix @@ -43,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: { propagatedBuildInputs = [ abseil-cpp ] ++ lib.optionals (!stdenv.hostPlatform.isStatic) [ icu ]; + strictDeps = true; + cmakeFlags = [ (lib.cmakeBool "RE2_BUILD_TESTING" true) (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--timeout;999999") From 6502d61f22617795474d3539d599cd8b12cba3a0 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:19:10 +0200 Subject: [PATCH 257/318] re2: enable structuredAttrs, use tag --- pkgs/by-name/re/re2/package.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/re/re2/package.nix b/pkgs/by-name/re/re2/package.nix index 22b4a96df6fa..06bc5bd10c12 100644 --- a/pkgs/by-name/re/re2/package.nix +++ b/pkgs/by-name/re/re2/package.nix @@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchFromGitHub { owner = "google"; repo = "re2"; - rev = finalAttrs.version; + tag = finalAttrs.version; hash = "sha256-0J1HVk+eR7VN0ymucW9dNlT36j16XIfCzcs1EVyEIEU="; }; @@ -62,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: { haskell-re2 = haskellPackages.re2; }; + __structuredAttrs = true; + meta = { description = "Regular expression library"; longDescription = '' From f93982ce4da94ba29eb09a28b94e6a1d28aadf53 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:23:39 +0200 Subject: [PATCH 258/318] lua: enable strictDeps --- pkgs/development/interpreters/lua-5/interpreter.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix index c4fc149074ee..8128f4416944 100644 --- a/pkgs/development/interpreters/lua-5/interpreter.nix +++ b/pkgs/development/interpreters/lua-5/interpreter.nix @@ -82,6 +82,8 @@ stdenv.mkDerivation ( nativeBuildInputs = [ makeWrapper ]; buildInputs = [ readline ]; + strictDeps = true; + inherit patches; postPatch = '' From d45d9dc17fb47307cdb97c0d4807a7f57c3fe381 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 00:23:49 +0200 Subject: [PATCH 259/318] lua: enable structuredAttrs --- pkgs/development/interpreters/lua-5/interpreter.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/interpreters/lua-5/interpreter.nix b/pkgs/development/interpreters/lua-5/interpreter.nix index 8128f4416944..c7cc52a75a5e 100644 --- a/pkgs/development/interpreters/lua-5/interpreter.nix +++ b/pkgs/development/interpreters/lua-5/interpreter.nix @@ -219,6 +219,8 @@ stdenv.mkDerivation ( ); }; + __structuredAttrs = true; + meta = { homepage = "https://www.lua.org"; description = "Powerful, fast, lightweight, embeddable scripting language"; From b2dbab49281688bdf6e2bfc72cf165e1c77c4c53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Tue, 11 Aug 2026 19:33:42 -0700 Subject: [PATCH 260/318] cpio: patch CVE-2026-66484, CVE-2026-66485, and CVE-2026-66486 --- pkgs/by-name/cp/cpio/package.nix | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/cp/cpio/package.nix b/pkgs/by-name/cp/cpio/package.nix index d53c81fe6919..30e608bda31f 100644 --- a/pkgs/by-name/cp/cpio/package.nix +++ b/pkgs/by-name/cp/cpio/package.nix @@ -2,7 +2,9 @@ lib, stdenv, fetchurl, + fetchpatch, autoreconfHook, + texinfo, # for passthru.tests git, @@ -20,7 +22,29 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-k3YQuXwymh7JJoVT+3gAN7z/8Nz/6XJevE/ZwaqQdds="; }; - nativeBuildInputs = [ autoreconfHook ]; + patches = [ + (fetchpatch { + name = "CVE-2026-66484.patch"; + url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=e2b9cbdd3354d2b1569b7390d1bc15c1930559ad"; + hash = "sha256-WjphVpMaI/ePg8MTZx+vvilKzpRAAzhAFwCwrbsPLRE="; + }) + (fetchpatch { + name = "CVE-2026-66485.patch"; + url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=3cd514031371d8aeeaf2048aa10103e02831aaa9"; + hash = "sha256-YDlROEYYlZERNzzlx1cQD29gV5IrU01aVcZ/sKpWrRo="; + }) + (fetchpatch { + name = "CVE-2026-66486.patch"; + url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=2ff9600c9ef32e88759843cdbde74c8db5ae9b30"; + excludes = [ "NEWS" ]; + hash = "sha256-qi9/9xhKnIyPpji63RgzbnnHZsJgwRnQVMaMiLxQipk="; + }) + ]; + + nativeBuildInputs = [ + autoreconfHook + texinfo # for makeinfo + ]; separateDebugInfo = true; From 1e1128d44308d31fef7d5372bafe89d9bd496eca Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Fri, 14 Aug 2026 22:32:14 +0200 Subject: [PATCH 261/318] libpq: 18.4 -> 18.16 Release Notes: https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/ Note: 18.5 was not shipped due to a regression. --- pkgs/servers/sql/postgresql/libpq.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix index 5ea0c5113225..96c05fdf54c6 100644 --- a/pkgs/servers/sql/postgresql/libpq.nix +++ b/pkgs/servers/sql/postgresql/libpq.nix @@ -40,14 +40,14 @@ stdenv.mkDerivation (finalAttrs: { pname = "libpq"; - version = "18.4"; + version = "18.6"; src = fetchFromGitHub { owner = "postgres"; repo = "postgres"; # rev, not tag, on purpose: see generic.nix. - rev = "refs/tags/REL_18_4"; - hash = "sha256-Ac/Dqcj8vjcW3my5vsnKaMiQqTq/HPtUzckJ3SMyrfA="; + rev = "refs/tags/REL_18_6"; + hash = "sha256-ySffxlG7jlNyzx++BmIN+WuaQ9TMAJt/qER9wIjd6B8="; }; __structuredAttrs = true; From f1f02f03cf9a86b9b703ee27840aca9e35e8fc24 Mon Sep 17 00:00:00 2001 From: Yiyu Zhou Date: Fri, 14 Aug 2026 13:54:25 -0700 Subject: [PATCH 262/318] aroccPackages.latest-unwrapped: 0-unstable-2025-11-09 -> 0-unstable-2026-04-02 --- pkgs/development/compilers/arocc/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/compilers/arocc/default.nix b/pkgs/development/compilers/arocc/default.nix index 47bb659cbde6..a017b60b9a4e 100644 --- a/pkgs/development/compilers/arocc/default.nix +++ b/pkgs/development/compilers/arocc/default.nix @@ -8,12 +8,12 @@ let versions = [ { inherit zig; - version = "0-unstable-2025-11-09"; + version = "0-unstable-2026-04-02"; src = fetchFromGitHub { owner = "Vexu"; repo = "arocc"; - rev = "3fb778c201718bd82bf1f08cd46ea133c4697b76"; - hash = "sha256-Hac+rhf7wB3KTs2OIfdcGVq2+H/81yXMl3cq//LUeRk="; + rev = "5f5a050569a95ecc40a426f0c3666ae7ef987ede"; + hash = "sha256-f8Z0SXWx5Uia2TCMB5SUpcO8+xUnaWk32Oknva7xcxw="; }; } ]; From dac0cee4b760a8e8a02104e586fbff2021f67fe1 Mon Sep 17 00:00:00 2001 From: matthewcroughan Date: Sat, 15 Aug 2026 01:08:19 +0100 Subject: [PATCH 263/318] python3Packages.matplotlib: fix 64 bit -> 32 bit cross --- pkgs/development/python-modules/matplotlib/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix index eb6e218d354c..ca9677848d91 100644 --- a/pkgs/development/python-modules/matplotlib/default.nix +++ b/pkgs/development/python-modules/matplotlib/default.nix @@ -110,6 +110,7 @@ buildPythonPackage (finalAttrs: { ffmpeg-headless freetype qhull + pybind11 libraqm ] ++ lib.optionals enableGtk3 [ @@ -123,7 +124,6 @@ buildPythonPackage (finalAttrs: { build-system = [ certifi numpy - pybind11 meson-python setuptools-scm ]; From b120c4cd31beae0905cdbae44422175e0dac6f3c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 15 Aug 2026 08:42:28 +0000 Subject: [PATCH 264/318] publicsuffix-list: 0-unstable-2026-07-25 -> 0-unstable-2026-08-14 --- pkgs/by-name/pu/publicsuffix-list/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix index d6c15745fa64..7eea2c3139bd 100644 --- a/pkgs/by-name/pu/publicsuffix-list/package.nix +++ b/pkgs/by-name/pu/publicsuffix-list/package.nix @@ -7,13 +7,13 @@ stdenvNoCC.mkDerivation { pname = "publicsuffix-list"; - version = "0-unstable-2026-07-25"; + version = "0-unstable-2026-08-14"; src = fetchFromGitHub { owner = "publicsuffix"; repo = "list"; - rev = "e1b8015c3b2f0f4f8c18659c2480fc1a22c07b20"; - hash = "sha256-F+OmANpg7I4dBFL7PM3oJlhpDzfxrRTfo+50lQHdU2M="; + rev = "a77cfe0674a4b05c6e2448c01f3cb2c965a1b6d8"; + hash = "sha256-b/8hOFxgnoGQHGfgZ3Xz8H4Gu5ssxwHOCHswX2uQHMc="; }; dontBuild = true; From 219eb510152380ee0a36bcd9e55ea36d2a423cef Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sat, 15 Aug 2026 13:06:33 +0200 Subject: [PATCH 265/318] libpfm: use hash, --replace-fail, group env variables --- pkgs/by-name/li/libpfm/package.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/li/libpfm/package.nix b/pkgs/by-name/li/libpfm/package.nix index d68516dcec02..e2c1362ea74a 100644 --- a/pkgs/by-name/li/libpfm/package.nix +++ b/pkgs/by-name/li/libpfm/package.nix @@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "mirror://sourceforge/perfmon2/libpfm4/libpfm-${finalAttrs.version}.tar.gz"; - sha256 = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E="; + hash = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E="; }; # Don't install libpfm.so on windows as it doesn't exist @@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: { # See: https://github.com/NixOS/nixpkgs/pull/252982#discussion_r1314346216 postPatch = '' substituteInPlace config.mk examples/Makefile \ - --replace '($(SYS),WINDOWS)' '($(SYS),Windows)' + --replace-fail '($(SYS),WINDOWS)' '($(SYS),Windows)' ''; makeFlags = [ @@ -33,8 +33,10 @@ stdenv.mkDerivation (finalAttrs: { "SYS=${stdenv.hostPlatform.uname.system}" ]; - env.NIX_CFLAGS_COMPILE = "-Wno-error"; - env.CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n"; + env = { + NIX_CFLAGS_COMPILE = "-Wno-error"; + CONFIG_PFMLIB_SHARED = if enableShared then "y" else "n"; + }; buildInputs = lib.optional stdenv.hostPlatform.isMinGW windows.libgnurx; From faa34e1e7ec3b291375e562f52db3c0cef814ae4 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Thu, 13 Aug 2026 23:56:28 +0200 Subject: [PATCH 266/318] auto-patchelf: enable strictDeps --- pkgs/by-name/au/auto-patchelf/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/au/auto-patchelf/package.nix b/pkgs/by-name/au/auto-patchelf/package.nix index 031e780f89c9..4d5cf55f3236 100644 --- a/pkgs/by-name/au/auto-patchelf/package.nix +++ b/pkgs/by-name/au/auto-patchelf/package.nix @@ -15,6 +15,8 @@ stdenv.mkDerivation { buildInputs = [ pythonEnv ]; + strictDeps = true; + src = ./source; buildPhase = '' From e9c40c11afed1a6135abd5947b8ca924e8678048 Mon Sep 17 00:00:00 2001 From: dish Date: Fri, 24 Jul 2026 21:50:07 -0400 Subject: [PATCH 267/318] stb: 0-unstable-2023-01-29 -> 0-unstable-2026-04-15 Nothing major, just some updates and adding an updateScript. many packages rely on a later version since it ships with a new image resizing header that the current version does not have. Let's get this updated to reduce the amount of duplicated packages in nixpkgs. --- pkgs/by-name/st/stb/package.nix | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/st/stb/package.nix b/pkgs/by-name/st/stb/package.nix index 3283dcc11f17..cd3e8b268a66 100644 --- a/pkgs/by-name/st/stb/package.nix +++ b/pkgs/by-name/st/stb/package.nix @@ -4,17 +4,18 @@ fetchFromGitHub, copyPkgconfigItems, makePkgconfigItem, + unstableGitUpdater, }: stdenv.mkDerivation (finalAttrs: { pname = "stb"; - version = "0-unstable-2023-01-29"; + version = "0-unstable-2026-04-15"; src = fetchFromGitHub { owner = "nothings"; repo = "stb"; - rev = "5736b15f7ea0ffb08dd38af21067c314d6a3aae9"; - hash = "sha256-s2ASdlT3bBNrqvwfhhN6skjbmyEnUgvNOrvhgUSRj98="; + rev = "31c1ad37456438565541f4919958214b6e762fb4"; + hash = "sha256-m2yNUlA37hDkKQVrQ+R8nufHfW/cXLnMo+n1X1Cyun0="; }; nativeBuildInputs = [ copyPkgconfigItems ]; @@ -42,6 +43,8 @@ stdenv.mkDerivation (finalAttrs: { runHook postInstall ''; + passthru.updateScript = unstableGitUpdater { }; + meta = { description = "Single-file public domain libraries for C/C++"; homepage = "https://github.com/nothings/stb"; From a47159a51a7f37e59cca3b2c0cd8ac44b5c6fa84 Mon Sep 17 00:00:00 2001 From: dish Date: Sat, 15 Aug 2026 16:17:08 -0400 Subject: [PATCH 268/318] noctalia{,-greeter}: Remove stb override Unneeded since stb has been updated --- pkgs/by-name/no/noctalia-greeter/package.nix | 14 +------------- pkgs/by-name/no/noctalia/package.nix | 14 +------------- 2 files changed, 2 insertions(+), 26 deletions(-) diff --git a/pkgs/by-name/no/noctalia-greeter/package.nix b/pkgs/by-name/no/noctalia-greeter/package.nix index e223372a8a8a..2025ae76565b 100644 --- a/pkgs/by-name/no/noctalia-greeter/package.nix +++ b/pkgs/by-name/no/noctalia-greeter/package.nix @@ -28,18 +28,6 @@ nix-update-script, }: -let - # nixpkgs stb doesn't have stb_image_resize2.h which noctalia-greeter needs - stb' = stb.overrideAttrs { - version = "0-unstable-2025-10-26"; - src = fetchFromGitHub { - owner = "nothings"; - repo = "stb"; - rev = "f1c79c02822848a9bed4315b12c8c8f3761e1296"; - hash = "sha256-BlyXJtAI7WqXCTT3ylww8zoG0hBxaojJnQDvdQOXJPE="; - }; - }; -in stdenv.mkDerivation (finalAttrs: { pname = "noctalia-greeter"; version = "1.2.1"; @@ -73,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: { libxkbcommon nlohmann_json pango - stb' + stb tomlplusplus wayland wayland-protocols diff --git a/pkgs/by-name/no/noctalia/package.nix b/pkgs/by-name/no/noctalia/package.nix index 445d0e3dd69b..db034268800e 100644 --- a/pkgs/by-name/no/noctalia/package.nix +++ b/pkgs/by-name/no/noctalia/package.nix @@ -49,18 +49,6 @@ gitMinimal, }: -let - # nixpkgs stb doesn't have stb_image_resize2.h which noctalia needs - stb' = stb.overrideAttrs { - version = "0-unstable-2025-10-26"; - src = fetchFromGitHub { - owner = "nothings"; - repo = "stb"; - rev = "f1c79c02822848a9bed4315b12c8c8f3761e1296"; - hash = "sha256-BlyXJtAI7WqXCTT3ylww8zoG0hBxaojJnQDvdQOXJPE="; - }; - }; -in stdenv.mkDerivation (finalAttrs: { __structuredAttrs = true; @@ -111,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: { pipewire polkit sdbus-cpp_2 - stb' + stb systemdLibs tomlplusplus wayland From 9ebef1f4f325e71c294b1fa85afb61f46bd26b05 Mon Sep 17 00:00:00 2001 From: dish Date: Sat, 15 Aug 2026 16:40:26 -0400 Subject: [PATCH 269/318] various: remove stb_image.h fetchers These should all be fine with stb_image.h from stb in nixpkgs, and they build correctly with it. I am not, however, able to test them, so there may be good reason to revert this patch. --- pkgs/by-name/_2/_2ship2harkinian/package.nix | 9 ++------- pkgs/by-name/sh/shipwright/package.nix | 9 ++------- pkgs/by-name/sp/spaghettikart/package.nix | 9 ++------- pkgs/by-name/st/starship-sf64/package.nix | 9 ++------- 4 files changed, 8 insertions(+), 28 deletions(-) diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix index ed77e1b5e6ab..c14a56940da2 100644 --- a/pkgs/by-name/_2/_2ship2harkinian/package.nix +++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix @@ -19,6 +19,7 @@ libpulseaudio, libzip, nlohmann_json, + stb, SDL2, spdlog, tinyxml-2, @@ -82,12 +83,6 @@ let ''; }; - stb' = fetchurl { - name = "stb_image.h"; - url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h"; - hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw="; - }; - stormlib' = applyPatches { src = fetchFromGitHub { owner = "ladislav-zezula"; @@ -213,7 +208,7 @@ stdenv.mkDerivation (finalAttrs: { preConfigure = '' # mirror 2ship's stb mkdir stb - cp ${stb'} ./stb/${stb'.name} + cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h cp ${stb_impl} ./stb/${stb_impl.name} substituteInPlace libultraship/cmake/dependencies/common.cmake \ --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)" diff --git a/pkgs/by-name/sh/shipwright/package.nix b/pkgs/by-name/sh/shipwright/package.nix index 6315867c2555..d1c4f44aa6ac 100644 --- a/pkgs/by-name/sh/shipwright/package.nix +++ b/pkgs/by-name/sh/shipwright/package.nix @@ -25,6 +25,7 @@ nlohmann_json, tinyxml-2, spdlog, + stb, writeTextFile, fixDarwinDylibNames, applyPatches, @@ -83,12 +84,6 @@ let ''; }; - stb' = fetchurl { - name = "stb_image.h"; - url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h"; - hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw="; - }; - stormlib' = applyPatches { src = fetchFromGitHub { owner = "ladislav-zezula"; @@ -208,7 +203,7 @@ stdenv.mkDerivation (finalAttrs: { preConfigure = '' mkdir stb - cp ${stb'} ./stb/${stb'.name} + cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h cp ${stb_impl} ./stb/${stb_impl.name} substituteInPlace libultraship/cmake/dependencies/common.cmake \ --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)" diff --git a/pkgs/by-name/sp/spaghettikart/package.nix b/pkgs/by-name/sp/spaghettikart/package.nix index 0d8068583ed5..18372e4063e5 100644 --- a/pkgs/by-name/sp/spaghettikart/package.nix +++ b/pkgs/by-name/sp/spaghettikart/package.nix @@ -24,6 +24,7 @@ SDL2, SDL2_net, spdlog, + stb, tinyxml-2, tomlplusplus, zenity, @@ -83,12 +84,6 @@ let ''; }; - stb' = fetchurl { - name = "stb_image.h"; - url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h"; - hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw="; - }; - stormlib' = applyPatches { src = fetchFromGitHub { owner = "ladislav-zezula"; @@ -219,7 +214,7 @@ stdenv.mkDerivation (finalAttrs: { preConfigure = '' mkdir stb - cp ${stb'} ./stb/${stb'.name} + cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h cp ${stb_impl} ./stb/${stb_impl.name} substituteInPlace libultraship/cmake/dependencies/common.cmake \ --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)" diff --git a/pkgs/by-name/st/starship-sf64/package.nix b/pkgs/by-name/st/starship-sf64/package.nix index e0aabc29488d..0bf4a9a49bc3 100644 --- a/pkgs/by-name/st/starship-sf64/package.nix +++ b/pkgs/by-name/st/starship-sf64/package.nix @@ -24,6 +24,7 @@ nlohmann_json, SDL2, spdlog, + stb, tinyxml-2, zenity, sdl_gamecontrollerdb, @@ -76,12 +77,6 @@ let ''; }; - stb' = fetchurl { - name = "stb_image.h"; - url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h"; - hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw="; - }; - stormlib' = applyPatches { src = fetchFromGitHub { owner = "ladislav-zezula"; @@ -195,7 +190,7 @@ stdenv.mkDerivation (finalAttrs: { preConfigure = '' mkdir stb - cp ${stb'} ./stb/${stb'.name} + cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h cp ${stb_impl} ./stb/${stb_impl.name} substituteInPlace libultraship/cmake/dependencies/common.cmake \ --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)" From e119515fbb4b58ffaa3239bac5450d542a60b297 Mon Sep 17 00:00:00 2001 From: Ihar Hrachyshka Date: Sat, 15 Aug 2026 18:32:14 -0400 Subject: [PATCH 270/318] python3Packages.pyarrow: use pure tzdata in tests test_orc.py tests may fail on darwin because they try to read from /usr/share/zoneinfo which may not work in darwin sandbox. This was reported multiple times, see: https://github.com/NixOS/nixpkgs/pull/477944 https://github.com/NixOS/nixpkgs/pull/485004 https://github.com/NixOS/nixpkgs/issues/483241 I also hit it myself in my personal flake CI. This patch switches the test to use pure tzdata to avoid the sandbox issue for darwin and re-enables one of previously skipped test_orc.py cases (for both platforms). Fixes #483241 --- pkgs/development/python-modules/pyarrow/default.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pyarrow/default.nix b/pkgs/development/python-modules/pyarrow/default.nix index f21dac9e39cc..d911cff61143 100644 --- a/pkgs/development/python-modules/pyarrow/default.nix +++ b/pkgs/development/python-modules/pyarrow/default.nix @@ -21,6 +21,7 @@ scikit-build-core, setuptools, setuptools-scm, + tzdata, }: let @@ -121,8 +122,6 @@ buildPythonPackage rec { "pyarrow/tests/test_csv.py::TestThreadedCSVTableRead::test_cancellation" # expects arrow-cpp headers to be bundled. "pyarrow/tests/test_cpp_internals.py::test_pyarrow_include" - # Searches for TZDATA in /usr. - "pyarrow/tests/test_orc.py::test_example_using_json" # AssertionError: assert 'Europe/Monaco' == 'Europe/Paris' "pyarrow/tests/test_types.py::test_dateutil_tzinfo_to_string" # These fail with xxx_fixture not found. @@ -168,6 +167,13 @@ buildPythonPackage rec { disabledTests = [ "GcsFileSystem" ]; preCheck = '' + # Prepare r/w zoneinfo that test_orc can then copy and modify. + export TZDIR="$TMPDIR/zoneinfo" + cp -R "${tzdata}/${python.sitePackages}/tzdata/zoneinfo" "$TZDIR" + chmod -R u+w "$TZDIR" + substituteInPlace pyarrow/tests/test_orc.py \ + --replace-fail "Path('/usr/share/zoneinfo')" "Path('$TZDIR')" + export PARQUET_TEST_DATA="${arrow-cpp.env.PARQUET_TEST_DATA}" shopt -s extglob rm -r pyarrow/!(conftest.py|tests) From dc1618565dccb3246eebc9f9b0fa1be9770225eb Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 16 Aug 2026 11:56:25 +0200 Subject: [PATCH 271/318] strace: enable strictDeps --- pkgs/by-name/st/strace/package.nix | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix index 77345bd6a3ae..a93b32106f78 100644 --- a/pkgs/by-name/st/strace/package.nix +++ b/pkgs/by-name/st/strace/package.nix @@ -3,6 +3,7 @@ stdenv, fetchurl, perl, + bashNonInteractive, libunwind, buildPackages, gitUpdater, @@ -30,15 +31,18 @@ stdenv.mkDerivation (finalAttrs: { enableParallelBuilding = true; - # libunwind for -k. - # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace. - # The build will silently fall back and -k will not work on RISC-V. buildInputs = [ + bashNonInteractive # for strace-log-merge shebang + # libunwind for -k. + # On RISC-V platforms, LLVM's libunwind implementation is unsupported by strace. + # The build will silently fall back and -k will not work on RISC-V. libunwind ] # -kk ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform elfutils) elfutils; + strictDeps = true; + configureFlags = [ "--enable-mpers=check" ] From 8c5882a4d84e1fa359b95a345d664301cb277327 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Sun, 16 Aug 2026 11:57:10 +0200 Subject: [PATCH 272/318] strace: enable structuredAttrs, move enableParallelBuilding So this option doesn't interrupt the lists of various inputs. --- pkgs/by-name/st/strace/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix index a93b32106f78..1919c9e29903 100644 --- a/pkgs/by-name/st/strace/package.nix +++ b/pkgs/by-name/st/strace/package.nix @@ -29,8 +29,6 @@ stdenv.mkDerivation (finalAttrs: { depsBuildBuild = [ buildPackages.stdenv.cc ]; nativeBuildInputs = [ perl ]; - enableParallelBuilding = true; - buildInputs = [ bashNonInteractive # for strace-log-merge shebang # libunwind for -k. @@ -41,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: { # -kk ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform elfutils) elfutils; + enableParallelBuilding = true; strictDeps = true; configureFlags = [ @@ -54,6 +53,8 @@ stdenv.mkDerivation (finalAttrs: { rev-prefix = "v"; }; + __structuredAttrs = true; + meta = { homepage = "https://strace.io/"; description = "System call tracer for Linux"; From c82ff0ab02ecd25cd9f43fb10d9418f260983736 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 15:30:56 +0200 Subject: [PATCH 273/318] makeSetupHook: use explicit substitution and enable structuredAttrs --- doc/release-notes/rl-2611.section.md | 2 ++ pkgs/build-support/trivial-builders/default.nix | 10 ++++------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md index 33cdf427dd32..15a83e96970d 100644 --- a/doc/release-notes/rl-2611.section.md +++ b/doc/release-notes/rl-2611.section.md @@ -136,6 +136,8 @@ [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual for details. +- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered. + - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0) - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds. diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix index b33f75e34676..4f4b6a9e5911 100644 --- a/pkgs/build-support/trivial-builders/default.nix +++ b/pkgs/build-support/trivial-builders/default.nix @@ -735,7 +735,6 @@ rec { meta ? { }, passthru ? { }, substitutions ? { }, - __structuredAttrs ? false, }@args: script: runCommand name @@ -745,10 +744,6 @@ rec { # Make the position of the derivation accurate. # Since not having `name` is deprecated, this should be fairly accurate. pos = lib.unsafeGetAttrPos "name" args; - # TODO(@Artturin:) substitutions should be inside the env attrset - # but users are likely passing non-substitution arguments through substitutions - # turn off __structuredAttrs to unbreak substituteAll - inherit __structuredAttrs; pname = name; version = "26.05pre-git"; inherit meta; @@ -756,6 +751,7 @@ rec { inherit propagatedBuildInputs; inherit propagatedNativeBuildInputs; strictDeps = true; + __structuredAttrs = true; # TODO 2023-01, no backport: simplify to inherit passthru; passthru = passthru @@ -771,7 +767,9 @@ rec { recordPropagatedDependencies '' + lib.optionalString (substitutions != { }) '' - substituteAll ${script} $out/nix-support/setup-hook + substitute ${script} $out/nix-support/setup-hook ${ + lib.concatMapAttrsStringSep " " (name: _: "--subst-var ${name}") substitutions + } '' ); From ed9d6018dfe4026a463ee82b576bf67ee304f3f7 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 15:42:30 +0200 Subject: [PATCH 274/318] checkPhaseThreadLimitHook: remove explicit __structuredAttrs = true --- pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix index 6bd9bda7135a..5171993b8856 100644 --- a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix +++ b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix @@ -6,8 +6,6 @@ makeSetupHook { name = "check-phase-thread-limit-hook"; - __structuredAttrs = true; - meta = { license = lib.licenses.mit; maintainers = with lib.maintainers; [ grimmauld ]; From e2bdadcc7cc7a02368a22a139a1c14bac9ab553f Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 15:42:46 +0200 Subject: [PATCH 275/318] pnpmBuildHook: remove explicit __structuredAttrs = true --- pkgs/by-name/pn/pnpmBuildHook/package.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/by-name/pn/pnpmBuildHook/package.nix b/pkgs/by-name/pn/pnpmBuildHook/package.nix index 361c15a16b99..0c86980d53b8 100644 --- a/pkgs/by-name/pn/pnpmBuildHook/package.nix +++ b/pkgs/by-name/pn/pnpmBuildHook/package.nix @@ -6,5 +6,4 @@ makeSetupHook { # the config hook must also be used. name = "pnpm-build-hook"; - __structuredAttrs = true; } ./pnpm-build-hook.sh From 90c611df0c285d56480c5aa72d2ec0f27c9dcf6d Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sun, 16 Aug 2026 15:48:21 +0200 Subject: [PATCH 276/318] glibc: 2.42-67 -> 2.42-84, fixes CVE-2026-6368 & CVE-2026-6791 Closes #551399 Closes #551398 The most recent fixes from #537324 are now part of the 2.42 branch. --- ...or-inet_ntop-failure-in-ns_sprintrrf.patch | 69 - ...s-as-unknown-in-ns_sprintrrf-CVE-202.patch | 134 - ...r-overreads-in-ns_sprintrrf-CVE-2026.patch | 66 - .../libraries/glibc/2.42-master.patch | 3259 +++++++++++++++++ pkgs/development/libraries/glibc/common.nix | 11 +- 5 files changed, 3260 insertions(+), 279 deletions(-) delete mode 100644 pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch delete mode 100644 pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch delete mode 100644 pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch diff --git a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch b/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch deleted file mode 100644 index 5e55d1242bb4..000000000000 --- a/pkgs/development/libraries/glibc/0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 4d9c6b19fcb34fab03fb7dab8f6d36a2cc4ef982 Mon Sep 17 00:00:00 2001 -From: Florian Weimer -Date: Fri, 19 Jun 2026 18:22:20 +0200 -Subject: [PATCH 1/3] resolv: Check for inet_ntop failure in ns_sprintrrf - -This makes the output more consistent (either failure or complete -output) and helps with systematic testing with varying buffer -sizes. - -Reviewed-by: Carlos O'Donell -Reviewed-by: Adhemerval Zanella -(cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a) ---- - resolv/ns_print.c | 18 +++++++++++------- - 1 file changed, 11 insertions(+), 7 deletions(-) - -diff --git a/resolv/ns_print.c b/resolv/ns_print.c -index cef2212fd2..cb680fb74e 100644 ---- a/resolv/ns_print.c -+++ b/resolv/ns_print.c -@@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen, - switch (type) { - case ns_t_a: - if (rdlen != (size_t)NS_INADDRSZ) -- goto formerr; -- (void) inet_ntop(AF_INET, rdata, buf, buflen); -+ goto formerr; -+ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) -+ return -1; - addlen(strlen(buf), &buf, &buflen); - break; - -@@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen, - } - - case ns_t_aaaa: -- if (rdlen != (size_t)NS_IN6ADDRSZ) -- goto formerr; -- (void) inet_ntop(AF_INET6, rdata, buf, buflen); -+ if (rdlen != (size_t)NS_IN6ADDRSZ) -+ goto formerr; -+ if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL) -+ return -1; - addlen(strlen(buf), &buf, &buflen); - break; - -@@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, - goto formerr; - - /* Address. */ -- (void) inet_ntop(AF_INET, rdata, buf, buflen); -+ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) -+ return -1; - addlen(strlen(buf), &buf, &buflen); - rdata += NS_INADDRSZ; - -@@ -542,7 +545,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, - if (rdata + pbyte >= edata) goto formerr; - memset(&a, 0, sizeof(a)); - memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); -- (void) inet_ntop(AF_INET6, &a, buf, buflen); -+ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) -+ return -1; - addlen(strlen(buf), &buf, &buflen); - rdata += sizeof(a) - pbyte; - } --- -2.54.0 - diff --git a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch b/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch deleted file mode 100644 index 5b39165a43b0..000000000000 --- a/pkgs/development/libraries/glibc/0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 103658e72f5aaeb36a5e405f9abaa1b687488fc1 Mon Sep 17 00:00:00 2001 -From: Florian Weimer -Date: Fri, 19 Jun 2026 18:22:20 +0200 -Subject: [PATCH 2/3] resolv: More types as unknown in ns_sprintrrf - (CVE-2026-5435) - -Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy -implementations of TSIG, fixing bug 34033, and partially -fixing bug 34069. - -Reviewed-by: Carlos O'Donell -Reviewed-by: Adhemerval Zanella -(cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72) ---- - resolv/ns_print.c | 96 ----------------------------------------------- - 1 file changed, 96 deletions(-) - -diff --git a/resolv/ns_print.c b/resolv/ns_print.c -index cb680fb74e..8c876b147e 100644 ---- a/resolv/ns_print.c -+++ b/resolv/ns_print.c -@@ -437,96 +437,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, - break; - } - -- case ns_t_cert: { -- u_int c_type, key_tag, alg; -- int n; -- unsigned int siz; -- char base64_cert[8192], tmp[40]; -- const char *leader; -- -- c_type = ns_get16(rdata); rdata += NS_INT16SZ; -- key_tag = ns_get16(rdata); rdata += NS_INT16SZ; -- alg = (u_int) *rdata++; -- -- len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg)); -- T(addstr(tmp, len, &buf, &buflen)); -- siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */ -- if (siz > sizeof(base64_cert) * 3/4) { -- const char *str = "record too long to print"; -- T(addstr(str, strlen(str), &buf, &buflen)); -- } -- else { -- len = b64_ntop(rdata, edata-rdata, base64_cert, siz); -- -- if (len < 0) -- goto formerr; -- else if (len > 15) { -- T(addstr(" (", 2, &buf, &buflen)); -- leader = "\n\t\t"; -- spaced = 0; -- } -- else -- leader = " "; -- -- for (n = 0; n < len; n += 48) { -- T(addstr(leader, strlen(leader), -- &buf, &buflen)); -- T(addstr(base64_cert + n, MIN(len - n, 48), -- &buf, &buflen)); -- } -- if (len > 15) -- T(addstr(" )", 2, &buf, &buflen)); -- } -- break; -- } -- -- case ns_t_tkey: { -- /* KJD - need to complete this */ -- u_long t; -- int mode, err, keysize; -- -- /* Algorithm name. */ -- T(addname(msg, msglen, &rdata, origin, &buf, &buflen)); -- T(addstr(" ", 1, &buf, &buflen)); -- -- /* Inception. */ -- t = ns_get32(rdata); rdata += NS_INT32SZ; -- len = SPRINTF((tmp, "%lu ", t)); -- T(addstr(tmp, len, &buf, &buflen)); -- -- /* Expiration. */ -- t = ns_get32(rdata); rdata += NS_INT32SZ; -- len = SPRINTF((tmp, "%lu ", t)); -- T(addstr(tmp, len, &buf, &buflen)); -- -- /* Mode , Error, Key Size. */ -- /* Priority, Weight, Port. */ -- mode = ns_get16(rdata); rdata += NS_INT16SZ; -- err = ns_get16(rdata); rdata += NS_INT16SZ; -- keysize = ns_get16(rdata); rdata += NS_INT16SZ; -- len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize)); -- T(addstr(tmp, len, &buf, &buflen)); -- -- /* XXX need to dump key, print otherdata length & other data */ -- break; -- } -- -- case ns_t_tsig: { -- /* BEW - need to complete this */ -- int n; -- -- T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen)); -- T(addstr(" ", 1, &buf, &buflen)); -- rdata += 8; /*%< time */ -- n = ns_get16(rdata); rdata += INT16SZ; -- rdata += n; /*%< sig */ -- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */ -- sprintf(buf, "%d", ns_get16(rdata)); -- rdata += INT16SZ; -- addlen(strlen(buf), &buf, &buflen); -- break; -- } -- - case ns_t_a6: { - struct in6_addr a; - int pbyte, pbit; -@@ -561,12 +471,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, - break; - } - -- case ns_t_opt: { -- len = SPRINTF((tmp, "%u bytes", class)); -- T(addstr(tmp, len, &buf, &buflen)); -- break; -- } -- - default: - snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type); - comment = errbuf; --- -2.54.0 - diff --git a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch b/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch deleted file mode 100644 index 8bde49f159e0..000000000000 --- a/pkgs/development/libraries/glibc/0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 2290143edc27486196815874dca5a528c118a73f Mon Sep 17 00:00:00 2001 -From: Florian Weimer -Date: Fri, 19 Jun 2026 18:22:20 +0200 -Subject: [PATCH 3/3] resolv: Fix buffer overreads in ns_sprintrrf - (CVE-2026-6238) - -Check that the RDATA payload does not require more than RDATALEN -bytes while processing it. The fixes cover A6, LOC records. -(CERT, TKEY, TSIG were fixed before, by switching to the generic -formatter.) - -The vulnerable LOC record handling was first introduced before -glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. - -CERT, TSIG, TKEY handling came with commit -b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. - -A6 record handling was introduced in commit -91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c -(ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc -2.7. - -This fixes bug 34069. - -Reviewed-by: Carlos O'Donell -Reviewed-by: Adhemerval Zanella -(cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a) ---- - resolv/ns_print.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/resolv/ns_print.c b/resolv/ns_print.c -index 8c876b147e..6832255a25 100644 ---- a/resolv/ns_print.c -+++ b/resolv/ns_print.c -@@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, - case ns_t_loc: { - char t[255]; - -- /* XXX protocol format checking? */ -+ if (rdlen != 16) -+ goto formerr; - (void) loc_ntoa(rdata, t); - T(addstr(t, strlen(t), &buf, &buflen)); - break; -@@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen, - - /* address suffix: provided only when prefix len != 128 */ - if (pbit < 128) { -- if (rdata + pbyte >= edata) goto formerr; -+ unsigned int bytelen = sizeof(a) - pbyte; -+ if (edata - rdata < bytelen) goto formerr; - memset(&a, 0, sizeof(a)); -- memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); -+ memcpy(&a.s6_addr[pbyte], rdata, bytelen); - if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) - return -1; - addlen(strlen(buf), &buf, &buflen); -- rdata += sizeof(a) - pbyte; -+ rdata += bytelen; - } - - /* prefix name: provided only when prefix len > 0 */ --- -2.54.0 - diff --git a/pkgs/development/libraries/glibc/2.42-master.patch b/pkgs/development/libraries/glibc/2.42-master.patch index a7bdf93961db..8abd567ee32b 100644 --- a/pkgs/development/libraries/glibc/2.42-master.patch +++ b/pkgs/development/libraries/glibc/2.42-master.patch @@ -7913,3 +7913,3262 @@ index 86ae5019a6..17b5565d0f 100644 /* Enlarge the buffer. */ wstr = (wchar_t *) realloc (*strptr, newsize * sizeof (wchar_t)); + +commit b866ef29773b22a1343ff9084374775114350b78 +Author: Maciej W. Rozycki +Date: Wed May 27 12:57:10 2026 -0400 + + support: Implement 'xfmemopen' for seamless 'fmemopen' use + + Add 'xfmemopen' wrapper for seamless 'fmemopen' use in tests, following + 'xfopen', 'xfclose', etc., and providing a standardized error reporting + facility. + + Reviewed-by: Florian Weimer + (cherry picked from commit fe709cc24578ecfd2ff5b07e10e3829fcb55075b) + + Reviewed-by: Carlos O'Donell + +diff --git a/support/Makefile b/support/Makefile +index d41278eeab..f67f38130a 100644 +--- a/support/Makefile ++++ b/support/Makefile +@@ -134,6 +134,7 @@ libsupport-routines = \ + xfclose \ + xfdopendir \ + xfgets \ ++ xfmemopen \ + xfopen \ + xfork \ + xfread \ +diff --git a/support/xfmemopen.c b/support/xfmemopen.c +new file mode 100644 +index 0000000000..f1dbc72c67 +--- /dev/null ++++ b/support/xfmemopen.c +@@ -0,0 +1,31 @@ ++/* fmemopen with error checking. ++ Copyright (C) 2025 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++ ++#include ++#include ++ ++FILE * ++xfmemopen (void *mem, size_t len, const char *mode) ++{ ++ FILE *fp = fmemopen (mem, len, mode); ++ if (fp == NULL) ++ FAIL_EXIT1 ("fmemopen (mode \"%s\"): %m", mode); ++ return fp; ++} +diff --git a/support/xstdio.h b/support/xstdio.h +index c3fdf9496f..70b83f11da 100644 +--- a/support/xstdio.h ++++ b/support/xstdio.h +@@ -27,6 +27,7 @@ __BEGIN_DECLS + FILE *xfopen (const char *path, const char *mode); + void xfclose (FILE *); + FILE *xfreopen (const char *path, const char *mode, FILE *stream); ++FILE *xfmemopen (void *mem, size_t len, const char *mode); + void xfread (void *ptr, size_t size, size_t nmemb, FILE *stream); + char *xfgets (char *s, int size, FILE *stream); + + +commit 97926e9017f3faeaacce9337f1288460f5e6ec7d +Author: Maciej W. Rozycki +Date: Wed May 27 12:57:10 2026 -0400 + + stdio-common: Reject insufficient character data in scanf [BZ #12701] + + Reject invalid formatted scanf character data with the 'c' conversion + where there is not enough input available to satisfy the field width + requested. It is required by ISO C that this conversion matches a + sequence of characters of exactly the number specified by the field + width and it is also already documented as such in our own manual: + + "It reads precisely the next N characters, and fails if it cannot get + that many." + + Currently a matching success is instead incorrectly produced where the + EOF condition is encountered before the required number of characters + has been retrieved, and the characters actually obtained are stored in + the buffer provided. + + Add test cases accordingly and remove placeholders from 'c' conversion + input data for the existing scanf tests. + + Reviewed-by: Adhemerval Zanella + + [This is a modified version of commit 2b16c76609, which tests for the + old behavior and only includes the test cases, for older branches + and downstream backports - DJ] + + Reviewed-by: Carlos O'Donell + +diff --git a/localedata/Makefile b/localedata/Makefile +index 4a23593cca..bff5c0bc71 100644 +--- a/localedata/Makefile ++++ b/localedata/Makefile +@@ -236,6 +236,7 @@ tests = \ + bug-iconv-trans \ + bug-setlocale1 \ + bug-usesetlocale \ ++ tst-bz12701-lc \ + tst-bz13988 \ + tst-c-utf8-consistency \ + tst-digits \ +diff --git a/localedata/tst-bz12701-lc.c b/localedata/tst-bz12701-lc.c +new file mode 100644 +index 0000000000..23c2ab7d2a +--- /dev/null ++++ b/localedata/tst-bz12701-lc.c +@@ -0,0 +1,218 @@ ++/* Verify scanf field width handling with the 'lc' conversion (BZ #12701). ++ Copyright (C) 2025-2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++/* Compare character-wise the initial part of the wide character object ++ pointed to by WS corresponding to wide characters obtained by the ++ conversion of first N bytes of the multibyte character object pointed ++ to by S. */ ++ ++static int ++tst_bz12701_lc_memcmp (const wchar_t *ds, const char *s, size_t n) ++{ ++ size_t nc = mbsnrtowcs (NULL, &s, n, 0, NULL); ++ ++ struct support_next_to_fault ntf; ++ ntf = support_next_to_fault_allocate (nc * sizeof (wchar_t)); ++ wchar_t *ss = (wchar_t *) ntf.buffer; ++ ++ mbsnrtowcs (ss, &s, n, nc, NULL); ++ int r = wmemcmp (ds, ss, nc); ++ ++ support_next_to_fault_free (&ntf); ++ ++ return r; ++} ++ ++/* Verify various aspects of field width handling, including the data ++ obtained, the number of bytes consumed, and the stream position. */ ++ ++static int ++do_test (void) ++{ ++ if (setlocale (LC_ALL, "pl_PL.UTF-8") == NULL) ++ FAIL_EXIT1 ("setlocale (LC_ALL, \"pl_PL.UTF-8\")"); ++ ++ /* Part of a tongue-twister in Polish, which says: ++ "On a rainy morning cuckoos and warblers, rather than starting ++ on earthworms, stuffed themselves fasted with the flesh of cress." */ ++ static const char s[126] = "Dżdżystym rankiem gżegżółki i piegże, " ++ "zamiast wziąć się za dżdżownice, " ++ "nażarły się na czczo miąższu rzeżuchy"; ++ ++ const char *sp = s; ++ size_t nc; ++ TEST_VERIFY_EXIT ((nc = mbsnrtowcs (NULL, &sp, sizeof (s), 0, NULL)) == 108); ++ ++ struct support_next_to_fault ntfo, ntfi; ++ ntfo = support_next_to_fault_allocate (nc * sizeof (wchar_t)); ++ ntfi = support_next_to_fault_allocate (sizeof (s)); ++ wchar_t *e = (wchar_t *) ntfo.buffer + nc; ++ char *b = ntfi.buffer; ++ ++ wchar_t *c; ++ FILE *f; ++ int ic; ++ int n; ++ int i; ++ ++ memcpy (ntfi.buffer, s, sizeof (s)); ++ ++ ic = i = 0; ++ f = xfmemopen (b, sizeof (s), "r"); ++ ++ c = e - 1; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ /* Avoid: "warning: zero width in gnu_scanf format [-Werror=format=]". */ ++ DIAG_PUSH_NEEDS_COMMENT; ++ DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wformat"); ++ TEST_VERIFY_EXIT (fscanf (f, "%0lc%n", c, &n) == 1); ++ DIAG_POP_NEEDS_COMMENT; ++ TEST_VERIFY_EXIT (n == 1); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 1; ++ i += n; ++ ++ c = e - 1; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 2); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 1; ++ i += n; ++ ++ c = e - 1; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%1lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 1); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 1; ++ i += n; ++ ++ c = e - 2; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 3); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 2; ++ i += n; ++ ++ c = e - 4; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%4lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 4); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 4; ++ i += n; ++ ++ c = e - 8; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%8lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 8); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 8; ++ i += n; ++ ++ c = e - 16; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%16lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 20); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 16; ++ i += n; ++ ++ c = e - 32; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%32lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 38); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 32; ++ i += n; ++ ++ c = e - (nc - ic); ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_COMPARE (fscanf (f, "%64lc%n", c, &n), 1); ++ TEST_COMPARE (n , 49); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, sizeof (s) - i) == 0); ++ ++ TEST_VERIFY_EXIT (ftell (f) == sizeof (s)); ++ TEST_VERIFY_EXIT (feof (f) != 0); ++ ++ xfclose (f); ++ ++ ic = i = 0; ++ f = xfmemopen (b, 3, "r"); ++ ++ c = e - 2; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 3); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 2; ++ i += n; ++ ++ c = e - (nc - ic); ++ TEST_VERIFY_EXIT (feof (f) == 0); ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == EOF); ++ TEST_VERIFY_EXIT (n == 3); ++ ++ TEST_VERIFY_EXIT (ftell (f) == 3); ++ TEST_VERIFY_EXIT (feof (f) != 0); ++ ++ xfclose (f); ++ ++ ic = i = 0; ++ f = xfmemopen (b, 3, "r"); ++ ++ c = e - 1; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 1); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, n) == 0); ++ ic += 1; ++ i += n; ++ ++ c = e - (nc - ic); ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2lc%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 2); ++ TEST_VERIFY_EXIT (tst_bz12701_lc_memcmp (c, s + i, 3 - i) == 0); ++ ++ TEST_VERIFY_EXIT (ftell (f) == 3); ++ TEST_VERIFY_EXIT (feof (f) != 0); ++ ++ xfclose (f); ++ ++ support_next_to_fault_free (&ntfi); ++ support_next_to_fault_free (&ntfo); ++ ++ return 0; ++} ++ ++#include +diff --git a/stdio-common/Makefile b/stdio-common/Makefile +index e52c333808..fdb545242e 100644 +--- a/stdio-common/Makefile ++++ b/stdio-common/Makefile +@@ -260,6 +260,7 @@ tests := \ + tllformat \ + tst-bz11319 \ + tst-bz11319-fortify2 \ ++ tst-bz12701-c \ + tst-cookie \ + tst-dprintf-length \ + tst-fclose-devzero \ +diff --git a/stdio-common/tst-bz12701-c.c b/stdio-common/tst-bz12701-c.c +new file mode 100644 +index 0000000000..4f3616fbfd +--- /dev/null ++++ b/stdio-common/tst-bz12701-c.c +@@ -0,0 +1,169 @@ ++/* Verify scanf field width handling with the 'c' conversion (BZ #12701). ++ Copyright (C) 2025-2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++/* Verify various aspects of field width handling, including the data ++ obtained, the number of bytes consumed, and the stream position. */ ++ ++static int ++do_test (void) ++{ ++ static const char s[43] = "The quick brown fox jumps over the lazy dog"; ++ struct support_next_to_fault ntfo, ntfi; ++ ntfo = support_next_to_fault_allocate (sizeof (s)); ++ ntfi = support_next_to_fault_allocate (sizeof (s)); ++ char *e = ntfo.buffer + sizeof (s); ++ char *b = ntfi.buffer; ++ ++ char *c; ++ FILE *f; ++ int n; ++ int i; ++ ++ memcpy (ntfi.buffer, s, sizeof (s)); ++ ++ i = 0; ++ f = xfmemopen (b, sizeof (s), "r"); ++ ++ c = e - 1; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ /* Avoid: "warning: zero width in gnu_scanf format [-Werror=format=]". */ ++ DIAG_PUSH_NEEDS_COMMENT; ++ DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wformat"); ++ TEST_VERIFY_EXIT (fscanf (f, "%0c%n", c, &n) == 1); ++ DIAG_POP_NEEDS_COMMENT; ++ TEST_VERIFY_EXIT (n == 1); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - 1; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 1); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - 1; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%1c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 1); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - 2; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 2); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - 4; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%4c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 4); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - 8; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%8c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 8); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - 16; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%16c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 16); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - (sizeof (s) - i); ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%32c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 10); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, sizeof (s) - i) == 0); ++ ++ TEST_VERIFY_EXIT (ftell (f) == sizeof (s)); ++ TEST_VERIFY_EXIT (feof (f) != 0); ++ ++ xfclose (f); ++ ++ i = 0; ++ f = xfmemopen (b, 3, "r"); ++ ++ c = e - 1; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 1); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - 2; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 2); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - (3 - i); ++ TEST_VERIFY_EXIT (feof (f) == 0); ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == EOF); ++ TEST_VERIFY_EXIT (n == 2); ++ ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (feof (f) != 0); ++ ++ xfclose (f); ++ ++ i = 0; ++ f = xfmemopen (b, 3, "r"); ++ ++ c = e - 2; ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 2); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, n) == 0); ++ i += n; ++ ++ c = e - (3 - i); ++ TEST_VERIFY_EXIT (ftell (f) == i); ++ TEST_VERIFY_EXIT (fscanf (f, "%2c%n", c, &n) == 1); ++ TEST_VERIFY_EXIT (n == 1); ++ TEST_VERIFY_EXIT (memcmp (c, s + i, 3 - i) == 0); ++ ++ TEST_VERIFY_EXIT (ftell (f) == 3); ++ TEST_VERIFY_EXIT (feof (f) != 0); ++ ++ xfclose (f); ++ ++ support_next_to_fault_free (&ntfi); ++ support_next_to_fault_free (&ntfo); ++ ++ return 0; ++} ++ ++#include + +commit 6cebb0b80fd783e442a8ad27c3f52cde52a9cac7 +Author: DJ Delorie +Date: Wed May 27 12:57:10 2026 -0400 + + stdio-common: Allow partially-filled %mc buffers [BZ #12701] + + This is a backwards-compatible alternative to the main solution to + the %mc part of 12701. The allocated buffer is expanded to the + requested size and NUL padded, but truncated reads are allowed. + + Reviewed-by: Carlos O'Donell + +diff --git a/localedata/Makefile b/localedata/Makefile +index bff5c0bc71..e212facef0 100644 +--- a/localedata/Makefile ++++ b/localedata/Makefile +@@ -237,6 +237,7 @@ tests = \ + bug-setlocale1 \ + bug-usesetlocale \ + tst-bz12701-lc \ ++ tst-bz12701-lc2 \ + tst-bz13988 \ + tst-c-utf8-consistency \ + tst-digits \ +diff --git a/localedata/tst-bz12701-lc2.c b/localedata/tst-bz12701-lc2.c +new file mode 100644 +index 0000000000..b24e86df0b +--- /dev/null ++++ b/localedata/tst-bz12701-lc2.c +@@ -0,0 +1,47 @@ ++/* Verify scanf memory handling with the 'c' conversion (BZ #12701). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++static int ++do_test (void) ++{ ++ wchar_t *c = NULL; ++ int i; ++ ++ TEST_VERIFY (sscanf ("1234", "%30mlc", &c) == 1); ++ ++ TEST_VERIFY (c != NULL); ++ TEST_COMPARE_BLOB (c, 5 * sizeof (wchar_t), ++ L"1234\0", 5 * sizeof (wchar_t)); ++ for (i = 5; i < 30; i ++) ++ TEST_VERIFY (c[i] == L'\0'); ++ ++ TEST_VERIFY (malloc_usable_size (c) >= 30 * sizeof(wchar_t)); ++ ++ return 0; ++} ++ ++#include +diff --git a/stdio-common/Makefile b/stdio-common/Makefile +index fdb545242e..27e7ea20f0 100644 +--- a/stdio-common/Makefile ++++ b/stdio-common/Makefile +@@ -261,6 +261,7 @@ tests := \ + tst-bz11319 \ + tst-bz11319-fortify2 \ + tst-bz12701-c \ ++ tst-bz12701-c2 \ + tst-cookie \ + tst-dprintf-length \ + tst-fclose-devzero \ +diff --git a/stdio-common/tst-bz12701-c2.c b/stdio-common/tst-bz12701-c2.c +new file mode 100644 +index 0000000000..5f9ca7c592 +--- /dev/null ++++ b/stdio-common/tst-bz12701-c2.c +@@ -0,0 +1,46 @@ ++/* Verify scanf memory handling with the 'c' conversion (BZ #12701). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++static int ++do_test (void) ++{ ++ char *c = NULL; ++ int i; ++ ++ TEST_VERIFY (sscanf ("1234", "%30mc", &c) == 1); ++ ++ TEST_VERIFY (c != NULL); ++ TEST_COMPARE_BLOB (c, 5, "1234\0", 5); ++ for (i = 5; i < 30; i ++) ++ TEST_VERIFY (c[i] == '\0'); ++ ++ TEST_VERIFY (malloc_usable_size (c) >= 30); ++ ++ return 0; ++} ++ ++#include +diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c +index 17b5565d0f..90a1886951 100644 +--- a/stdio-common/vfscanf-internal.c ++++ b/stdio-common/vfscanf-internal.c +@@ -780,9 +780,9 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + conv_error (); \ + } while (0) + #ifdef COMPILE_WSCANF +- STRING_ARG (str, char, 100); ++ STRING_ARG (str, char, (width > 0 ? width : 1)); + #else +- STRING_ARG (str, char, (width > 1024 ? 1024 : width)); ++ STRING_ARG (str, char, (width > 0 ? width : 1)); + #endif + + c = inchar (); +@@ -891,6 +891,11 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + + if (!(flags & SUPPRESS)) + { ++ /* If the buffer isn't completely filled, pad it with NULs. */ ++ if (flags & MALLOC) ++ while (width-- > 0) ++ *str++ = '\0'; ++ + if ((flags & MALLOC) && str - *strptr != strsize) + { + char *cp = (char *) realloc (*strptr, str - *strptr); +@@ -908,7 +913,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + if (width == -1) + width = 1; + +- STRING_ARG (wstr, wchar_t, (width > 1024 ? 1024 : width)); ++ STRING_ARG (wstr, wchar_t, (width > 0 ? width : 1)); + + c = inchar (); + if (__glibc_unlikely (c == EOF)) +@@ -1044,6 +1049,11 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + + if (!(flags & SUPPRESS)) + { ++ /* If the buffer isn't completely filled, pad it with NULs. */ ++ if (flags & MALLOC) ++ while (width-- > 0) ++ *wstr++ = L'\0'; ++ + if ((flags & MALLOC) && wstr - (wchar_t *) *strptr != strsize) + { + wchar_t *cp = (wchar_t *) realloc (*strptr, + +commit 748699d9385fc298f7d3369af0a015a6d88b7e64 +Author: Sam James +Date: Sat Jun 6 20:32:27 2026 +0100 + + elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210] + + dbe5065f2166be20e57a24f246a40d50e001a05d and ae589cb84df10825fc545a45c7007a5f79409bf1 + cater for setups where ld.so.conf{,.d} is required to find runtime support + libraries, but tst-glibc-hwcaps-prepend-cache clobbers the created ld.so.conf + with its own entry. + + Fix it to instead use the ld.so.conf.d created in ae589cb84df10825fc545a45c7007a5f79409bf1 + to co-exist with existing entries. + + Bug: https://bugs.gentoo.org/976773 + Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31901 + Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=34210 + Tested-by: Andreas K. Hüttel + Reported-by: Eli Schwartz + Reviewed-by: Andreas K. Hüttel + (cherry picked from commit d0cc9bf859d0434e397530d75a6507f13db79fba) + +diff --git a/elf/tst-glibc-hwcaps-prepend-cache.c b/elf/tst-glibc-hwcaps-prepend-cache.c +index b7df3962b5..2d51c22328 100644 +--- a/elf/tst-glibc-hwcaps-prepend-cache.c ++++ b/elf/tst-glibc-hwcaps-prepend-cache.c +@@ -46,7 +46,7 @@ do_test (void) + + { + /* Install the default implementation of libmarkermod1.so. */ +- char *conf_path = xasprintf ("%s/ld.so.conf", support_sysconfdir_prefix); ++ char *conf_path = xasprintf ("%s/ld.so.conf.d/hwcaps.conf", support_sysconfdir_prefix); + xmkdirp (support_sysconfdir_prefix, 0777); + support_write_file_string (conf_path, "/glibc-test/lib\n"); + free (conf_path); + +commit f671746f6c3ae511432b5666953be668267159f8 +Author: Florian Weimer +Date: Tue Jun 9 07:28:02 2026 +0200 + + iconv: Suppress intermediate errors with //TRANSLIT (bug 34236) + + When tentatively converting characters on behalf of + __gconv_transliterate, do not create a persistent error. Just + produce a local error, and rely on __gconv_transliterate to + produce the error if all transliteration options are exhausted. + + This fixes transliteration of “½” to ASCII, which cannot use the + “ 1⁄2 ” alternative. Eventually, the “ 1/2 ” alternative is chosen, + but the error sticks. Therefore, iconv exited with status 1 before + this change. + + Adjust iconv/tst-iconv_prog.sh to test both C and en_US.UTF-8 locales. + This requires changing the way the ICONV template is defined, so that + run_program_env is evaluated multiple times. + + Fixes commit 9a4b0eaf726f5404c6683d5c7c5e86f61c3f3fbc ("iconv: do not + report error exit with transliteration [BZ #32448]"), + commit 6cbf845fcdc76131d0e674cee454fe738b69c69d ("iconv: Preserve + iconv -c error exit on invalid inputs (bug 32046)"), and bug 34236. + + Reviewed-by: Aurelien Jarno + (cherry picked from commit e9325bd7d04aacc45cf39505e279b1ca9de22c08) + +diff --git a/iconv/Makefile b/iconv/Makefile +index 9a94a41ba4..028d24ffc3 100644 +--- a/iconv/Makefile ++++ b/iconv/Makefile +@@ -138,7 +138,8 @@ $(objpfx)test-iconvconfig.out: $(objpfx)iconvconfig + rm -f $$tmp) > $@; \ + $(evaluate-test) + +-$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog ++$(objpfx)tst-iconv_prog.out: tst-iconv_prog.sh $(objpfx)iconv_prog \ ++ $(gen-locales) + $(BASH) $< $(common-objdir) '$(test-wrapper-env)' \ + '$(run-program-env)' > $@; \ + $(evaluate-test) +diff --git a/iconv/loop.c b/iconv/loop.c +index 1378d23147..74b2a3e26d 100644 +--- a/iconv/loop.c ++++ b/iconv/loop.c +@@ -144,8 +144,10 @@ + if (irreversible == NULL) \ + { \ + /* This means we are in call from __gconv_transliterate. In this \ +- case we are not doing any error recovery ourselves. */ \ +- result = __gconv_mark_illegal_input (step_data); \ ++ case we are not doing any error recovery ourselves. Do not create \ ++ a persistent error state. If __gconv_transliterate exhausts all \ ++ alternatives, it will call __gconv_mark_illegal_input itself. */ \ ++ result = __GCONV_ILLEGAL_INPUT; \ + break; \ + } \ + \ +diff --git a/iconv/tst-iconv_prog.sh b/iconv/tst-iconv_prog.sh +index e2a43280d2..7d7948b7aa 100644 +--- a/iconv/tst-iconv_prog.sh ++++ b/iconv/tst-iconv_prog.sh +@@ -27,10 +27,10 @@ LIBPATH=$codir:$codir/iconvdata + + # How the start the iconv(1) program. $from is not defined/expanded yet. + ICONV=' ++$test_wrapper_env $run_program_env + $codir/elf/ld.so --library-path $LIBPATH --inhibit-rpath ${from}.so + $codir/iconv/iconv_prog + ' +-ICONV="$test_wrapper_env $run_program_env $ICONV" + + TIMEOUTFACTOR=${TIMEOUTFACTOR:-1} + +@@ -218,6 +218,7 @@ testarray=( + "\x00\x00;;INVALID;UTF-8;1" + "\x00\x00;;UTF-8;INVALID;1" + "\xc3\xa9;;UTF-8;ASCII//TRANSLIT;0" ++"X\xc2\xbdY;;UTF-8;ASCII//TRANSLIT;0" + ) + + # Requires $twobyte input, $c flag, $from, and $to to be set; sets $ret +@@ -278,12 +279,21 @@ check_errtest_result () + fi + } + +-for testcommand in "${testarray[@]}"; do +- twobyte="$(echo "$testcommand" | cut -d";" -f 1)" +- c="$(echo "$testcommand" | cut -d";" -f 2)" +- from="$(echo "$testcommand" | cut -d";" -f 3)" +- to="$(echo "$testcommand" | cut -d";" -f 4)" +- eret="$(echo "$testcommand" | cut -d";" -f 5)" +- execute_test +- check_errtest_result +-done ++run_test_array () ++{ ++ for testcommand in "${testarray[@]}"; do ++ twobyte="$(echo "$testcommand" | cut -d";" -f 1)" ++ c="$(echo "$testcommand" | cut -d";" -f 2)" ++ from="$(echo "$testcommand" | cut -d";" -f 3)" ++ to="$(echo "$testcommand" | cut -d";" -f 4)" ++ eret="$(echo "$testcommand" | cut -d";" -f 5)" ++ execute_test ++ check_errtest_result ++ done ++} ++ ++echo "info: testing C locale" ++run_test_array ++echo "info: testing en_US.UTF-8 locale" ++run_program_env="$run_program_env LC_ALL=en_US.UTF-8" ++run_test_array + +commit f6713070c6accac5c93d96c1d580833afacde3f5 +Author: Adhemerval Zanella +Date: Wed May 13 08:32:24 2026 -0300 + + arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792) + + _dl_runtime_resolve and _dl_runtime_profile only preserved the integer + argument registers (r0-r3) across the inner call to _dl_fixup / + _dl_profile_fixup. Two related ABI requirements demand more: + + * Under AAPCS-VFP, d0-d7 hold the caller's double arguments to the + function being resolved. Recent GCC emits VFP instructions inside + the fixup routines, clobbering them, so the resolved function sees + corrupted arguments (BZ 34144). + + * Per RTABI32, the __aeabi_mem* helpers (and similar runtime helpers + reachable through the dynamic linker) must only corrupt integer + core registers. IFUNC resolvers, audit modules, and interposed + malloc invoked during symbol resolution may also use VFP, even on + softfp ABI builds (BZ 15792). + + Save all call-clobbered VFP state -- d0-d15 unconditionally, d16-d31 + when HWCAP_ARM_VFPD32 is set, and fpscr -- around the inner fixup + call. Whether VFP is usable is a property of the hardware, not of + the ABI glibc was built with, so the decision is gated on AT_HWCAP at + runtime in both hardfp and softfp builds; hardfp builds will always + find HWCAP_ARM_VFP set, while softfp builds running on a non-VFP CPU + correctly skip the save. + + For _dl_runtime_profile the save area is slipped in just before the + bl to _dl_profile_fixup; the outgoing framesizep argument is + recomputed to account for the extra frame, and both the fast path + (no audit framesize) and the slow path (audit wraps with + pltenter/pltexit) traverse the restore before splitting. + + Checked on arm-linux-gnueabihf. + + Tested-by: Aurelien Jarno + Reviewed-by: Wilco Dijkstra + (cherry picked from commit 1111fbdd3e7ebed402800bc23e67055eaae0d972) + +diff --git a/sysdeps/arm/Makefile b/sysdeps/arm/Makefile +index 9c4fd6b236..be9e46aeeb 100644 +--- a/sysdeps/arm/Makefile ++++ b/sysdeps/arm/Makefile +@@ -30,6 +30,25 @@ $(objpfx)tst-armtlsdescloc: $(objpfx)tst-armtlsdesclocmod.so + $(objpfx)tst-armtlsdescextnow: $(objpfx)tst-armtlsdescextnowmod.so + $(objpfx)tst-armtlsdescextlazy: $(objpfx)tst-armtlsdescextlazymod.so + endif ++ ++tests += \ ++ tst-bz34144 \ ++ tst-bz34144-audit \ ++ # tests ++modules-names += \ ++ tst-bz34144-auditmod \ ++ tst-bz34144-mod \ ++ # modules-names ++$(objpfx)tst-bz34144: $(objpfx)tst-bz34144-mod.so ++$(objpfx)tst-bz34144-audit: $(objpfx)tst-bz34144-mod.so ++$(objpfx)tst-bz34144-audit.out: $(objpfx)tst-bz34144-auditmod.so ++# Use lazy binding to check if _dl_runtime_resolve correctly save/restore ++# the VFP state. ++LDFLAGS-tst-bz34144 = -Wl,-z,lazy ++# With LD_AUDIT, lazy resolution goes through _dl_runtime_profile, which ++# must also save/restore VFP state (BZ 34144). ++LDFLAGS-tst-bz34144-audit = -Wl,-z,lazy ++tst-bz34144-audit-ENV = LD_AUDIT=$(objpfx)tst-bz34144-auditmod.so + endif + endif + +diff --git a/sysdeps/arm/dl-trampoline.S b/sysdeps/arm/dl-trampoline.S +index fffac55050..ef358d48bc 100644 +--- a/sysdeps/arm/dl-trampoline.S ++++ b/sysdeps/arm/dl-trampoline.S +@@ -20,6 +20,7 @@ + #define NO_THUMB + #include + #include ++#include + + .text + .globl _dl_runtime_resolve +@@ -36,13 +37,40 @@ _dl_runtime_resolve: + @ ip contains &GOT[n+3] (pointer to function) + @ lr points to &GOT[2] + +- @ Save arguments. We save r4 to realign the stack. ++ @ Save arguments. We save r4 to realign the stack and to hold ++ @ the hwcap value used to decide whether to save VFP registers. + push {r0-r4} + cfi_adjust_cfa_offset (20) + cfi_rel_offset (r0, 0) + cfi_rel_offset (r1, 4) + cfi_rel_offset (r2, 8) + cfi_rel_offset (r3, 12) ++ cfi_rel_offset (r4, 16) ++ ++#ifdef SHARED ++ @ Preserve all call-clobbered VFP registers across _dl_fixup. ++ @ VFP may be used by IFUNC resolvers, audit modules, interposed ++ @ malloc, and the __aeabi_mem* helpers required by RTABI32, ++ @ which mandates that those helpers only corrupt integer core ++ @ registers. ++ LDR_GLOBAL (r4, r3, C_SYMBOL_NAME(_rtld_global_ro), \ ++ RTLD_GLOBAL_RO_DL_HWCAP_OFFSET) ++ ++ tst r4, #HWCAP_ARM_VFP ++ beq .Lno_vfp_save ++ ++# define VFP_STACK_REQ (32*8 + 8) ++ sub sp, sp, VFP_STACK_REQ ++ cfi_adjust_cfa_offset (VFP_STACK_REQ) ++ mov r3, sp ++ .inst 0xeca30b20 @ vstmia r3!, {d0-d15} ++ tst r4, #HWCAP_ARM_VFPD32 ++ beq 1f ++ .inst 0xece30b20 @ vstmia r3!, {d16-d31} ++1: .inst 0xeef12a10 @ vmrs r2, fpscr ++ str r2, [r3] ++.Lno_vfp_save: ++#endif /* SHARED */ + + @ get pointer to linker struct + ldr r0, [lr, #-4] +@@ -59,8 +87,23 @@ _dl_runtime_resolve: + @ save the return + mov ip, r0 + +- @ get arguments and return address back. We restore r4 +- @ only to realign the stack. ++#ifdef SHARED ++ tst r4, #HWCAP_ARM_VFP ++ beq .Lno_vfp_restore ++ mov r3, sp ++ .inst 0xecb30b20 @ vldmia r3!, {d0-d15} ++ tst r4, #HWCAP_ARM_VFPD32 ++ beq 2f ++ .inst 0xecf30b20 @ vldmia r3!, {d16-d31} ++2: ldr r2, [r3] ++ .inst 0xeee12a10 @ vmsr fpscr, r2 ++ add sp, sp, VFP_STACK_REQ ++ cfi_adjust_cfa_offset (-VFP_STACK_REQ) ++.Lno_vfp_restore: ++#endif /* SHARED */ ++ ++ @ get arguments and return address back. We restore r4 to ++ @ its original value as well. + pop {r0-r4,lr} + cfi_adjust_cfa_offset (-24) + +@@ -124,14 +167,71 @@ _dl_runtime_profile: + add r3, sp, #8 + stmia r3!, {r0,r1} + ++ @ Preserve all call-clobbered VFP registers across ++ @ _dl_profile_fixup. See the matching comment in ++ @ _dl_runtime_resolve above for the rationale (BZ 34144, ++ @ BZ 15792). ++ @ ++ @ Stack layout below the current sp (which becomes the new sp ++ @ after the sub): ++ @ sp + 0 .. 3: outgoing arg (framesizep) for _dl_profile_fixup ++ @ sp + 4 .. 7: saved hwcap (so we can test it after the call) ++ @ sp + 8 .. 11: saved r2 (used as scratch for LDR_GLOBAL) ++ @ sp + 12 .. 15: padding (for 8-byte alignment of the VFP area) ++ @ sp + 16 .. 16+VFP_STACK_REQ-1: VFP regs + fpscr ++#define VFP_PROFILE_STACK (16 + VFP_STACK_REQ) ++ sub sp, sp, #VFP_PROFILE_STACK ++ cfi_adjust_cfa_offset (VFP_PROFILE_STACK) ++ ++ @ r2 holds the retaddr (3rd arg to _dl_profile_fixup); spill ++ @ it so we can use it as the LDR_GLOBAL destination. ++ str r2, [sp, #8] ++ ++ LDR_GLOBAL (r2, ip, C_SYMBOL_NAME(_rtld_global_ro), \ ++ RTLD_GLOBAL_RO_DL_HWCAP_OFFSET) ++ str r2, [sp, #4] ++ ++ tst r2, #HWCAP_ARM_VFP ++ beq .Lprofile_no_vfp_save ++ add ip, sp, #16 ++ .inst 0xecac0b20 @ vstmia ip!, {d0-d15} ++ tst r2, #HWCAP_ARM_VFPD32 ++ beq 7f ++ .inst 0xecec0b20 @ vstmia ip!, {d16-d31} ++7: .inst 0xeef12a10 @ vmrs r2, fpscr ++ str r2, [ip] ++.Lprofile_no_vfp_save: ++ ++ @ Restore r2 (retaddr) for _dl_profile_fixup. ++ ldr r2, [sp, #8] ++ + @ Set up extra args for _dl_profile_fixup. +- @ r2 and r3 are already loaded. +- add ip, sp, #208 ++ @ The framesize slot is at the old sp+208, which is the new ++ @ sp + VFP_PROFILE_STACK + 208 -- compute in two steps because ++ @ the combined offset is not encodable as an ARM immediate. ++ add ip, sp, #VFP_PROFILE_STACK ++ add ip, ip, #208 + str ip, [sp, #0] + + @ call profiling fixup routine + bl _dl_profile_fixup + ++ @ Restore VFP registers. r0 holds the resolved function ++ @ address; r1/r2/ip are caller-saved by the call. ++ ldr r1, [sp, #4] ++ tst r1, #HWCAP_ARM_VFP ++ beq .Lprofile_no_vfp_restore ++ add ip, sp, #16 ++ .inst 0xecbc0b20 @ vldmia ip!, {d0-d15} ++ tst r1, #HWCAP_ARM_VFPD32 ++ beq 8f ++ .inst 0xecfc0b20 @ vldmia ip!, {d16-d31} ++8: ldr r2, [ip] ++ .inst 0xeee12a10 @ vmsr fpscr, r2 ++.Lprofile_no_vfp_restore: ++ add sp, sp, #VFP_PROFILE_STACK ++ cfi_adjust_cfa_offset (-VFP_PROFILE_STACK) ++ + @ The address to call is now in r0. + + @ Check whether we're wrapping this function. +diff --git a/sysdeps/arm/tst-bz34144-audit.c b/sysdeps/arm/tst-bz34144-audit.c +new file mode 100644 +index 0000000000..8f1084fa0a +--- /dev/null ++++ b/sysdeps/arm/tst-bz34144-audit.c +@@ -0,0 +1,32 @@ ++/* Test that lazy PLT resolution via _dl_runtime_profile preserves ++ caller-saved VFP registers used to pass double arguments (BZ 34144). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++ ++extern void test_float_args (double a, double b, double c, double d, ++ double e, double f, double g, double h); ++ ++static int ++do_test (void) ++{ ++ test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0); ++ return 0; ++} ++ ++#include +diff --git a/sysdeps/arm/tst-bz34144-auditmod.c b/sysdeps/arm/tst-bz34144-auditmod.c +new file mode 100644 +index 0000000000..ada9f126c2 +--- /dev/null ++++ b/sysdeps/arm/tst-bz34144-auditmod.c +@@ -0,0 +1,50 @@ ++/* Minimal audit module used by tst-bz34144-audit to force PLT calls ++ to go through _dl_runtime_profile instead of _dl_runtime_resolve. ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++ ++unsigned int ++la_version (unsigned int v) ++{ ++ return v; ++} ++ ++unsigned int ++la_objopen (struct link_map *l, Lmid_t lmid, uintptr_t *cookie) ++{ ++ return LA_FLG_BINDFROM | LA_FLG_BINDTO; ++} ++ ++uintptr_t ++la_symbind32 (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook, ++ uintptr_t *defcook, unsigned int *flags, const char *symname) ++{ ++ return sym->st_value; ++} ++ ++Elf32_Addr ++la_arm_gnu_pltenter (Elf32_Sym *sym, unsigned int ndx, uintptr_t *refcook, ++ uintptr_t *defcook, La_arm_regs *regs, ++ unsigned int *flags, const char *symname, ++ long int *framesizep) ++{ ++ return sym->st_value; ++} +diff --git a/sysdeps/arm/tst-bz34144-mod.c b/sysdeps/arm/tst-bz34144-mod.c +new file mode 100644 +index 0000000000..be6b54bf91 +--- /dev/null ++++ b/sysdeps/arm/tst-bz34144-mod.c +@@ -0,0 +1,28 @@ ++/* DSO used by tst-bz34144. ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++ ++void ++test_float_args (double a, double b, double c, double d, ++ double e, double f, double g, double h) ++{ ++ if (a != 2.0 || b != 3.0 || c != 4.0 || d != 5.0 ++ || e != 6.0 || f != 7.0 || g != 8.0 || h != 9.0) ++ abort (); ++} +diff --git a/sysdeps/arm/tst-bz34144.c b/sysdeps/arm/tst-bz34144.c +new file mode 100644 +index 0000000000..61e41b3945 +--- /dev/null ++++ b/sysdeps/arm/tst-bz34144.c +@@ -0,0 +1,32 @@ ++/* Test that lazy PLT resolution preserves caller-saved VFP registers ++ used to pass double arguments (BZ 34144). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++ ++extern void test_float_args (double a, double b, double c, double d, ++ double e, double f, double g, double h); ++ ++static int ++do_test (void) ++{ ++ test_float_args (2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0); ++ return 0; ++} ++ ++#include + +commit 0be5a6a72a4a3132bc211720d2b6949a84f54dc3 +Author: John David Anglin +Date: Tue Jun 23 13:41:10 2026 -0400 + + hppa: Fix missing call to __feraiseexcept (BZ 34306) + + The feupdateenv function is supposed to raise exceptions after + installing the environment represented by its envp argument. + This was accidentally missed on hppa. + + The failure to raise exceptions was noticed by the failure of + the math/test-narrowing-trap test. + + Signed-off-by: John David Anglin + +diff --git a/sysdeps/hppa/fpu/feupdateenv.c b/sysdeps/hppa/fpu/feupdateenv.c +index 46b83cc7a0..a3d3de33e4 100644 +--- a/sysdeps/hppa/fpu/feupdateenv.c ++++ b/sysdeps/hppa/fpu/feupdateenv.c +@@ -24,6 +24,7 @@ __feupdateenv (const fenv_t *envp) + { + union { unsigned long long l; unsigned int sw[2]; } s; + fenv_t temp; ++ + /* Get the current exception status */ + __asm__ ("fstd %%fr0,0(%1) \n\t" + "fldd 0(%1),%%fr0 \n\t" +@@ -46,6 +47,10 @@ __feupdateenv (const fenv_t *envp) + + /* Install new environment. */ + __fesetenv (&temp); ++ ++ /* Raise exceptions. */ ++ __feraiseexcept (temp.__status_word >> 27); ++ + /* Success. */ + return 0; + } + +commit 54929540335ef339ac66a8c28e3f4c22ebae2630 +Author: Fabian Rast +Date: Thu Jun 11 14:30:37 2026 +0200 + + rtld: cache cpuid results on the stack for intel + + dl_init_cacheinfo retrieves various information about cache + sizes, using the cpuid instruction on x86. + Previously, the same cpuid leaves were queried multiple times. + This behavior caused intel_check_word to prominently show up in + profiles of dynamic loader startup on the Intel(R) Xeon(R) Gold 6430. + The big performance impact could not be reproduced on other Intel cpus. + + This patch reduces the number of cpuid queries on startup + by caching their results on the stack for reuse when searching for a + different cache size value. + This approach does not change the overall design of + the cache enumeration code (repeated calls to handle_* functions). + The values are cached on the stack instead of globally (e.g. + in the cpu_features global) because they are never needed after + early initialization. + + The cache is only active for Intel cpus, because it has not yet + been shown through benchmarks that it meaningfully improves performance + for other processors. + + Signed-off-by: Fabian Rast + Reviewed-by: Sunil K Pandey + (cherry picked from commit df83fa8813eb53dcb232462a4f6dd00c873115f0) + +diff --git a/sysdeps/x86/dl-cacheinfo.h b/sysdeps/x86/dl-cacheinfo.h +index 6f9bb08a19..201d3ad278 100644 +--- a/sysdeps/x86/dl-cacheinfo.h ++++ b/sysdeps/x86/dl-cacheinfo.h +@@ -98,6 +98,15 @@ static const struct intel_02_cache_info + + #define nintel_02_known (sizeof (intel_02_known) / sizeof (intel_02_known [0])) + ++/* Cache for redundant cpuid queries in handle_intel, intel_check_word and ++ get_common_cache_info. Currently, this has only been shown to significantly ++ improve performance on a specific Intel CPU (Xeon 6430). */ ++struct intel_cpuid_cache ++{ ++ unsigned char leaf2_valid, leaf4_valid; /* Number of cached (sub)leaves. */ ++ unsigned int leaf2[4], leaf4[0x10][4]; ++}; ++ + static int + intel_02_known_compare (const void *p1, const void *p2) + { +@@ -118,7 +127,8 @@ static long int + __attribute__ ((noinline)) + intel_check_word (int name, unsigned int value, bool *has_level_2, + bool *no_level_2_or_3, +- const struct cpu_features *cpu_features) ++ const struct cpu_features *cpu_features, ++ struct intel_cpuid_cache *cache) + { + if ((value & 0x80000000) != 0) + /* The register value is reserved. */ +@@ -152,7 +162,21 @@ intel_check_word (int name, unsigned int value, bool *has_level_2, + unsigned int round = 0; + while (1) + { +- __cpuid_count (4, round, eax, ebx, ecx, edx); ++ if (round < cache->leaf4_valid) ++ /* Subleaf was queried before. Do not execute cpuid again. */ ++ eax = cache->leaf4[round][0], ebx = cache->leaf4[round][1], ++ ecx = cache->leaf4[round][2], edx = cache->leaf4[round][3]; ++ else if (round == cache->leaf4_valid ++ && round < sizeof(cache->leaf4)/sizeof(*cache->leaf4)) ++ { ++ /* Cache the cpuid result if we have space. */ ++ __cpuid_count (4, round, eax, ebx, ecx, edx); ++ cache->leaf4[round][0] = eax, cache->leaf4[round][1] = ebx; ++ cache->leaf4[round][2] = ecx, cache->leaf4[round][3] = edx; ++ cache->leaf4_valid++; ++ } ++ else ++ __cpuid_count (4, round, eax, ebx, ecx, edx); + + enum { null = 0, data = 1, inst = 2, uni = 3 } type = eax & 0x1f; + if (type == null) +@@ -247,7 +271,8 @@ intel_check_word (int name, unsigned int value, bool *has_level_2, + + + static long int __attribute__ ((noinline)) +-handle_intel (int name, const struct cpu_features *cpu_features) ++handle_intel (int name, const struct cpu_features *cpu_features, ++ struct intel_cpuid_cache *cache) + { + unsigned int maxidx = cpu_features->basic.max_cpuid; + +@@ -260,41 +285,33 @@ handle_intel (int name, const struct cpu_features *cpu_features) + long int result = 0; + bool no_level_2_or_3 = false; + bool has_level_2 = false; +- unsigned int eax; +- unsigned int ebx; +- unsigned int ecx; +- unsigned int edx; +- __cpuid (2, eax, ebx, ecx, edx); ++ int i; ++ ++ if (!cache->leaf2_valid) ++ { ++ __cpuid (2, cache->leaf2[0], cache->leaf2[1], ++ cache->leaf2[2], cache->leaf2[3]); ++ cache->leaf2_valid = 1; ++ } + + /* The low byte of EAX of CPUID leaf 2 should always return 1 and it + should be ignored. If it isn't 1, use CPUID leaf 4 instead. */ +- if ((eax & 0xff) != 1) ++ if ((cache->leaf2[0] & 0xff) != 1) + return intel_check_word (name, 0xff, &has_level_2, &no_level_2_or_3, +- cpu_features); +- else +- { +- eax &= 0xffffff00; +- +- /* Process the individual registers' value. */ +- result = intel_check_word (name, eax, &has_level_2, +- &no_level_2_or_3, cpu_features); +- if (result != 0) +- return result; ++ cpu_features, cache); + +- result = intel_check_word (name, ebx, &has_level_2, +- &no_level_2_or_3, cpu_features); +- if (result != 0) +- return result; +- +- result = intel_check_word (name, ecx, &has_level_2, +- &no_level_2_or_3, cpu_features); +- if (result != 0) +- return result; ++ /* Process all descriptors in leaf 2. */ ++ result = intel_check_word (name, cache->leaf2[0]&0xffffff00, &has_level_2, ++ &no_level_2_or_3, cpu_features, cache); ++ if (result != 0) ++ return result; + +- result = intel_check_word (name, edx, &has_level_2, +- &no_level_2_or_3, cpu_features); ++ for (i = 1; i < 4; i++) ++ { ++ result = intel_check_word (name, cache->leaf2[i], &has_level_2, ++ &no_level_2_or_3, cpu_features, cache); + if (result != 0) +- return result; ++ return result; + } + + if (name >= _SC_LEVEL2_CACHE_SIZE && name <= _SC_LEVEL3_CACHE_LINESIZE +@@ -611,7 +628,7 @@ handle_hygon (int name) + + static void + get_common_cache_info (long int *shared_ptr, long int * shared_per_thread_ptr, unsigned int *threads_ptr, +- long int core) ++ long int core, struct intel_cpuid_cache *cache) + { + unsigned int eax; + unsigned int ebx; +@@ -669,7 +686,14 @@ get_common_cache_info (long int *shared_ptr, long int * shared_per_thread_ptr, u + int check = 0x1 | (threads_l3 == 0) << 1; + do + { +- __cpuid_count (4, i++, eax, ebx, ecx, edx); ++ if (cache != NULL && i < cache->leaf4_valid) ++ eax = cache->leaf4[i][0], ebx = cache->leaf4[i][1], ++ ecx = cache->leaf4[i][2], edx = cache->leaf4[i][3]; ++ else ++ /* Do not attempt to cache queries at this point, ++ because get_common_cache_info is called last. */ ++ __cpuid_count (4, i, eax, ebx, ecx, edx); ++ i++; + + /* There seems to be a bug in at least some Pentium Ds + which sometimes fail to iterate all cache parameters. +@@ -849,35 +873,38 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) + + if (cpu_features->basic.kind == arch_kind_intel) + { +- data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features); +- shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features); ++ struct intel_cpuid_cache cache; ++ cache.leaf2_valid = cache.leaf4_valid = 0; ++ ++ data = handle_intel (_SC_LEVEL1_DCACHE_SIZE, cpu_features, &cache); ++ shared = handle_intel (_SC_LEVEL3_CACHE_SIZE, cpu_features, &cache); + shared_per_thread = shared; + + level1_icache_size +- = handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features); ++ = handle_intel (_SC_LEVEL1_ICACHE_SIZE, cpu_features, &cache); + level1_icache_linesize +- = handle_intel (_SC_LEVEL1_ICACHE_LINESIZE, cpu_features); ++ = handle_intel (_SC_LEVEL1_ICACHE_LINESIZE, cpu_features, &cache); + level1_dcache_size = data; + level1_dcache_assoc +- = handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features); ++ = handle_intel (_SC_LEVEL1_DCACHE_ASSOC, cpu_features, &cache); + level1_dcache_linesize +- = handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features); ++ = handle_intel (_SC_LEVEL1_DCACHE_LINESIZE, cpu_features, &cache); + level2_cache_size +- = handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features); ++ = handle_intel (_SC_LEVEL2_CACHE_SIZE, cpu_features, &cache); + level2_cache_assoc +- = handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features); ++ = handle_intel (_SC_LEVEL2_CACHE_ASSOC, cpu_features, &cache); + level2_cache_linesize +- = handle_intel (_SC_LEVEL2_CACHE_LINESIZE, cpu_features); ++ = handle_intel (_SC_LEVEL2_CACHE_LINESIZE, cpu_features, &cache); + level3_cache_size = shared; + level3_cache_assoc +- = handle_intel (_SC_LEVEL3_CACHE_ASSOC, cpu_features); ++ = handle_intel (_SC_LEVEL3_CACHE_ASSOC, cpu_features, &cache); + level3_cache_linesize +- = handle_intel (_SC_LEVEL3_CACHE_LINESIZE, cpu_features); ++ = handle_intel (_SC_LEVEL3_CACHE_LINESIZE, cpu_features, &cache); + level4_cache_size +- = handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features); ++ = handle_intel (_SC_LEVEL4_CACHE_SIZE, cpu_features, &cache); + + get_common_cache_info (&shared, &shared_per_thread, &threads, +- level2_cache_size); ++ level2_cache_size, &cache); + } + else if (cpu_features->basic.kind == arch_kind_zhaoxin) + { +@@ -898,7 +925,7 @@ dl_init_cacheinfo (struct cpu_features *cpu_features) + level3_cache_linesize = handle_zhaoxin (_SC_LEVEL3_CACHE_LINESIZE); + + get_common_cache_info (&shared, &shared_per_thread, &threads, +- level2_cache_size); ++ level2_cache_size, NULL); + } + else if (cpu_features->basic.kind == arch_kind_amd) + { + +commit f2f55eac9e6f1167486f2694dea88adf87c77fdd +Author: Florian Weimer +Date: Fri Jun 19 18:22:20 2026 +0200 + + resolv: Declare __p_class_syms, __p_type_syms for internal use + + Reviewed-by: Carlos O'Donell + Reviewed-by: Adhemerval Zanella + (cherry picked from commit 360f352c9a6da545d798ef3015e73ca114f0d230) + +diff --git a/include/resolv.h b/include/resolv.h +index 4dbbac3800..d5ad9994b9 100644 +--- a/include/resolv.h ++++ b/include/resolv.h +@@ -70,6 +70,11 @@ libc_hidden_proto (__libc_res_nameinquery) + extern __typeof (__res_queriesmatch) __libc_res_queriesmatch; + libc_hidden_proto (__libc_res_queriesmatch) + ++extern const struct res_sym __p_class_syms[]; ++libresolv_hidden_proto (__p_class_syms) ++extern const struct res_sym __p_type_syms[]; ++libresolv_hidden_proto (__p_type_syms) ++ + /* Variant of res_hnok which operates on binary (but uncompressed) names. */ + bool __res_binary_hnok (const unsigned char *dn) attribute_hidden; + +diff --git a/resolv/res_debug.c b/resolv/res_debug.c +index 73af0c72fe..6bf9962916 100644 +--- a/resolv/res_debug.c ++++ b/resolv/res_debug.c +@@ -390,8 +390,6 @@ p_fqname(const u_char *cp, const u_char *msg, FILE *file) { + * that C_ANY is a qclass but not a class. (You can ask for records of class + * C_ANY, but you can't have any records of that class in the database.) + */ +-extern const struct res_sym __p_class_syms[]; +-libresolv_hidden_proto (__p_class_syms) + const struct res_sym __p_class_syms[] = { + {C_IN, (char *) "IN"}, + {C_CHAOS, (char *) "CHAOS"}, +@@ -426,8 +424,6 @@ const struct res_sym __p_update_section_syms[] attribute_hidden = { + * Names of RR types and qtypes. The list is incomplete because its + * size is part of the ABI. + */ +-extern const struct res_sym __p_type_syms[]; +-libresolv_hidden_proto (__p_type_syms) + const struct res_sym __p_type_syms[] = { + {ns_t_a, (char *) "A", (char *) "address"}, + {ns_t_ns, (char *) "NS", (char *) "name server"}, + +commit 3c27e5170c456a69807348de8586c123f62a51f6 +Author: Florian Weimer +Date: Fri Jun 19 18:22:20 2026 +0200 + + resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289) + + The p_class and p_type results could overwrite each other if both + were unknown. Format unknown values with CLASS and TYPE prefixes, + as in RFC 3597. Handle A6 separately because it cannot be added + to __p_type_syms for ABI reasons. + + Reviewed-by: Carlos O'Donell + Reviewed-by: Adhemerval Zanella + (cherry picked from commit f69b7f95e3694177546faec25d88bb266885c3b8) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index cef2212fd2..e75c39eaa8 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -78,6 +78,24 @@ ns_sprintrr(const ns_msg *handle, const ns_rr *rr, + } + libresolv_hidden_def (ns_sprintrr) + ++/* Writes the class/type symbol NUMBER to *BUF, using the name from ++ *SYMS if possible. If NUMBER is not found in *SYMS, print the ++ number with PREFIX. */ ++static int ++addsym (const struct res_sym *syms, int number, const char *prefix, ++ char **buf, size_t *buflen) ++{ ++ for (; syms->name != NULL; syms++) ++ if (number == syms->number) ++ { ++ T (addstr (" ", 1, buf, buflen)); ++ return addstr (syms->name, strlen (syms->name), buf, buflen); ++ } ++ char tmp[20]; ++ int len = snprintf (tmp, sizeof (tmp), " %s%d", prefix, number); ++ return addstr (tmp, len, buf, buflen); ++} ++ + /*% + * Convert the fields of an RR into presentation format. + * +@@ -128,11 +146,21 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + /* + * TTL, Class, Type. + */ +- T(x = ns_format_ttl(ttl, buf, buflen)); +- addlen(x, &buf, &buflen); +- len = SPRINTF((tmp, " %s %s", p_class(class), p_type(type))); +- T(addstr(tmp, len, &buf, &buflen)); +- T(spaced = addtab(x + len, 16, spaced, &buf, &buflen)); ++ { ++ char *start = buf; ++ ++ T (x = ns_format_ttl (ttl, buf, buflen)); ++ addlen (x, &buf, &buflen); ++ T (addsym (__p_class_syms, class, "CLASS", &buf, &buflen)); ++ if (type == ns_t_a6) ++ /* A6 is not part of __p_type_syms, which is exported. ++ Adding A6 there would change its size. Handle it here. */ ++ T (addstr (" A6", 3, &buf, &buflen)); ++ else ++ T (addsym (__p_type_syms, type, "TYPE", &buf, &buflen)); ++ ++ T (spaced = addtab(buf - start, 16, spaced, &buf, &buflen)); ++ } + + /* + * RData. + +commit 509d819cea20f5d6c615eed1f869cc930effd9d2 +Author: Florian Weimer +Date: Fri Jun 19 18:22:20 2026 +0200 + + resolv: Improve formatting of unknown records in ns_sprintrrf + + Do not add the "unknown RR type" comment. After adding the TYPE + prefix, the number is largely redundant. + + Reviewed-by: Carlos O'Donell + Reviewed-by: Adhemerval Zanella + (cherry picked from commit d58415eb17d457a160af99f9e8ab164404ca151b) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index e75c39eaa8..3d38876483 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -115,7 +115,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + + const char *comment; + char tmp[100]; +- char errbuf[40]; + int len, x; + + /* +@@ -590,20 +589,18 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + T(addstr(tmp, len, &buf, &buflen)); + break; + } +- + default: +- snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type); +- comment = errbuf; ++ comment = ""; + goto hexify; + } + return (buf - obuf); + formerr: +- comment = "RR format error"; ++ comment = " ; RR format error"; + hexify: { + int n, m; + char *p; + +- len = SPRINTF((tmp, "\\# %u%s\t; %s", (unsigned)(edata - rdata), ++ len = SPRINTF((tmp, "\\# %u%s%s", (unsigned)(edata - rdata), + rdlen != 0U ? " (" : "", comment)); + T(addstr(tmp, len, &buf, &buflen)); + while (rdata < edata) { + +commit 05dc6da0b4e12dbc60d3705e4961b823d3f7026d +Author: Florian Weimer +Date: Fri Jun 19 18:22:20 2026 +0200 + + resolv: Check for inet_ntop failure in ns_sprintrrf + + This makes the output more consistent (either failure or complete + output) and helps with systematic testing with varying buffer + sizes. + + Reviewed-by: Carlos O'Donell + Reviewed-by: Adhemerval Zanella + (cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index 3d38876483..e58df5f35a 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -167,8 +167,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + switch (type) { + case ns_t_a: + if (rdlen != (size_t)NS_INADDRSZ) +- goto formerr; +- (void) inet_ntop(AF_INET, rdata, buf, buflen); ++ goto formerr; ++ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + break; + +@@ -334,9 +335,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + } + + case ns_t_aaaa: +- if (rdlen != (size_t)NS_IN6ADDRSZ) +- goto formerr; +- (void) inet_ntop(AF_INET6, rdata, buf, buflen); ++ if (rdlen != (size_t)NS_IN6ADDRSZ) ++ goto formerr; ++ if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + break; + +@@ -427,7 +429,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + goto formerr; + + /* Address. */ +- (void) inet_ntop(AF_INET, rdata, buf, buflen); ++ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + rdata += NS_INADDRSZ; + +@@ -569,7 +572,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + if (rdata + pbyte >= edata) goto formerr; + memset(&a, 0, sizeof(a)); + memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); +- (void) inet_ntop(AF_INET6, &a, buf, buflen); ++ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) ++ return -1; + addlen(strlen(buf), &buf, &buflen); + rdata += sizeof(a) - pbyte; + } + +commit 299e1d25c32c5f9ef78ddd6cbfd0c6a09a1f4227 +Author: Florian Weimer +Date: Fri Jun 19 18:22:20 2026 +0200 + + resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) + + Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy + implementations of TSIG, fixing bug 34033, and partially + fixing bug 34069. + + Reviewed-by: Carlos O'Donell + Reviewed-by: Adhemerval Zanella + (cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index e58df5f35a..ab68bf2cb7 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -464,96 +464,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + break; + } + +- case ns_t_cert: { +- u_int c_type, key_tag, alg; +- int n; +- unsigned int siz; +- char base64_cert[8192], tmp[40]; +- const char *leader; +- +- c_type = ns_get16(rdata); rdata += NS_INT16SZ; +- key_tag = ns_get16(rdata); rdata += NS_INT16SZ; +- alg = (u_int) *rdata++; +- +- len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg)); +- T(addstr(tmp, len, &buf, &buflen)); +- siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */ +- if (siz > sizeof(base64_cert) * 3/4) { +- const char *str = "record too long to print"; +- T(addstr(str, strlen(str), &buf, &buflen)); +- } +- else { +- len = b64_ntop(rdata, edata-rdata, base64_cert, siz); +- +- if (len < 0) +- goto formerr; +- else if (len > 15) { +- T(addstr(" (", 2, &buf, &buflen)); +- leader = "\n\t\t"; +- spaced = 0; +- } +- else +- leader = " "; +- +- for (n = 0; n < len; n += 48) { +- T(addstr(leader, strlen(leader), +- &buf, &buflen)); +- T(addstr(base64_cert + n, MIN(len - n, 48), +- &buf, &buflen)); +- } +- if (len > 15) +- T(addstr(" )", 2, &buf, &buflen)); +- } +- break; +- } +- +- case ns_t_tkey: { +- /* KJD - need to complete this */ +- u_long t; +- int mode, err, keysize; +- +- /* Algorithm name. */ +- T(addname(msg, msglen, &rdata, origin, &buf, &buflen)); +- T(addstr(" ", 1, &buf, &buflen)); +- +- /* Inception. */ +- t = ns_get32(rdata); rdata += NS_INT32SZ; +- len = SPRINTF((tmp, "%lu ", t)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* Expiration. */ +- t = ns_get32(rdata); rdata += NS_INT32SZ; +- len = SPRINTF((tmp, "%lu ", t)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* Mode , Error, Key Size. */ +- /* Priority, Weight, Port. */ +- mode = ns_get16(rdata); rdata += NS_INT16SZ; +- err = ns_get16(rdata); rdata += NS_INT16SZ; +- keysize = ns_get16(rdata); rdata += NS_INT16SZ; +- len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize)); +- T(addstr(tmp, len, &buf, &buflen)); +- +- /* XXX need to dump key, print otherdata length & other data */ +- break; +- } +- +- case ns_t_tsig: { +- /* BEW - need to complete this */ +- int n; +- +- T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen)); +- T(addstr(" ", 1, &buf, &buflen)); +- rdata += 8; /*%< time */ +- n = ns_get16(rdata); rdata += INT16SZ; +- rdata += n; /*%< sig */ +- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */ +- sprintf(buf, "%d", ns_get16(rdata)); +- rdata += INT16SZ; +- addlen(strlen(buf), &buf, &buflen); +- break; +- } +- + case ns_t_a6: { + struct in6_addr a; + int pbyte, pbit; +@@ -588,11 +498,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + break; + } + +- case ns_t_opt: { +- len = SPRINTF((tmp, "%u bytes", class)); +- T(addstr(tmp, len, &buf, &buflen)); +- break; +- } + default: + comment = ""; + goto hexify; + +commit cb4c62448047c043981deea84e5e01eccf8b36d4 +Author: Florian Weimer +Date: Fri Jun 19 18:22:20 2026 +0200 + + resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238) + + Check that the RDATA payload does not require more than RDATALEN + bytes while processing it. The fixes cover A6, LOC records. + (CERT, TKEY, TSIG were fixed before, by switching to the generic + formatter.) + + The vulnerable LOC record handling was first introduced before + glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f. + + CERT, TSIG, TKEY handling came with commit + b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2. + + A6 record handling was introduced in commit + 91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c + (ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc + 2.7. + + This fixes bug 34069. + + Reviewed-by: Carlos O'Donell + Reviewed-by: Adhemerval Zanella + (cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a) + +diff --git a/resolv/ns_print.c b/resolv/ns_print.c +index ab68bf2cb7..f9dd086804 100644 +--- a/resolv/ns_print.c ++++ b/resolv/ns_print.c +@@ -345,7 +345,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + case ns_t_loc: { + char t[255]; + +- /* XXX protocol format checking? */ ++ if (rdlen != 16) ++ goto formerr; + (void) loc_ntoa(rdata, t); + T(addstr(t, strlen(t), &buf, &buflen)); + break; +@@ -479,13 +480,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen, + + /* address suffix: provided only when prefix len != 128 */ + if (pbit < 128) { +- if (rdata + pbyte >= edata) goto formerr; ++ unsigned int bytelen = sizeof(a) - pbyte; ++ if (edata - rdata < bytelen) goto formerr; + memset(&a, 0, sizeof(a)); +- memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte); ++ memcpy(&a.s6_addr[pbyte], rdata, bytelen); + if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL) + return -1; + addlen(strlen(buf), &buf, &buflen); +- rdata += sizeof(a) - pbyte; ++ rdata += bytelen; + } + + /* prefix name: provided only when prefix len > 0 */ + +commit 296fb7f4a2b35db13efef52609f8efc00291b2a8 +Author: Florian Weimer +Date: Fri Jun 19 18:22:20 2026 +0200 + + resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069) + + This test case covers both input buffer overreads and output buffer + overflows. It should systematically cover these issues. + + I used code auto-generation for updating the test expectations for + truncated RDATA in TXT, ISDN records, after writing the rest + of the test by hand. + + Assisted-by: LLM + Reviewed-by: Carlos O'Donell + Reviewed-by: Adhemerval Zanella + (cherry picked from commit 4ba0b79b9596e5a4951cc9eaa1546a55e543e083) + +diff --git a/resolv/Makefile b/resolv/Makefile +index 088a22ea18..c6d73b411c 100644 +--- a/resolv/Makefile ++++ b/resolv/Makefile +@@ -98,6 +98,7 @@ tests += \ + tst-ns_name \ + tst-ns_name_compress \ + tst-ns_name_pton \ ++ tst-ns_sprintrr \ + tst-res_hconf_reorder \ + tst-res_hnok \ + tst-resolv-aliases \ +@@ -331,5 +332,6 @@ $(objpfx)tst-ns_name: $(objpfx)libresolv.so + $(objpfx)tst-ns_name.out: tst-ns_name.data + $(objpfx)tst-ns_name_compress: $(objpfx)libresolv.so + $(objpfx)tst-ns_name_pton: $(objpfx)libresolv.so ++$(objpfx)tst-ns_sprintrr: $(objpfx)libresolv.so + $(objpfx)tst-res_hnok: $(objpfx)libresolv.so + $(objpfx)tst-p_secstodate: $(objpfx)libresolv.so +diff --git a/resolv/tst-ns_sprintrr.c b/resolv/tst-ns_sprintrr.c +new file mode 100644 +index 0000000000..34739b5924 +--- /dev/null ++++ b/resolv/tst-ns_sprintrr.c +@@ -0,0 +1,329 @@ ++/* Tests for the ns_sprintrr function. ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++ ++/* Regions that test_one_record uses for input and output. */ ++static struct support_next_to_fault ntf_in; ++static struct support_next_to_fault ntf_out; ++ ++/* This is used by test_one_record to construct the packet. */ ++static const char packet_prefix[] = ++ /* DNS response with one question, one answer record. */ ++ "AA\x81\x80\0\1\0\1\0\0\0\0" ++ /* Question: www.example.org/IN/ANY. */ ++ "\3www\7example\3org\0\0\xff\0\1" ++ /* Response: compression reference. */ ++ "\xc0\x0c"; ++ ++/* Use ns_sprintrr to format a DNS record (starting with ++ packet_prefix) of type RTYPE, with a record payload of RDATALEN ++ bytes starting at RDATA. Check successful formatting against ++ EXPECTED. Try various truncated input and output buffers to catch ++ overreads and buffer overflows, using ntf_in and ntf_out above. */ ++static void ++test_one_record (uint16_t rtype, const char *rdata, size_t rdatalen, ++ const char *expected) ++{ ++ struct rr_header ++ { ++ uint16_t typ; ++ uint16_t cls; ++ uint32_t ttl; ++ uint16_t rdatalen; ++ uint16_t pad; ++ } hdr = ++ { ++ .typ = htons (rtype), ++ .cls = htons (ns_c_in), ++ .ttl = htonl (86400), /* One day. */ ++ .rdatalen = htons (rdatalen), ++ }; ++ enum { hdrlen = offsetof (struct rr_header, pad) }; ++ TEST_COMPARE (hdrlen, 10); ++ ++ /* Construct the packet from packet_prefix, hdr, and rdata. */ ++ unsigned char packet[512]; ++ size_t packetlen; ++ { ++ struct alloc_buffer buf = alloc_buffer_create (packet, sizeof (packet)); ++ alloc_buffer_copy_bytes (&buf, packet_prefix, sizeof (packet_prefix) - 1); ++ alloc_buffer_copy_bytes (&buf, &hdr, hdrlen); ++ alloc_buffer_copy_bytes (&buf, rdata, rdatalen); ++ packetlen = sizeof (packet) - alloc_buffer_size (&buf); ++ } ++ ++ /* Parse the record. */ ++ ns_msg msg; ++ TEST_COMPARE (ns_initparse (packet, packetlen, &msg), 0); ++ ns_rr rr; ++ TEST_COMPARE (ns_parserr (&msg, ns_s_an, 0, &rr), 0); ++ ++ /* Try sizes up to this limit. Go a bit beyond the expected size to ++ check for errors. */ ++ size_t max_result_size = strlen (expected) + 16; ++ ++ bool success = false; ++ for (size_t result_size = 1; result_size <= max_result_size; ++result_size) ++ { ++ char *result_start = ntf_out.buffer + ntf_out.length - result_size; ++ memset (result_start, 'X', result_size); ++ ++ /* ns_sprintrr was deprecated in 2.34. */ ++ DIAG_PUSH_NEEDS_COMMENT; ++ DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wdeprecated-declarations"); ++ int ret = ns_sprintrr (&msg, &rr, NULL, NULL, result_start, result_size); ++ DIAG_POP_NEEDS_COMMENT; ++ ++ if (ret > 0) ++ { ++ TEST_COMPARE_STRING (result_start, expected); ++ TEST_COMPARE (ret, strlen (expected)); ++ success = true; ++ } ++ else ++ { ++ TEST_VERIFY (!success); ++ TEST_COMPARE (ret, -1); ++ } ++ } ++ TEST_VERIFY (success); ++ ++ /* Test with truncated RDATA. */ ++ for (size_t rdata_size = 0; rdata_size <= rdatalen; ++rdata_size) ++ { ++ size_t truncated_packet_size = packetlen - rdatalen + rdata_size; ++ unsigned char *packet_start ++ = ((unsigned char *) ntf_in.buffer + ntf_in.length ++ - truncated_packet_size); ++ memcpy (packet_start, packet, truncated_packet_size); ++ /* Patch in the updated RDATA length field. */ ++ uint16_t new_rdatalen = htons (rdata_size); ++ memcpy (packet_start + truncated_packet_size - rdata_size - 2, ++ &new_rdatalen, 2); ++ ++ ns_msg msg; ++ TEST_COMPARE (ns_initparse (packet_start, truncated_packet_size, &msg), ++ 0); ++ ns_rr rr; ++ TEST_COMPARE (ns_parserr (&msg, ns_s_an, 0, &rr), 0); ++ ++ size_t result_size = strlen (expected) + 1; ++ char *result_start = ntf_out.buffer + ntf_out.length - result_size; ++ memset (result_start, 'X', result_size); ++ ++ /* ns_sprintrr was deprecated in 2.34. */ ++ DIAG_PUSH_NEEDS_COMMENT; ++ DIAG_IGNORE_NEEDS_COMMENT (4.9, "-Wdeprecated-declarations"); ++ int ret = ns_sprintrr (&msg, &rr, NULL, NULL, result_start, result_size); ++ DIAG_POP_NEEDS_COMMENT; ++ ++ /* This flag indicates whether the output is syntactically ++ correct. In some cases, truncation may still yield a valid ++ payload. */ ++ bool broken = rdata_size < rdatalen; ++ switch (rtype) ++ { ++ case ns_t_wks: ++ /* WKS records use all trailing bytes for the port bitmap. */ ++ broken = rdata_size < 5; ++ break; ++ case ns_t_nsap: ++ /* Uses all bytes that are available. */ ++ broken = false; ++ break; ++ case ns_t_txt: ++ /* Truncation produces a valid payload if it occurs right ++ after a complete string in the TXT payload. */ ++ broken = false; ++ for (size_t pos = 0; pos < rdata_size; ) ++ { ++ unsigned int slen = rdata[pos] & 0xff; ++ if (pos + 1 + slen > rdata_size) ++ { ++ broken = true; ++ break; ++ } ++ pos += 1 + slen; ++ } ++ break; ++ case ns_t_isdn: ++ /* The second field is optional. If it is present, it must ++ not be truncated. */ ++ broken = rdata_size < 6 || (rdata_size > 6 && rdata_size < rdatalen); ++ break; ++ case ns_t_a6: ++ /* The first A6 subtest contains a trailing domain name, ++ which is ignored and not formatted. */ ++ if (rdata_size > 0 && rdata[0] == 0) ++ broken = rdata_size < 17; ++ break; ++ case ns_t_cert: ++ case ns_t_tkey: ++ case ns_t_tsig: ++ /* Only generic printing, which does not validate anything. */ ++ broken = false; ++ break; ++ } ++ ++ if (broken) ++ { ++ if (strstr (result_start, "RR format error") != NULL) ++ /* No further checks if an error indicator has been added ++ to the output. */ ++ ; ++ else ++ TEST_COMPARE (ret, -1); ++ } ++ else ++ TEST_VERIFY (ret > 0); ++ } ++} ++ ++static int ++do_test (void) ++{ ++ ntf_in = support_next_to_fault_allocate (512); ++ ntf_out = support_next_to_fault_allocate (256); ++ ++#define T(rtype, rdata, expected) \ ++ test_one_record (rtype, rdata, sizeof (rdata) - 1, expected) ++ T (ns_t_a, "\xc0\0\2\1", "www.example.org.\t1D IN A\t\t192.0.2.1"); ++ T (ns_t_cname, "\4www1\4prod\xc0\x10", ++ "www.example.org.\t1D IN CNAME\twww1.prod.example.org."); ++ T (ns_t_hinfo, "\5first\6second", ++ "www.example.org.\t1D IN HINFO\t\"first\" \"second\""); ++ T (ns_t_isdn, "\5first\6second", ++ "www.example.org.\t1D IN ISDN\t\"first\" \"second\""); ++ /* Bug: Extra space at the end in the text representation of ISDN RRs. */ ++ T (ns_t_isdn, "\5first", "www.example.org.\t1D IN ISDN\t\"first\" "); ++ T (ns_t_soa, ++ "\2ns\xc0\x10\12hostmaster\xc0\x10" ++ "\0\0\0\1\0\0\0\2\0\0\0\3\0\0\0\4\0\0\0\5", ++ "www.example.org.\t1D IN SOA\tns.example.org. hostmaster.example.org. (\n" ++ "\t\t\t\t\t1\t\t; serial\n" ++ "\t\t\t\t\t2S\t\t; refresh\n" ++ "\t\t\t\t\t3S\t\t; retry\n" ++ "\t\t\t\t\t4S\t\t; expiry\n" ++ "\t\t\t\t\t5S )\t\t; minimum\n"); ++ T (ns_t_mx, "\0\xa\2mx\xc0\x10", ++ "www.example.org.\t1D IN MX\t10 mx.example.org."); ++ T (ns_t_px, "\0\xa\3px1\xc0\x10\3px2\xc0\x10", ++ "www.example.org.\t1D IN PX\t10 px1.example.org. px2.example.org."); ++ T (ns_t_x25, "\4X.25", ++ "www.example.org.\t1D IN X25\t\"X.25\""); ++ T (ns_t_txt, "\1A\2BC\3DEF", ++ "www.example.org.\t1D IN TXT\t\"A\" \"BC\" \"DEF\""); ++ T (ns_t_nsap, "", ++ "www.example.org.\t1D IN NSAP\t"); ++ T (ns_t_nsap, "\1", ++ "www.example.org.\t1D IN NSAP\t01"); ++ T (ns_t_nsap, "\1\2", ++ "www.example.org.\t1D IN NSAP\t01.02"); ++ T (ns_t_nsap, "\1\2\3", ++ "www.example.org.\t1D IN NSAP\t01.0203"); ++ T (ns_t_nsap, "\1\2\3\4", ++ "www.example.org.\t1D IN NSAP\t01.0203.04"); ++ T (ns_t_nsap, ++ "\1\2\3\4\5\6\7\10\11\12\13\14\15\16\17\20\21\22\23\24\25\26\27\30\31\32" ++ "\33\34\35\36\37\40\41\42\43\44\45\46\47\50\51\52\53\54\55\56\57\60\61" ++ "\62\63\64\65\66\67\70\71\72\73\74\75\76\77\100\101\102\103\104\105\106" ++ "\107\110\111\112\113\114\115\116\117\120\121\122\123\124\125\126\127" ++ "\130\131\132\133\134\135\136\137\140\141\142\143\144\145\146\147\150" ++ "\151\152\153\154\155\156\157\160\161\162\163\164\165\166\167\170\171" ++ "\172\173\174\175\176\177\200\201\202\203\204\205\206\207\210\211\212" ++ "\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233" ++ "\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254" ++ "\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275" ++ "\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316" ++ "\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337" ++ "\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360" ++ "\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377", ++ "www.example.org.\t1D IN NSAP\t" ++ "01.0203.0405.0607.0809.0A0B.0C0D.0E0F.1011.1213.1415.1617.1819.1A1B" ++ ".1C1D.1E1F.2021.2223.2425.2627.2829.2A2B.2C2D.2E2F.3031.3233.3435.3637" ++ ".3839.3A3B.3C3D.3E3F.4041.4243.4445.4647.4849.4A4B.4C4D.4E4F.5051.5253" ++ ".5455.5657.5859.5A5B.5C5D.5E5F.6061.6263.6465.6667.6869.6A6B.6C6D.6E6F" ++ ".7071.7273.7475.7677.7879.7A7B.7C7D.7E7F.8081.8283.8485.8687.8889.8A8B" ++ ".8C8D.8E8F.9091.9293.9495.9697.9899.9A9B.9C9D.9E9F.A0A1.A2A3.A4A5.A6A7" ++ ".A8A9.AAAB.ACAD.AEAF.B0B1.B2B3.B4B5.B6B7.B8B9.BABB.BCBD.BEBF.C0C1.C2C3" ++ ".C4C5.C6C7.C8C9.CACB.CCCD.CECF.D0D1.D2D3.D4D5.D6D7.D8D9.DADB.DCDD.DEDF" ++ ".E0E1.E2E3.E4E5.E6E7.E8E9.EAEB.ECED.EEEF.F0F1.F2F3.F4F5.F6F7.F8F9.FAFB" ++ ".FCFD.FEFF"); ++ T (ns_t_aaaa, "\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x34", ++ "www.example.org.\t1D IN AAAA\t2001:db8::1234"); ++ /* Example from RFC 1876. The loc_ntoa format is different from the ++ official text representation. */ ++ T (ns_t_loc, ++ "\000\063\026\023\211\027\055\320\160\276\025\360\000\230\215\040", ++ "www.example.org.\t1D IN LOC" ++ "\t42 21 54.000 N 71 06 18.000 W -24.00m 30.00m 10000.00m 10.00m"); ++ T (ns_t_naptr, ++ "\0\1\0\2\5flags\7service\2.*\5naptr\xc0\x10", ++ "www.example.org.\t1D IN NAPTR\t1 2 \"flags\" \"service\" \".*\"" ++ " naptr.example.org."); ++ T (ns_t_srv, ++ "\0\1\0\2\0\x50\4www1\xc0\x10", ++ "www.example.org.\t1D IN SRV\t1 2 80 www1.example.org."); ++ T (ns_t_rp, "\3rp1\xc0\x10\3rp2\xc0\x10", ++ "www.example.org.\t1D IN RP\trp1.example.org. rp2.example.org."); ++ T (ns_t_wks, "\xc0\0\2\1\6\0\0\0\0\0\0\0\0\0\0\200", ++ "www.example.org.\t1D IN WKS\t192.0.2.1 6 ( \n\t\t\t\t80 )"); ++ T (ns_t_cert, "\0\1\x04\xd2\0blob", ++ "www.example.org.\t1D IN CERT\t\\# 9 (\n" ++ "\t00 01 04 d2 00 62 6c 6f 62 )\t\t\t; .....blob"); ++ T (ns_t_tkey, "\4algo\0\0\0\0\1\0\0\0\2\0\3\0\4" ++ "\0\5\xa1\xa2\xa3\xa4\xa5\0\3\xb1\xb2\xb3", ++ "www.example.org.\t1D IN TYPE249\t\\# 30 (\n" ++ "\t04 61 6c 67 6f 00 00 00 00 01 00 00 00 02 00 03 ; .algo...........\n" ++ "\t00 04 00 05 a1 a2 a3 a4 a5 00 03 b1 b2 b3 )\t; .............."); ++ T (ns_t_tsig, "\4algo\0" ++ "\0\20\xdd\xcd\x64\x10\xe9\x21\x34\x1a\x8e\xe0\xa1\x9a\x30\xfc\x3b\xd1" ++ "\0\2\0\3\0\5other", ++ "www.example.org.\t1D IN TSIG\t\\# 35 (\n" ++ "\t04 61 6c 67 6f 00 00 10 dd cd 64 10 e9 21 34 1a ; .algo.....d..!4.\n" ++ "\t8e e0 a1 9a 30 fc 3b d1 00 02 00 03 00 05 6f 74 ; ....0.;.......ot\n" ++ "\t68 65 72 )\t\t\t\t\t; her"); ++ T (ns_t_a6, ++ "\0\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x34\6prefix\xc0\x10", ++ "www.example.org.\t1D IN A6\t0 2001:db8::1234"); ++ T (ns_t_a6, ++ "\0\x20\x01\x0d\xb8\0\0\0\0\0\0\0\0\0\0\x12\x35", ++ "www.example.org.\t1D IN A6\t0 2001:db8::1235"); ++ T (ns_t_a6, "\200\6prefix\xc0\x10", ++ "www.example.org.\t1D IN A6\t128 prefix.example.org."); ++ T (ns_t_a6, "\x20\0\0\0\0\0\0\0\0\0\0\x12\x36\6prefix\xc0\x10", ++ "www.example.org.\t1D IN A6\t32 ::1236 prefix.example.org."); ++#undef T ++ ++ support_next_to_fault_free (&ntf_in); ++ support_next_to_fault_free (&ntf_out); ++ return 0; ++} ++ ++#include + +commit 7414631f8aec8b9cee1a8311506e1fdcd9b94c0d +Author: Adhemerval Zanella +Date: Tue Apr 14 10:50:37 2026 -0300 + + posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791) + + The parse_tilde function previously used strndupa to allocate memory + for the parsed username on the stack, and since the input is + user-defined, this can lead to a stack overflow. + + This patch fixes the issue by replacing strndupa with scratch_buffer, + by reusing the buffer used in the __getpwnam_r call. + + The new “tst-wordexp-tilde.c” test is a test-container to avoid using + system-defined NSS modules. + + Checked on x86_64-linux-gnu and i686-linux-gnu. + + (cherry picked from commit 07c24f35392b727e6100d33edfdf811a6c68c218) + +diff --git a/posix/Makefile b/posix/Makefile +index 0b29c9aa4e..595c6b3ec2 100644 +--- a/posix/Makefile ++++ b/posix/Makefile +@@ -356,6 +356,7 @@ tests-internal := \ + tests-container := \ + bug-ga2 \ + tst-vfork3 \ ++ tst-wordexp-tilde \ + # tests-container + + tests-time64 := \ +diff --git a/posix/tst-wordexp-tilde.c b/posix/tst-wordexp-tilde.c +new file mode 100644 +index 0000000000..1661603681 +--- /dev/null ++++ b/posix/tst-wordexp-tilde.c +@@ -0,0 +1,244 @@ ++/* Test wordexp tilde expansion with large usernames (BZ 34091). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++typedef void (*func_callback_t)(void); ++ ++static void ++subprocess_small_stack (void *closure) ++{ ++ struct rlimit rl; ++ TEST_COMPARE (getrlimit (RLIMIT_STACK, &rl), 0); ++ rl.rlim_cur = 512 * 1024; ++ TEST_COMPARE (setrlimit (RLIMIT_STACK, &rl), 0); ++ ++ func_callback_t func_test = closure; ++ func_test (); ++} ++ ++/* Build a string "~/tail" where is LEN bytes of the ++ character CH. The caller must free the result. */ ++static char * ++make_tilde_input (char ch, size_t len, const char *tail) ++{ ++ /* ~ + len + / + tail + \0 */ ++ size_t taillen = tail != NULL ? strlen (tail) : 0; ++ size_t total = 1 + len + 1 + taillen + 1; ++ char *buf = xmalloc (total); ++ buf[0] = '~'; ++ memset (buf + 1, ch, len); ++ buf[1 + len] = '/'; ++ if (tail != NULL) ++ memcpy (buf + 1 + len + 1, tail, taillen); ++ buf[total - 1] = '\0'; ++ return buf; ++} ++ ++/* Test 1: A very long username must not crash. The username will not match ++ any real user, so wordexp returns ~/rest. */ ++static void ++test_long_username (void) ++{ ++ printf ("info: test_long_username_no_crash\n"); ++ ++ static const char REST[] = "rest"; ++ ++ /* 1 MiB username — well beyond any reasonable stack frame. */ ++ const size_t long_len = 1024 * 1024; ++ char *input = make_tilde_input ('A', long_len, REST); ++ ++ wordexp_t we = { 0 }; ++ int ret = wordexp (input, &we, 0); ++ /* The (non-existent) username is invalid, so wordexp falls back to ++ literal output: ~AAA…/rest. */ ++ TEST_COMPARE (ret, 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ ++ /* Verify prefix: '~' followed by long_len 'A's. */ ++ const char *result = we.we_wordv[0]; ++ TEST_COMPARE (result[0], '~'); ++ TEST_COMPARE (strlen (result), ++ 1 /* ~ */ + long_len + sizeof (REST)); ++ for (size_t j = 1; j <= long_len; j++) ++ if (result[j] != 'A') ++ { ++ printf (" mismatch at position %zu: expected 'A', got '%c'\n", ++ j, result[j]); ++ support_record_failure (); ++ break; ++ } ++ /* Verify the tail after the username. */ ++ TEST_COMPARE_STRING (result + 1 + long_len, "/rest"); ++ ++ wordfree (&we); ++ free (input); ++} ++ ++/* Test 2: A username that just exceeds the default scratch_buffer inline ++ size (1024 bytes) exercises the scratch_buffer_set_array_size growth path ++ without being excessively large. */ ++static void ++test_scratch_buffer_growth (void) ++{ ++ printf ("info: test_scratch_buffer_growth\n"); ++ ++ const size_t len = 2048; ++ char *input = make_tilde_input ('x', len, NULL); ++ ++ wordexp_t we = { 0 }; ++ int ret = wordexp (input, &we, 0); ++ TEST_COMPARE (ret, 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ ++ /* ~xxx…/ — the trailing slash makes a separate empty component, but ++ wordexp merges it into the single token ~xxx…/. */ ++ const char *result = we.we_wordv[0]; ++ TEST_COMPARE (result[0], '~'); ++ for (size_t j = 1; j <= len; j++) ++ if (result[j] != 'x') ++ { ++ printf (" mismatch at position %zu\n", j); ++ support_record_failure (); ++ break; ++ } ++ TEST_COMPARE (result[1 + len], '/'); ++ ++ wordfree (&we); ++ free (input); ++} ++ ++/* Test 3: ~root still resolves to the correct home directory through the ++ __getpwnam_r path. */ ++static void ++test_known_user (void) ++{ ++ printf ("info: test_known_user\n"); ++ ++ /* Look up root's home directory for comparison. */ ++ struct passwd *pw = getpwnam ("root"); ++ if (pw == NULL || pw->pw_dir == NULL) ++ { ++ printf (" SKIP: cannot look up root\n"); ++ return; ++ } ++ ++ char *expected = xasprintf ("%s/file", pw->pw_dir); ++ ++ wordexp_t we = { 0 }; ++ TEST_COMPARE (wordexp ("~root/file", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ TEST_COMPARE_STRING (we.we_wordv[0], expected); ++ ++ wordfree (&we); ++ free (expected); ++} ++ ++/* Test 4: Bare tilde expands to $HOME. */ ++static void ++test_bare_tilde (void) ++{ ++ printf ("info: test_bare_tilde\n"); ++ ++ const char *home = getenv ("HOME"); ++ if (home == NULL) ++ { ++ printf (" SKIP: HOME is not set\n"); ++ return; ++ } ++ ++ wordexp_t we = { 0 }; ++ TEST_COMPARE (wordexp ("~", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ TEST_COMPARE_STRING (we.we_wordv[0], home); ++ ++ wordfree (&we); ++} ++ ++/* Test 5: Short non-existent username falls back to literal ~username output, ++ exercising the invalid-login-name path. */ ++static void ++test_unknown_user (void) ++{ ++ printf ("info: test_unknown_user\n"); ++ ++ /* Pick a username that is extremely unlikely to exist. */ ++ wordexp_t we = { 0 }; ++ TEST_COMPARE (wordexp ("~no_such_user_xyzzy42", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ TEST_COMPARE_STRING (we.we_wordv[0], "~no_such_user_xyzzy42"); ++ ++ wordfree (&we); ++} ++ ++/* Test 6: Tilde with username and WRDE_APPEND — exercises parse_tilde's ++ interaction with the WRDE_APPEND word list. */ ++static void ++test_tilde_with_append (void) ++{ ++ printf ("info: test_tilde_with_append\n"); ++ ++ const char *home = getenv ("HOME"); ++ if (home == NULL) ++ { ++ printf (" SKIP: HOME is not set\n"); ++ return; ++ } ++ ++ wordexp_t we = { 0 }; ++ TEST_COMPARE (wordexp ("first", &we, 0), 0); ++ ++ TEST_COMPARE (wordexp ("~/path", &we, WRDE_APPEND), 0); ++ TEST_COMPARE (we.we_wordc, 2); ++ TEST_COMPARE_STRING (we.we_wordv[0], "first"); ++ ++ char *expected = xasprintf ("%s/path", home); ++ TEST_COMPARE_STRING (we.we_wordv[1], expected); ++ ++ wordfree (&we); ++ free (expected); ++} ++ ++static int ++do_test (void) ++{ ++ test_known_user (); ++ test_bare_tilde (); ++ test_unknown_user (); ++ test_tilde_with_append (); ++ ++ support_isolate_in_subprocess (subprocess_small_stack, ++ test_long_username); ++ ++ support_isolate_in_subprocess (subprocess_small_stack, ++ test_scratch_buffer_growth); ++ ++ return 0; ++} ++ ++#include +diff --git a/posix/tst-wordexp-tilde.root/etc/group b/posix/tst-wordexp-tilde.root/etc/group +new file mode 100644 +index 0000000000..1dbf9013ee +--- /dev/null ++++ b/posix/tst-wordexp-tilde.root/etc/group +@@ -0,0 +1 @@ ++root:x:0: +diff --git a/posix/tst-wordexp-tilde.root/etc/nsswitch.conf b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf +new file mode 100644 +index 0000000000..098a8d5938 +--- /dev/null ++++ b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf +@@ -0,0 +1,3 @@ ++passwd: files ++group: files ++shadow: files +diff --git a/posix/tst-wordexp-tilde.root/etc/passwd b/posix/tst-wordexp-tilde.root/etc/passwd +new file mode 100644 +index 0000000000..eb85a552ad +--- /dev/null ++++ b/posix/tst-wordexp-tilde.root/etc/passwd +@@ -0,0 +1 @@ ++root:x:0:0:root:/root:/bin/sh +diff --git a/posix/wordexp.c b/posix/wordexp.c +index 9df4bb7424..731d1650e9 100644 +--- a/posix/wordexp.c ++++ b/posix/wordexp.c +@@ -335,17 +335,29 @@ parse_tilde (char **word, size_t *word_length, size_t *max_length, + else + { + /* Look up user name in database to get home directory */ +- char *user = strndupa (&words[1 + *offset], i - (1 + *offset)); +- struct passwd pwd, *tpwd; +- int result; ++ size_t userlen = i - (1 + *offset); ++ /* tmpbuf contains both the user and the __getpwnam_r working area. */ + struct scratch_buffer tmpbuf; + scratch_buffer_init (&tmpbuf); ++ if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1)) ++ return WRDE_NOSPACE; ++ char *user = tmpbuf.data; ++ memcpy (user, &words[1 + *offset], userlen); ++ user[userlen] = '\0'; + +- while ((result = __getpwnam_r (user, &pwd, tmpbuf.data, tmpbuf.length, ++ struct passwd pwd, *tpwd; ++ int result; ++ while ((result = __getpwnam_r (user, ++ &pwd, ++ tmpbuf.data + userlen + 1, ++ tmpbuf.length - userlen - 1, + &tpwd)) != 0 + && errno == ERANGE) +- if (!scratch_buffer_grow (&tmpbuf)) +- return WRDE_NOSPACE; ++ { ++ if (!scratch_buffer_grow_preserve (&tmpbuf)) ++ return WRDE_NOSPACE; ++ user = tmpbuf.data; ++ } + + if (result == 0 && tpwd != NULL && pwd.pw_dir) + *word = w_addstr (*word, word_length, max_length, pwd.pw_dir); + +commit 8be3551ccb4e17e93ad82152de56d2c90de21f97 +Author: Adhemerval Zanella +Date: Mon Apr 13 16:33:30 2026 -0300 + + posix: Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) + + The previous implementation saved a copy of the wordexp_t struct at + entry and blindly restored it on error via (*pwordexp = old_word). + This is incorrect when WRDE_APPEND is set because w_addword may have + called realloc on we_wordv during partial processing before the error + was detected. If realloc relocated the buffer, the saved we_wordv + pointer is dangling; restoring it causes a use-after-free in the + caller (e.g. via wordfree), and the relocated buffer is leaked. + + Fix this by duplicating the we_wordv pointer array at entry when + WRDE_APPEND is set, so that all subsequent realloc calls inside + w_addword operate on the copy. + + This change also fixes a POSIX conformance issue: if the WRDE_APPEND + flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall + not be modified. + + Also fix two pre-existing error return paths in the '"' and '\'' cases + that returned directly from w_addword failures instead of going through + do_error, which would leak the saved array (and previously would also + skip the word cleanup). + + Checked on x86_64-linux-gnu and i686-linux-gnu. + + Reviewed-by: DJ Delorie + (cherry picked from commit e2cefe16c37a617df9f11407cb00a272a6098823) + +diff --git a/posix/Makefile b/posix/Makefile +index 595c6b3ec2..a12c49c0ed 100644 +--- a/posix/Makefile ++++ b/posix/Makefile +@@ -326,6 +326,7 @@ tests := \ + tst-wait3 \ + tst-wait4 \ + tst-waitid \ ++ tst-wordexp-append \ + tst-wordexp-nocmd \ + tst-wordexp-reuse \ + tstgetopt \ +diff --git a/posix/tst-wordexp-append.c b/posix/tst-wordexp-append.c +new file mode 100644 +index 0000000000..87f388f0a7 +--- /dev/null ++++ b/posix/tst-wordexp-append.c +@@ -0,0 +1,393 @@ ++/* Test for wordexp with WRDE_APPEND flag. ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++ ++static unsigned int relocating_reallocs; ++ ++/* w_addword grows we_wordv with realloc, make every call guaranteed to ++ relocate the block. This makes BZ 34090 regression more deterministic. */ ++void * ++realloc (void *ptr, size_t size) ++{ ++ if (ptr == NULL) ++ return malloc (size); ++ if (size == 0) ++ { ++ free (ptr); ++ return NULL; ++ } ++ ++ void *new = malloc (size); ++ if (new == NULL) ++ return NULL; ++ ++ /* Copy only what is valid in the old block to avoid reading past it. */ ++ size_t old = malloc_usable_size (ptr); ++ memcpy (new, ptr, old < size ? old : size); ++ /* Clobber the old block so that a stale we_wordv pointer restored on the ++ error path reads garbage instead of the old contents, which might ++ otherwise survive intact and mask the bug. */ ++ memset (ptr, 0x5a, old); ++ free (ptr); ++ relocating_reallocs++; ++ return new; ++} ++ ++/* Verify that all words in we match the expected NULL-terminated ++ array. */ ++static void ++check_words (const wordexp_t *we, const char *const *expected) ++{ ++ size_t i; ++ for (i = 0; expected[i] != NULL; i++) ++ { ++ TEST_VERIFY (i < we->we_wordc); ++ TEST_COMPARE_STRING (we->we_wordv[we->we_offs + i], expected[i]); ++ } ++ TEST_COMPARE (we->we_wordc, i); ++} ++ ++#define CHECK_WORDS(we, ...) \ ++ do { \ ++ const char *const expected_[] = { __VA_ARGS__, NULL }; \ ++ check_words (we, expected_); \ ++ } while (0) ++ ++/* Test 1: WRDE_APPEND + WRDE_BADCHAR preserves we_wordc. */ ++static void ++test_append_badchar_preserves_count (void) ++{ ++ printf ("info: test_append_badchar_preserves_count\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("one two three", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 3); ++ ++ size_t saved_count = we.we_wordc; ++ ++ /* ')' triggers WRDE_BADCHAR and "extra" would be a new word if the ++ expansion succeeded, exercising the w_addword path before the error ++ is detected. */ ++ TEST_COMPARE (wordexp ("extra )", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (we.we_wordc, saved_count); ++ ++ wordfree (&we); ++} ++ ++/* Test 2: WRDE_APPEND + WRDE_BADCHAR preserves the we_wordv pointer even ++ when internal realloc would move the buffer. */ ++static void ++test_append_badchar_preserves_pointer (void) ++{ ++ printf ("info: test_append_badchar_preserves_pointer\n"); ++ wordexp_t we = { 0 }; ++ ++ /* Use many words so that the initial we_wordv allocation is ++ non-trivial and a later realloc is more likely to move it. */ ++ TEST_COMPARE (wordexp ("a b c d e f g h", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 8); ++ ++ char **saved_wordv = we.we_wordv; ++ size_t saved_count = we.we_wordc; ++ unsigned int saved_reallocs = relocating_reallocs; ++ ++ /* The interposed realloc guarantees the internal we_wordv buffer moves ++ during parsing, so the pointer-stability check below is meaningful. */ ++ TEST_COMPARE (wordexp ("append )", &we, WRDE_APPEND), WRDE_BADCHAR); ++ /* Verify that a relocating realloc actually happened during the failed ++ call, otherwise the pointer-stability check is vacuous. */ ++ TEST_VERIFY (relocating_reallocs > saved_reallocs); ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ ++ wordfree (&we); ++} ++ ++/* Test 3: After a failed WRDE_APPEND the original words are still accessible ++ and correct. */ ++static void ++test_append_badchar_words_intact (void) ++{ ++ printf ("info: test_append_badchar_words_intact\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("alpha beta gamma", &we, 0), 0); ++ CHECK_WORDS (&we, "alpha", "beta", "gamma"); ++ ++ TEST_COMPARE (wordexp ("delta )", &we, WRDE_APPEND), WRDE_BADCHAR); ++ ++ /* Words must still be intact. */ ++ CHECK_WORDS (&we, "alpha", "beta", "gamma"); ++ /* The NULL terminator must still be present. */ ++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL); ++ ++ wordfree (&we); ++} ++ ++/* Test 4: Successful WRDE_APPEND still works (regression test). */ ++static void ++test_append_success (void) ++{ ++ printf ("info: test_append_success\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("hello", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ ++ char **saved_wordv = we.we_wordv; ++ ++ TEST_COMPARE (wordexp ("world", &we, WRDE_APPEND), 0); ++ TEST_COMPARE (we.we_wordc, 2); ++ /* A successful append works on a fresh copy of the array, so the ++ caller-visible pointer must have changed. */ ++ TEST_VERIFY (we.we_wordv != saved_wordv); ++ CHECK_WORDS (&we, "hello", "world"); ++ ++ wordfree (&we); ++} ++ ++/* Test 5: Successful append after a failed append — the implementation must ++ recover and allow further use of the wordexp_t. */ ++static void ++test_append_success_after_failure (void) ++{ ++ printf ("info: test_append_success_after_failure\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("first", &we, 0), 0); ++ CHECK_WORDS (&we, "first"); ++ ++ TEST_COMPARE (wordexp ("bad |", &we, WRDE_APPEND), WRDE_BADCHAR); ++ ++ /* State must be exactly as before the failed call. */ ++ CHECK_WORDS (&we, "first"); ++ ++ /* A subsequent successful append must work. */ ++ TEST_COMPARE (wordexp ("second third", &we, WRDE_APPEND), 0); ++ CHECK_WORDS (&we, "first", "second", "third"); ++ ++ wordfree (&we); ++} ++ ++/* Test 6: Multiple consecutive failed appends do not corrupt state. */ ++static void ++test_append_multiple_failures (void) ++{ ++ printf ("info: test_append_multiple_failures\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("keep this", &we, 0), 0); ++ CHECK_WORDS (&we, "keep", "this"); ++ ++ size_t saved_count = we.we_wordc; ++ char **saved_wordv = we.we_wordv; ++ ++ /* Each of these bad characters must leave the state unchanged. */ ++ TEST_COMPARE (wordexp ("x )", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x |", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x ;", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x &", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x <", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x >", &we, WRDE_APPEND), WRDE_BADCHAR); ++ ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ CHECK_WORDS (&we, "keep", "this"); ++ ++ wordfree (&we); ++} ++ ++/* Test 7: WRDE_APPEND with WRDE_SYNTAX error (unterminated quote) also ++ preserves state. */ ++static void ++test_append_syntax_error (void) ++{ ++ printf ("info: test_append_syntax_error\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("original", &we, 0), 0); ++ CHECK_WORDS (&we, "original"); ++ ++ char **saved_wordv = we.we_wordv; ++ size_t saved_count = we.we_wordc; ++ ++ /* Unterminated double quote triggers WRDE_SYNTAX. */ ++ TEST_COMPARE (wordexp ("\"unterminated", &we, WRDE_APPEND), WRDE_SYNTAX); ++ ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ CHECK_WORDS (&we, "original"); ++ ++ wordfree (&we); ++} ++ ++/* Test 8: Error without WRDE_APPEND still works (regression test for the ++ non-APPEND code path in do_error). */ ++static void ++test_no_append_error (void) ++{ ++ printf ("info: test_no_append_error\n"); ++ wordexp_t we = { 0 }; ++ ++ /* Simple failure without WRDE_APPEND. */ ++ TEST_COMPARE (wordexp ("bad |", &we, 0), WRDE_BADCHAR); ++ ++ /* After failure without WRDE_APPEND the struct should be safe to ++ reuse — start fresh. */ ++ TEST_COMPARE (wordexp ("ok", &we, 0), 0); ++ CHECK_WORDS (&we, "ok"); ++ ++ wordfree (&we); ++} ++ ++/* Test 9: WRDE_BADCHAR on the very first character (no partial words added ++ before the error). */ ++static void ++test_append_badchar_immediate (void) ++{ ++ printf ("info: test_append_badchar_immediate\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("hello world", &we, 0), 0); ++ CHECK_WORDS (&we, "hello", "world"); ++ ++ char **saved_wordv = we.we_wordv; ++ size_t saved_count = we.we_wordc; ++ ++ /* The bad character is the very first byte — no w_addword call happens ++ before the error. */ ++ TEST_COMPARE (wordexp ("|", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ ++ wordfree (&we); ++} ++ ++/* Test 10: WRDE_APPEND into an empty wordexp_t (initial call uses WRDE_APPEND ++ with a zeroed struct — unusual but allowed). */ ++static void ++test_append_into_empty (void) ++{ ++ printf ("info: test_append_into_empty\n"); ++ wordexp_t we = { 0 }; ++ ++ /* First call with WRDE_APPEND on a zeroed struct. The implementation ++ must handle we_wordv == NULL gracefully. */ ++ TEST_COMPARE (wordexp ("solo", &we, WRDE_APPEND), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ CHECK_WORDS (&we, "solo"); ++ ++ wordfree (&we); ++} ++ ++/* Verify that the leading we_offs slots are all NULL. */ ++static void ++check_offs_null (const wordexp_t *we) ++{ ++ for (size_t i = 0; i < we->we_offs; i++) ++ TEST_VERIFY (we->we_wordv[i] == NULL); ++} ++ ++/* Test 11: successful WRDE_APPEND with WRDE_DOOFFS and a non-zero we_offs. ++ The leading offset slots must stay NULL and words must land at ++ we_wordv[we_offs + i] across both the initial and the appended call. */ ++static void ++test_dooffs_append_success (void) ++{ ++ printf ("info: test_dooffs_append_success\n"); ++ wordexp_t we = { 0 }; ++ we.we_offs = 2; ++ ++ TEST_COMPARE (wordexp ("one two", &we, WRDE_DOOFFS), 0); ++ TEST_COMPARE (we.we_offs, 2); ++ check_offs_null (&we); ++ CHECK_WORDS (&we, "one", "two"); ++ ++ TEST_COMPARE (wordexp ("three", &we, WRDE_APPEND | WRDE_DOOFFS), 0); ++ TEST_COMPARE (we.we_offs, 2); ++ check_offs_null (&we); ++ CHECK_WORDS (&we, "one", "two", "three"); ++ /* The NULL terminator must sit right after the last word. */ ++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL); ++ ++ wordfree (&we); ++} ++ ++/* Test 12: failed WRDE_APPEND with WRDE_DOOFFS preserves we_wordc, the ++ we_wordv pointer, the words and the leading NULL offset slots. This ++ exercises the we_offs arithmetic in the array duplication and in the ++ error-path cleanup (we_wordv[we_offs + --we_wordc]). */ ++static void ++test_dooffs_append_error_preserves_state (void) ++{ ++ printf ("info: test_dooffs_append_error_preserves_state\n"); ++ wordexp_t we = { 0 }; ++ we.we_offs = 3; ++ ++ TEST_COMPARE (wordexp ("alpha beta", &we, WRDE_DOOFFS), 0); ++ check_offs_null (&we); ++ CHECK_WORDS (&we, "alpha", "beta"); ++ ++ char **saved_wordv = we.we_wordv; ++ size_t saved_count = we.we_wordc; ++ unsigned int saved_reallocs = relocating_reallocs; ++ ++ /* "gamma" is a partial word added via w_addword (forcing a relocating ++ realloc of we_wordv) before ')' triggers WRDE_BADCHAR. */ ++ TEST_COMPARE (wordexp ("gamma )", &we, WRDE_APPEND | WRDE_DOOFFS), ++ WRDE_BADCHAR); ++ TEST_VERIFY (relocating_reallocs > saved_reallocs); ++ ++ TEST_COMPARE (we.we_offs, 3); ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ check_offs_null (&we); ++ CHECK_WORDS (&we, "alpha", "beta"); ++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL); ++ ++ wordfree (&we); ++} ++ ++static int ++do_test (void) ++{ ++ test_append_badchar_preserves_count (); ++ test_append_badchar_preserves_pointer (); ++ test_append_badchar_words_intact (); ++ test_append_success (); ++ test_append_success_after_failure (); ++ test_append_multiple_failures (); ++ test_append_syntax_error (); ++ test_no_append_error (); ++ test_append_badchar_immediate (); ++ test_append_into_empty (); ++ test_dooffs_append_success (); ++ test_dooffs_append_error_preserves_state (); ++ ++ return 0; ++} ++ ++#include +diff --git a/posix/wordexp.c b/posix/wordexp.c +index 731d1650e9..50b0d7a256 100644 +--- a/posix/wordexp.c ++++ b/posix/wordexp.c +@@ -35,6 +35,7 @@ + #include + #include <_itoa.h> + #include ++#include + + /* + * This is a recursive-descent-style word expansion routine. +@@ -2224,6 +2225,12 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + char ifs_white[4]; + wordexp_t old_word = *pwordexp; + ++ /* When WRDE_APPEND is set we work on a copy of the we_wordv array so that ++ the caller's original pointer is never invalidated by realloc inside ++ w_addword. The saved_wordv keeps the original; on success we free it, ++ on non-NOSPACE error we free the working copy and restore the original. */ ++ char **saved_wordv = NULL; ++ + if (flags & WRDE_REUSE) + { + /* Minimal implementation of WRDE_REUSE for now */ +@@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + pwordexp->we_offs = 0; + } + } ++ else if (pwordexp->we_wordv != NULL) ++ { ++ /* WRDE_APPEND with an existing word list: duplicate the array so that ++ realloc during parsing does not invalidate the caller's pointer. The ++ strings themselves are shared. */ ++ size_t num_p; ++ char **dup; ++ if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p) ++ || INT_ADD_WRAPV (num_p, 1, &num_p)) ++ return WRDE_NOSPACE; ++ dup = __libc_reallocarray (NULL, num_p, sizeof *dup); ++ if (dup == NULL) ++ return WRDE_NOSPACE; ++ memcpy (dup, pwordexp->we_wordv, num_p * sizeof *dup); ++ saved_wordv = pwordexp->we_wordv; ++ pwordexp->we_wordv = dup; ++ } + + /* Find out what the field separators are. + * There are two types: whitespace and non-whitespace. +@@ -2338,7 +2362,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + error = w_addword (pwordexp, NULL); + + if (error) +- return error; ++ goto do_error; + } + + break; +@@ -2356,7 +2380,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + error = w_addword (pwordexp, NULL); + + if (error) +- return error; ++ goto do_error; + } + + break; +@@ -2422,10 +2446,18 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + + /* There was a word separator at the end */ + if (word == NULL) /* i.e. w_newword */ +- return 0; ++ { ++ free (saved_wordv); ++ return 0; ++ } + +- /* There was no field separator at the end */ +- return w_addword (pwordexp, word); ++ /* There was no field separator at the end. The only possible error ++ from w_addword is WRDE_NOSPACE. */ ++ error = w_addword (pwordexp, word); ++ if (error != 0) ++ goto do_error; ++ free (saved_wordv); ++ return 0; + + do_error: + /* Error: +@@ -2436,11 +2468,30 @@ do_error: + free (word); + + if (error == WRDE_NOSPACE) +- return WRDE_NOSPACE; ++ { ++ /* we_wordc and we_wordv are updated to reflect any words that were ++ successfully expanded. The old array is obsolete. */ ++ free (saved_wordv); ++ return WRDE_NOSPACE; ++ } + +- if ((flags & WRDE_APPEND) == 0) +- wordfree (pwordexp); ++ if (flags & WRDE_APPEND) ++ { ++ /* POSIX 2024 states that for in other error cases, if the WRDE_APPEND ++ flag was specified, we_wordc and we_wordv shall not be modified. ++ ++ Free strings appended during this call, discard the working copy of ++ we_wordv, and restore the caller's original pointer. */ ++ while (pwordexp->we_wordc > old_word.we_wordc) ++ free (pwordexp->we_wordv[pwordexp->we_offs + --pwordexp->we_wordc]); ++ free (pwordexp->we_wordv); ++ pwordexp->we_wordv = saved_wordv; ++ } ++ else ++ { ++ wordfree (pwordexp); ++ *pwordexp = old_word; ++ } + +- *pwordexp = old_word; + return error; + } diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix index 3d1fb9398dd8..1c95152d3f66 100644 --- a/pkgs/development/libraries/glibc/common.nix +++ b/pkgs/development/libraries/glibc/common.nix @@ -51,7 +51,7 @@ let version = "2.42"; - patchSuffix = "-67"; + patchSuffix = "-84"; sha256 = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8="; in @@ -116,15 +116,6 @@ stdenv.mkDerivation ( # enable parallel & reproducible build of glibcLocales ./0001-localedata-allow-reproducible-parallel-install-of-lo.patch ./0002-Makeconfig-make-inst_complocaledir-overridable.patch - - # Security fixes. - # - # Can be dropped on 2.44. The first patch is only to make it - # easier to backport the fix for CVE-2026-6238 and it seems - # useful in its own right anyhow. - ./0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch - ./0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch - ./0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch ] /* NVCC does not support ARM intrinsics. Since is pulled in by almost From 4b38845072b859992c4d437256d0707ee957e17f Mon Sep 17 00:00:00 2001 From: whoomee Date: Fri, 7 Aug 2026 19:04:33 +0200 Subject: [PATCH 277/318] rtmpdump: fix pkg-config include directory --- pkgs/by-name/rt/rtmpdump/package.nix | 38 ++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/rt/rtmpdump/package.nix b/pkgs/by-name/rt/rtmpdump/package.nix index b84a0f644b31..b70006410d9c 100644 --- a/pkgs/by-name/rt/rtmpdump/package.nix +++ b/pkgs/by-name/rt/rtmpdump/package.nix @@ -2,6 +2,8 @@ lib, stdenv, fetchgit, + testers, + versionCheckHook, zlib, gnutlsSupport ? false, gnutls, @@ -12,7 +14,7 @@ assert (gnutlsSupport || opensslSupport); -stdenv.mkDerivation { +stdenv.mkDerivation (finalAttrs: { pname = "rtmpdump"; version = "2.6"; @@ -23,6 +25,18 @@ stdenv.mkDerivation { hash = "sha256-rwMA9eougKnkpG+fe6vZIwOBt2CC1d9qI9a079EbE5o="; }; + postPatch = '' + for file in rtmp{dump.1,gw.8}{,.html} librtmp/librtmp.3{,.html}; do + substituteInPlace "$file" \ + --replace-fail "RTMPDump v2.4" "RTMPDump v${finalAttrs.version}" + done + + for file in Makefile librtmp/Makefile; do + substituteInPlace "$file" \ + --replace-fail "VERSION=v2.4" "VERSION=v${finalAttrs.version}" + done + ''; + preBuild = '' makeFlagsArray+=(CC="$CC") ''; @@ -44,18 +58,38 @@ stdenv.mkDerivation { ] ++ lib.optional opensslSupport openssl; + nativeInstallCheckInputs = [ versionCheckHook ]; + versionCheckProgramArg = "--help"; + doInstallCheck = true; + outputs = [ "out" "dev" ]; + # incdir hardcoded to ${prefix}/include, but we move includes to -dev + # pkg-config version field is specified without "v" prefix + postFixup = '' + substituteInPlace $dev/lib/pkgconfig/librtmp.pc \ + --replace-fail 'incdir=''${prefix}/include' "incdir=$dev/include" \ + --replace-fail 'Version: v${finalAttrs.version}' 'Version: ${finalAttrs.version}' + ''; + separateDebugInfo = true; + passthru.tests.pkg-config = testers.hasPkgConfigModules { + package = finalAttrs.finalPackage; + versionCheck = true; + }; + meta = { description = "Toolkit for RTMP streams"; homepage = "https://rtmpdump.mplayerhq.hu/"; + changelog = "https://rtmpdump.mplayerhq.hu/ChangeLog"; license = lib.licenses.gpl2Plus; + mainProgram = "rtmpdump"; + pkgConfigModules = [ "librtmp" ]; platforms = lib.platforms.unix; maintainers = [ ]; }; -} +}) From 19745ce59c1539beb3cb936d2f0226cb8b26e239 Mon Sep 17 00:00:00 2001 From: whoomee Date: Fri, 7 Aug 2026 19:05:35 +0200 Subject: [PATCH 278/318] rtmpdump: adopt --- pkgs/by-name/rt/rtmpdump/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/rt/rtmpdump/package.nix b/pkgs/by-name/rt/rtmpdump/package.nix index b70006410d9c..f09b5c92387f 100644 --- a/pkgs/by-name/rt/rtmpdump/package.nix +++ b/pkgs/by-name/rt/rtmpdump/package.nix @@ -90,6 +90,6 @@ stdenv.mkDerivation (finalAttrs: { mainProgram = "rtmpdump"; pkgConfigModules = [ "librtmp" ]; platforms = lib.platforms.unix; - maintainers = [ ]; + maintainers = with lib.maintainers; [ tmarkus ]; }; }) From 53e6f17d063a67f37f957dbd8949fcbd315c87c5 Mon Sep 17 00:00:00 2001 From: whoomee Date: Fri, 7 Aug 2026 19:06:10 +0200 Subject: [PATCH 279/318] tinyalsa: unstable-2022-06-05 -> 2.0.0-unstable-2026-07-27 --- pkgs/by-name/ti/tinyalsa/package.nix | 44 ++++++++++++++++------------ 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/pkgs/by-name/ti/tinyalsa/package.nix b/pkgs/by-name/ti/tinyalsa/package.nix index f90680f8f41b..157a104b223a 100644 --- a/pkgs/by-name/ti/tinyalsa/package.nix +++ b/pkgs/by-name/ti/tinyalsa/package.nix @@ -1,43 +1,49 @@ { lib, stdenv, + testers, fetchFromGitHub, - cmake, + meson, + ninja, }: -stdenv.mkDerivation { +stdenv.mkDerivation (finalAttrs: { pname = "tinyalsa"; - version = "unstable-2022-06-05"; + version = "2.0.0-unstable-2026-07-27"; src = fetchFromGitHub { owner = "tinyalsa"; repo = "tinyalsa"; - rev = "3d70d227e7dfd1be6f8f420a5aae164a2b4126e0"; - hash = "sha256-RHeF3VShy+LYFtJK+AEU7swIr5/rnpg2fdllnH9cFCk="; + rev = "9fab97ca07184371ecad81154d1dadb09d0fa7cf"; + hash = "sha256-+/wz0pwyF1kulUA5kjFGVOwbSkunEU+WzsZf/UsCEVk="; }; + separateDebugInfo = true; + strictDeps = true; + __structuredAttrs = true; + + outputs = [ + "out" + "dev" + "bin" + ]; + nativeBuildInputs = [ - cmake + meson + ninja ]; - cmakeFlags = [ - "-DTINYALSA_USES_PLUGINS=ON" - ]; - - env.NIX_CFLAGS_COMPILE = toString [ - "-Wno-error=sign-compare" - ]; - - postPatch = '' - substituteInPlace CMakeLists.txt \ - --replace-fail "cmake_minimum_required(VERSION 3.1)" "cmake_minimum_required(VERSION 3.10)" - ''; + passthru.tests.pkg-config = testers.hasPkgConfigModules { + package = finalAttrs.finalPackage; + versionCheck = false; + }; meta = { homepage = "https://github.com/tinyalsa/tinyalsa"; description = "Tiny library to interface with ALSA in the Linux kernel"; license = lib.licenses.mit; + pkgConfigModules = [ "tinyalsa" ]; maintainers = [ ]; platforms = with lib.platforms; linux; }; -} +}) From 5abd5b424bab34da4150639a4510f8b3adfe00a4 Mon Sep 17 00:00:00 2001 From: whoomee Date: Fri, 7 Aug 2026 19:07:22 +0200 Subject: [PATCH 280/318] tinyalsa: adopt --- pkgs/by-name/ti/tinyalsa/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ti/tinyalsa/package.nix b/pkgs/by-name/ti/tinyalsa/package.nix index 157a104b223a..809fcb47ffda 100644 --- a/pkgs/by-name/ti/tinyalsa/package.nix +++ b/pkgs/by-name/ti/tinyalsa/package.nix @@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: { description = "Tiny library to interface with ALSA in the Linux kernel"; license = lib.licenses.mit; pkgConfigModules = [ "tinyalsa" ]; - maintainers = [ ]; + maintainers = with lib.maintainers; [ tmarkus ]; platforms = with lib.platforms; linux; }; }) From 1d337c342efb05cf5b20e664372c71e62c485125 Mon Sep 17 00:00:00 2001 From: Gerhard Schwanzer Date: Fri, 14 Aug 2026 09:30:44 +0200 Subject: [PATCH 281/318] rsync: 3.4.4 -> 3.5.0 https://download.samba.org/pub/rsync/NEWS#3.5.0 Fixes 33 security issues in path handling and the daemon protocol. Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol) --- pkgs/by-name/rs/rsync/package.nix | 59 ++++++++++++++++++++++--------- 1 file changed, 43 insertions(+), 16 deletions(-) diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix index a39a47765b4d..ce828249f536 100644 --- a/pkgs/by-name/rs/rsync/package.nix +++ b/pkgs/by-name/rs/rsync/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchurl, - fetchpatch, updateAutotoolsGnuConfigScriptsHook, perl, @@ -29,27 +28,33 @@ stdenv.mkDerivation (finalAttrs: { pname = "rsync"; - version = "3.4.4"; + version = "3.5.0"; src = fetchurl { # signed with key 9FEF 112D CE19 A0DC 7E88 2CB8 1BB2 4997 A853 5F6F url = "mirror://samba/rsync/src/rsync-${finalAttrs.version}.tar.gz"; - hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY="; + hash = "sha256-x//R72U+mVQPZh5HywC3+crR7muXI5mxb5PWcmVuDTM="; }; - patches = [ - # Fixes test failure on darwin - (fetchpatch { - url = "https://github.com/RsyncProject/rsync/commit/e1c5f0e93a75dd45f32f3b92ba221ef158ac2e5f.patch"; - hash = "sha256-pg65K9BCTq/WvS5icK6KT28ARccFKedp2445wLYdRsE="; - excludes = [ - ".github/workflows/cygwin-build.yml" - ]; - }) - ]; + patches = [ ]; + + # Remove with the first upstream release that links t_acl against the snprintf fallback. + postPatch = '' + substituteInPlace Makefile.in \ + --replace-fail 'T_ACL_OBJ = t_acl.o lib/acl.o' 'T_ACL_OBJ = t_acl.o lib/acl.o lib/snprintf.o' + ''; preBuild = '' - patchShebangs ./runtests.py + patchShebangs ./runtests.py ./support/rrsync + + # patchShebangs ignores non-executable test sources and embedded shebangs. + substituteInPlace \ + testsuite/{daemon-namecvt-{empty-response,newline-token},rrsync-{sender-parent-pin,symlink}}_test.py \ + --replace-fail '#!/usr/bin/env python3' '#!${python3}/bin/python3' + + substituteInPlace \ + testsuite/rsync-ssl-stunnel-{ca-required,hostname-check}_test.py \ + --replace-fail '#!/usr/bin/env bash' '#!${stdenv.shell}' ''; nativeBuildInputs = [ @@ -103,9 +108,31 @@ stdenv.mkDerivation (finalAttrs: { python3 ]; - # Test fails when built in a chroot store + # These require set-id, chown, xattrs, or unrestricted /proc/self/fd, + # which the Linux Nix build sandbox does not provide. preCheck = '' - rm testsuite/chgrp.test + export RSYNC_EXCLUDE=${ + lib.concatStringsSep "," ( + lib.optionals stdenv.hostPlatform.isLinux [ + "chmod-option" + "chmod-setid" + "chown-fake" + "fake-super-backup-fifo-regression" + "protected-regular" + "rrsync-backup-dir-inband-pivot" + "rrsync-pull-delivers-content" + "variety-symlink-traversal" + "variety" + ] + # This test assumes that every Linux libc provides glibc malloc stats. + ++ lib.optional stdenv.hostPlatform.isMusl "misc-coverage" + # These require a native compiler and dynamic interposition. + ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [ + "link-dest-symlink-enotsup" + "partial-protected-regular-retry-linux" + ] + ) + } ''; doCheck = true; From a9c473dbce8bfb1e2cdd9ecf5cebc3219323230a Mon Sep 17 00:00:00 2001 From: whoomee Date: Sun, 16 Aug 2026 20:23:51 +0200 Subject: [PATCH 282/318] gst_all_1.gst-libav: remove ffmpeg pin GStreamer 1.28.6 adds support for ffmpeg 9. --- pkgs/development/libraries/gstreamer/libav/default.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix index 6731f09fb1e9..0d637b250465 100644 --- a/pkgs/development/libraries/gstreamer/libav/default.nix +++ b/pkgs/development/libraries/gstreamer/libav/default.nix @@ -9,8 +9,7 @@ gstreamer, gst-plugins-base, gettext, - # FIXME: unpin when upstream supports ffmpeg 9 - ffmpeg_8-headless, + ffmpeg-headless, # Checks meson.is_cross_build(), so even canExecute isn't enough. enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform, hotdoc, @@ -51,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: { buildInputs = [ gstreamer gst-plugins-base - ffmpeg_8-headless + ffmpeg-headless ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_gstreamer From d1db2c4b534628ac6b94024df500f02fa0f9345f Mon Sep 17 00:00:00 2001 From: Aaron Andersen Date: Sun, 16 Aug 2026 16:33:37 -0400 Subject: [PATCH 283/318] pipewire: replace systemd dependency with systemdLibs --- pkgs/by-name/pi/pipewire/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix index 144def6c59a9..981c7f867324 100644 --- a/pkgs/by-name/pi/pipewire/package.nix +++ b/pkgs/by-name/pi/pipewire/package.nix @@ -12,8 +12,8 @@ elogind, libinotify-kqueue, epoll-shim, - systemd, - enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, # enableSystemd=false maintained by maintainers.highghlow. + systemdLibs, + enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs, # enableSystemd=false maintained by maintainers.highghlow. pkg-config, docutils, doxygen, @@ -157,7 +157,7 @@ stdenv.mkDerivation (finalAttrs: { ] ++ ( if enableSystemd then - [ systemd ] + [ systemdLibs ] else if stdenv.hostPlatform.isLinux then [ elogind From 0bd88d4b5d341189f6da3319e9607d92275a6aca Mon Sep 17 00:00:00 2001 From: whoomee Date: Sun, 16 Aug 2026 23:20:58 +0200 Subject: [PATCH 284/318] tinyalsa: set updateScript --- pkgs/by-name/ti/tinyalsa/package.nix | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ti/tinyalsa/package.nix b/pkgs/by-name/ti/tinyalsa/package.nix index 809fcb47ffda..de827704e4c8 100644 --- a/pkgs/by-name/ti/tinyalsa/package.nix +++ b/pkgs/by-name/ti/tinyalsa/package.nix @@ -2,6 +2,7 @@ lib, stdenv, testers, + unstableGitUpdater, fetchFromGitHub, meson, ninja, @@ -33,9 +34,14 @@ stdenv.mkDerivation (finalAttrs: { ninja ]; - passthru.tests.pkg-config = testers.hasPkgConfigModules { - package = finalAttrs.finalPackage; - versionCheck = false; + passthru = { + updateScript = unstableGitUpdater { + tagPrefix = "v"; + }; + tests.pkg-config = testers.hasPkgConfigModules { + package = finalAttrs.finalPackage; + versionCheck = false; + }; }; meta = { From c33881bc35d24c80334fe93f87d1bea0b69e3f2b Mon Sep 17 00:00:00 2001 From: whoomee Date: Mon, 10 Aug 2026 20:59:59 +0200 Subject: [PATCH 285/318] libnice: fix devdoc and refactor mesonFlags --- pkgs/by-name/li/libnice/package.nix | 48 ++++++++++++++++++++--------- 1 file changed, 34 insertions(+), 14 deletions(-) diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix index a946663f2f4c..a032ea4eaeab 100644 --- a/pkgs/by-name/li/libnice/package.nix +++ b/pkgs/by-name/li/libnice/package.nix @@ -6,16 +6,21 @@ meson, ninja, pkg-config, - python3, - gobject-introspection, - gtk-doc, - docbook_xsl, - docbook_xml_dtd_412, glib, gupnp-igd, gst_all_1, gnutls, + enableDocumentation ? stdenv.buildPlatform == stdenv.hostPlatform, + gtk-doc, + docbook_xsl, + docbook_xml_dtd_412, graphviz, + python3, + withIntrospection ? + lib.meta.availableOn stdenv.hostPlatform gobject-introspection + && stdenv.hostPlatform.emulatorAvailable buildPackages, + buildPackages, + gobject-introspection, }: stdenv.mkDerivation (finalAttrs: { @@ -27,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: { "out" "dev" ] - ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ]; + ++ lib.optionals enableDocumentation [ "devdoc" ]; src = fetchurl { url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz"; @@ -51,18 +56,26 @@ stdenv.mkDerivation (finalAttrs: { ./musl.patch ]; + # specifies <1.30, but also works with later versions + postPatch = '' + substituteInPlace docs/reference/libnice/meson.build \ + --replace-fail "version: '<1.30', " "" + ''; + nativeBuildInputs = [ meson ninja pkg-config - python3 + ] + ++ lib.optionals withIntrospection [ gobject-introspection - - # documentation + ] + ++ lib.optionals enableDocumentation [ gtk-doc docbook_xsl docbook_xml_dtd_412 graphviz + python3 ]; buildInputs = [ @@ -76,11 +89,18 @@ stdenv.mkDerivation (finalAttrs: { glib ]; - mesonFlags = [ - "-Dgtk_doc=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}" - "-Dintrospection=${if (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}" - "-Dexamples=disabled" # requires many dependencies and probably not useful for our users - ]; + mesonFlags = lib.mapAttrsToList lib.mesonEnable { + gtk_doc = enableDocumentation; + introspection = withIntrospection; + + # requires many dependencies and probably not useful for our users + examples = false; + tests = finalAttrs.finalPackage.doCheck; + + gstreamer = true; + + glib_debug = false; + }; # Tests are flaky # see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295 From bd50939c8a8fdcf13902c84cccae40d8a7e5b60e Mon Sep 17 00:00:00 2001 From: whoomee Date: Mon, 10 Aug 2026 21:01:21 +0200 Subject: [PATCH 286/318] libnice: adopt --- pkgs/by-name/li/libnice/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix index a032ea4eaeab..5a75de403604 100644 --- a/pkgs/by-name/li/libnice/package.nix +++ b/pkgs/by-name/li/libnice/package.nix @@ -122,5 +122,6 @@ stdenv.mkDerivation (finalAttrs: { lgpl21 mpl11 ]; + maintainers = with lib.maintainers; [ tmarkus ]; }; }) From e7f2b610e7aa820bee4522ca5e01c0e3bb45e85d Mon Sep 17 00:00:00 2001 From: whoomee Date: Mon, 10 Aug 2026 21:04:25 +0200 Subject: [PATCH 287/318] libnice: declare and test meta.pkgConfigModules --- pkgs/by-name/li/libnice/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix index 5a75de403604..cd906b1a74db 100644 --- a/pkgs/by-name/li/libnice/package.nix +++ b/pkgs/by-name/li/libnice/package.nix @@ -1,6 +1,7 @@ { lib, stdenv, + testers, fetchurl, fetchpatch, meson, @@ -106,6 +107,8 @@ stdenv.mkDerivation (finalAttrs: { # see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295 doCheck = false; + passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; + meta = { changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS"; description = "GLib ICE implementation"; @@ -117,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: { It provides a GLib-based library, libnice and a Glib-free library, libstun as well as GStreamer elements.''; homepage = "https://libnice.freedesktop.org/"; + pkgConfigModules = [ "nice" ]; platforms = lib.platforms.unix; license = with lib.licenses; [ lgpl21 From ebdf6ac4571e8f4fb5f9d68b02fea16a3f9b8b25 Mon Sep 17 00:00:00 2001 From: whoomee Date: Sun, 16 Aug 2026 18:12:03 +0200 Subject: [PATCH 288/318] libnice: use fetchFromGitLab and set updateScript Fetching the source from Gitlab allows nix-update to automatically detect the latest version. --- pkgs/by-name/li/libnice/package.nix | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/li/libnice/package.nix b/pkgs/by-name/li/libnice/package.nix index cd906b1a74db..5a0590c209f5 100644 --- a/pkgs/by-name/li/libnice/package.nix +++ b/pkgs/by-name/li/libnice/package.nix @@ -2,8 +2,9 @@ lib, stdenv, testers, - fetchurl, + fetchFromGitLab, fetchpatch, + nix-update-script, meson, ninja, pkg-config, @@ -35,9 +36,12 @@ stdenv.mkDerivation (finalAttrs: { ] ++ lib.optionals enableDocumentation [ "devdoc" ]; - src = fetchurl { - url = "https://libnice.freedesktop.org/releases/libnice-${finalAttrs.version}.tar.gz"; - hash = "sha256-YY/E6N45O3GbFkHB2O7AGCbU050VrekmedIhx/Xk5w0="; + src = fetchFromGitLab { + domain = "gitlab.freedesktop.org"; + owner = "libnice"; + repo = "libnice"; + tag = finalAttrs.version; + hash = "sha256-UPppE5kBois0jJwsHKefBC8iTfSIkPZXV6XnUBnEFn8="; }; patches = [ @@ -107,7 +111,10 @@ stdenv.mkDerivation (finalAttrs: { # see https://github.com/NixOS/nixpkgs/pull/53293#issuecomment-453739295 doCheck = false; - passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; + passthru = { + updateScript = nix-update-script { }; + tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage; + }; meta = { changelog = "https://gitlab.freedesktop.org/libnice/libnice/-/blob/${finalAttrs.version}/NEWS"; From 7e7b9a88ded097a98c4866b4063600c593ef630a Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 3 Aug 2026 13:16:49 +0200 Subject: [PATCH 289/318] libiconv: enable structuredAttrs, use finalAttrs, use hash --- pkgs/development/libraries/libiconv/default.nix | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix index a90ea21d6cfb..2e24e6a509e0 100644 --- a/pkgs/development/libraries/libiconv/default.nix +++ b/pkgs/development/libraries/libiconv/default.nix @@ -10,13 +10,13 @@ # assert !stdenv.hostPlatform.isLinux || stdenv.hostPlatform != stdenv.buildPlatform; # TODO: improve on cross -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "libiconv"; version = "1.19"; src = fetchurl { - url = "mirror://gnu/libiconv/${pname}-${version}.tar.gz"; - sha256 = "sha256-iN2WqMBGTsoUT8eRrmDNMc2O54Mh5nOX4l/AlcShmqY="; + url = "mirror://gnu/libiconv/libiconv-${finalAttrs.version}.tar.gz"; + hash = "sha256-iN2WqMBGTsoUT8eRrmDNMc2O54Mh5nOX4l/AlcShmqY="; }; enableParallelBuilding = true; @@ -84,7 +84,9 @@ stdenv.mkDerivation rec { # remove after gnulib is updated ++ lib.optional stdenv.hostPlatform.isCygwin "gl_cv_clean_version_stddef=yes"; - passthru = { inherit setupHooks; }; + passthru = { inherit (finalAttrs) setupHooks; }; + + __structuredAttrs = true; meta = { description = "Iconv(3) implementation"; @@ -108,4 +110,4 @@ stdenv.mkDerivation rec { # This library is not needed on GNU platforms. hydraPlatforms = with lib.platforms; cygwin ++ darwin ++ freebsd; }; -} +}) From 9a92753202c6ba793a35654da71d7a5288186280 Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Fri, 14 Aug 2026 22:09:27 +0200 Subject: [PATCH 290/318] glib: enable structuredAttrs --- pkgs/by-name/gl/glib/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix index d504331900ce..b671ab262978 100644 --- a/pkgs/by-name/gl/glib/package.nix +++ b/pkgs/by-name/gl/glib/package.nix @@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: { }; }; + __structuredAttrs = true; + meta = { description = "C library of programming buildings blocks"; homepage = "https://gitlab.gnome.org/GNOME/glib"; From fffccc637f9d91e2a75bd2a073f3229c6f5e90d3 Mon Sep 17 00:00:00 2001 From: Julian Stecklina Date: Mon, 17 Aug 2026 14:32:40 +0200 Subject: [PATCH 291/318] zip: remove rec in favor of finalAttrs --- pkgs/by-name/zi/zip/package.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix index 3bf6b8a1641a..07d985fcc19c 100644 --- a/pkgs/by-name/zi/zip/package.nix +++ b/pkgs/by-name/zi/zip/package.nix @@ -10,13 +10,15 @@ assert enableNLS -> libnatspec != null; -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "zip"; version = "3.0"; src = fetchurl { urls = [ - "ftp://ftp.info-zip.org/pub/infozip/src/zip${lib.replaceStrings [ "." ] [ "" ] version}.tgz" + "ftp://ftp.info-zip.org/pub/infozip/src/zip${ + lib.replaceStrings [ "." ] [ "" ] finalAttrs.version + }.tgz" "https://src.fedoraproject.org/repo/pkgs/zip/zip30.tar.gz/7b74551e63f8ee6aab6fbc86676c0d37/zip30.tar.gz" ]; sha256 = "0sb3h3067pzf3a7mlxn1hikpcjrsvycjcnj9hl9b1c3ykcgvps7h"; @@ -88,4 +90,4 @@ stdenv.mkDerivation rec { maintainers = with lib.maintainers; [ RossComputerGuy ]; mainProgram = "zip"; }; -} +}) From 0642347f9dbbafcfc3d1d960d1a8cf88fcb35aac Mon Sep 17 00:00:00 2001 From: Julian Stecklina Date: Mon, 17 Aug 2026 14:39:01 +0200 Subject: [PATCH 292/318] zip: fetch build fix from debian --- .../zi/zip/12-fix-build-with-gcc-14.patch | 56 ------------------- pkgs/by-name/zi/zip/package.nix | 10 +++- 2 files changed, 7 insertions(+), 59 deletions(-) delete mode 100644 pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch diff --git a/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch b/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch deleted file mode 100644 index 58d070a3c2b9..000000000000 --- a/pkgs/by-name/zi/zip/12-fix-build-with-gcc-14.patch +++ /dev/null @@ -1,56 +0,0 @@ -From: Santiago Vila -Subject: Fix build with gcc-14 -Bug-Debian: https://bugs.debian.org/1075706 -X-Debian-version: 3.0-14 - ---- a/unix/configure -+++ b/unix/configure -@@ -514,14 +514,16 @@ - echo Check for $func - echo "int main(){ $func(); return 0; }" > conftest.c - $CC $BFLAG -o conftest conftest.c >/dev/null 2>/dev/null -- [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_`echo $func | tr '[a-z]' '[A-Z]'`" -+# glibc-based systems do not need this -+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_`echo $func | tr '[a-z]' '[A-Z]'`" - done - - - echo Check for memset - echo "int main(){ char k; memset(&k,0,0); return 0; }" > conftest.c - $CC -o conftest conftest.c >/dev/null 2>/dev/null --[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM" -+# glibc-based systems do not need this -+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DZMEM" - - - echo Check for memmove -@@ -551,7 +553,8 @@ - } - _EOF_ - $CC $CFLAGS -c conftest.c >/dev/null 2>/dev/null --[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_ERRNO" -+# glibc-based systems do not need this -+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_ERRNO" - - - echo Check for directory libraries -@@ -567,7 +570,8 @@ - $CC -o conftest conftest.c -l$lib >/dev/null 2>/dev/null - [ $? -eq 0 ] && OPT=-l$lib && break - done -- if [ ${OPT} ]; then -+ # glibc-based systems do not need this -+ if true; then - LFLAGS2="${LFLAGS2} ${OPT}" - else - CFLAGS="${CFLAGS} -DNO_DIR" -@@ -629,7 +633,8 @@ - } - _EOF_ - $CC ${CFLAGS} -c conftest.c > /dev/null 2>/dev/null --[ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_VALLOC" -+# glibc-based systems do not need this -+# [ $? -ne 0 ] && CFLAGS="${CFLAGS} -DNO_VALLOC" - - - echo Check for /usr/local/bin and /usr/local/man diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix index 07d985fcc19c..5a103ecef2ed 100644 --- a/pkgs/by-name/zi/zip/package.nix +++ b/pkgs/by-name/zi/zip/package.nix @@ -6,6 +6,7 @@ libnatspec ? null, libiconv, fetchpatch, + fetchDebianPatch, }: assert enableNLS -> libnatspec != null; @@ -46,9 +47,12 @@ stdenv.mkDerivation (finalAttrs: { # zip I/O error: No such file or directory # zip error: Could not create output file (was replacing the original zip file) # make[2]: *** [CreateJars.gmk:659: /build/source/build/linux-x86_64-normal-server-release/images/src.zip] Error 1 - # - # Source: Debian - ./12-fix-build-with-gcc-14.patch + (fetchDebianPatch { + inherit (finalAttrs) pname version; + debianRevision = "16"; + patch = "fix-build-with-gcc-14.patch"; + hash = "sha256-C966AdPV5E44cJ1L28iFvmXq3frjNiW6PoHiOOusS04="; + }) (fetchpatch { url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/zip/files/zip-3.0-pic.patch?id=d37d095fc7a2a9e4a8e904a7bf0f597fe99df85a"; hash = "sha256-OXgC9KqiOpH/o/bSabt3LqtoT/xifqfkvpLLPfPz+1c="; From d06149fb16148dd0945a04045ee545cd7dc37f42 Mon Sep 17 00:00:00 2001 From: Julian Stecklina Date: Mon, 17 Aug 2026 13:47:15 +0200 Subject: [PATCH 293/318] zip: fix buffer overflow Fixes: CVE-2018-13410 --- pkgs/by-name/zi/zip/package.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix index 5a103ecef2ed..22b7bab6170a 100644 --- a/pkgs/by-name/zi/zip/package.nix +++ b/pkgs/by-name/zi/zip/package.nix @@ -80,6 +80,14 @@ stdenv.mkDerivation (finalAttrs: { url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-arch/zip/files/zip-3.0-zipnote-freeze.patch?id=d37d095fc7a2a9e4a8e904a7bf0f597fe99df85a"; hash = "sha256-EVr7YS3IytnCRjAYUlkg05GA/kaAY9NRFG7uDt0QLAY="; }) + # Fix buffer overflow (CVE-2018-13410). + # See: https://seclists.org/fulldisclosure/2018/Jul/24 + (fetchDebianPatch { + inherit (finalAttrs) pname version; + debianRevision = "16"; + patch = "buffer-overflow-cve-2018-13410.patch"; + hash = "sha256-Hgy0yrBuSX2XWN1PNASQbjiXfyzSScwHQ+o0fv6Sgs4="; + }) ] ++ lib.optionals (enableNLS && !stdenv.hostPlatform.isCygwin) [ ./natspec-gentoo.patch.bz2 ]; From dd9b9f6c0b6d8f4b0a9de973958689169dd57c70 Mon Sep 17 00:00:00 2001 From: Julian Stecklina Date: Mon, 17 Aug 2026 13:47:40 +0200 Subject: [PATCH 294/318] zip: fix command injection There is no CVE assigned yet. See: https://security-tracker.debian.org/tracker/TEMP-1143866-6DBA82 --- pkgs/by-name/zi/zip/package.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/pkgs/by-name/zi/zip/package.nix b/pkgs/by-name/zi/zip/package.nix index 22b7bab6170a..e67be89c2a9b 100644 --- a/pkgs/by-name/zi/zip/package.nix +++ b/pkgs/by-name/zi/zip/package.nix @@ -88,6 +88,14 @@ stdenv.mkDerivation (finalAttrs: { patch = "buffer-overflow-cve-2018-13410.patch"; hash = "sha256-Hgy0yrBuSX2XWN1PNASQbjiXfyzSScwHQ+o0fv6Sgs4="; }) + # Command injection in zip -T for specially crafted file + # names. See: https://seclists.org/oss-sec/2026/q3/494 + (fetchDebianPatch { + inherit (finalAttrs) pname version; + debianRevision = "16"; + patch = "fix-command-injection.patch"; + hash = "sha256-cfE98l98KkPfDS5KT/DB2bqFNPTbHBKyJ7W2+iKgaGI="; + }) ] ++ lib.optionals (enableNLS && !stdenv.hostPlatform.isCygwin) [ ./natspec-gentoo.patch.bz2 ]; From 44da7d4f09c3dc5480e0b065ef92b850b47daf11 Mon Sep 17 00:00:00 2001 From: abstracts33d Date: Mon, 17 Aug 2026 16:33:50 +0200 Subject: [PATCH 295/318] qt6.qtdeclarative: backport QTBUG-147153 InternalClass crash fix QV4's InternalClass::changeMember returns a stale property index when cleanInternalClass rebuilds the transition hierarchy, which happens after 255 redundant transitions from add/delete/re-add property churn on a JS object. The rebuilt object may hold all surviving members inline with no out-of-line memberData, so a store through the stale index dereferences null. Long-running QML applications crash with SIGSEGV in QV4::Object::insertMember; reported against quickshell based desktop shells (noctalia-dev/noctalia#3992) with a deterministic reproducer. Upstream fix qt/qtdeclarative@624e90bb5e (Pick-to: 6.12 6.11 6.8) is not in any released Qt yet (absent from 6.11.1). Patch applies to 6.11.1 with offsets only. --- .../libraries/qt-6/modules/qtdeclarative/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix index cfcdb5f6c59a..113d717a5f6e 100644 --- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix +++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix @@ -57,6 +57,15 @@ qtModule { url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.diff"; hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA="; }) + + # backport fix for a QV4 heap corruption crash on JS objects with + # add/delete/re-add property churn (QTBUG-147153); crashes e.g. + # quickshell-based shells like noctalia-shell + # https://bugreports.qt.io/browse/QTBUG-147153 + (fetchpatch { + url = "https://github.com/qt/qtdeclarative/commit/624e90bb5e89837d4b759b43e2120b059d98a41e.diff"; + hash = "sha256-7duTYpHZusVNDMlkm19dCppEWBejjTbc0sy3QvJG65s="; + }) ]; cmakeFlags = [ From f3bfdc3eda6f33d41ee7869b7f0d944d98b7c6ab Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Mon, 17 Aug 2026 22:37:34 +0100 Subject: [PATCH 296/318] chromaprint: 1.6.0 -> 1.6.1 Changes: https://github.com/acoustid/chromaprint/releases/tag/v1.6.1 --- pkgs/by-name/ch/chromaprint/package.nix | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/pkgs/by-name/ch/chromaprint/package.nix b/pkgs/by-name/ch/chromaprint/package.nix index 1f4a27adb643..f08c1c0e914e 100644 --- a/pkgs/by-name/ch/chromaprint/package.nix +++ b/pkgs/by-name/ch/chromaprint/package.nix @@ -2,7 +2,6 @@ lib, stdenv, fetchFromGitHub, - fetchpatch, fetchurl, cmake, ninja, @@ -17,23 +16,15 @@ stdenv.mkDerivation (finalAttrs: { pname = "chromaprint"; - version = "1.6.0"; + version = "1.6.1"; src = fetchFromGitHub { owner = "acoustid"; repo = "chromaprint"; tag = "v${finalAttrs.version}"; - hash = "sha256-G3HIMgbjaAXsC+8nt7mkj58xA62qwA8FC+PfTGblhNg="; + hash = "sha256-Es903zeZ++9/Xb/npUU3rB0V87DVqwT9uTMbQdSzfJI="; }; - patches = [ - # fix generated pkg-config files - (fetchpatch { - url = "https://github.com/acoustid/chromaprint/commit/782ef6bb5f6498e35f8e275f76998fbd5ffa36d6.patch"; - hash = "sha256-drUfAMzTrqqB5UbzOnfPq6XD3HI+3sxyJJSTCa0BmD8="; - }) - ]; - nativeBuildInputs = [ cmake ninja From 849bc6de5f1ab19566e3d2058416e39b63fadeaa Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 18 Aug 2026 00:26:53 +0000 Subject: [PATCH 297/318] procps: 4.0.6 -> 4.0.7 --- pkgs/os-specific/linux/procps-ng/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix index ff53296d9aba..78374bdbbfb1 100644 --- a/pkgs/os-specific/linux/procps-ng/default.nix +++ b/pkgs/os-specific/linux/procps-ng/default.nix @@ -23,12 +23,12 @@ stdenv.mkDerivation (finalAttrs: { pname = "procps"; - version = "4.0.6"; + version = "4.0.7"; # The project's releases are on SF, but git repo on gitlab. src = fetchurl { url = "mirror://sourceforge/procps-ng/procps-ng-${finalAttrs.version}.tar.xz"; - hash = "sha256-Z76m+8OkKlNaAjDJ6JHl3ftNnTlCLUZWWimQ0azhUhY="; + hash = "sha256-nSAh9HpFAcZnhiyZQqktGVNpSyHRG80XAug+tZTj1n0="; }; outputs = [ From 079bcf2560f70325dfcf937984fd4ac85f3f7e80 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:51:10 +0000 Subject: [PATCH 298/318] perlPackages.CryptDSA: 1.21 -> 1.24 Fixes CVE-2026-14570. 1.24 uses Crypt::SysRandom and no longer requires Crypt::URandom. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 7b34c7e62275..a1000f164ae3 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -7124,16 +7124,15 @@ with self; CryptDSA = buildPerlPackage { pname = "Crypt-DSA"; - version = "1.21"; + version = "1.24"; src = fetchurl { - url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.21.tar.gz"; - hash = "sha256-pGIB6DkOi6O75RER12SJ8x2v2g9qYLCrkxndUr0rMrA="; + url = "mirror://cpan/authors/id/T/TI/TIMLEGGE/Crypt-DSA-1.24.tar.gz"; + hash = "sha256-ChY4tvK07+ktbuL0kBzKAtenBWf2uw9Iapu19pvnZ2Y="; }; propagatedBuildInputs = [ ConvertASN1 ConvertPEM CryptSysRandom - CryptURandom DataBuffer FileWhich ]; From b3b347504e08b7e453dcf4fe8c58e7fa36a3aeef Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:52:53 +0000 Subject: [PATCH 299/318] perlPackages.DevelDeprecate: init at 0.01 New runtime dependency of Data::Entropy 0.010. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index a1000f164ae3..b5881c17e302 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -9675,6 +9675,24 @@ with self; }; }; + DevelDeprecate = buildPerlPackage { + pname = "Devel-Deprecate"; + version = "0.01"; + src = fetchurl { + url = "mirror://cpan/authors/id/O/OV/OVID/Devel-Deprecate-0.01.tar.gz"; + hash = "sha256-xQLEGoL+JU6XFRJ3ytOk8KQHrTydP2I9J3sDA6PhoS8="; + }; + buildInputs = [ SubOverride ]; + propagatedBuildInputs = [ DateTime ]; + meta = { + description = "Create deprecation schedules in your code"; + license = with lib.licenses; [ + artistic1 + gpl1Plus + ]; + }; + }; + DevelDeprecationsEnvironmental = buildPerlPackage { pname = "Devel-Deprecations-Environmental"; version = "1.101"; From 26c50f57329a0da8224b771b36d1aa9f5ee1c015 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:54:58 +0000 Subject: [PATCH 300/318] perlPackages.DataEntropy: 0.008 -> 0.010 Fixes CVE-2026-18536. 0.010 removes the Random.org sources, which were the only consumers of HTTP::Lite, and requires Devel::Deprecate. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index b5881c17e302..25fbcf8b8f4e 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -8228,16 +8228,16 @@ with self; DataEntropy = buildPerlPackage { pname = "Data-Entropy"; - version = "0.008"; + version = "0.010"; src = fetchurl { - url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.008.tar.gz"; - hash = "sha256-GKUrE4boLGuM2zhKOYYdYCIKRCp5DgdwEL5y3YU7Z7M="; + url = "mirror://cpan/authors/id/R/RR/RRWO/Data-Entropy-0.010.tar.gz"; + hash = "sha256-0M8s2wKCAuidw2K42Qtw00WFApOwGQDZoYgqDG8g+Dc="; }; propagatedBuildInputs = [ CryptRijndael CryptURandom DataFloat - HTTPLite + DevelDeprecate ParamsClassify ]; meta = { From b2a490b6534095408f0449fcc565f626df639935 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:55:50 +0000 Subject: [PATCH 301/318] perlPackages.MojoJWT: 0.09 -> 1.02 Fixes CVE-2026-9537. 1.02 requires CryptX at runtime. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 25fbcf8b8f4e..eb7a8f52d1ab 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -23227,13 +23227,16 @@ with self; MojoJWT = buildPerlModule { pname = "Mojo-JWT"; - version = "0.09"; + version = "1.02"; src = fetchurl { - url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-0.09.tar.gz"; - hash = "sha256-wE4DmD4MbyvORdCOoucph5yWee+mNLDmjLa4t7SoWIY="; + url = "mirror://cpan/authors/id/J/JB/JBERGER/Mojo-JWT-1.02.tar.gz"; + hash = "sha256-yBHXkoWMJBFQNyDxJDbjNDZ0k2dUO/vCqV1PgDzmCHQ="; }; buildInputs = [ ModuleBuildTiny ]; - propagatedBuildInputs = [ Mojolicious ]; + propagatedBuildInputs = [ + CryptX + Mojolicious + ]; meta = { description = "JSON Web Token the Mojo way"; homepage = "https://github.com/jberger/Mojo-JWT"; From 2f2c8475756fe4a204a20a2d400a68a7d911bfb0 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:56:26 +0000 Subject: [PATCH 302/318] perlPackages.ack: 3.9.0 -> 3.10.0 Fixes CVE-2026-49146. CVE-2026-49145 and CVE-2026-49147 remain unfixed in 3.10.0. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index eb7a8f52d1ab..7cb3f4f85857 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -116,11 +116,11 @@ with self; ack = buildPerlPackage rec { pname = "ack"; - version = "3.9.0"; + version = "3.10.0"; src = fetchurl { url = "mirror://cpan/authors/id/P/PE/PETDANCE/ack-v${version}.tar.gz"; - hash = "sha256-lO1Hfjs/lNEmzscynw6DmfHQzoLHxNiCqUrbFQ5//JA="; + hash = "sha256-Zeg8+zinH8pyXpoUqCAe6HHmKfxrECMeEwPdNQG6Vjo="; }; outputs = [ From 4114dbc5bcf69cae580a228ff22498a26b9fbe5d Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:57:55 +0000 Subject: [PATCH 303/318] perlPackages.Imager: 1.031 -> 1.034 Fixes CVE-2026-13705, CVE-2026-14454 and CVE-2026-19082. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 7cb3f4f85857..1029c4602890 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -17355,10 +17355,10 @@ with self; Imager = buildPerlPackage rec { pname = "Imager"; - version = "1.031"; + version = "1.034"; src = fetchurl { url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz"; - hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE="; + hash = "sha256-hrWizXGna4QJJJFSGl1WI4Qo8sN1AYMsmVxaMxJg+AM="; }; buildInputs = [ pkgs.freetype From 0d1907cd9fc18179000472f036fff8b23b7ffa42 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 15:59:57 +0000 Subject: [PATCH 304/318] perlPackages.HTTPDate: 6.06 -> 6.08 Fixes CVE-2026-14741. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 1029c4602890..6bec15eac311 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -16925,10 +16925,10 @@ with self; HTTPDate = buildPerlPackage { pname = "HTTP-Date"; - version = "6.06"; + version = "6.08"; src = fetchurl { - url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.06.tar.gz"; - hash = "sha256-e2hRkcasw+dz0fwCyV7h+frpT3d4MXX154wYHMktK1I="; + url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Date-6.08.tar.gz"; + hash = "sha256-tX2Aym2CHGlJykiydGfUWrp6nHc0ZWIwb6zKeBoAPkQ="; }; propagatedBuildInputs = [ TimeDate ]; meta = { From dda5a5d9a982a1b411fdbdf96afdf364140f49db Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 16:38:53 +0000 Subject: [PATCH 305/318] perlPackages.Mojolicious: 9.46 -> 9.48 Fixes CVE-2026-14803 in Mojo::JSON and CVE-2026-15747. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 6bec15eac311..013ba5d8d347 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -22865,10 +22865,10 @@ with self; Mojolicious = buildPerlPackage { pname = "Mojolicious"; - version = "9.46"; + version = "9.48"; src = fetchurl { - url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.46.tar.gz"; - hash = "sha256-/kc9LK5tLe/pUBgCggc2VoJa0F20TwvIxIQhXi1xaqw="; + url = "mirror://cpan/authors/id/S/SR/SRI/Mojolicious-9.48.tar.gz"; + hash = "sha256-Jv8EFSgR/VsaNrR9mewhnFiZW6jnsVugKzPQdwpe7pg="; }; meta = { description = "Real-time web framework"; From d56e5a7696268bcaa4678acf321a758f9baa3221 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 16:51:31 +0000 Subject: [PATCH 306/318] perlPackages.DBI: 1.648 -> 1.651 Fixes CVE-2026-14380, CVE-2026-14739 and CVE-2026-14740 (1.650), and CVE-2026-15043, CVE-2026-15392, CVE-2026-60081 and CVE-2026-60082 (1.651). Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 013ba5d8d347..3cc00861f57d 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -10133,11 +10133,11 @@ with self; DBI = buildPerlPackage { pname = "DBI"; - version = "1.648"; + version = "1.651"; src = fetchurl { - url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.648.tgz"; - hash = "sha256-7yZqrWAQzi6rt+Rl69c8owILxYFQ9pib2Jwrj5usaoY="; + url = "mirror://cpan/authors/id/H/HM/HMBRAND/DBI-1.651.tgz"; + hash = "sha256-2mIaI/po4eBPrIJM/T1B6P+6sqs+umQqEkmSQui+UlM="; }; env = lib.optionalAttrs stdenv.cc.isGNU { From eb5ca223180217b72d0b28da37f8f41e241ff9bc Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sat, 8 Aug 2026 16:56:10 +0000 Subject: [PATCH 307/318] perlPackages.JSONXS: 4.03 -> 4.04 4.04 contains the upstream fix for CVE-2025-40928. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- .../perl-modules/JSON-XS-CVE-2025-40928.patch | 31 ------------------- pkgs/top-level/perl-packages.nix | 7 ++--- 2 files changed, 3 insertions(+), 35 deletions(-) delete mode 100644 pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch diff --git a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch b/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch deleted file mode 100644 index f1d258c12a3d..000000000000 --- a/pkgs/development/perl-modules/JSON-XS-CVE-2025-40928.patch +++ /dev/null @@ -1,31 +0,0 @@ ---- a/XS.xs 2025-09-06 08:34:51.376455632 -0300 -+++ b/XS.xs 2025-09-06 08:35:30.725873619 -0300 -@@ -253,16 +253,16 @@ - // if we recurse too deep, skip all remaining digits - // to avoid a stack overflow attack - if (expect_false (--maxdepth <= 0)) -- while (((U8)*s - '0') < 10) -+ while ((U8)(*s - '0') < 10) - ++s; - - for (;;) - { -- U8 dig = (U8)*s - '0'; -+ U8 dig = *s - '0'; - - if (expect_false (dig >= 10)) - { -- if (dig == (U8)((U8)'.' - (U8)'0')) -+ if (dig == (U8)('.' - '0')) - { - ++s; - json_atof_scan1 (s, accum, expo, 1, maxdepth); -@@ -282,7 +282,7 @@ - else if (*s == '+') - ++s; - -- while ((dig = (U8)*s - '0') < 10) -+ while ((dig = (U8)(*s - '0')) < 10) - exp2 = exp2 * 10 + *s++ - '0'; - - *expo += neg ? -exp2 : exp2; diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 3cc00861f57d..35fbeedb3f26 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -18646,12 +18646,11 @@ with self; JSONXS = buildPerlPackage { pname = "JSON-XS"; - version = "4.03"; + version = "4.04"; src = fetchurl { - url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.03.tar.gz"; - hash = "sha256-UVU29F8voafojIgkUzdY0BIdJnq5y0U6G1iHyKVrkGg="; + url = "mirror://cpan/authors/id/M/ML/MLEHMANN/JSON-XS-4.04.tar.gz"; + hash = "sha256-jv8enzBMViW1mre0IlhBX20+NoHB3atrclUYoBin9eA="; }; - patches = [ ../development/perl-modules/JSON-XS-CVE-2025-40928.patch ]; propagatedBuildInputs = [ TypesSerialiser ]; buildInputs = [ CanaryStability ]; meta = { From 61d5a4891aaa93359e2d1105282f84d7f960d10d Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sun, 9 Aug 2026 00:51:03 +0000 Subject: [PATCH 308/318] perlPackages.FileFindRule: 0.34 -> 0.35 0.35 contains the upstream fix for CVE-2011-10007. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- .../FileFindRule-CVE-2011-10007.patch | 25 ------------------- pkgs/top-level/perl-packages.nix | 9 +++---- 2 files changed, 3 insertions(+), 31 deletions(-) delete mode 100644 pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch diff --git a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch b/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch deleted file mode 100644 index dd8492c60f21..000000000000 --- a/pkgs/development/perl-modules/FileFindRule-CVE-2011-10007.patch +++ /dev/null @@ -1,25 +0,0 @@ -From ca70a73bb147549e62e74751d924b1dbb59d1707 Mon Sep 17 00:00:00 2001 -From: Stig Palmquist -Date: Thu, 5 Jun 2025 03:45:50 +0200 -Subject: [PATCH] Fix CVE-2011-10007 - ---- - lib/File/Find/Rule.pm | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/File/Find/Rule.pm b/lib/File/Find/Rule.pm -index feccc76..d4dc475 100644 ---- a/lib/File/Find/Rule.pm -+++ b/lib/File/Find/Rule.pm -@@ -420,7 +420,7 @@ sub grep { - - $self->exec( sub { - local *FILE; -- open FILE, $_ or return; -+ open FILE, '<', $_ or return; - local ($_, $.); - while () { - for my $p (@pattern) { --- -2.49.0 - diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 35fbeedb3f26..f28e415e9f74 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -13634,14 +13634,11 @@ with self; FileFindRule = buildPerlPackage { pname = "File-Find-Rule"; - version = "0.34"; + version = "0.35"; src = fetchurl { - url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.34.tar.gz"; - hash = "sha256-fm8WzDPrHyn/Jb7lHVE/S4qElHu/oY7bLTzECi1kyv4="; + url = "mirror://cpan/authors/id/R/RC/RCLAMP/File-Find-Rule-0.35.tar.gz"; + hash = "sha256-K9VWKJptRK0u50gDJYuwsAUNJG8egcqrCyY8MDrPDII="; }; - patches = [ - ../development/perl-modules/FileFindRule-CVE-2011-10007.patch - ]; propagatedBuildInputs = [ NumberCompare TextGlob From d3a1694c8f48ccce9932b5b10a4c914ff82ec4e5 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sun, 9 Aug 2026 00:56:50 +0000 Subject: [PATCH 309/318] perlPackages.CatalystAuthenticationCredentialHTTP: 1.018 -> 1.019 1.019 contains the upstream fix for CVE-2025-40920, which uses Crypt::SysRandom instead of Data::UUID. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index f28e415e9f74..a7b34c72bba8 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -3352,18 +3352,11 @@ with self; CatalystAuthenticationCredentialHTTP = buildPerlModule { pname = "Catalyst-Authentication-Credential-HTTP"; - version = "1.018"; + version = "1.019"; src = fetchurl { - url = "mirror://cpan/authors/id/E/ET/ETHER/Catalyst-Authentication-Credential-HTTP-1.018.tar.gz"; - hash = "sha256-b6GBbe5kSw216gzBXF5xHcLO0gg2JavOcJZSHx1lpSk="; + url = "mirror://cpan/authors/id/A/AB/ABRAXXA/Catalyst-Authentication-Credential-HTTP-1.019.tar.gz"; + hash = "sha256-7IHpbCo/ZYbqQdCI6o6AGx80ABqxnMmmXe+KOMOaW9o="; }; - patches = [ - (fetchpatch { - name = "CVE-2025-40920.patch"; - url = "https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP/commit/ad2c03aad95406db4ce35dfb670664ebde004c18.patch"; - hash = "sha256-WI6JwvY6i3KkQO9HbbSvHPX8mgM8I2cF0UTjF1D14T4="; - }) - ]; buildInputs = [ ModuleBuildTiny TestException @@ -3374,7 +3367,6 @@ with self; CatalystPluginAuthentication ClassAccessor CryptSysRandom - DataUUID StringEscape ]; meta = { From 7b1e682245c0c05aae0541b1697b472c7f74d578 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sun, 9 Aug 2026 02:51:18 +0000 Subject: [PATCH 310/318] perl: 5.42.0 -> 5.42.3 5.42.3 ships the interpreter fixes and the updated dual-life modules, so the CVE-2026-8376 patch and every vendoredPerlDistributions entry are dropped. perl-cross 1.6.4 has no patch set for 5.42.3, so the perl5-5.42.0 set, which applies unchanged, is vendored under the name perl-cross expects. - perl: CVE-2026-13221, CVE-2026-57432, CVE-2026-8376 https://metacpan.org/release/SHAY/perl-5.42.3/view/pod/perldelta.pod - HTTP-Tiny 0.096: CVE-2026-7010, CVE-2026-7017 https://metacpan.org/release/HAARG/HTTP-Tiny-0.096/changes - Socket 2.041: CVE-2026-12087 https://metacpan.org/release/PEVANS/Socket-2.041/changes - Storable 3.37_01: CVE-2026-57433 - Archive-Tar 3.12, Compress-Raw-Bzip2 2.218, Compress-Raw-Zlib 2.222, IO-Compress 2.223 Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- .../interpreters/perl/CVE-2026-8376.patch | 20 ----- .../development/interpreters/perl/default.nix | 4 +- .../interpreters/perl/interpreter.nix | 47 +--------- .../perl/perl-cross-1.6.4--5.42.3.patch | 86 +++++++++++++++++++ 4 files changed, 91 insertions(+), 66 deletions(-) delete mode 100644 pkgs/development/interpreters/perl/CVE-2026-8376.patch create mode 100644 pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch diff --git a/pkgs/development/interpreters/perl/CVE-2026-8376.patch b/pkgs/development/interpreters/perl/CVE-2026-8376.patch deleted file mode 100644 index c8ad72298178..000000000000 --- a/pkgs/development/interpreters/perl/CVE-2026-8376.patch +++ /dev/null @@ -1,20 +0,0 @@ -Targeted patch for CVE-2026-8376, based on 5e7f119eb2bb1181be908701f22bf7068e722f1c but avoids changes to t/re/pat_psycho.t as they do not apply cleanly. - -diff --git a/regcomp_study.c b/regcomp_study.c -index b513454a4258..1602663f4b26 100644 ---- a/regcomp_study.c -+++ b/regcomp_study.c -@@ -2784,6 +2784,13 @@ Perl_study_chunk(pTHX_ - (U8 *) SvEND(data->last_found)) - - (U8*)s; - l -= old; -+ -+ if (l > 0 && -+ (mincount >= SSize_t_MAX / (SSize_t)l -+ || old > SSize_t_MAX - mincount * (SSize_t)l)) { -+ FAIL("Regexp out of space"); -+ } -+ - /* Get the added string: */ - last_str = newSVpvn_utf8(s + old, l, UTF); - last_chrs = UTF ? utf8_length((U8*)(s + old), diff --git a/pkgs/development/interpreters/perl/default.nix b/pkgs/development/interpreters/perl/default.nix index cab0ea1a2268..6cc6f5755ac4 100644 --- a/pkgs/development/interpreters/perl/default.nix +++ b/pkgs/development/interpreters/perl/default.nix @@ -73,8 +73,8 @@ in rec { perl5 = callPackage ./interpreter.nix { self = perl5; - version = "5.42.0"; - sha256 = "sha256-4JPvGE1/mhuXl+JGUpb1VRCtttq4hCsMPtUzKWYwltw="; + version = "5.42.3"; + sha256 = "sha256-ETd0CYWDe1zfFfDPq5Miedy0NS+RL+1vwUTotPCCNic="; inherit passthruFun; }; } diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix index cdb03912b517..4b308c156f02 100644 --- a/pkgs/development/interpreters/perl/interpreter.nix +++ b/pkgs/development/interpreters/perl/interpreter.nix @@ -36,8 +36,6 @@ let commonPatches = [ # Do not look in /usr etc. for dependencies. ./no-sys-dirs.patch - - ./CVE-2026-8376.patch ] # Fix build on Solaris on x86_64 @@ -83,48 +81,7 @@ let # Inject fixed CPAN releases for bundled dual-life distributions until the # next perl maintenance release includes them. - vendoredPerlDistributions = [ - { - # CVE-2026-7010 - path = "cpan/HTTP-Tiny"; - src = fetchurl { - url = "mirror://cpan/authors/id/H/HA/HAARG/HTTP-Tiny-0.094.tar.gz"; - hash = "sha256-poQemfwbVdFd6VlHzL17dnvsxRxxAhl/qPBE333cB0M="; - }; - } - { - # CVE-2026-3381, CVE-2026-4176 - path = "cpan/Compress-Raw-Zlib"; - src = fetchurl { - url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.222.tar.gz"; - hash = "sha256-Hf19URplVifIGBXTDTurwo+luIRV/wP4sECZ3LUShrg="; - }; - } - { - # Runtime dependency of IO-Compress 2.220. - path = "cpan/Compress-Raw-Bzip2"; - src = fetchurl { - url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.218.tar.gz"; - hash = "sha256-iRU+ai69pSNJSTsHT6S3VJ/x+QU952E8GKXgXFtBX6g="; - }; - } - { - # CVE-2026-48962, CVE-2026-48961, CVE-2026-48959 - path = "cpan/IO-Compress"; - src = fetchurl { - url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz"; - hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic="; - }; - } - { - # CVE-2026-42496, CVE-2026-42497, CVE-2026-9538 - path = "cpan/Archive-Tar"; - src = fetchurl { - url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz"; - hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw="; - }; - } - ]; + vendoredPerlDistributions = [ ]; replaceVendoredPerlDistributions = lib.concatMapStringsSep "\n" (d: '' rm -rf ${d.path} @@ -440,6 +397,8 @@ stdenv.mkDerivation ( # fixes build failure due to missing d_fdopendir/HAS_FDOPENDIR configure option # https://github.com/arsv/perl-cross/pull/159 ./cross-fdopendir.patch + + ./perl-cross-1.6.4--5.42.3.patch ]; depsBuildBuild = [ diff --git a/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch new file mode 100644 index 000000000000..853fb8a667a2 --- /dev/null +++ b/pkgs/development/interpreters/perl/perl-cross-1.6.4--5.42.3.patch @@ -0,0 +1,86 @@ +perl-cross 1.6.4 ships no patch set for perl 5.42.3. The perl5-5.42.0 set +applies unchanged, so link it under the name perl-cross looks for. The +links are per-file because `find cnf/diffs/perl5-$version`, which +perl-cross uses to collect them, does not descend into a symlinked +directory. + +diff --git a/cnf/diffs/perl5-5.42.3/constant.patch b/cnf/diffs/perl5-5.42.3/constant.patch +new file mode 120000 +index 0000000..61f792a +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/constant.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/constant.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/dynaloader.patch b/cnf/diffs/perl5-5.42.3/dynaloader.patch +new file mode 120000 +index 0000000..543415e +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/dynaloader.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/dynaloader.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/findext.patch b/cnf/diffs/perl5-5.42.3/findext.patch +new file mode 120000 +index 0000000..94ed668 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/findext.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/findext.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/installscripts.patch b/cnf/diffs/perl5-5.42.3/installscripts.patch +new file mode 120000 +index 0000000..6f715b4 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/installscripts.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/installscripts.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/liblist.patch b/cnf/diffs/perl5-5.42.3/liblist.patch +new file mode 120000 +index 0000000..5037380 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/liblist.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/liblist.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/makemaker.patch b/cnf/diffs/perl5-5.42.3/makemaker.patch +new file mode 120000 +index 0000000..cf9fc6c +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/makemaker.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/makemaker.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/posix-makefile.patch b/cnf/diffs/perl5-5.42.3/posix-makefile.patch +new file mode 120000 +index 0000000..072ba89 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/posix-makefile.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/posix-makefile.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/test-checkcase.patch b/cnf/diffs/perl5-5.42.3/test-checkcase.patch +new file mode 120000 +index 0000000..6ecc9bc +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/test-checkcase.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/test-checkcase.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/test-makemaker.patch b/cnf/diffs/perl5-5.42.3/test-makemaker.patch +new file mode 120000 +index 0000000..fc6bcda +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/test-makemaker.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/test-makemaker.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/xconfig.patch b/cnf/diffs/perl5-5.42.3/xconfig.patch +new file mode 120000 +index 0000000..87ac501 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/xconfig.patch +@@ -0,0 +1 @@ ++../perl5-5.42.0/xconfig.patch +\ No newline at end of file From d4db41d8bfa5e92019bdf43e5a932f600224afef Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sun, 9 Aug 2026 05:58:49 +0000 Subject: [PATCH 311/318] perlPackages.Yancy: skip tests broken by Mojolicious 9.48 Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these tests drive forms without a token and fail with 400 "CSRF token failure". Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- pkgs/top-level/perl-packages.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index a7b34c72bba8..918a76d21803 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -39604,6 +39604,11 @@ with self; MojoliciousPluginOpenAPI RoleTiny ]; + # Mojolicious 9.48 enforces CSRF token validation (CVE-2026-15747); these + # tests drive forms without a token and fail with 400 "CSRF token failure". + preCheck = '' + rm t/plugin/auth/github.t t/plugin/form/bootstrap4.t + ''; meta = { homepage = "http://preaction.me/yancy/"; description = "Best Web Framework Deserves the Best CMS"; From 709e8699ab3e17bfdaf02e11cf0e8e2996491360 Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Sun, 9 Aug 2026 18:59:53 +0000 Subject: [PATCH 312/318] perl: fix CVE-2026-15534 Apply upstream commits 568e6fd238867bb9e99fa3f47cba3169009239e0 and 54cf3d44cbbedd17d774e9a37921963e8fd5d0cb. Assisted-by: Claude Code (Claude Opus 5) Signed-off-by: Stig Palmquist --- .../interpreters/perl/CVE-2026-15534-1.patch | 39 ++++++++++++ .../interpreters/perl/CVE-2026-15534-2.patch | 59 +++++++++++++++++++ .../interpreters/perl/interpreter.nix | 3 + 3 files changed, 101 insertions(+) create mode 100644 pkgs/development/interpreters/perl/CVE-2026-15534-1.patch create mode 100644 pkgs/development/interpreters/perl/CVE-2026-15534-2.patch diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch new file mode 100644 index 000000000000..fc8ee2f29ea9 --- /dev/null +++ b/pkgs/development/interpreters/perl/CVE-2026-15534-1.patch @@ -0,0 +1,39 @@ +CVE-2026-15534, upstream commit +568e6fd238867bb9e99fa3f47cba3169009239e0. + +diff --git a/regexec.c b/regexec.c +index 35a727459c4a..29aa73c13cb9 100644 +--- a/regexec.c ++++ b/regexec.c +@@ -9211,7 +9211,8 @@ NULL + reginfo->poscache_iter = reginfo->poscache_maxiter; + } + +- if (reginfo->poscache_iter-- == 0) { ++ if (reginfo->poscache_iter == 1) { ++ reginfo->poscache_iter--; + /* initialise cache */ + const SSize_t size = (reginfo->poscache_maxiter + 7)/8; + regmatch_info_aux *const aux = reginfo->info_aux; +@@ -9232,11 +9233,10 @@ NULL + ); + } + +- if (reginfo->poscache_iter < 0) { ++ if (reginfo->poscache_iter == 0) { + /* have we already failed at this position? */ + SSize_t offset, mask; + +- reginfo->poscache_iter = -1; /* stop eventual underflow */ + offset = (FLAGS(scan) & 0xf) - 1 + + (locinput - reginfo->strbeg) + * (FLAGS(scan)>>4); +@@ -9252,6 +9252,8 @@ NULL + ST.cache_offset = offset; + ST.cache_mask = mask; + } ++ else ++ reginfo->poscache_iter--; + } + + /* Prefer B over A for minimal matching. */ diff --git a/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch new file mode 100644 index 000000000000..b5d0ff5ed3d0 --- /dev/null +++ b/pkgs/development/interpreters/perl/CVE-2026-15534-2.patch @@ -0,0 +1,59 @@ +CVE-2026-15534, upstream commit +54cf3d44cbbedd17d774e9a37921963e8fd5d0cb. + +diff --git a/regexec.c b/regexec.c +index 29aa73c13cb9..66e0c0924059 100644 +--- a/regexec.c ++++ b/regexec.c +@@ -9202,22 +9202,27 @@ NULL + if (!reginfo->poscache_maxiter) { + /* start the countdown: Postpone detection until we + * know the match is not *that* much linear. */ +- reginfo->poscache_maxiter +- = (reginfo->strend - reginfo->strbeg + 1) +- * (FLAGS(scan)>>4); +- /* possible overflow for long strings and many CURLYX's */ +- if (reginfo->poscache_maxiter < 0) +- reginfo->poscache_maxiter = I32_MAX; +- reginfo->poscache_iter = reginfo->poscache_maxiter; ++ STRLEN len = reginfo->strend - reginfo->strbeg; ++ /* number of participating WHILEMs */ ++ U8 n = (FLAGS(scan)>>4); ++ ++ /* Only do the calculations and enable the cache if it ++ * won't overflow. This test is equivalent to: ++ * ((len + 1) * n + 7) <= max(STRLEN) ++ */ ++ if (len < ((~(STRLEN)0) - 7)/n) { ++ reginfo->poscache_maxiter = (len + 1) * n; ++ reginfo->poscache_iter = reginfo->poscache_maxiter; ++ } + } + + if (reginfo->poscache_iter == 1) { + reginfo->poscache_iter--; + /* initialise cache */ +- const SSize_t size = (reginfo->poscache_maxiter + 7)/8; ++ const STRLEN size = (reginfo->poscache_maxiter + 7)/8; + regmatch_info_aux *const aux = reginfo->info_aux; + if (aux->poscache) { +- if ((SSize_t)reginfo->poscache_size < size) { ++ if (reginfo->poscache_size < size) { + Renew(aux->poscache, size, char); + reginfo->poscache_size = size; + } +diff --git a/regexp.h b/regexp.h +index 057d9ac5011b..d5d40e0a5618 100644 +--- a/regexp.h ++++ b/regexp.h +@@ -839,8 +839,8 @@ typedef struct { + char *cutpoint; /* (*COMMIT) position (if any) */ + regmatch_info_aux *info_aux; /* extra fields that need cleanup */ + regmatch_info_aux_eval *info_aux_eval; /* extra saved state for (?{}) */ +- I32 poscache_maxiter; /* how many whilems todo before S-L cache kicks in */ +- I32 poscache_iter; /* current countdown from _maxiter to zero */ ++ STRLEN poscache_maxiter; /* how many whilems todo before S-L cache kicks in */ ++ STRLEN poscache_iter; /* current countdown from _maxiter to zero */ + STRLEN poscache_size; /* size of regmatch_info_aux.poscache */ + bool intuit; /* re_intuit_start() is the top-level caller */ + bool is_utf8_pat; /* regex is utf8 */ diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix index 4b308c156f02..ae75db2ead90 100644 --- a/pkgs/development/interpreters/perl/interpreter.nix +++ b/pkgs/development/interpreters/perl/interpreter.nix @@ -36,6 +36,9 @@ let commonPatches = [ # Do not look in /usr etc. for dependencies. ./no-sys-dirs.patch + + ./CVE-2026-15534-1.patch + ./CVE-2026-15534-2.patch ] # Fix build on Solaris on x86_64 From e9b237a50342589b5977481e38c8b6390542f8a6 Mon Sep 17 00:00:00 2001 From: Sergei Volkov Date: Tue, 18 Aug 2026 13:02:26 +0200 Subject: [PATCH 313/318] python3Packages.smmap: 6.0.0 -> 5.0.3 The upstream development is continued on 5.x branch with latest release 5.0.3 in 2026 while the 6.0.0 was released in 2023. The 6.0.0 is marked as yanked on PyPi and replaced by non-breaking 5.0.1 https://pypi.org/project/smmap/#history https://pypi.org/project/smmap/6.0.0/ --- pkgs/development/python-modules/smmap/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/smmap/default.nix b/pkgs/development/python-modules/smmap/default.nix index 27ae1788145f..a9d20b2e2bbc 100644 --- a/pkgs/development/python-modules/smmap/default.nix +++ b/pkgs/development/python-modules/smmap/default.nix @@ -8,12 +8,12 @@ buildPythonPackage rec { pname = "smmap"; - version = "6.0.0"; + version = "5.0.3"; pyproject = true; src = fetchPypi { inherit pname version; - hash = "sha256-jXkCjqbMEx2l6rCZpdlamY1DxneZVv/+O0VQQJEQdto="; + hash = "sha256-TZ3ruLmQB65HFlq8CGcL10y3S1In3af2Q+zMTp61ZCw="; }; build-system = [ setuptools ]; From 3b59449299452c19a73f7260c08e689f963477ea Mon Sep 17 00:00:00 2001 From: whoomee Date: Sun, 16 Aug 2026 20:31:14 +0200 Subject: [PATCH 314/318] gst_all_1.gst-libav: refactor mesonFlags --- pkgs/development/libraries/gstreamer/libav/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix index 0d637b250465..f9cabab17180 100644 --- a/pkgs/development/libraries/gstreamer/libav/default.nix +++ b/pkgs/development/libraries/gstreamer/libav/default.nix @@ -56,9 +56,10 @@ stdenv.mkDerivation (finalAttrs: { apple-sdk_gstreamer ]; - mesonFlags = [ - (lib.mesonEnable "doc" enableDocumentation) - ]; + mesonFlags = lib.mapAttrsToList lib.mesonEnable { + doc = enableDocumentation; + tests = finalAttrs.finalPackage.doCheck; + }; postPatch = '' patchShebangs \ From c1e1f95922c21517f26ff12aa9773b3b94b5ff1e Mon Sep 17 00:00:00 2001 From: whoomee Date: Sun, 16 Aug 2026 21:38:22 +0200 Subject: [PATCH 315/318] gst_all_1.gst-libav: remove unused -dev output --- pkgs/development/libraries/gstreamer/libav/default.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix index f9cabab17180..6dc5f3abd6e4 100644 --- a/pkgs/development/libraries/gstreamer/libav/default.nix +++ b/pkgs/development/libraries/gstreamer/libav/default.nix @@ -21,11 +21,6 @@ stdenv.mkDerivation (finalAttrs: { pname = "gst-libav"; version = "1.28.6"; - outputs = [ - "out" - "dev" - ]; - src = fetchurl { url = "https://gstreamer.freedesktop.org/src/gst-libav/gst-libav-${finalAttrs.version}.tar.xz"; hash = "sha256-cebq+0//KmbRuwuo0HgiTf5+M5cwfYwLuj3CNgbgj1E="; From d065e27a7024f2c0b94977b92072f4034c414667 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 16 Aug 2026 03:33:14 +0000 Subject: [PATCH 316/318] systemd: 261.1 -> 261.2 --- pkgs/os-specific/linux/systemd/default.nix | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index 6a7b4b0b7475..d7994b8270e3 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -5,6 +5,7 @@ pkgsCross, testers, fetchFromGitHub, + fetchpatch, buildPackages, makeBinaryWrapper, ninja, @@ -203,13 +204,13 @@ let in stdenv.mkDerivation (finalAttrs: { inherit pname; - version = "261.1"; + version = "261.2"; src = fetchFromGitHub { owner = "systemd"; repo = "systemd"; tag = "v${finalAttrs.version}"; - hash = "sha256-4iOitWGdRmGgJjEXGWtq2lEhPtGguma+qrjTShrps2g="; + hash = "sha256-w0Fxx+zYBs806whyaKBytGwSgn89ARdukAm6Hp+XlQQ="; }; # PATCH POLICY @@ -239,6 +240,13 @@ stdenv.mkDerivation (finalAttrs: { ./0003-add-rootprefix-to-lookup-dir-paths.patch ./0004-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch ./0005-core-don-t-taint-on-unmerged-usr.patch + # Remove this with v262 + # Fixes an issue for switch-to-configuration + (fetchpatch { + name = "postpone-d-bus-queue-dispatch.patch"; + url = "https://github.com/systemd/systemd/commit/266b3e50218e2b27cd67d2371c165bf53ad3bf00.patch"; + hash = "sha256-dEEzZUqicnmgDuXVBV1y0BxzgKbb6Q47Dmxj+O71bFE="; + }) ] ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) [ ./0006-timesyncd-disable-NSCD-when-DNSSEC-validation-is-dis.patch From d07615172cfad0be007e8c6d42d4731e82b2190f Mon Sep 17 00:00:00 2001 From: Leon Klingele Date: Wed, 19 Aug 2026 18:54:00 +0200 Subject: [PATCH 317/318] go_1_26: 1.26.6 -> 1.26.7 --- pkgs/development/compilers/go/1.26.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix index 9f52b27211ef..ccb5b67f17af 100644 --- a/pkgs/development/compilers/go/1.26.nix +++ b/pkgs/development/compilers/go/1.26.nix @@ -25,11 +25,11 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "go"; - version = "1.26.6"; + version = "1.26.7"; src = fetchurl { url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz"; - hash = "sha256-oHIcVMaIkBRI13rZs+x+p8R0cwdV/4kTgukuy5P/LLE="; + hash = "sha256-DtJOrHVRBQhbif6cq8J0K5GgrXuUtZ0602SRjryJVq0="; }; strictDeps = true; From 42cfbb8ab7cf8bf2a446395125328393067addb4 Mon Sep 17 00:00:00 2001 From: K900 Date: Wed, 19 Aug 2026 20:10:48 +0300 Subject: [PATCH 318/318] qt6: 6.11.1 -> 6.11.2 --- pkgs/development/libraries/qt-6/fetch.sh | 2 +- .../qt-6/modules/qtdeclarative/default.nix | 23 -- .../libraries/qt-6/modules/qtmqtt.nix | 4 +- pkgs/development/libraries/qt-6/srcs.nix | 336 +++++++++--------- 4 files changed, 171 insertions(+), 194 deletions(-) diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh index bd94b3ae2c48..e97e92bf7f8c 100644 --- a/pkgs/development/libraries/qt-6/fetch.sh +++ b/pkgs/development/libraries/qt-6/fetch.sh @@ -1 +1 @@ -WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.1/submodules/ -A '*.tar.xz' ) +WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.2/submodules/ -A '*.tar.xz' ) diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix index 113d717a5f6e..786229c5651b 100644 --- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix +++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix @@ -43,29 +43,6 @@ qtModule { hash = "sha256-ESy35OlmsvI4yFQ/rFT8oelOUBCwCmlcbQJvwcTrCig="; revert = true; }) - - # backport fix recommended by KDE - (fetchpatch { - url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff"; - hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM="; - }) - - # backport required at least for [musescore][1], and perhaps many other - # applications. - # [1]: https://github.com/musescore/MuseScore/issues/33015 - (fetchpatch { - url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.diff"; - hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA="; - }) - - # backport fix for a QV4 heap corruption crash on JS objects with - # add/delete/re-add property churn (QTBUG-147153); crashes e.g. - # quickshell-based shells like noctalia-shell - # https://bugreports.qt.io/browse/QTBUG-147153 - (fetchpatch { - url = "https://github.com/qt/qtdeclarative/commit/624e90bb5e89837d4b759b43e2120b059d98a41e.diff"; - hash = "sha256-7duTYpHZusVNDMlkm19dCppEWBejjTbc0sy3QvJG65s="; - }) ]; cmakeFlags = [ diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix index c70d2cbd1f88..b5e6c6bc6e19 100644 --- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix +++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix @@ -6,13 +6,13 @@ qtModule rec { pname = "qtmqtt"; - version = "6.11.1"; + version = "6.11.2"; src = fetchFromGitHub { owner = "qt"; repo = "qtmqtt"; tag = "v${version}"; - hash = "sha256-GWaF4iCPtATL1mJkPHVY0rom8R2FMNWGahE3KWBlfV8="; + hash = "sha256-Xg4vfVfYgruRXB6LSWFJWSMtsClJMtML+KhaQExWUGs="; }; propagatedBuildInputs = [ qtbase ]; diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix index 93c206858d18..c6688d20db77 100644 --- a/pkgs/development/libraries/qt-6/srcs.nix +++ b/pkgs/development/libraries/qt-6/srcs.nix @@ -4,339 +4,339 @@ { qt3d = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt3d-everywhere-src-6.11.1.tar.xz"; - sha256 = "01q11bs7vjz1s5wdrdjq904dgl2m6l7r8d3vd2kyf7lx0j78qvd6"; - name = "qt3d-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qt3d-everywhere-src-6.11.2.tar.xz"; + sha256 = "0adczdz74mlmrb8w7hzjln1902isn7bgfbzpr1r18wasg6j8a4a1"; + name = "qt3d-everywhere-src-6.11.2.tar.xz"; }; }; qt5compat = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt5compat-everywhere-src-6.11.1.tar.xz"; - sha256 = "06qndy534rzabxk9yq07dsl8fj1vd72lmck11r5xbajil3d9zjyg"; - name = "qt5compat-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qt5compat-everywhere-src-6.11.2.tar.xz"; + sha256 = "11s225zq0hskkq61rrfhy65aqzdny7np00c75ngnl2ci6gz21hv8"; + name = "qt5compat-everywhere-src-6.11.2.tar.xz"; }; }; qtactiveqt = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtactiveqt-everywhere-src-6.11.1.tar.xz"; - sha256 = "05hcnhxkajry4ha7ykmqr83p16qjipspwxid8l2rxgz80wy6aadv"; - name = "qtactiveqt-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtactiveqt-everywhere-src-6.11.2.tar.xz"; + sha256 = "0g3ak3jmh4fqjl0xh3vcj7hlw7k7902b2arqxa304hmh1s0dmblx"; + name = "qtactiveqt-everywhere-src-6.11.2.tar.xz"; }; }; qtbase = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtbase-everywhere-src-6.11.1.tar.xz"; - sha256 = "1b616gr7k8byfr2ns4vczs4kj3sznhlrlw9inpb3m8la48qllnfr"; - name = "qtbase-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtbase-everywhere-src-6.11.2.tar.xz"; + sha256 = "08ng4gns21a3za3qszzw3yp3a2pxipma1zrl870xi97mrbn00bjv"; + name = "qtbase-everywhere-src-6.11.2.tar.xz"; }; }; qtcanvaspainter = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcanvaspainter-everywhere-src-6.11.1.tar.xz"; - sha256 = "1l08zp68q3wcr9v5hh82kw6jqvc1wmnrjn7h9959psx520dwcdly"; - name = "qtcanvaspainter-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtcanvaspainter-everywhere-src-6.11.2.tar.xz"; + sha256 = "0q77hc83ynvnagwxa9z0j9rwvlzmyig06kklb7v5zvyfa1ra544a"; + name = "qtcanvaspainter-everywhere-src-6.11.2.tar.xz"; }; }; qtcharts = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcharts-everywhere-src-6.11.1.tar.xz"; - sha256 = "0p2icmrwb6am7x2kgk9pnpa8ypi7jiscyaawgi0x31iaihqyvqrz"; - name = "qtcharts-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtcharts-everywhere-src-6.11.2.tar.xz"; + sha256 = "0agvnva90diqvllfvrd1smicar6nlv5pjqvwjfg509fih4xyasah"; + name = "qtcharts-everywhere-src-6.11.2.tar.xz"; }; }; qtconnectivity = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtconnectivity-everywhere-src-6.11.1.tar.xz"; - sha256 = "14g5h0wixqy981cnn5f8gkjbji804f18gfjkzbanxd0lljg2h191"; - name = "qtconnectivity-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtconnectivity-everywhere-src-6.11.2.tar.xz"; + sha256 = "0dv0bqlvfdphk2a5pzq7fm222h6zvy87k18aaamq7585pmbimc45"; + name = "qtconnectivity-everywhere-src-6.11.2.tar.xz"; }; }; qtdatavis3d = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdatavis3d-everywhere-src-6.11.1.tar.xz"; - sha256 = "1b4kcqfq5q79lm70f08qiksxl36laa9dgx9ladjk2xwl1af7n6hy"; - name = "qtdatavis3d-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdatavis3d-everywhere-src-6.11.2.tar.xz"; + sha256 = "07b61fkdzkhv3hfa7r6vfadd72bnyk4cgqwws5ns3y6nqlcnjknj"; + name = "qtdatavis3d-everywhere-src-6.11.2.tar.xz"; }; }; qtdeclarative = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdeclarative-everywhere-src-6.11.1.tar.xz"; - sha256 = "193ar0fcfzjjr7mi8i2622vip95qrr3qry949d9lyc5hf3v71rjj"; - name = "qtdeclarative-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdeclarative-everywhere-src-6.11.2.tar.xz"; + sha256 = "0c5lqr8kbrfvaxh147d92vqbcirw7wj94sxwx8ih2f3ya5q7nnr1"; + name = "qtdeclarative-everywhere-src-6.11.2.tar.xz"; }; }; qtdoc = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdoc-everywhere-src-6.11.1.tar.xz"; - sha256 = "1hd5z6prx2sbr3wxzkynrn2iyjllvkids505l2xg3p272j4b5306"; - name = "qtdoc-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtdoc-everywhere-src-6.11.2.tar.xz"; + sha256 = "1dsfnlsk0kihz55fnmyrybya9x3s88nam9jfpb5g68vk4n9if9sn"; + name = "qtdoc-everywhere-src-6.11.2.tar.xz"; }; }; qtgraphs = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgraphs-everywhere-src-6.11.1.tar.xz"; - sha256 = "0qh43qxqg4biyrrsd78nmi4dm3dnbswa95cq8db2k3lans517cc4"; - name = "qtgraphs-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtgraphs-everywhere-src-6.11.2.tar.xz"; + sha256 = "08cbzc0146j4d18dlqsw0qbilhcwk1hi9h8n84adsigs9a2hj8cz"; + name = "qtgraphs-everywhere-src-6.11.2.tar.xz"; }; }; qtgrpc = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgrpc-everywhere-src-6.11.1.tar.xz"; - sha256 = "0l52w91hd2crq6zyh5a8arv07yixnwcr2pya74bxpk2hqpq08ys3"; - name = "qtgrpc-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtgrpc-everywhere-src-6.11.2.tar.xz"; + sha256 = "14xdchng4sn90r2cva7wxrqlyzncpwkj11gscm4z73q5y0blcha4"; + name = "qtgrpc-everywhere-src-6.11.2.tar.xz"; }; }; qthttpserver = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qthttpserver-everywhere-src-6.11.1.tar.xz"; - sha256 = "01p7li9fvwnz2shx3d9wj9nnnnipya2q0whchyvgjqb8yzy71gq4"; - name = "qthttpserver-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qthttpserver-everywhere-src-6.11.2.tar.xz"; + sha256 = "13mxwy5h41c96ykdkxlxcdf2pqv2gswyvyzxrzsj13x55cxpdxgh"; + name = "qthttpserver-everywhere-src-6.11.2.tar.xz"; }; }; qtimageformats = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtimageformats-everywhere-src-6.11.1.tar.xz"; - sha256 = "04y4pa5krrpyiqn039d6m8bzcxj6pa1m850rz3bmw5xc8ml6rgxj"; - name = "qtimageformats-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtimageformats-everywhere-src-6.11.2.tar.xz"; + sha256 = "1y0123s8hry81059w8x46fv0i0425zv99g09cc3m0rabyc08kkff"; + name = "qtimageformats-everywhere-src-6.11.2.tar.xz"; }; }; qtlanguageserver = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlanguageserver-everywhere-src-6.11.1.tar.xz"; - sha256 = "1vwavpi8swgs88pfjfddnb9cmsb4k1sjcgywp2rsnm6ay8vqa02h"; - name = "qtlanguageserver-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlanguageserver-everywhere-src-6.11.2.tar.xz"; + sha256 = "0ppw27jsqsih48sd0iizfc2jwsxya8z0a9vjjaqhxjplxir45g1q"; + name = "qtlanguageserver-everywhere-src-6.11.2.tar.xz"; }; }; qtlocation = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlocation-everywhere-src-6.11.1.tar.xz"; - sha256 = "06z4hbiqki5chhmph131s71czyrjpnjvy3rxb4560vwy55vwx49p"; - name = "qtlocation-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlocation-everywhere-src-6.11.2.tar.xz"; + sha256 = "0fn2clzz2wmc3lwzqlkwk07scvmmdhim1ihpxkv7dg8zw3nafl2d"; + name = "qtlocation-everywhere-src-6.11.2.tar.xz"; }; }; qtlottie = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlottie-everywhere-src-6.11.1.tar.xz"; - sha256 = "0y969gp64imwh49d5zbnw0wi2yva9fsp6qn58617rs9kvkdzml70"; - name = "qtlottie-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtlottie-everywhere-src-6.11.2.tar.xz"; + sha256 = "0lj8a90frd265waypkwghabj0r9h5p6vh1dlrjksksyr2qkp2g7m"; + name = "qtlottie-everywhere-src-6.11.2.tar.xz"; }; }; qtmultimedia = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtmultimedia-everywhere-src-6.11.1.tar.xz"; - sha256 = "02lvq1jk6m67m6z0w7vdzxhzmi441j8avvp79mfclfpfvm98w3rr"; - name = "qtmultimedia-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtmultimedia-everywhere-src-6.11.2.tar.xz"; + sha256 = "17yd17qm0jxfimkqs843z5m86ciif1pcs8h66vdkqybbxh15wywn"; + name = "qtmultimedia-everywhere-src-6.11.2.tar.xz"; }; }; qtnetworkauth = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtnetworkauth-everywhere-src-6.11.1.tar.xz"; - sha256 = "0gan2qjv97d1387jqaiis2gigm6lz5jbk1k10x13w0yc5kr5n7cz"; - name = "qtnetworkauth-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtnetworkauth-everywhere-src-6.11.2.tar.xz"; + sha256 = "0nx03zab9jrzkrwali45czswlniwbh0v0nx17wwj8y5bfwqc50qc"; + name = "qtnetworkauth-everywhere-src-6.11.2.tar.xz"; }; }; qtopenapi = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtopenapi-everywhere-src-6.11.1.tar.xz"; - sha256 = "0nzl95w5pbfd6mfb6rzv6arz09pcm6siz1n07pgm9rrdr6z083a4"; - name = "qtopenapi-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtopenapi-everywhere-src-6.11.2.tar.xz"; + sha256 = "1873byinl4ikm3bncz869fjhn1z2jwj9s0bg3h9ncnn4kl0fp74b"; + name = "qtopenapi-everywhere-src-6.11.2.tar.xz"; }; }; qtpositioning = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtpositioning-everywhere-src-6.11.1.tar.xz"; - sha256 = "1xbq1xjjbhb41lfp9mli8a5rgqf5pniswv0161v6wa5f04cbkrnm"; - name = "qtpositioning-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtpositioning-everywhere-src-6.11.2.tar.xz"; + sha256 = "16blmv0plbh0l214q6phfp7jb18201cyqk66v8555cd38fnibkyq"; + name = "qtpositioning-everywhere-src-6.11.2.tar.xz"; }; }; qtquick3d = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3d-everywhere-src-6.11.1.tar.xz"; - sha256 = "0vs5bcz62r32gin0g4lb6wdmqrv0ypzar1s9wsza98la7zg8asy7"; - name = "qtquick3d-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquick3d-everywhere-src-6.11.2.tar.xz"; + sha256 = "1d1pcy9ipjsipczrassn6h9jq2bx7v1457fg6wx3f9nvivqf3f1s"; + name = "qtquick3d-everywhere-src-6.11.2.tar.xz"; }; }; qtquick3dphysics = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3dphysics-everywhere-src-6.11.1.tar.xz"; - sha256 = "1bvrmjb6m0ynq00ybdghvkbmwm237vff23ng8n4njysf05pns26i"; - name = "qtquick3dphysics-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquick3dphysics-everywhere-src-6.11.2.tar.xz"; + sha256 = "0vmqvr68qq0caglackln225xj3p8srdycykw3m44iz458b7j8nhw"; + name = "qtquick3dphysics-everywhere-src-6.11.2.tar.xz"; }; }; qtquickeffectmaker = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquickeffectmaker-everywhere-src-6.11.1.tar.xz"; - sha256 = "0sqk8hkkdibv0ayxrvpcbgj3dcwfngpd6qjp2xm15pcbx1q3xrng"; - name = "qtquickeffectmaker-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquickeffectmaker-everywhere-src-6.11.2.tar.xz"; + sha256 = "1dswhg102b09x3p3iyldmwkhnkphcisl4jp2dbisacz9hirdq8vr"; + name = "qtquickeffectmaker-everywhere-src-6.11.2.tar.xz"; }; }; qtquicktimeline = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquicktimeline-everywhere-src-6.11.1.tar.xz"; - sha256 = "09wcx83yxif8r4v81h2jfj3wlj60wnc9k4dsp7hlah4yzm1zclxg"; - name = "qtquicktimeline-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtquicktimeline-everywhere-src-6.11.2.tar.xz"; + sha256 = "05qxi1gqv02af28rlzlbmxc4v939i920gqblvrfh9i50002z22i5"; + name = "qtquicktimeline-everywhere-src-6.11.2.tar.xz"; }; }; qtremoteobjects = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtremoteobjects-everywhere-src-6.11.1.tar.xz"; - sha256 = "06hiiyjpcgn8dp9jmgxj30nlrw73rqb869f0m63scccmqsarhqj0"; - name = "qtremoteobjects-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtremoteobjects-everywhere-src-6.11.2.tar.xz"; + sha256 = "1zbwg7pzswibjjx2vgcl3r4v47xhdwk0c9bik8bv3hlyg60rc32y"; + name = "qtremoteobjects-everywhere-src-6.11.2.tar.xz"; }; }; qtscxml = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtscxml-everywhere-src-6.11.1.tar.xz"; - sha256 = "0gr0j09isxgii3aivfvr35x40d9n0kj0g2icc7g7bzniwm2m4jcf"; - name = "qtscxml-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtscxml-everywhere-src-6.11.2.tar.xz"; + sha256 = "1zrmxhf2a58dynbxij08vxa6x7b6jllcfwvrhlhgpgzqlyxw957m"; + name = "qtscxml-everywhere-src-6.11.2.tar.xz"; }; }; qtsensors = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsensors-everywhere-src-6.11.1.tar.xz"; - sha256 = "13ygry3lybkgci6gkrd7k081l01icavzkiyy4g82drbvv9i70q93"; - name = "qtsensors-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtsensors-everywhere-src-6.11.2.tar.xz"; + sha256 = "069ij142dvh4spqp9584pfqqj8265x659xb35wcf5s1jzd6y9j38"; + name = "qtsensors-everywhere-src-6.11.2.tar.xz"; }; }; qtserialbus = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialbus-everywhere-src-6.11.1.tar.xz"; - sha256 = "02pj4jnxc4afl5ymv7w8asggpg0hdj3dbnwwcqd305b8il69qv64"; - name = "qtserialbus-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtserialbus-everywhere-src-6.11.2.tar.xz"; + sha256 = "1h9nvwhbfhb5js0458ha653n04d46m70j4gh8gn4bc7njnxcj1lg"; + name = "qtserialbus-everywhere-src-6.11.2.tar.xz"; }; }; qtserialport = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialport-everywhere-src-6.11.1.tar.xz"; - sha256 = "0x1r5l3kx7riprf0b2api0bcg0z755fq9vbgmx7px6pxiy4imwws"; - name = "qtserialport-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtserialport-everywhere-src-6.11.2.tar.xz"; + sha256 = "13md2wdypib4wjw3mai8hqfyjjs4l67232dnxjr32ks42qv76fnz"; + name = "qtserialport-everywhere-src-6.11.2.tar.xz"; }; }; qtshadertools = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtshadertools-everywhere-src-6.11.1.tar.xz"; - sha256 = "1z42r414jid12jmhm1yf5kw44j886w01igav0kggkg13kcphax90"; - name = "qtshadertools-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtshadertools-everywhere-src-6.11.2.tar.xz"; + sha256 = "070b41mzqf1b7xnxn2mh7ap79s2702a7bcwhd1c6axkmnyw4cl40"; + name = "qtshadertools-everywhere-src-6.11.2.tar.xz"; }; }; qtspeech = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtspeech-everywhere-src-6.11.1.tar.xz"; - sha256 = "051z4yf22hkqhy3pkgxq8s77x06k4cd70i9jcmd8f99004cc6df0"; - name = "qtspeech-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtspeech-everywhere-src-6.11.2.tar.xz"; + sha256 = "166bqmcffdncyr64zw4h99c9ng19nk30ys371br4j03ikpf0a7cw"; + name = "qtspeech-everywhere-src-6.11.2.tar.xz"; }; }; qtsvg = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsvg-everywhere-src-6.11.1.tar.xz"; - sha256 = "154adaicyy5wyz6yc95g3lm4iw9v2zdsd7l5qp107gr490pz0g3z"; - name = "qtsvg-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtsvg-everywhere-src-6.11.2.tar.xz"; + sha256 = "0xhq64622f6iz42xj4dn0jjgs4jwd9gbi1zyczxjck58xizk756m"; + name = "qtsvg-everywhere-src-6.11.2.tar.xz"; }; }; qttasktree = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttasktree-everywhere-src-6.11.1.tar.xz"; - sha256 = "1mjdwy3i24ggn2g82z5pg3grzhnaxmq7nmvdc7ba8dsdixzvjam2"; - name = "qttasktree-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttasktree-everywhere-src-6.11.2.tar.xz"; + sha256 = "1n1yq8hws4yq0raanfkjj2r4z671mic2dspg2p6sc5hny292jxn0"; + name = "qttasktree-everywhere-src-6.11.2.tar.xz"; }; }; qttools = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttools-everywhere-src-6.11.1.tar.xz"; - sha256 = "03gmr9zpf0raqcvqk2cpw9lblw907hsl5cb5c2fgm4wwcxd86qcf"; - name = "qttools-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttools-everywhere-src-6.11.2.tar.xz"; + sha256 = "07h4nhk02izczi1wz6dh7gab84vzk7rkm30wwq4pwbsibkrmm9wy"; + name = "qttools-everywhere-src-6.11.2.tar.xz"; }; }; qttranslations = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttranslations-everywhere-src-6.11.1.tar.xz"; - sha256 = "0xsnxhiqc3ybwvyn1jbhdf1sjmcf7v4mma6w9sxwg535420jrh1p"; - name = "qttranslations-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qttranslations-everywhere-src-6.11.2.tar.xz"; + sha256 = "0560cyg3j4fcsq7ikb7rraa8g5ymi9lscmmhqfmryylklz0q85h2"; + name = "qttranslations-everywhere-src-6.11.2.tar.xz"; }; }; qtvirtualkeyboard = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz"; - sha256 = "073y02qmpwxxdqc4pkm6k9frghsjg1zppg2hip5b4hv269xrdim1"; - name = "qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtvirtualkeyboard-everywhere-src-6.11.2.tar.xz"; + sha256 = "0bvwci70c4ng5zgzj621a723p22v58cmzbprbz6llkjw99rjcsjc"; + name = "qtvirtualkeyboard-everywhere-src-6.11.2.tar.xz"; }; }; qtwayland = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwayland-everywhere-src-6.11.1.tar.xz"; - sha256 = "1cyr5frhglp2krxvpnqk9q426rgp6nr34ngnxpa42m7p0ajqly4m"; - name = "qtwayland-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwayland-everywhere-src-6.11.2.tar.xz"; + sha256 = "1pzr4a11dmlbpzfgcm7z95cvnm2r5pq71pg80vsi0aik75g63dwf"; + name = "qtwayland-everywhere-src-6.11.2.tar.xz"; }; }; qtwebchannel = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebchannel-everywhere-src-6.11.1.tar.xz"; - sha256 = "10ld2nh6gd1v2ssbgqlf6w0lsjlqkjdfwqv85mn5krnnf45vbyv9"; - name = "qtwebchannel-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebchannel-everywhere-src-6.11.2.tar.xz"; + sha256 = "0pspql8j7yxjvvxwibavb4kw5lidh6a62rcjqbq8ga5xb2bi9czy"; + name = "qtwebchannel-everywhere-src-6.11.2.tar.xz"; }; }; qtwebengine = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebengine-everywhere-src-6.11.1.tar.xz"; - sha256 = "10vhcvw8j60n0mf38bi3fjcx5v1i0cbfyn4wbqhzqn61qv66d737"; - name = "qtwebengine-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebengine-everywhere-src-6.11.2.tar.xz"; + sha256 = "0qy1lyykwwkp288v0y5kqnd1pmz8frzicpgfcldkv4zz02mc20b1"; + name = "qtwebengine-everywhere-src-6.11.2.tar.xz"; }; }; qtwebsockets = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebsockets-everywhere-src-6.11.1.tar.xz"; - sha256 = "1gvgci383dfm4sljqlapdiva7jhks1i2z2ayck0wbj1436hklgi4"; - name = "qtwebsockets-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebsockets-everywhere-src-6.11.2.tar.xz"; + sha256 = "18y9ycpmny1czkqz7c97hp7l89vxj34h56y5wf87czy3hg1jbzib"; + name = "qtwebsockets-everywhere-src-6.11.2.tar.xz"; }; }; qtwebview = { - version = "6.11.1"; + version = "6.11.2"; src = fetchurl { - url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebview-everywhere-src-6.11.1.tar.xz"; - sha256 = "0g8k4xs7b0s474x00ds4i8q9b164icdgrdg8ngln10nmf3pwhqld"; - name = "qtwebview-everywhere-src-6.11.1.tar.xz"; + url = "${mirror}/official_releases/qt/6.11/6.11.2/submodules/qtwebview-everywhere-src-6.11.2.tar.xz"; + sha256 = "0k0zi0pzbcvrrjfzhim55rbaar4xrdmpip9y5ppxxnl9xq4y28by"; + name = "qtwebview-everywhere-src-6.11.2.tar.xz"; }; }; }