From b6c8359810152534c8e6bda471e17847d279ef7e Mon Sep 17 00:00:00 2001 From: Aliaksandr Date: Thu, 12 Feb 2026 02:14:41 +0200 Subject: [PATCH 001/115] bind: add json_c for JSON statistics channel support bind_exporter 0.8.0 defaults to the JSON statistics channel instead of XML. This requires BIND to be compiled with json-c support. Without this, BIND returns 404 for /json/v1/server requests, causing the prometheus-bind-exporter to fail to retrieve metrics. --- pkgs/by-name/bi/bind/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix index aa435fcb2feb..43a6c1ce1dcb 100644 --- a/pkgs/by-name/bi/bind/package.nix +++ b/pkgs/by-name/bi/bind/package.nix @@ -9,6 +9,7 @@ libidn2, libtool, libxml2, + json_c, openssl, liburcu, libuv, @@ -59,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: { libidn2 libtool libxml2 + json_c openssl liburcu libuv From 95d571d0f5e203e6b7238c4251f2364a29c97765 Mon Sep 17 00:00:00 2001 From: Aliaksandr Date: Thu, 12 Feb 2026 02:14:47 +0200 Subject: [PATCH 002/115] prometheus-bind-exporter: 0.7.0 -> 0.8.0 https://github.com/prometheus-community/bind_exporter/releases/tag/v0.8.0 Changelog: - [CHANGE] Drop XML statistics v2 support - [CHANGE] Deprecate collection of task stats by default - [CHANGE] Update logging library - [ENHANCEMENT] Add metric rpz_rewrites - [BUGFIX] Make log level configurable via command-line flag The exporter now defaults to JSON statistics channel instead of XML. --- pkgs/by-name/pr/prometheus-bind-exporter/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pr/prometheus-bind-exporter/package.nix b/pkgs/by-name/pr/prometheus-bind-exporter/package.nix index 1749028329e9..b135449f097b 100644 --- a/pkgs/by-name/pr/prometheus-bind-exporter/package.nix +++ b/pkgs/by-name/pr/prometheus-bind-exporter/package.nix @@ -7,16 +7,16 @@ buildGoModule rec { pname = "bind_exporter"; - version = "0.7.0"; + version = "0.8.0"; src = fetchFromGitHub { rev = "v${version}"; owner = "prometheus-community"; repo = "bind_exporter"; - sha256 = "sha256-x/XGatlXCKo9cI92JzFItApsjuZAfZX+8IZRpy7PVUo="; + sha256 = "sha256-r1P+zy3iMgPmfvIBgycW8KS0gfNOxCT9YMmHdeY4uXA="; }; - vendorHash = "sha256-f0ei/zotOj5ebURAOWUox/7J3jS2abQ5UgjninI9nRk="; + vendorHash = "sha256-/fPj5LOe3QdnVPdtYdaqtnGMJ7/SZ458mpvjwO8TxEI="; passthru.tests = { inherit (nixosTests.prometheus-exporters) bind; }; From d9a2e3b3c0ba8d4edf67475e1c64b00202cc58c6 Mon Sep 17 00:00:00 2001 From: Aliaksandr Date: Thu, 12 Feb 2026 02:14:53 +0200 Subject: [PATCH 003/115] nixos/prometheus-exporters/bind: update for bind_exporter 0.8.0 - Change default bindVersion from 'auto' to 'json' (new upstream default) - Add 'json' and 'xml' to bindVersion enum options - Remove deprecated 'xml.v2' option (dropped in 0.8.0) --- .../services/monitoring/prometheus/exporters/bind.nix | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/nixos/modules/services/monitoring/prometheus/exporters/bind.nix b/nixos/modules/services/monitoring/prometheus/exporters/bind.nix index 3390374172c4..935ebff7e5bd 100644 --- a/nixos/modules/services/monitoring/prometheus/exporters/bind.nix +++ b/nixos/modules/services/monitoring/prometheus/exporters/bind.nix @@ -17,7 +17,7 @@ in type = types.str; default = "http://localhost:8053/"; description = '' - HTTP XML API address of an Bind server. + HTTP API address of a BIND server. ''; }; bindTimeout = mkOption { @@ -29,13 +29,14 @@ in }; bindVersion = mkOption { type = types.enum [ - "xml.v2" + "json" + "xml" "xml.v3" "auto" ]; - default = "auto"; + default = "json"; description = '' - BIND statistics version. Can be detected automatically. + BIND statistics version. Defaults to JSON. ''; }; bindGroups = mkOption { From f9e4559b773822abfa1c3a8decc9377144aa3bb2 Mon Sep 17 00:00:00 2001 From: Aliaksandr Date: Thu, 12 Feb 2026 02:14:58 +0200 Subject: [PATCH 004/115] nixosTests.prometheus-exporters.bind: check bind_up metric Check for 'bind_up 1' instead of 'bind_query_recursions_total 0'. The bind_query_recursions_total metric is only emitted when there have been recursive queries. In a fresh BIND instance with no traffic, this counter doesn't exist. The bind_up metric reliably indicates that the exporter successfully connected to BIND's statistics channel. --- nixos/tests/prometheus-exporters.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix index 6383f1b54cfd..3f8d5fa61110 100644 --- a/nixos/tests/prometheus-exporters.nix +++ b/nixos/tests/prometheus-exporters.nix @@ -108,7 +108,7 @@ let wait_for_unit("prometheus-bind-exporter.service") wait_for_open_port(9119) succeed( - "curl -sSf http://localhost:9119/metrics | grep 'bind_query_recursions_total 0'" + "curl -sSf http://localhost:9119/metrics | grep 'bind_up 1'" ) ''; }; From 8a1309cd7c5d29b36d0c43358b74dffe3155cfd7 Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Thu, 30 Apr 2026 22:34:06 -0400 Subject: [PATCH 005/115] terminal-notifier: adopt --- pkgs/by-name/te/terminal-notifier/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/te/terminal-notifier/package.nix b/pkgs/by-name/te/terminal-notifier/package.nix index 9cca1d289092..7f763b50610f 100644 --- a/pkgs/by-name/te/terminal-notifier/package.nix +++ b/pkgs/by-name/te/terminal-notifier/package.nix @@ -31,7 +31,7 @@ stdenv.mkDerivation rec { ''; meta = { - maintainers = [ ]; + maintainers = with lib.maintainers; [ amarshall ]; homepage = "https://github.com/julienXX/terminal-notifier"; license = lib.licenses.mit; platforms = lib.platforms.darwin; From e6bc67413e560af19a0c58c1edb4d6663d070ef5 Mon Sep 17 00:00:00 2001 From: Andrew Marshall Date: Thu, 30 Apr 2026 22:34:16 -0400 Subject: [PATCH 006/115] terminal-notifier: cleanup - Sort params - Prefer finalAttrs over rec - Prefer SRI hash over sha256 - Prefer makeWrapper over ad-hoc shell script wrapper - Run pre and postInstall hooks - Add meta.description - Misc. formatting and syntax --- pkgs/by-name/te/terminal-notifier/package.nix | 37 ++++++++++--------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/pkgs/by-name/te/terminal-notifier/package.nix b/pkgs/by-name/te/terminal-notifier/package.nix index 7f763b50610f..c121b7d10033 100644 --- a/pkgs/by-name/te/terminal-notifier/package.nix +++ b/pkgs/by-name/te/terminal-notifier/package.nix @@ -1,40 +1,43 @@ { - stdenv, - runtimeShell, - lib, fetchzip, + lib, + makeBinaryWrapper, + stdenv, }: -stdenv.mkDerivation rec { +stdenv.mkDerivation (finalAttrs: { pname = "terminal-notifier"; - version = "2.0.0"; src = fetchzip { - url = "https://github.com/alloy/terminal-notifier/releases/download/${version}/terminal-notifier-${version}.zip"; - sha256 = "0gi54v92hi1fkryxlz3k5s5d8h0s66cc57ds0vbm1m1qk3z4xhb0"; + url = "https://github.com/alloy/terminal-notifier/releases/download/${finalAttrs.version}/terminal-notifier-${finalAttrs.version}.zip"; + hash = "sha256-YMFO/pg41FDXBrqdwpgxGkDUii5zfNp9ni5EKNImJT4="; stripRoot = false; }; + nativeBuildInputs = [ makeBinaryWrapper ]; + dontBuild = true; installPhase = '' - mkdir -p $out/Applications - mkdir -p $out/bin + runHook preInstall + + mkdir -p $out/{Applications,bin} cp -r terminal-notifier.app $out/Applications - cat >$out/bin/terminal-notifier < Date: Thu, 30 Apr 2026 22:43:14 -0400 Subject: [PATCH 007/115] terminal-notifier: build from source This fixes running on pure aarch64-darwin, as the upstream release binary is only x86_64-darwin. --- pkgs/by-name/te/terminal-notifier/package.nix | 33 ++++++++++++++----- 1 file changed, 25 insertions(+), 8 deletions(-) diff --git a/pkgs/by-name/te/terminal-notifier/package.nix b/pkgs/by-name/te/terminal-notifier/package.nix index c121b7d10033..ecfea7c2fb1d 100644 --- a/pkgs/by-name/te/terminal-notifier/package.nix +++ b/pkgs/by-name/te/terminal-notifier/package.nix @@ -1,29 +1,46 @@ { - fetchzip, + apple-sdk, + fetchFromGitHub, + ibtool, lib, makeBinaryWrapper, stdenv, + xcbuildHook, }: stdenv.mkDerivation (finalAttrs: { pname = "terminal-notifier"; version = "2.0.0"; - src = fetchzip { - url = "https://github.com/alloy/terminal-notifier/releases/download/${finalAttrs.version}/terminal-notifier-${finalAttrs.version}.zip"; - hash = "sha256-YMFO/pg41FDXBrqdwpgxGkDUii5zfNp9ni5EKNImJT4="; - stripRoot = false; + src = fetchFromGitHub { + owner = "julienXX"; + repo = "terminal-notifier"; + tag = finalAttrs.version; + hash = "sha256-Hd9cI3R2nQK2deBb5CBYz4DTHAEcO4vzqtA5qZwa1Ao="; }; - nativeBuildInputs = [ makeBinaryWrapper ]; + nativeBuildInputs = [ + ibtool + makeBinaryWrapper + xcbuildHook + ]; - dontBuild = true; + buildInputs = [ + apple-sdk + ]; + + xcbuildFlags = [ + "-target" + "terminal-notifier" + "-configuration" + "Release" + ]; installPhase = '' runHook preInstall mkdir -p $out/{Applications,bin} - cp -r terminal-notifier.app $out/Applications + cp -r Products/Release/terminal-notifier.app $out/Applications/ makeWrapper \ $out/Applications/terminal-notifier.app/Contents/MacOS/terminal-notifier \ $out/bin/terminal-notifier \ From 433cbb426eb6a81b51418fdd4ebdc98050edef77 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 11 May 2026 15:30:59 +0000 Subject: [PATCH 008/115] crowdsec: 1.7.7 -> 1.7.8 --- pkgs/by-name/cr/crowdsec/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/cr/crowdsec/package.nix b/pkgs/by-name/cr/crowdsec/package.nix index 3289a53dbc82..41776f0e0418 100644 --- a/pkgs/by-name/cr/crowdsec/package.nix +++ b/pkgs/by-name/cr/crowdsec/package.nix @@ -7,16 +7,16 @@ buildGoModule (finalAttrs: { pname = "crowdsec"; - version = "1.7.7"; + version = "1.7.8"; src = fetchFromGitHub { owner = "crowdsecurity"; repo = "crowdsec"; tag = "v${finalAttrs.version}"; - hash = "sha256-TG9YRKzht9OAnlDNxLNP8060v0klee6GY7vJCu6MugM="; + hash = "sha256-2t9nxuqWNDAUOZHtfNkZ4ZFKXvv8k5LuvKrGNjpdGXc="; }; - vendorHash = "sha256-BjkTMBrQPv8uZzme02WFdobuYdbe1RvRkZ8RjHGubo8="; + vendorHash = "sha256-RDkttsV4PNOfjWPr4v+uIwdkmXYH83vkYFQQIO3CYGE="; nativeBuildInputs = [ installShellFiles ]; From 518687b52b2c77e4b34034362ff6f0107a400347 Mon Sep 17 00:00:00 2001 From: Pratham Patel Date: Tue, 12 May 2026 11:32:47 +0530 Subject: [PATCH 009/115] nixos/cosmic: remove unnecessary dependency of cosmic-session.target on xdg-desktop-autostart.target --- nixos/modules/services/desktop-managers/cosmic.nix | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/nixos/modules/services/desktop-managers/cosmic.nix b/nixos/modules/services/desktop-managers/cosmic.nix index c780a5164922..b66966891f2d 100644 --- a/nixos/modules/services/desktop-managers/cosmic.nix +++ b/nixos/modules/services/desktop-managers/cosmic.nix @@ -124,16 +124,7 @@ in }; }; - systemd = { - packages = [ pkgs.cosmic-session ]; - user.targets = { - # TODO: remove when upstream has XDG autostart support - cosmic-session = { - wants = [ "xdg-desktop-autostart.target" ]; - before = [ "xdg-desktop-autostart.target" ]; - }; - }; - }; + systemd.packages = [ pkgs.cosmic-session ]; fonts.packages = with pkgs; [ fira From 8709639151bcf2d9a9c96e2126275099e73f4c3a Mon Sep 17 00:00:00 2001 From: Silvan Mosberger Date: Sat, 30 May 2026 00:43:37 +0200 Subject: [PATCH 010/115] ci/OWNERS: Remove myself from contributor docs --- ci/OWNERS | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/ci/OWNERS b/ci/OWNERS index 6e2ba2f601ae..793a226e3959 100644 --- a/ci/OWNERS +++ b/ci/OWNERS @@ -94,16 +94,16 @@ nixos/modules/installer/tools/nix-fallback-paths.nix @Artturin @Ericson2314 @lo /maintainers/scripts/doc @jtojnar @ryantm # Contributor documentation -/CONTRIBUTING.md @infinisil -/.github/PULL_REQUEST_TEMPLATE.md @infinisil -/doc/contributing/ @infinisil -/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil -/lib/README.md @infinisil -/doc/README.md @infinisil -/nixos/README.md @infinisil -/pkgs/README.md @infinisil -/pkgs/by-name/README.md @infinisil -/maintainers/README.md @infinisil +/CONTRIBUTING.md +/.github/PULL_REQUEST_TEMPLATE.md +/doc/contributing/ +/doc/contributing/contributing-to-documentation.chapter.md @jtojnar +/lib/README.md +/doc/README.md +/nixos/README.md +/pkgs/README.md +/pkgs/by-name/README.md +/maintainers/README.md # User-facing development documentation /doc/development.md @infinisil From cd2f95a405a7e90806e45dd8693dbcdc6194f8ec Mon Sep 17 00:00:00 2001 From: Vilem Liepelt <17603372+buggymcbugfix@users.noreply.github.com> Date: Tue, 2 Jun 2026 11:38:30 +0200 Subject: [PATCH 011/115] maintainers: add buggymcbugfix, Vilem Liepelt --- maintainers/maintainer-list.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 923a945becb7..195a184fd8b0 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -4175,6 +4175,13 @@ githubId = 18356186; name = "Gabriela Moreira"; }; + buggymcbugfix = { + email = "nix@vilem.net"; + github = "buggymcbugfix"; + matrix = "@buggymcbugfix:matrix.org"; + githubId = 17603372; + name = "Vilem Liepelt"; + }; bugworm = { email = "bugworm@zoho.com"; github = "bugworm"; From 3a1f2d4f837d375be39d572f2a17ca407bf85c15 Mon Sep 17 00:00:00 2001 From: Vilem Liepelt <17603372+buggymcbugfix@users.noreply.github.com> Date: Tue, 2 Jun 2026 11:50:48 +0200 Subject: [PATCH 012/115] urweb: add buggymcbugfix as maintainer --- pkgs/by-name/ur/urweb/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/ur/urweb/package.nix b/pkgs/by-name/ur/urweb/package.nix index 9b7274bb326a..445c01cec8f0 100644 --- a/pkgs/by-name/ur/urweb/package.nix +++ b/pkgs/by-name/ur/urweb/package.nix @@ -76,6 +76,7 @@ stdenv.mkDerivation rec { license = lib.licenses.bsd3; platforms = lib.platforms.linux ++ lib.platforms.darwin; maintainers = [ + lib.maintainers.buggymcbugfix lib.maintainers.thoughtpolice lib.maintainers.sheganinans ]; From 967e3dc39cd9054e8615aa8fe36d637a42092361 Mon Sep 17 00:00:00 2001 From: Alexander Sieg Date: Mon, 8 Jun 2026 13:44:45 +0200 Subject: [PATCH 013/115] mealie: move frontend into package.nix --- pkgs/by-name/me/mealie/mealie-frontend.nix | 68 --------------------- pkgs/by-name/me/mealie/package.nix | 69 +++++++++++++++++++++- 2 files changed, 66 insertions(+), 71 deletions(-) delete mode 100644 pkgs/by-name/me/mealie/mealie-frontend.nix diff --git a/pkgs/by-name/me/mealie/mealie-frontend.nix b/pkgs/by-name/me/mealie/mealie-frontend.nix deleted file mode 100644 index b3359fb64271..000000000000 --- a/pkgs/by-name/me/mealie/mealie-frontend.nix +++ /dev/null @@ -1,68 +0,0 @@ -src: version: -{ - lib, - fetchYarnDeps, - dart-sass, - nodejs, - fixup-yarn-lock, - stdenv, - yarn, - writableTmpDirAsHomeHook, -}: -stdenv.mkDerivation { - name = "mealie-frontend"; - inherit version; - src = "${src}/frontend"; - - yarnOfflineCache = fetchYarnDeps { - yarnLock = "${src}/frontend/yarn.lock"; - hash = "sha256-F1dhdBHfT9N1Ejk7WLyz2BbKlTPfqqEDNi7ZTL3phWY="; - }; - - nativeBuildInputs = [ - fixup-yarn-lock - nodejs - (yarn.override { inherit nodejs; }) - writableTmpDirAsHomeHook - dart-sass - ]; - - configurePhase = '' - runHook preConfigure - - sed -i 's+"@nuxt/fonts",+// NUXT FONTS DISABLED+g' nuxt.config.ts - - yarn config --offline set yarn-offline-mirror "$yarnOfflineCache" - fixup-yarn-lock yarn.lock - yarn install --offline --frozen-lockfile --no-progress --non-interactive --ignore-scripts - patchShebangs node_modules - - substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \ - --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];' - - runHook postConfigure - ''; - - buildPhase = '' - runHook preBuild - - export NUXT_TELEMETRY_DISABLED=1 - yarn --offline generate - runHook postBuild - ''; - - installPhase = '' - runHook preInstall - mv .output/public $out - runHook postInstall - ''; - - meta = { - description = "Frontend for Mealie"; - license = lib.licenses.agpl3Only; - maintainers = with lib.maintainers; [ - litchipi - esch - ]; - }; -} diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix index 765822f5dfa9..48a7a30fa2d9 100644 --- a/pkgs/by-name/me/mealie/package.nix +++ b/pkgs/by-name/me/mealie/package.nix @@ -1,7 +1,5 @@ { lib, - pkgs, - callPackage, fetchFromGitHub, makeWrapper, nixosTests, @@ -9,6 +7,15 @@ nltk-data, writeShellScript, nix-update-script, + + # frontend + fetchYarnDeps, + dart-sass, + nodejs, + fixup-yarn-lock, + stdenv, + yarn, + writableTmpDirAsHomeHook, }: let @@ -20,7 +27,63 @@ let hash = "sha256-DUwLCe221MQb6AEYNxNDWXoaEdf9q/dNklOXJncnnJ4="; }; - frontend = callPackage (import ./mealie-frontend.nix src version) { }; + frontend = stdenv.mkDerivation { + name = "mealie-frontend"; + inherit version; + src = "${src}/frontend"; + + yarnOfflineCache = fetchYarnDeps { + yarnLock = "${src}/frontend/yarn.lock"; + hash = "sha256-F1dhdBHfT9N1Ejk7WLyz2BbKlTPfqqEDNi7ZTL3phWY="; + }; + + nativeBuildInputs = [ + fixup-yarn-lock + nodejs + (yarn.override { inherit nodejs; }) + writableTmpDirAsHomeHook + dart-sass + ]; + + configurePhase = '' + runHook preConfigure + + sed -i 's+"@nuxt/fonts",+// NUXT FONTS DISABLED+g' nuxt.config.ts + + yarn config --offline set yarn-offline-mirror "$yarnOfflineCache" + fixup-yarn-lock yarn.lock + yarn install --offline --frozen-lockfile --no-progress --non-interactive --ignore-scripts + patchShebangs node_modules + + substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \ + --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];' + + runHook postConfigure + ''; + + buildPhase = '' + runHook preBuild + + export NUXT_TELEMETRY_DISABLED=1 + yarn --offline generate + runHook postBuild + ''; + + installPhase = '' + runHook preInstall + mv .output/public $out + runHook postInstall + ''; + + meta = { + description = "Frontend for Mealie"; + license = lib.licenses.agpl3Only; + maintainers = with lib.maintainers; [ + litchipi + esch + ]; + }; + }; python = python3; pythonpkgs = python.pkgs; From f3423127d8113ee8a1d1b6ea7e903bee63f461fb Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 13 Jun 2026 08:20:15 +0000 Subject: [PATCH 014/115] pangolin-cli: 0.8.3 -> 0.10.1 --- pkgs/by-name/pa/pangolin-cli/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pa/pangolin-cli/package.nix b/pkgs/by-name/pa/pangolin-cli/package.nix index f558700c7a2e..3cee1faf7112 100644 --- a/pkgs/by-name/pa/pangolin-cli/package.nix +++ b/pkgs/by-name/pa/pangolin-cli/package.nix @@ -10,20 +10,20 @@ buildGoModule (finalAttrs: { pname = "pangolin-cli"; - version = "0.8.3"; + version = "0.10.1"; src = fetchFromGitHub { owner = "fosrl"; repo = "cli"; tag = finalAttrs.version; - hash = "sha256-y+B29E6wXUcMQsWLAcLYIpg0uuqjr+zfxf2WVt0oY9A="; + hash = "sha256-6TRO7tBrWH6EeMFEA6FrpvmlCkUcMtiZ5qr/LQjcLeY="; }; ldflags = [ "-X github.com/fosrl/cli/internal/version.Version=${finalAttrs.version}" ]; - vendorHash = "sha256-r7Tbs05jRlIX1zLRMVqzvDth4+yaMUck2q6R3uPHAWs="; + vendorHash = "sha256-UmzzZDO2lz/HsrUlnV8Wa4GM8lYgoI0ggJlOvxrd79Q="; nativeBuildInputs = [ installShellFiles ]; From 1c03bb6d3396f836584da683e6298806b9347cff Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 15 Jun 2026 17:27:33 +0000 Subject: [PATCH 015/115] csharpier: 1.2.6 -> 1.3.0 --- pkgs/by-name/cs/csharpier/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/cs/csharpier/package.nix b/pkgs/by-name/cs/csharpier/package.nix index 23a75a8bc7a7..6731cf7c7c12 100644 --- a/pkgs/by-name/cs/csharpier/package.nix +++ b/pkgs/by-name/cs/csharpier/package.nix @@ -2,10 +2,10 @@ buildDotnetGlobalTool { pname = "csharpier"; - version = "1.2.6"; + version = "1.3.0"; executables = "csharpier"; - nugetHash = "sha256-SaBHGaaeg/1c4okHN1Pn8caGZgfLJ/KsGRqgUiAqKlQ="; + nugetHash = "sha256-hwieEoQTcATyKZIZ7CQSWANPBv+pEShg6cDXU5EIexU="; meta = { description = "Opinionated code formatter for C#"; From 198b92d5b1895fd20a6e3a90efd40565c05530df Mon Sep 17 00:00:00 2001 From: Morgan Jones Date: Mon, 15 Jun 2026 11:48:01 -0700 Subject: [PATCH 016/115] mattermostLatest: 11.7.0 -> 11.8.1 --- pkgs/by-name/ma/mattermost/package.nix | 2 +- pkgs/by-name/ma/mattermostLatest/package.nix | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix index 6e198f6b213f..7a7c62582070 100644 --- a/pkgs/by-name/ma/mattermost/package.nix +++ b/pkgs/by-name/ma/mattermost/package.nix @@ -265,7 +265,7 @@ buildMattermost rec { buildPhase = '' runHook preBuild - for ws in platform/{types,client,components,shared} channels; do + for ws in platform/{types,client,shared,components} channels; do if [ -d "$ws" ]; then npm run build --workspace="$ws" fi diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix index 45685a9cfc8a..e0fd905a82d2 100644 --- a/pkgs/by-name/ma/mattermostLatest/package.nix +++ b/pkgs/by-name/ma/mattermostLatest/package.nix @@ -15,10 +15,10 @@ mattermost.override ( # and make sure the version regex is up to date here. # Ensure you also check ../mattermost/package.nix for ESR releases. regex = "^v(11\\.[0-9]+\\.[0-9]+)$"; - version = "11.7.0"; - srcHash = "sha256-oH9bLN2BPvRSWl5m3VNHBNMBXfdmkwaE9tzL7pcD1mg="; - vendorHash = "sha256-PmwwiXNaDarc1H7z1G4zstgs7tvmZ/d7V5eGqMh1VX4="; - npmDepsHash = "sha256-C3vfWW2hMOMnrPn1538kT+ma09T9VswrmADV/KPkrPc="; + version = "11.8.1"; + srcHash = "sha256-9EIbTwnEeZQKg5uixkMp3sp/n+9I2N9W7hxsW5juF3M="; + vendorHash = "sha256-F2QMrLbio7812ZTGQZZPTqHWtIXbwbDmjUhtvv0DJ9s="; + npmDepsHash = "sha256-9GRM0VXrh1eR16ocSGEV/F2eflOflzkhrhRRnm9uB6s="; autoUpdate = ./package.nix; }; } From bff3d1a971098e1a7e2ae1c7a1de31f7e04a1d66 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Mon, 15 Jun 2026 21:38:42 +0200 Subject: [PATCH 017/115] libgit2: add withExperimentalSha256 argument --- pkgs/by-name/li/libgit2/package.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/by-name/li/libgit2/package.nix b/pkgs/by-name/li/libgit2/package.nix index 568fa09201aa..c17240378a92 100644 --- a/pkgs/by-name/li/libgit2/package.nix +++ b/pkgs/by-name/li/libgit2/package.nix @@ -17,6 +17,7 @@ gitstatus, llhttp, withGssapi ? false, + withExperimentalSha256 ? false, krb5, }: @@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: { "-DUSE_HTTP_PARSER=llhttp" "-DUSE_SSH=ON" (lib.cmakeBool "USE_GSSAPI" withGssapi) + (lib.cmakeBool "EXPERIMENTAL_SHA256" withExperimentalSha256) "-DBUILD_SHARED_LIBS=${if staticBuild then "OFF" else "ON"}" ] ++ lib.optionals stdenv.hostPlatform.isWindows [ @@ -89,6 +91,13 @@ stdenv.mkDerivation (finalAttrs: { ) ''; + postInstall = lib.optionalString withExperimentalSha256 '' + # Downstream Rust bindings (git2-rs / git2-sys) expect experimental headers + # to be located at 'git2/experimental.h', but upstream libgit2 installs them + # into 'git2-experimental/' when EXPERIMENTAL_SHA256 is enabled. + ln -s git2-experimental $dev/include/git2 + ''; + passthru.tests = lib.mapAttrs (_: v: v.override { libgit2 = finalAttrs.finalPackage; }) { inherit libgit2-glib; inherit (python3Packages) pygit2; From 78067eb5942286a9ade63cdfc6c107c9710b563f Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Sun, 14 Jun 2026 12:18:42 +0200 Subject: [PATCH 018/115] gram: 2.1.2 -> 2.2.0 Changelog: https://codeberg.org/GramEditor/gram/releases/tag/2.2.0 --- pkgs/by-name/gr/gram/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/gr/gram/package.nix b/pkgs/by-name/gr/gram/package.nix index 6d6f84306f33..48a4664be6fd 100644 --- a/pkgs/by-name/gr/gram/package.nix +++ b/pkgs/by-name/gr/gram/package.nix @@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "gram"; - version = "2.1.2"; + version = "2.2.0"; outputs = [ "out" @@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: { owner = "GramEditor"; repo = "gram"; tag = finalAttrs.version; - hash = "sha256-7FzAvC/JMMIFcuTGkL2Ju644UAIsneOMhiDUFnQske4="; + hash = "sha256-w0uZ2qAc3Tt6QVRAX97LWW9aOs02fG1SEYCDhpUhinE="; }; postPatch = '' @@ -54,7 +54,7 @@ rustPlatform.buildRustPackage (finalAttrs: { --replace-fail '$CARGO_ABOUT_VERSION' '${cargo-about.version}' ''; - cargoHash = "sha256-feESY8ALSG3xa906HBc4pOKGerQ1jF7VUxzvUcsZbrY="; + cargoHash = "sha256-+lmDbawAIRllC7LzGJ9qPMtHXPd5aMoul47YOA7nfXA="; __structuredAttrs = true; @@ -71,7 +71,7 @@ rustPlatform.buildRustPackage (finalAttrs: { dontUseCmakeConfigure = true; buildInputs = [ - libgit2 + (libgit2.override { withExperimentalSha256 = true; }) openssl sqlite zlib From 2e23af70a8e4528205b3f45472bdb5007e4ab0bc Mon Sep 17 00:00:00 2001 From: Oskar Philipsson Date: Mon, 17 Nov 2025 08:51:40 +0100 Subject: [PATCH 019/115] nixos/systemd-initrd: add systemd.*.services.path to initrd store --- nixos/modules/system/boot/systemd/initrd.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix index f242cb8c6a5b..6a52b920c2e2 100644 --- a/nixos/modules/system/boot/systemd/initrd.nix +++ b/nixos/modules/system/boot/systemd/initrd.nix @@ -124,6 +124,16 @@ let jobScripts = concatLists ( mapAttrsToList (_: unit: unit.jobScripts or [ ]) (filterAttrs (_: v: v.enable) cfg.services) ); + unitEnv = pkgs.buildEnv { + name = "initrd-unit-env"; + paths = concatLists ( + mapAttrsToList (_: unit: unit.path or [ ]) (filterAttrs (_: v: v.enable) cfg.services) + ); + pathsToLink = [ + "/bin" + "/sbin" + ]; + }; stage1Units = generateUnits { type = "initrd"; @@ -636,6 +646,7 @@ in "${pkgs.bashNonInteractive}/bin" ] ++ jobScripts + ++ [ unitEnv ] ++ map (c: removeAttrs c [ "text" ]) (builtins.attrValues cfg.contents) ++ lib.optional (pkgs.stdenv.hostPlatform.libc == "glibc") "${pkgs.glibc}/lib/libnss_files.so.2"; From 15db6b4ed23e8415dc3ed3bfc74f31100e24bb75 Mon Sep 17 00:00:00 2001 From: Ghastrum Date: Tue, 16 Jun 2026 15:26:23 +0200 Subject: [PATCH 020/115] maintainers: add ghastrum --- maintainers/maintainer-list.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 037d762a9343..1dcbc84c4bc4 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -9876,6 +9876,12 @@ githubId = 3217744; name = "Peter Ferenczy"; }; + ghastrum = { + name = "Dennis Malmin"; + email = "dennis.malmin@tuta.com"; + github = "Ghastrum"; + githubId = 276720856; + }; ghostbuster91 = { name = "Kasper Kondzielski"; email = "kghost0@gmail.com"; From 1b9a6da5308093176671da1b169f4e627f23822c Mon Sep 17 00:00:00 2001 From: Ethan Carter Edwards Date: Tue, 16 Jun 2026 12:49:31 -0700 Subject: [PATCH 021/115] python3Packages.mne: remove pytestFlag + typo Signed-off-by: Ethan Carter Edwards --- pkgs/development/python-modules/mne/default.nix | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/pkgs/development/python-modules/mne/default.nix b/pkgs/development/python-modules/mne/default.nix index c1efad30c8fb..7a767a48fd63 100644 --- a/pkgs/development/python-modules/mne/default.nix +++ b/pkgs/development/python-modules/mne/default.nix @@ -32,6 +32,8 @@ buildPythonPackage rec { version = "1.12.1"; pyproject = true; + __structuredAttrs = true; + src = fetchFromGitHub { owner = "mne-tools"; repo = "mne-python"; @@ -99,11 +101,6 @@ buildPythonPackage rec { "test_sys_info_basic" ]; - pytestFlag = [ - # removes 700k lines from pytest log, remove this when scipy is at v1.17.0 - "--disable-warnings" - ]; - disabledTestMarks = [ "slowtest" "ultraslowtest" From aa4336b4d04faf6854e045ab853ef8381fe1f017 Mon Sep 17 00:00:00 2001 From: Nadir Ishiguro <23151917+nadir-ishiguro@users.noreply.github.com> Date: Fri, 29 May 2026 22:45:12 +0200 Subject: [PATCH 022/115] plakar: 1.0.6 -> 1.1.3 Done: - don't skip test "TestExecuteCmdMountDefault" - skip test "TestRebuildStateVersionMismatch" - add `__darwinAllowLocalNetworking = true;` to avoid having all the Test(Get|Set|Validate)Service.* tests fail on Darwin Changelogs: - https://github.com/PlakarKorp/plakar/releases/tag/v1.1.3 - https://github.com/PlakarKorp/plakar/releases/tag/v1.1.2 - https://github.com/PlakarKorp/plakar/releases/tag/v1.1.1 - https://github.com/PlakarKorp/plakar/releases/tag/v1.1.0 --- pkgs/by-name/pl/plakar/package.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/pl/plakar/package.nix b/pkgs/by-name/pl/plakar/package.nix index 584908cb2aae..40aa2121fd10 100644 --- a/pkgs/by-name/pl/plakar/package.nix +++ b/pkgs/by-name/pl/plakar/package.nix @@ -8,16 +8,19 @@ }: buildGo125Module (finalAttrs: { pname = "plakar"; - version = "1.0.6"; + version = "1.1.3"; + + # to avoid having all the Test(Get|Set|Validate)Service.* tests fail on darwin + __darwinAllowLocalNetworking = true; src = fetchFromGitHub { owner = "PlakarKorp"; repo = "plakar"; tag = "v${finalAttrs.version}"; - hash = "sha256-X8m2dXMb+cxWBbKm0MhhY2pNSBTUONyHoPnGlDG9jOg="; + hash = "sha256-AQyE8VtTdkuevBVMLDfhN1h6/DirdhLgPu+76QfRUas="; }; - vendorHash = "sha256-6MdwUJTu9QvqZ3iGEg39L5B5mce7JssFTF3ZmoTuH3M="; + vendorHash = "sha256-nueFE6Ka1dq4Rt+Qs9YJU9N+yYfEyA8jkVGC4vKLjSI="; buildInputs = [ fuse @@ -30,8 +33,8 @@ buildGo125Module (finalAttrs: { checkFlags = let skippedTests = [ - # mount: fusermount: exec: "fusermount": executable file not found in $PATH - "TestExecuteCmdMountDefault" + # hangs even outside Nix, so probably an upstream issue: + "TestRebuildStateVersionMismatch" ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ "TestBTreeScanMemory" From 6c0230116b8c9baabdc1dfec5e9b93b9e75a9fe9 Mon Sep 17 00:00:00 2001 From: Nadir Ishiguro <23151917+nadir-ishiguro@users.noreply.github.com> Date: Mon, 15 Jun 2026 19:37:36 +0200 Subject: [PATCH 023/115] plakar: add nadir-ishiguro to maintainers --- pkgs/by-name/pl/plakar/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/pl/plakar/package.nix b/pkgs/by-name/pl/plakar/package.nix index 40aa2121fd10..1754b9420be0 100644 --- a/pkgs/by-name/pl/plakar/package.nix +++ b/pkgs/by-name/pl/plakar/package.nix @@ -56,6 +56,7 @@ buildGo125Module (finalAttrs: { maintainers = with lib.maintainers; [ heph2 qbit + nadir-ishiguro ]; }; }) From f73e79198fcd9497f7ee48c604ab4f08d51db943 Mon Sep 17 00:00:00 2001 From: Ghastrum Date: Tue, 16 Jun 2026 15:26:36 +0200 Subject: [PATCH 024/115] fetch: init at 2.1.0 --- pkgs/by-name/fe/fetch/package.nix | 45 +++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 pkgs/by-name/fe/fetch/package.nix diff --git a/pkgs/by-name/fe/fetch/package.nix b/pkgs/by-name/fe/fetch/package.nix new file mode 100644 index 000000000000..13e80e78d502 --- /dev/null +++ b/pkgs/by-name/fe/fetch/package.nix @@ -0,0 +1,45 @@ +{ + lib, + stdenv, + fetchFromGitHub, + # linux dependencies + makeWrapper, + fastfetch, + pciutils, +}: + +stdenv.mkDerivation (finalAttrs: { + pname = "fetch"; + version = "2.1.0"; + __structuredAttrs = true; + strictDeps = true; + + src = fetchFromGitHub { + owner = "areofyl"; + repo = "fetch"; + tag = "v${finalAttrs.version}"; + hash = "sha256-9ixx7XJcY4ktcN/lUfjvFljvHIEO2ktOebeGgL0ulHg="; + }; + + makeFlags = [ "PREFIX=${placeholder "out"}" ]; + nativeBuildInputs = [ makeWrapper ]; + postInstall = '' + wrapProgram $out/bin/fetch \ + --prefix PATH : ${ + lib.makeBinPath [ + fastfetch + pciutils + ] + } + ''; + + meta = { + description = "Animated 3D fetch tool that renders your distro logo as a spinning bas-relief"; + homepage = "https://github.com/areofyl/fetch"; + changelog = "https://github.com/areofyl/fetch/releases/tag/${finalAttrs.src.tag}"; + license = lib.licenses.isc; + maintainers = with lib.maintainers; [ ghastrum ]; + mainProgram = "fetch"; + platforms = lib.platforms.linux; + }; +}) From c5619642a1435cbf0a2c3ac1292c32802870981b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Wed, 17 Jun 2026 23:13:14 +0200 Subject: [PATCH 025/115] intel-graphics-compiler: 2.34.4 -> 2.36.3 Changelog: https://github.com/intel/intel-graphics-compiler/releases/tag/v2.35.5 Changelog: https://github.com/intel/intel-graphics-compiler/releases/tag/v2.36.3 --- .../intel-graphics-compiler/bump-cmake.patch | 45 ------------------- .../in/intel-graphics-compiler/package.nix | 36 +++++++++------ 2 files changed, 22 insertions(+), 59 deletions(-) delete mode 100644 pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch diff --git a/pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch b/pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch deleted file mode 100644 index 2a15e8acd780..000000000000 --- a/pkgs/by-name/in/intel-graphics-compiler/bump-cmake.patch +++ /dev/null @@ -1,45 +0,0 @@ -From bc76a7087e4621269bdf9080581088a6c8f6b3a6 Mon Sep 17 00:00:00 2001 -From: Chris Mayo -Date: Tue, 20 May 2025 19:27:57 +0100 -Subject: [PATCH] Raise minimum CMake version to 3.5 - -For compatibility with CMake 4.0, which also removes CMP0043 OLD - there -are no uses of COMPILE_DEFINITIONS_. - -Signed-off-by: Chris Mayo ---- - external/SPIRV-Tools/CMakeLists.txt | 2 +- - visa/CMakeLists.txt | 7 +------ - visa/iga/GEDLibrary/GED_external/CMakeLists.txt | 6 +----- - 4 files changed, 4 insertions(+), 13 deletions(-) - -diff --git a/external/SPIRV-Tools/CMakeLists.txt b/external/SPIRV-Tools/CMakeLists.txt -index d2e3f63fb0d3..75f013409990 100644 ---- a/igc/external/SPIRV-Tools/CMakeLists.txt -+++ b/igc/external/SPIRV-Tools/CMakeLists.txt -@@ -6,7 +6,7 @@ - # - #============================ end_copyright_notice ============================= - --cmake_minimum_required(VERSION 2.8.12) -+cmake_minimum_required(VERSION 3.5) - - message(STATUS "============================ SPIRV-Tools project ============================") - -diff --git a/visa/iga/GEDLibrary/GED_external/CMakeLists.txt b/visa/iga/GEDLibrary/GED_external/CMakeLists.txt -index e40313fc1944..275fff1114a6 100644 ---- a/igc/visa/iga/GEDLibrary/GED_external/CMakeLists.txt -+++ b/igc/visa/iga/GEDLibrary/GED_external/CMakeLists.txt -@@ -7,11 +7,7 @@ - #============================ end_copyright_notice ============================= - - # GEDLibrary/GED --if(WIN32) -- cmake_minimum_required(VERSION 3.1) --else() -- cmake_minimum_required(VERSION 2.8.12) --endif(WIN32) -+cmake_minimum_required(VERSION 3.5) - - project(GEDLibrary) - diff --git a/pkgs/by-name/in/intel-graphics-compiler/package.nix b/pkgs/by-name/in/intel-graphics-compiler/package.nix index 3c0a5c6c5eaf..99398395bf78 100644 --- a/pkgs/by-name/in/intel-graphics-compiler/package.nix +++ b/pkgs/by-name/in/intel-graphics-compiler/package.nix @@ -11,15 +11,28 @@ intel-compute-runtime, python3, spirv-tools, - spirv-headers, }: let - llvmVersion = "16.0.6"; + llvmVersion = "17.0.6"; + + spirv-headers = stdenv.mkDerivation { + pname = "spirv-headers"; + version = "1.4.341.0-unstable-2026-04-29"; + + src = fetchFromGitHub { + owner = "KhronosGroup"; + repo = "SPIRV-Headers"; + rev = "b8a32968473ce852a809b9de5f04f02a5a9dfa78"; + hash = "sha256-k5lAF7TxJ+8cXDnx7lQxG/3IjSTzYcqBl5PYY2gv9E8="; + }; + + nativeBuildInputs = [ cmake ]; + }; in stdenv.mkDerivation rec { pname = "intel-graphics-compiler"; - version = "2.34.4"; + version = "2.36.3"; # See the repository for expected versions: # @@ -29,14 +42,14 @@ stdenv.mkDerivation rec { owner = "intel"; repo = "intel-graphics-compiler"; tag = "v${version}"; - hash = "sha256-w20nrn3wo9Dvv3BILYBzuJTTLXqcWaRAF7SiPtryhwk="; + hash = "sha256-0GzZQECcngF9b5lZyeIKXeM6w64WzCYFtHOobQKN80o="; }) (fetchFromGitHub { name = "llvm-project"; owner = "llvm"; repo = "llvm-project"; tag = "llvmorg-${llvmVersion}"; - hash = "sha256-fspqSReX+VD+Nl/Cfq+tDcdPtnQPV1IRopNDfd5VtUs="; + hash = "sha256-8MEDLLhocshmxoEBRSKlJ/GzJ8nfuzQ8qn0X/vLA+ag="; }) (fetchFromGitHub { name = "vc-intrinsics"; @@ -49,24 +62,19 @@ stdenv.mkDerivation rec { name = "opencl-clang"; owner = "intel"; repo = "opencl-clang"; - tag = "v16.0.11"; - hash = "sha256-ema1jTNMHs3pUituVb1NPllc6cA8eYJHtDOjuEzIDWM="; + tag = "v17.0.7"; + hash = "sha256-7kQlH1Y4pnNvj/CS2qAVbYUl9FQWBuMew7i8CpORfKE="; }) (fetchFromGitHub { name = "llvm-spirv"; owner = "KhronosGroup"; repo = "SPIRV-LLVM-Translator"; - tag = "v16.0.24"; - hash = "sha256-aTcwfQt2WdOA44jfHdD7x7oxt8emSDexgZnI7MPVqvU="; + tag = "v17.0.24"; + hash = "sha256-s/dNWmT3KXdXK0CSVjqEfsY9r8ONAGMZ5KUy9FeqF0E="; }) ]; patches = [ - # Raise minimum CMake version to 3.5 - # https://github.com/intel/intel-graphics-compiler/commit/4f0123a7d67fb716b647f0ba5c1ab550abf2f97d - # https://github.com/intel/intel-graphics-compiler/pull/364 - ./bump-cmake.patch - # Fix for GCC 15 by adding a previously-implicit `#include ` and # replacing `` with `` in the the llvm directory. Based # on https://github.com/intel/intel-graphics-compiler/pull/383. From 167a0b78ea6ca7a573bd439a43be5b75804d77b0 Mon Sep 17 00:00:00 2001 From: Anders Kaseorg Date: Wed, 17 Jun 2026 23:21:51 -0700 Subject: [PATCH 026/115] =?UTF-8?q?openafs:=201.8.15=20=E2=86=92=201.8.16?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Anders Kaseorg --- pkgs/by-name/op/openafs/module.nix | 63 ------------------------------ pkgs/by-name/op/openafs/srcs.nix | 6 +-- 2 files changed, 3 insertions(+), 66 deletions(-) diff --git a/pkgs/by-name/op/openafs/module.nix b/pkgs/by-name/op/openafs/module.nix index 8c88b291b7bd..234498b7b3dc 100644 --- a/pkgs/by-name/op/openafs/module.nix +++ b/pkgs/by-name/op/openafs/module.nix @@ -28,69 +28,6 @@ stdenv.mkDerivation { inherit src; patches = [ - # Linux: Use get_tree_nodev - (fetchpatch { - url = "https://github.com/openafs/openafs/commit/c02a8f451b48766aa163e729abe40d145751b2dc.patch"; - hash = "sha256-9okSQLV4tW1wjoffQXPneZbu6tTRqrqVPbEOwZmaD+E="; - }) - # LINUX: Re-dirty folio on writepages recursion - (fetchpatch { - url = "https://github.com/openafs/openafs/commit/11849e96820eca64d91742a8c521614e1e99d9fa.patch"; - hash = "sha256-F2MOqEDaj4e0Xj1mvs7v61cutZY3cO22p9iIp2bLiRQ="; - }) - # Linux: Introduce LINUX_WRITE_CACHE_PAGES_USES_FOLIOS - (fetchpatch { - url = "https://github.com/openafs/openafs/commit/63a3503240c06187fa87514e5ea421cece483422.patch"; - hash = "sha256-ZWV8IZ8CeFQaEOamqKfkXuUccSxCRFNkZ7/kxKbEuis="; - }) - # Linux: Avoid write_cache_pages() for ->writepages() - (fetchpatch { - url = "https://gerrit.openafs.org/changes/16704/revisions/d465a07a98c2b0b2c23780571a8fe70c2584473a/patch"; - decode = "base64 -d"; - hash = "sha256-2FOf+o36gbTHm90RxtOI7iXcgb6rv9nh9rSjZzL5O7A="; - }) - # LINUX: Log warning on recursive folio writeback - (fetchpatch { - url = "https://gerrit.openafs.org/changes/16705/revisions/d66ca6372461840c6ecaaa46ec293640c8f22573/patch"; - decode = "base64 -d"; - hash = "sha256-A383wDMkwnGFatBDHUGV8FVqPMjzvhqUnIWrP2C+ym4="; - }) - # Linux: Move afs_root()/afs_fill_super() in osi_vfsops - (fetchpatch { - url = "https://gerrit.openafs.org/changes/16706/revisions/988c70859f1d402022e9342e28f0c5a954760a72/patch"; - decode = "base64 -d"; - hash = "sha256-JsZwGGa7dRT43RIUUY3hYCbbqPObd5bkDOHl9QK/MhE="; - }) - # Linux: Use sockaddr_unsized for socket->ops->bind - (fetchpatch { - url = "https://gerrit.openafs.org/changes/16707/revisions/e6069d6c35e848b5b388f4c47a2ecf0d72420198/patch"; - decode = "base64 -d"; - hash = "sha256-hTRaTqOc0njW/RIsNTrFZ5uWTrQq04Fuh/Sk7K2Q5e4="; - }) - # Linux: Pass 3rd parameter to filemap_alloc_folio() - (fetchpatch { - url = "https://gerrit.openafs.org/changes/16708/revisions/48d2184ec95418cada68b70919b0afd9888bb945/patch"; - decode = "base64 -d"; - hash = "sha256-CSGlXYkkLSHQoWK2xLpUYJDOUP/mlsxkTru2qdmbeQo="; - }) - # Linux: implement aops->migrate_folio - (fetchpatch { - url = "https://gerrit.openafs.org/changes/16709/revisions/2c51471aea08cc495a5d59fee6e651ba58c9d772/patch"; - decode = "base64 -d"; - hash = "sha256-TtcblVczSp8b1bfd0ajWjK2LffAkgYr2+KUL2nEe8hs="; - }) - # Linux: Use set_default_d_op() to set dentry ops - (fetchpatch { - url = "https://gerrit.openafs.org/changes/16729/revisions/6d0a2107fcab28fc4ba64d365133d171b75bd3dc/patch"; - decode = "base64 -d"; - hash = "sha256-OKxR5zzVKSXPzudPl5jc7koObisQMMqq/d9kfrMem/M="; - }) - # Linux: Use __getname()/__putname() to alloc name - (fetchpatch { - url = "https://gerrit.openafs.org/changes/16738/revisions/a1754489f382aabd087f14c325d13a36faa5bf5c/patch"; - decode = "base64 -d"; - hash = "sha256-JizLrwnujybCkcbDIltGfgVtCc5fL3ZxWvgVbI1kKto="; - }) ]; nativeBuildInputs = [ diff --git a/pkgs/by-name/op/openafs/srcs.nix b/pkgs/by-name/op/openafs/srcs.nix index 596198b13cfc..28de72ebe14d 100644 --- a/pkgs/by-name/op/openafs/srcs.nix +++ b/pkgs/by-name/op/openafs/srcs.nix @@ -1,16 +1,16 @@ { fetchurl }: rec { - version = "1.8.15"; + version = "1.8.16"; src = fetchurl { url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-src.tar.bz2"; - hash = "sha256-MvEN0kG12LhG5CWrnL8nW1VroYgL9998RZzZ60kFg1U="; + hash = "sha256-7oEnaJdXy9lyOoU6EvrigcnenD6JSkvZAQf7b4UnBGk="; }; srcs = [ src (fetchurl { url = "https://www.openafs.org/dl/openafs/${version}/openafs-${version}-doc.tar.bz2"; - hash = "sha256-kAGRw3T0VdJ/XMqqFjV0Z7gzKbWeyZWEsMsBJ+7ijsE="; + hash = "sha256-F9fyLe5Ofs6Ri4MXlO63wOZmhZuY8FAh2P/aoAX5wiQ="; }) ]; } From 1008c97051459df1098806565922bf8012d63330 Mon Sep 17 00:00:00 2001 From: Anders Kaseorg Date: Wed, 17 Jun 2026 23:24:53 -0700 Subject: [PATCH 027/115] linuxPackages.openafs: Patch for Linux kernel 7.1 Signed-off-by: Anders Kaseorg --- pkgs/by-name/op/openafs/module.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/by-name/op/openafs/module.nix b/pkgs/by-name/op/openafs/module.nix index 234498b7b3dc..d9c455f5db41 100644 --- a/pkgs/by-name/op/openafs/module.nix +++ b/pkgs/by-name/op/openafs/module.nix @@ -28,6 +28,16 @@ stdenv.mkDerivation { inherit src; patches = [ + # Linux: pagevec.h renamed to folio_batch.h + (fetchpatch { + url = "https://github.com/openafs/openafs/commit/d47c438aec49e417066a7bef00bd82078014f5ea.patch"; + hash = "sha256-LPURZovpl6KbigzP4mNjgHvPlXYKY5Pxh8sj9RT2W08="; + }) + # Linux: Add comment for d_alias configure test + (fetchpatch { + url = "https://github.com/openafs/openafs/commit/fd157926f08d10afe981d85654395bbf083ea7a3.patch"; + hash = "sha256-gJ+ylIEZwJcpTWc5hmIXS/QcxtICqjaEzZsl2QegjhY="; + }) ]; nativeBuildInputs = [ From 83d06f84aefe9658990293f640a7776076a28a88 Mon Sep 17 00:00:00 2001 From: Al McElrath Date: Wed, 17 Jun 2026 10:01:34 -0700 Subject: [PATCH 028/115] lan-mouse: 0.10.0 -> 0.11.0 --- pkgs/by-name/la/lan-mouse/package.nix | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/pkgs/by-name/la/lan-mouse/package.nix b/pkgs/by-name/la/lan-mouse/package.nix index 97acca9f355b..0c086a58ef8a 100644 --- a/pkgs/by-name/la/lan-mouse/package.nix +++ b/pkgs/by-name/la/lan-mouse/package.nix @@ -14,24 +14,13 @@ rustPlatform.buildRustPackage rec { pname = "lan-mouse"; - version = "0.10.0"; + version = "0.11.0"; src = fetchFromGitHub { owner = "feschber"; repo = "lan-mouse"; rev = "v${version}"; - hash = "sha256-ofiNgJbmf35pfRvZB3ZmMkCJuM7yYgNL+Dd5mZZqyNk="; - }; - - # lan-mouse uses `git` to determine the version at build time and - # has Cargo set the `GIT_DESCRIBE` environment variable. To improve - # build reproducibility, we define the variable based on the package - # version instead. - prePatch = '' - rm build.rs - ''; - env = { - GIT_DESCRIBE = "${version}-nixpkgs"; + hash = "sha256-6EqA9WfiukOymUT4FkNdMvzmFKByW0LLoI/9sv4TzBU="; }; nativeBuildInputs = [ @@ -47,7 +36,7 @@ rustPlatform.buildRustPackage rec { libxtst ]; - cargoHash = "sha256-+UXRBYfbkb114mwDGj36oG5ZT3TQtcEzsbyZvtWTMxM="; + cargoHash = "sha256-Lxs0qWvNAv4KCeJ+cDBYBzwlbJfQJshcxPRdg9w0szc="; postInstall = '' install -Dm444 de.feschber.LanMouse.desktop -t $out/share/applications From 494b92013764b1e576cdcc4231c31140c949adc6 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Thu, 18 Jun 2026 21:17:37 +0200 Subject: [PATCH 029/115] ruff: 0.15.17 -> 0.15.18 Changelog: https://github.com/astral-sh/ruff/releases/tag/0.15.18 Diff: https://github.com/astral-sh/ruff/compare/0.15.17...0.15.18 --- pkgs/by-name/ru/ruff/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix index 8aa8f51b8273..ca5d02475508 100644 --- a/pkgs/by-name/ru/ruff/package.nix +++ b/pkgs/by-name/ru/ruff/package.nix @@ -16,7 +16,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ruff"; - version = "0.15.17"; + version = "0.15.18"; __structuredAttrs = true; @@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: { owner = "astral-sh"; repo = "ruff"; tag = finalAttrs.version; - hash = "sha256-+UsKRBe+lp/LdsmK/W11wCt2RypEryA5eBPb01OKCJw="; + hash = "sha256-DH00tENXdCdNcGPXPGzZsU3RVYQ0VBe1QLvbgEg/G6k="; }; cargoBuildFlags = [ "--package=ruff" ]; - cargoHash = "sha256-y1sKf+KXya/K+WUiIE357U6DXh/d+AQgj0SQIi1gpUw="; + cargoHash = "sha256-RmK14NMPbhoRVLwIF5GXdGQg2AnMH20JGx7XF4HO+wY="; nativeBuildInputs = [ installShellFiles ]; From bc7d3e5dda98e8bb1a813b817f327372cb26f5a1 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Thu, 18 Jun 2026 22:23:52 +0100 Subject: [PATCH 030/115] bind: 9.20.23 -> 9.20.24 Changes: https://bind9.readthedocs.io/en/bind-9.20/notes.html#notes-for-bind-9-20-24 --- pkgs/by-name/bi/bind/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/bi/bind/package.nix b/pkgs/by-name/bi/bind/package.nix index 2f12ebf30ea0..c47a0cb1433e 100644 --- a/pkgs/by-name/bi/bind/package.nix +++ b/pkgs/by-name/bi/bind/package.nix @@ -29,11 +29,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "bind"; - version = "9.20.23"; + version = "9.20.24"; src = fetchurl { url = "https://downloads.isc.org/isc/bind9/${finalAttrs.version}/bind-${finalAttrs.version}.tar.xz"; - hash = "sha256-XUR1rtP55QDvVUsrFNlyvbg9M94hSps76SkY6kaQg3E="; + hash = "sha256-mJ/vH8iOpZ0EzYb4VNylpGFqIKmWi83ePBo2aKs2vgg="; }; outputs = [ From f35704a496985c19a04ca51e5963d354a78182b3 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Thu, 18 Jun 2026 18:44:16 +0200 Subject: [PATCH 031/115] ty: 0.0.49 -> 0.0.51 Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.51 Diff: https://github.com/astral-sh/ty/compare/0.0.49...0.0.51 --- pkgs/by-name/ty/ty/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix index 41db756b4492..8a3b04bc7a09 100644 --- a/pkgs/by-name/ty/ty/package.nix +++ b/pkgs/by-name/ty/ty/package.nix @@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ty"; - version = "0.0.49"; + version = "0.0.51"; __structuredAttrs = true; src = fetchFromGitHub { @@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: { repo = "ty"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-IKeoskueujGYFjhUd3V7iwKwZjFZqG3OYfe36S6J2aw="; + hash = "sha256-99CucCCZ8oOQV1PaPLZXq++8S7d6QJSAaQq/WXP87n4="; }; # For Darwin platforms, remove the integration test for file notifications, @@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoBuildFlags = [ "--package=ty" ]; - cargoHash = "sha256-y1sKf+KXya/K+WUiIE357U6DXh/d+AQgj0SQIi1gpUw="; + cargoHash = "sha256-N76A6howQn/ZbDJ7PWrThDYKhH+vc7tnZPShR7T31Ug="; nativeBuildInputs = [ installShellFiles ]; buildInputs = [ rust-jemalloc-sys ]; From d8b16de49ddea3c9fea3d9fe3c447cf0effd35fc Mon Sep 17 00:00:00 2001 From: Yureka Date: Fri, 19 Jun 2026 12:04:18 +0200 Subject: [PATCH 032/115] nixos: fix message on failure to determine mmap ASLR entropy Previously the script would stop early without any explanation. Now it continues to the point where the proper error message is printed, and then exits with an error exit status. --- nixos/modules/config/sysctl.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix index df4165fbbec5..05f99aff70f4 100644 --- a/nixos/modules/config/sysctl.nix +++ b/nixos/modules/config/sysctl.nix @@ -74,7 +74,9 @@ in } ( '' + set +e mmap_rnd_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$") + set -e if [[ -z "$mmap_rnd_bits_max" ]]; then echo "Unable to determine mmap_rnd_bits_max. Check your kernel configfile is valid." exit 1 @@ -83,7 +85,9 @@ in '' # HAVE_ARCH_MMAP_RND_COMPAT_BITS is not defined on 32-bit architectures or LoongArch64 + lib.optionalString (with pkgs.stdenv.hostPlatform; (!is32bit && !isLoongArch64)) '' + set +e mmap_rnd_compat_bits_max=$(grep "^CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=" $configfile | grep --only-matching "[0-9]*$") + set -e if [[ -z "$mmap_rnd_compat_bits_max" ]]; then echo "Unable to determine mmap_rnd_compat_bits_max. Check your kernel configfile is valid." exit 1 From 628ef44091749cf93efd06eb5c3caa7385b63920 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 19 Jun 2026 13:09:13 +0000 Subject: [PATCH 033/115] basedpyright: 1.39.7 -> 1.39.8 --- pkgs/by-name/ba/basedpyright/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix index 4196aae7a9ee..c539c185124a 100644 --- a/pkgs/by-name/ba/basedpyright/package.nix +++ b/pkgs/by-name/ba/basedpyright/package.nix @@ -18,13 +18,13 @@ buildNpmPackage rec { pname = "basedpyright"; - version = "1.39.7"; + version = "1.39.8"; src = fetchFromGitHub { owner = "detachhead"; repo = "basedpyright"; tag = "v${version}"; - hash = "sha256-E4TR5deuPSf2YinrEzpP79Rq8zZHLJQUKiEsfUdMDOE="; + hash = "sha256-8S83CTd/td7USKxfCI0cXd2gPBMivi4QMRQwVgxhs6w="; }; npmDepsHash = "sha256-humpJB+fv3+PITcPCz3uY2jNANb3P7sXy0lFP8Eg58I="; From ad3e95b0931c8c618dc3fd017174fd97302c5538 Mon Sep 17 00:00:00 2001 From: Ilan Joselevich Date: Fri, 19 Jun 2026 12:36:40 +0300 Subject: [PATCH 034/115] switch-to-configuration-ng: handle socket-activated Accept=yes services A per-connection instance spawned by an Accept=yes socket (e.g. foo@1234.service) has an implicit socket of foo.socket, but the implicit name was derived from the template base name including the trailing "@", yielding foo@.socket. That never matches an active unit, so such running instances were treated as non-socket-activated and the activation script tried to start them directly on a configuration switch. That fails because there is no connection socket to pass, sending the instance into a restart loop. Strip the trailing "@" so the implicit socket resolves correctly; the running instances are then stopped and their socket restarted, leaving systemd to spawn fresh instances for new connections. Resolves: https://github.com/NixOS/nixpkgs/issues/533205 Assisted-by: Claude:claude-opus-4-8 --- nixos/tests/switch-test.nix | 64 +++++++++++++++++++ .../sw/switch-to-configuration-ng/src/main.rs | 6 +- 2 files changed, 69 insertions(+), 1 deletion(-) diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix index 2dbc9386f8ae..63dc78e2e6dc 100644 --- a/nixos/tests/switch-test.nix +++ b/nixos/tests/switch-test.nix @@ -43,6 +43,19 @@ let server.serve_forever() ''; + # Per-connection (Accept=yes) socket-activated service that requires the + # connection socket to be passed via socket activation and fails when started + # without one. It greets the client and stays alive for as long as the + # connection is held open. + acceptSocketTest = pkgs.writeShellScript "accept-socket-test.sh" '' + if [ "''${LISTEN_FDS:-0}" -lt 1 ]; then + echo "Expected exactly one socket, got 0" >&2 + exit 4 + fi + printf hello >&3 + exec ${lib.getExe' pkgs.coreutils "cat"} <&3 >/dev/null + ''; + in { name = "switch-test"; @@ -508,6 +521,26 @@ in }; }; + accept-socket.configuration = { + systemd.sockets.accept-socket = { + wantedBy = [ "sockets.target" ]; + listenStreams = [ "/run/accept-test.sock" ]; + socketConfig = { + Accept = "yes"; + SocketMode = "0777"; + }; + }; + systemd.services."accept-socket@" = { + description = "A per-connection socket-activated service"; + serviceConfig.ExecStart = acceptSocketTest; + }; + }; + + accept-socket-service-modified.configuration = { + imports = [ accept-socket.configuration ]; + systemd.services."accept-socket@".serviceConfig.X-Test = "test"; + }; + mount.configuration = { systemd.mounts = [ { @@ -1587,6 +1620,37 @@ in if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello": raise Exception("Socket was not properly activated after the service was restarted") + with subtest("socket-activated services with Accept=yes"): + # Socket-activated services don't get started, just the socket + machine.fail("[ -S /run/accept-test.sock ]") + out = switch_to_specialisation("${machine}", "accept-socket") + assert_contains(out, "the following new units were started: accept-socket.socket\n") + machine.succeed("[ -S /run/accept-test.sock ]") + + # Hold a connection open so a per-connection instance keeps running + machine.succeed("socat EXEC:'sleep infinity' UNIX-CONNECT:/run/accept-test.sock >&2 &") + instance = machine.wait_until_succeeds( + "systemctl list-units --no-legend --state=running 'accept-socket@*.service' " + + "| grep -m1 -o 'accept-socket@[^ ]*\\.service'" + ).strip() + + # Changing the templated service must stop the running instance and + # restart the socket instead of (re)starting the per-connection + # instance, which cannot be started without a connection socket + out = switch_to_specialisation("${machine}", "accept-socket-service-modified") + assert_contains(out, "stopping the following units:") + assert_contains(out, instance) + assert_contains(out, "accept-socket.socket") + assert_contains(out, "\nstarting the following units: accept-socket.socket\n") + assert_lacks(out, "NOT restarting the following changed units:") + assert_lacks(out, "\nrestarting the following units:") + # The per-connection instance must not be (re)started + starting = out[out.index("\nstarting the following units:") :] + assert instance not in starting, f"instance {instance} should not be (re)started" + # Socket-activation of the unit still works + if machine.succeed("socat - UNIX-CONNECT:/run/accept-test.sock Date: Fri, 19 Jun 2026 12:54:08 -0700 Subject: [PATCH 035/115] mdadm: 4.4 -> 4.6 Changelog: https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/tree/CHANGELOG.md?h=mdadm-4.6 --- .../md/mdadm4/no-self-references.patch | 124 ------------------ pkgs/by-name/md/mdadm4/package.nix | 16 +-- 2 files changed, 3 insertions(+), 137 deletions(-) delete mode 100644 pkgs/by-name/md/mdadm4/no-self-references.patch diff --git a/pkgs/by-name/md/mdadm4/no-self-references.patch b/pkgs/by-name/md/mdadm4/no-self-references.patch deleted file mode 100644 index 3b3dc4d84609..000000000000 --- a/pkgs/by-name/md/mdadm4/no-self-references.patch +++ /dev/null @@ -1,124 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2a51d813..a31ac48a 100644 ---- a/Makefile -+++ b/Makefile -@@ -63,6 +63,9 @@ endif - ifdef DEBIAN - CPPFLAGS += -DDEBIAN - endif -+ifdef NIXOS -+CPPFLAGS += -DNIXOS -+endif - ifdef DEFAULT_OLD_METADATA - CPPFLAGS += -DDEFAULT_OLD_METADATA - DEFAULT_METADATA=0.90 -@@ -129,6 +132,7 @@ endif - INSTALL = /usr/bin/install - DESTDIR = - BINDIR = /sbin -+INSTALL_BINDIR = ${BINDIR} - MANDIR = /usr/share/man - MAN4DIR = $(MANDIR)/man4 - MAN5DIR = $(MANDIR)/man5 -@@ -253,16 +257,16 @@ sha1.o : sha1.c sha1.h md5.h - install : install-bin install-man install-udev - - install-static : mdadm.static install-man -- $(INSTALL) -D $(STRIP) -m 755 mdadm.static $(DESTDIR)$(BINDIR)/mdadm -+ $(INSTALL) -D $(STRIP) -m 755 mdadm.static $(DESTDIR)$(INSTALL_BINDIR)/mdadm - - install-tcc : mdadm.tcc install-man -- $(INSTALL) -D $(STRIP) -m 755 mdadm.tcc $(DESTDIR)$(BINDIR)/mdadm -+ $(INSTALL) -D $(STRIP) -m 755 mdadm.tcc $(DESTDIR)$(INSTALL_BINDIR)/mdadm - - install-uclibc : mdadm.uclibc install-man -- $(INSTALL) -D $(STRIP) -m 755 mdadm.uclibc $(DESTDIR)$(BINDIR)/mdadm -+ $(INSTALL) -D $(STRIP) -m 755 mdadm.uclibc $(DESTDIR)$(INSTALL_BINDIR)/mdadm - - install-klibc : mdadm.klibc install-man -- $(INSTALL) -D $(STRIP) -m 755 mdadm.klibc $(DESTDIR)$(BINDIR)/mdadm -+ $(INSTALL) -D $(STRIP) -m 755 mdadm.klibc $(DESTDIR)$(INSTALL_BINDIR)/mdadm - - install-man: mdadm.8 md.4 mdadm.conf.5 mdmon.8 - $(INSTALL) -D -m 644 mdadm.8 $(DESTDIR)$(MAN8DIR)/mdadm.8 -@@ -305,7 +309,7 @@ install-bin: mdadm mdmon - $(INSTALL) -D $(STRIP) -m 755 mdmon $(DESTDIR)$(BINDIR)/mdmon - - uninstall: -- rm -f $(DESTDIR)$(MAN8DIR)/mdadm.8 $(DESTDIR)$(MAN8DIR)/mdmon.8 $(DESTDIR)$(MAN4DIR)/md.4 $(DESTDIR)$(MAN5DIR)/mdadm.conf.5 $(DESTDIR)$(BINDIR)/mdadm -+ rm -f $(DESTDIR)$(MAN8DIR)/mdadm.8 $(DESTDIR)$(MAN8DIR)/mdmon.8 $(DESTDIR)$(MAN4DIR)/md.4 $(DESTDIR)$(MAN5DIR)/mdadm.conf.5 $(DESTDIR)$(INSTALL_BINDIR)/mdadm - - test: mdadm mdmon test_stripe swap_super raid6check - @echo "Please run './test' as root" -diff --git a/policy.c b/policy.c -index eee9ef63..9f916e9d 100644 ---- a/policy.c -+++ b/policy.c -@@ -817,12 +817,39 @@ char *find_rule(struct rule *rule, char *rule_type) - #define UDEV_RULE_FORMAT \ - "ACTION==\"add\", SUBSYSTEM==\"block\", " \ - "ENV{DEVTYPE}==\"%s\", ENV{ID_PATH}==\"%s\", " \ --"RUN+=\"" BINDIR "/mdadm --incremental $env{DEVNAME}\"\n" -+"RUN+=\"%s/mdadm --incremental $env{DEVNAME}\"\n" - - #define UDEV_RULE_FORMAT_NOTYPE \ - "ACTION==\"add\", SUBSYSTEM==\"block\", " \ - "ENV{ID_PATH}==\"%s\", " \ --"RUN+=\"" BINDIR "/mdadm --incremental $env{DEVNAME}\"\n" -+"RUN+=\"%s/mdadm --incremental $env{DEVNAME}\"\n" -+ -+#ifdef NIXOS -+const char *get_mdadm_bindir(void) -+{ -+ static char *bindir = NULL; -+ if (bindir != NULL) { -+ return bindir; -+ } else { -+ int len; -+ bindir = xmalloc(1025); -+ len = readlink("/proc/self/exe", bindir, 1024); -+ if (len > 0) { -+ char *basename; -+ if ((basename = strrchr(bindir, '/')) != NULL) -+ *basename = '\0'; -+ else -+ *(bindir + len) = '\0'; -+ } else { -+ *bindir = '\0'; -+ } -+ return bindir; -+ } -+} -+#define SELF get_mdadm_bindir() -+#else -+#define SELF BINDIR -+#endif - - /* Write rule in the rule file. Use format from UDEV_RULE_FORMAT */ - int write_rule(struct rule *rule, int fd, int force_part) -@@ -836,9 +863,9 @@ int write_rule(struct rule *rule, int fd, int force_part) - if (force_part) - typ = type_part; - if (typ) -- snprintf(line, sizeof(line) - 1, UDEV_RULE_FORMAT, typ, pth); -+ snprintf(line, sizeof(line) - 1, UDEV_RULE_FORMAT, typ, pth, SELF); - else -- snprintf(line, sizeof(line) - 1, UDEV_RULE_FORMAT_NOTYPE, pth); -+ snprintf(line, sizeof(line) - 1, UDEV_RULE_FORMAT_NOTYPE, pth, SELF); - return write(fd, line, strlen(line)) == (int)strlen(line); - } - -diff --git a/util.c b/util.c -index 3d05d074..e004a798 100644 ---- a/util.c -+++ b/util.c -@@ -1913,7 +1913,9 @@ int start_mdmon(char *devnm) - char pathbuf[1024]; - char *paths[4] = { - pathbuf, -+#ifndef NIXOS - BINDIR "/mdmon", -+#endif - "./mdmon", - NULL - }; diff --git a/pkgs/by-name/md/mdadm4/package.nix b/pkgs/by-name/md/mdadm4/package.nix index 2143acc494e5..a35b504f6234 100644 --- a/pkgs/by-name/md/mdadm4/package.nix +++ b/pkgs/by-name/md/mdadm4/package.nix @@ -15,27 +15,16 @@ stdenv.mkDerivation (finalAttrs: { pname = "mdadm"; - version = "4.4"; + version = "4.6"; src = fetchgit { url = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git"; tag = "mdadm-${finalAttrs.version}"; - hash = "sha256-jGmc8fkJM0V9J7V7tQPXSF/WD0kzyEAloBAwaAFenS0="; + hash = "sha256-jFsVPJC4lcShkSwQCGjVdVkvk4q4weM7i5DzrLgpuSM="; }; patches = [ - ./no-self-references.patch ./fix-hardcoded-mapdir.patch - # Fixes build on musl - (fetchurl { - url = "https://raw.githubusercontent.com/void-linux/void-packages/e58d2b17d3c40faffc0d426aab00184f28d9dafa/srcpkgs/mdadm/patches/musl.patch"; - hash = "sha256-TIcQs+8RM5Q6Z8MHkI50kaJd7f9WdS/EVI16F7b2+SA="; - }) - # Fixes build on musl 1.2.5+ - (fetchurl { - url = "https://lore.kernel.org/linux-raid/20240220165158.3521874-1-raj.khem@gmail.com/raw"; - hash = "sha256-JOZ8n7zi+nq236NPpB4e2gUy8I3l3DbcoLhpeL73f98="; - }) ]; makeFlags = [ @@ -97,6 +86,7 @@ stdenv.mkDerivation (finalAttrs: { }; meta = { + changelog = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/tree/CHANGELOG.md?h=${finalAttrs.src.tag}"; description = "Programs for managing RAID arrays under Linux"; homepage = "https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git"; license = lib.licenses.gpl2Plus; From f266705e0f6a267347a06fe2b75e7c2ffeb84d00 Mon Sep 17 00:00:00 2001 From: drazere <78786391+drazere@users.noreply.github.com> Date: Fri, 19 Jun 2026 23:43:16 +0530 Subject: [PATCH 036/115] stoat-desktop: 1.3.0 -> 1.4.0 --- pkgs/by-name/st/stoat-desktop/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/st/stoat-desktop/package.nix b/pkgs/by-name/st/stoat-desktop/package.nix index 471ab1348038..c175249c7c66 100644 --- a/pkgs/by-name/st/stoat-desktop/package.nix +++ b/pkgs/by-name/st/stoat-desktop/package.nix @@ -11,23 +11,23 @@ copyDesktopItems, pnpm_10, nodejs, - electron_38, + electron_42, zip, }: let - electron = electron_38; + electron = electron_42; stdenv = stdenvNoCC; in stdenv.mkDerivation (finalAttrs: { pname = "stoat-desktop"; - version = "1.3.0"; + version = "1.4.0"; src = fetchFromGitHub { owner = "stoatchat"; repo = "for-desktop"; tag = "v${finalAttrs.version}"; fetchSubmodules = true; - hash = "sha256-vMXnBniA0wyoK7Pe13h/yHtf8ky59ts4VQb9k7KuUCE="; + hash = "sha256-l4kxlPwohaxserVyNAb3Dp4f5XhnPUKeuRJwrOl9EWc="; }; postPatch = '' @@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: { inherit (finalAttrs) pname version src; fetcherVersion = 3; pnpm = pnpm_10; - hash = "sha256-m0EuM8qTCFLxxO0RNze5WgMkuHZXeIi+U/Jiuv91eCg="; + hash = "sha256-bIDwEmt/8URBMx7XIQ1EP4SucwMuyGZE1hlQM0rxDnw="; }; env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1"; From ef352e5401b276b155a93cba39e6a02ac2d7ebfc Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 1 Jun 2026 19:54:38 +0200 Subject: [PATCH 037/115] nixos/fuse: disable by default This change disables the fuse module by default and shifts the obligation to enable it to consumers. --- nixos/doc/manual/release-notes/rl-2611.section.md | 2 ++ nixos/modules/profiles/bashless.nix | 2 -- nixos/modules/programs/fuse.nix | 4 +--- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index 0252bcb370ea..2a79a0500d3a 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -58,4 +58,6 @@ - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon. +- The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...). + - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`. diff --git a/nixos/modules/profiles/bashless.nix b/nixos/modules/profiles/bashless.nix index 501563b97b3d..20f2f7256f07 100644 --- a/nixos/modules/profiles/bashless.nix +++ b/nixos/modules/profiles/bashless.nix @@ -15,8 +15,6 @@ environment.corePackages = lib.mkForce [ ]; # Contains bash completions nix.enable = lib.mkDefault false; - # The fuse{,3} package contains a runtime dependency on bash. - programs.fuse.enable = lib.mkDefault false; documentation.man.man-db.enable = lib.mkDefault false; # autovt depends on bash console.enable = lib.mkDefault false; diff --git a/nixos/modules/programs/fuse.nix b/nixos/modules/programs/fuse.nix index e7e317d7ef9b..07026cbd33db 100644 --- a/nixos/modules/programs/fuse.nix +++ b/nixos/modules/programs/fuse.nix @@ -12,9 +12,7 @@ in meta.maintainers = [ ]; options.programs.fuse = { - enable = lib.mkEnableOption "fuse" // { - default = true; - }; + enable = lib.mkEnableOption "fuse"; mountMax = lib.mkOption { # In the C code it's an "int" (i.e. signed and at least 16 bit), but From 5a7a109c5ac4e41c5d508ddfd45129cd9d1f1319 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 1 Jun 2026 19:56:50 +0200 Subject: [PATCH 038/115] nixos/gvfs: enable fuse --- nixos/modules/services/desktops/gvfs.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/desktops/gvfs.nix b/nixos/modules/services/desktops/gvfs.nix index 004810327798..cebfb0820229 100644 --- a/nixos/modules/services/desktops/gvfs.nix +++ b/nixos/modules/services/desktops/gvfs.nix @@ -40,6 +40,8 @@ in environment.systemPackages = [ cfg.package ]; + programs.fuse.enable = true; + services.dbus.packages = [ cfg.package ]; systemd.packages = [ cfg.package ]; From bd44b6318872853768665494351ad5fe75e83f0d Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 2 Jun 2026 01:43:26 +0200 Subject: [PATCH 039/115] nixos/kubo: enable programs.fuse --- nixos/modules/services/network-filesystems/kubo.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/network-filesystems/kubo.nix b/nixos/modules/services/network-filesystems/kubo.nix index 3c75423f3ffa..4e676b80a1aa 100644 --- a/nixos/modules/services/network-filesystems/kubo.nix +++ b/nixos/modules/services/network-filesystems/kubo.nix @@ -332,8 +332,9 @@ in boot.kernel.sysctl."net.core.rmem_max" = lib.mkDefault 7500000; boot.kernel.sysctl."net.core.wmem_max" = lib.mkDefault 7500000; - programs.fuse = lib.mkIf (cfg.autoMount && cfg.settings.Mounts.FuseAllowOther) { - userAllowOther = true; + programs.fuse = { + enable = lib.mkIf cfg.autoMount true; + userAllowOther = lib.mkIf cfg.settings.Mounts.fuseAllowOther true; }; users.users = lib.mkIf (cfg.user == "ipfs") { From 69a96a84d616f8075fb03c4c233d11ee994cc2d8 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 2 Jun 2026 02:05:22 +0200 Subject: [PATCH 040/115] nixos/flatpak: enable fuse --- nixos/modules/services/desktops/flatpak.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/desktops/flatpak.nix b/nixos/modules/services/desktops/flatpak.nix index 5756738c9fda..e874cbac7a4f 100644 --- a/nixos/modules/services/desktops/flatpak.nix +++ b/nixos/modules/services/desktops/flatpak.nix @@ -40,6 +40,8 @@ in pkgs.fuse3 ]; + programs.fuse.enable = true; + security.polkit.enable = true; fonts.fontDir.enable = true; From 28c15019478ea63cb4484f6e819993d9a43f6fb4 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 2 Jun 2026 02:06:30 +0200 Subject: [PATCH 041/115] nixos/appimage: enable fuse --- nixos/modules/programs/appimage.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/programs/appimage.nix b/nixos/modules/programs/appimage.nix index c0379557c97a..4662a6c3d8cc 100644 --- a/nixos/modules/programs/appimage.nix +++ b/nixos/modules/programs/appimage.nix @@ -43,6 +43,8 @@ in } ); environment.systemPackages = [ cfg.package ]; + + programs.fuse.enable = true; }; meta.maintainers = with lib.maintainers; [ From ab51f0dbef1ff1b7ba0fc1b59b3a366117eaefd2 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 2 Jun 2026 02:43:40 +0200 Subject: [PATCH 042/115] nixos/sshfs: enable fuse --- nixos/modules/tasks/filesystems/sshfs.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/tasks/filesystems/sshfs.nix b/nixos/modules/tasks/filesystems/sshfs.nix index f070779ecc54..917ceea7b691 100644 --- a/nixos/modules/tasks/filesystems/sshfs.nix +++ b/nixos/modules/tasks/filesystems/sshfs.nix @@ -10,6 +10,8 @@ lib.mkIf (config.boot.supportedFilesystems.sshfs or config.boot.supportedFilesystems."fuse.sshfs" or false) { + programs.fuse.enable = true; + system.fsPackages = [ pkgs.sshfs ]; }; } From 99ed707074f5a579998e1072a3b83fd9f9d16e97 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 5 Jun 2026 13:56:54 +0200 Subject: [PATCH 043/115] nixos/test/gocryptfs: enable fuse --- nixos/tests/gocryptfs.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/tests/gocryptfs.nix b/nixos/tests/gocryptfs.nix index d0e5df5e40b5..763e1c1407fa 100644 --- a/nixos/tests/gocryptfs.nix +++ b/nixos/tests/gocryptfs.nix @@ -13,6 +13,8 @@ pkgs.openssl ]; + programs.fuse.enable = true; + specialisation.fstab-test.configuration = { # This can't be fileSytems, as the qemu machinery doesn't honor it. virtualisation.fileSystems."/plain" = { From a92efa870c547481956055a2011475aee39b1ae1 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 15 Jun 2026 17:51:15 +0200 Subject: [PATCH 044/115] nixos/plasma6: opt into fuse Used by the kio-* stack. --- nixos/modules/services/desktop-managers/plasma6.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/desktop-managers/plasma6.nix b/nixos/modules/services/desktop-managers/plasma6.nix index 0813b1b6b84c..f6106d3e83fe 100644 --- a/nixos/modules/services/desktop-managers/plasma6.nix +++ b/nixos/modules/services/desktop-managers/plasma6.nix @@ -274,6 +274,7 @@ in services.power-profiles-daemon.enable = mkDefault true; services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true); + programs.fuse.enable = true; services.udisks2.enable = true; services.upower.enable = config.powerManagement.enable; services.libinput.enable = mkDefault true; From 944a258aebf337420c2aaf0332228682b2dad956 Mon Sep 17 00:00:00 2001 From: Ilan Joselevich Date: Fri, 19 Jun 2026 15:14:40 +0300 Subject: [PATCH 045/115] switch-to-configuration-ng: handle transition to socket activation When a service gains a `.socket` unit, the socket is not yet active, so the `active_cur.contains_key(socket)` check is false and the service is queued in `units_to_start`. That races with the socket unit being started by `sockets.target`, producing "Socket service already active, refusing" or "no socket activation file descriptors found" errors. Treat the service as socket-activated whenever the socket is absent now but present in the new configuration, leaving it to be activated on demand by the newly started socket rather than started directly. Fixes: https://github.com/NixOS/nixpkgs/pull/510391#issuecomment-4273511176 Assisted-by: Claude:claude-opus-4-8 --- nixos/tests/switch-test.nix | 18 +++++++++++++++++ .../sw/switch-to-configuration-ng/src/main.rs | 20 +++++++++++++------ 2 files changed, 32 insertions(+), 6 deletions(-) diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix index 63dc78e2e6dc..b81d84086f2e 100644 --- a/nixos/tests/switch-test.nix +++ b/nixos/tests/switch-test.nix @@ -541,6 +541,12 @@ in systemd.services."accept-socket@".serviceConfig.X-Test = "test"; }; + socket-activated-without-socket.configuration = { + imports = [ simple-socket.configuration ]; + systemd.sockets.socket-activated.enable = false; + systemd.services.socket-activated.wantedBy = [ "multi-user.target" ]; + }; + mount.configuration = { systemd.mounts = [ { @@ -1620,6 +1626,18 @@ in if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello": raise Exception("Socket was not properly activated after the service was restarted") + # A service transitioning to socket activation is not started directly, + # it's left for the newly started socket to activate on demand + switch_to_specialisation("${machine}", "socket-activated-without-socket") + machine.succeed("systemctl is-active socket-activated.service") + out = switch_to_specialisation("${machine}", "simple-socket-stop-if-changed") + assert_contains(out, "stopping the following units: socket-activated.service\n") + assert_lacks(out, "\nstarting the following units:") + assert_contains(out, "the following new units were started: socket-activated.socket\n") + machine.succeed("[ -S /run/test.sock ]") + if machine.succeed("socat - UNIX-CONNECT:/run/test.sock") != "hello": + raise Exception("Socket was not properly activated after the transition") + with subtest("socket-activated services with Accept=yes"): # Socket-activated services don't get started, just the socket machine.fail("[ -S /run/accept-test.sock ]") diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs index ec6bf1ad253f..b5d307d7bdb1 100644 --- a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs +++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs @@ -777,6 +777,9 @@ fn handle_modified_unit( } for socket in &sockets { + let socket_in_new_config = + toplevel.join(scope.etc_dir()).join(socket).exists(); + if active_cur.contains_key(socket) { // We can now be sure this is a socket-activated unit @@ -787,7 +790,7 @@ fn handle_modified_unit( } // Only restart sockets that actually exist in new configuration: - if toplevel.join(scope.etc_dir()).join(socket).exists() { + if socket_in_new_config { if use_restart_as_stop_and_start { units_to_restart.insert(socket.to_string(), ()); record_unit(&restart_list, socket); @@ -798,12 +801,17 @@ fn handle_modified_unit( socket_activated = true; } + } else if socket_in_new_config { + // Transitioning to socket activation; let the socket start it. + socket_activated = true; + } else { + continue; + } - // Remove from units to reload so we don't restart and reload - if units_to_reload.contains_key(unit) { - units_to_reload.remove(unit); - unrecord_unit(&reload_list, unit); - } + // Remove from units to reload so we don't restart and reload + if units_to_reload.contains_key(unit) { + units_to_reload.remove(unit); + unrecord_unit(&reload_list, unit); } } } From be9a0ac9924a5c4f116f7f4bc18be335664272e9 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sat, 20 Jun 2026 20:18:30 +0200 Subject: [PATCH 046/115] nixos/test-driver: properly tokenize udev rule When running a container test the udev linter complains, that tokens should be separate by a comma followed by a space. --- nixos/lib/testing/network.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix index 570b854d8e28..86d65faf21ad 100644 --- a/nixos/lib/testing/network.nix +++ b/nixos/lib/testing/network.nix @@ -135,8 +135,13 @@ let ); udevRules = map ( interface: - # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive. - ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}",NAME="${interface.name}"'' + lib.concatStringsSep ", " [ + ''SUBSYSTEM=="net"'' + ''ACTION=="add"'' + # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive. + ''ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}"'' + ''NAME="${interface.name}"'' + ] ) interfaces; in { From f62484a5e2b88ffcd9243dbdad36d64bbd20207d Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 20 Jun 2026 20:39:01 +0000 Subject: [PATCH 047/115] openttd-jgrpp: 0.72.3 -> 0.72.4 --- pkgs/by-name/op/openttd-jgrpp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/op/openttd-jgrpp/package.nix b/pkgs/by-name/op/openttd-jgrpp/package.nix index a362791747e5..310571619822 100644 --- a/pkgs/by-name/op/openttd-jgrpp/package.nix +++ b/pkgs/by-name/op/openttd-jgrpp/package.nix @@ -7,13 +7,13 @@ openttd.overrideAttrs (oldAttrs: rec { pname = "openttd-jgrpp"; - version = "0.72.3"; + version = "0.72.4"; src = fetchFromGitHub { owner = "JGRennison"; repo = "OpenTTD-patches"; rev = "jgrpp-${version}"; - hash = "sha256-W9RakMdyL4eJ/90+/vypzl4FwX7inlrdH9liXNYT3IA="; + hash = "sha256-qiTKoaCUdcm7dJKfxwTtYU8f5C8RYxj7XZL/TtOygtg="; }; patches = [ ]; From e0dedcf0db8647bee4179d72a0451f5ab307c090 Mon Sep 17 00:00:00 2001 From: Khushal Agrawal Date: Sun, 21 Jun 2026 13:47:07 +0530 Subject: [PATCH 048/115] starpls: don't build xtask The xtask build helper leaks into $out/bin. Restrict the build to the starpls crate so only the language server is produced. --- pkgs/by-name/st/starpls/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/st/starpls/package.nix b/pkgs/by-name/st/starpls/package.nix index 0f115597fae8..ff3f456153a2 100644 --- a/pkgs/by-name/st/starpls/package.nix +++ b/pkgs/by-name/st/starpls/package.nix @@ -18,6 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoHash = "sha256-5xYfQRm7U7sEQiJEfjaLznoXUxHsxnLmIEA/OxTkjFg="; + # Only build the starpls language server, not the xtask build helper, which + # would otherwise leak into $out/bin. + cargoBuildFlags = [ "-p starpls" ]; + nativeBuildInputs = [ protobuf ]; From e3ebd83643a71be5c449bbb170bedb53af86ac8b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 22 Jun 2026 04:50:58 +0000 Subject: [PATCH 049/115] lsp-plugins: 1.2.31 -> 1.2.33 --- pkgs/by-name/ls/lsp-plugins/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ls/lsp-plugins/package.nix b/pkgs/by-name/ls/lsp-plugins/package.nix index 8a056268bd01..07d99a9a034c 100644 --- a/pkgs/by-name/ls/lsp-plugins/package.nix +++ b/pkgs/by-name/ls/lsp-plugins/package.nix @@ -39,7 +39,7 @@ in stdenv.mkDerivation (finalAttrs: { pname = "lsp-plugins"; - version = "1.2.31"; + version = "1.2.33"; outputs = [ "out" @@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://github.com/lsp-plugins/lsp-plugins/releases/download/${finalAttrs.version}/lsp-plugins-src-${finalAttrs.version}.tar.gz"; - hash = "sha256-JZCnxqzgujGcgUXvFCYea7OfMomkmJ1LscFPRwGxzeI="; + hash = "sha256-K2kiEFEYrIe9lCsP8+e/PIGAInsqtcTlDkjeuQrGib0="; }; # By default, GStreamer plugins are installed right alongside GStreamer itself From e66aaa55c5dfae759d2e96036d7608c50086a5ca Mon Sep 17 00:00:00 2001 From: Stefan Frijters Date: Mon, 22 Jun 2026 10:15:29 +0200 Subject: [PATCH 050/115] python3Packages.xmldiff: 2.7.0 -> 3.0 Changelog: https://github.com/Shoobx/xmldiff/blob/master/CHANGES.rst * Previously disabled test fixed in https://github.com/Shoobx/xmldiff/pull/140 (test_main.py) * Runtime setuptools dependency removed in https://github.com/Shoobx/xmldiff/pull/136 --- .../python-modules/xmldiff/default.nix | 20 ++++++------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/pkgs/development/python-modules/xmldiff/default.nix b/pkgs/development/python-modules/xmldiff/default.nix index 2dd2eb288806..8e9d8f61c1fb 100644 --- a/pkgs/development/python-modules/xmldiff/default.nix +++ b/pkgs/development/python-modules/xmldiff/default.nix @@ -7,30 +7,22 @@ pytestCheckHook, }: -buildPythonPackage rec { +buildPythonPackage (finalAttrs: { pname = "xmldiff"; - version = "2.7.0"; + version = "3.0"; pyproject = true; src = fetchPypi { - inherit pname version; - hash = "sha256-wJELH4ADZt1+xikj5dBuiwahvZEgVpocJ/TyRGucaKI="; + inherit (finalAttrs) pname version; + hash = "sha256-OA7E0FzvM/W3Bs94mrzISNJ3MNZ+AtwLTxEH4Wzpqq0="; }; build-system = [ setuptools ]; - dependencies = [ - lxml - setuptools - ]; + dependencies = [ lxml ]; nativeCheckInputs = [ pytestCheckHook ]; - disabledTests = [ - # lxml 6.0 compat issue - "test_api_diff_texts" - ]; - pythonImportsCheck = [ "xmldiff" ]; meta = { @@ -40,4 +32,4 @@ buildPythonPackage rec { license = lib.licenses.mit; maintainers = with lib.maintainers; [ sfrijters ]; }; -} +}) From 82f97e122af9d825d109daedf76b1462c5b8a12e Mon Sep 17 00:00:00 2001 From: Colin Date: Mon, 22 Jun 2026 22:00:33 +0000 Subject: [PATCH 051/115] rdma-core: populate passthru.updateScript --- pkgs/by-name/rd/rdma-core/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/rd/rdma-core/package.nix b/pkgs/by-name/rd/rdma-core/package.nix index fa6d99f4039a..feb773beb76a 100644 --- a/pkgs/by-name/rd/rdma-core/package.nix +++ b/pkgs/by-name/rd/rdma-core/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + gitUpdater, cmake, pkg-config, docutils, @@ -73,6 +74,10 @@ stdenv.mkDerivation (finalAttrs: { doInstallCheck = true; + passthru.updateScript = gitUpdater { + rev-prefix = "v"; + }; + meta = { description = "RDMA Core Userspace Libraries and Daemons"; homepage = "https://github.com/linux-rdma/rdma-core"; From 0e1f4fd8d9e95f9f6e35f56ccbc882879d264db4 Mon Sep 17 00:00:00 2001 From: Colin Date: Mon, 22 Jun 2026 22:16:13 +0000 Subject: [PATCH 052/115] rdma-core: 62.0 -> 63.0 --- pkgs/by-name/rd/rdma-core/package.nix | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/rd/rdma-core/package.nix b/pkgs/by-name/rd/rdma-core/package.nix index feb773beb76a..e1504a0a9bbe 100644 --- a/pkgs/by-name/rd/rdma-core/package.nix +++ b/pkgs/by-name/rd/rdma-core/package.nix @@ -2,6 +2,7 @@ lib, stdenv, fetchFromGitHub, + fetchurl, gitUpdater, cmake, pkg-config, @@ -16,13 +17,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "rdma-core"; - version = "62.0"; + version = "63.0"; src = fetchFromGitHub { owner = "linux-rdma"; repo = "rdma-core"; rev = "v${finalAttrs.version}"; - hash = "sha256-1n33KH8HTyZ0jHtDanopxwABiLjAvt+V7lgaeabJs8s="; + hash = "sha256-YW6BJS6acj9S8wFXUhC1vrJSm9YowGGuwWEBzQRVyPM="; }; strictDeps = true; @@ -48,9 +49,20 @@ stdenv.mkDerivation (finalAttrs: { udev ]; + patches = [ + (fetchurl { + # remove when rdma-core 64.0 is released + # https://github.com/linux-rdma/rdma-core/pull/1737 + name = "cmake-allow-overriding-sysusers.d-install-directory"; + url = "https://github.com/linux-rdma/rdma-core/commit/8b186b5d932701e94bbced83d2f3899ee53f041a.patch?full_index=1"; + hash = "sha256-Rjknu7mmJL2Sx+Ypq9SRXU4LUiHERs9j5/qMIZaiRTI="; + }) + ]; + cmakeFlags = [ "-DCMAKE_INSTALL_RUNDIR=/run" "-DCMAKE_INSTALL_SHAREDSTATEDIR=/var/lib" + "-DSYSUSERS_DIR=${placeholder "out"}/lib/sysusers.d" ]; postPatch = '' From 6f687f13bd0783c3483707ec6249044459471b3e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Mon, 22 Jun 2026 22:29:13 +0000 Subject: [PATCH 053/115] jackett: 0.24.2066 -> 0.24.2108 --- pkgs/by-name/ja/jackett/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix index 79b99e8ae42d..78fb01480bab 100644 --- a/pkgs/by-name/ja/jackett/package.nix +++ b/pkgs/by-name/ja/jackett/package.nix @@ -12,13 +12,13 @@ buildDotnetModule (finalAttrs: { pname = "jackett"; - version = "0.24.2066"; + version = "0.24.2108"; src = fetchFromGitHub { owner = "jackett"; repo = "jackett"; tag = "v${finalAttrs.version}"; - hash = "sha256-hK7QfztI3kFJcOG9OTQ5/lOusFKnv8AyNfCaU9IhdKE="; + hash = "sha256-MWA5gTiNjkKIaHgUGVt2XV3QBPYGTf/dVqCnmdAaJ0U="; }; projectFile = "src/Jackett.Server/Jackett.Server.csproj"; From 7106a694391b7839c3d9c0a3c4eb0eb5e731338a Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Tue, 23 Jun 2026 04:21:47 +0200 Subject: [PATCH 054/115] ty: 0.0.51 -> 0.0.52 Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.52 Diff: https://github.com/astral-sh/ty/compare/0.0.51...0.0.52 --- pkgs/by-name/ty/ty/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix index 8a3b04bc7a09..48a4dbae05f2 100644 --- a/pkgs/by-name/ty/ty/package.nix +++ b/pkgs/by-name/ty/ty/package.nix @@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "ty"; - version = "0.0.51"; + version = "0.0.52"; __structuredAttrs = true; src = fetchFromGitHub { @@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: { repo = "ty"; tag = finalAttrs.version; fetchSubmodules = true; - hash = "sha256-99CucCCZ8oOQV1PaPLZXq++8S7d6QJSAaQq/WXP87n4="; + hash = "sha256-p9fTzQ4DYvnwrtLdpSTekBV4ZbR1KETR8dfsbp8CDpo="; }; # For Darwin platforms, remove the integration test for file notifications, @@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: { cargoBuildFlags = [ "--package=ty" ]; - cargoHash = "sha256-N76A6howQn/ZbDJ7PWrThDYKhH+vc7tnZPShR7T31Ug="; + cargoHash = "sha256-NUIdYOeyRsR/ZQueEXshYdWTnSeQiRjZRRi2ag8Dm48="; nativeBuildInputs = [ installShellFiles ]; buildInputs = [ rust-jemalloc-sys ]; From 779c8b826c58c129ed18e28dfc5a05bc7040f8ea Mon Sep 17 00:00:00 2001 From: Yureka Date: Tue, 23 Jun 2026 10:53:47 +0200 Subject: [PATCH 055/115] alsa-ucm-conf-asahi: 8 -> 9 Changelog: https://github.com/AsahiLinux/alsa-ucm-conf-asahi/releases/tag/v9 Diff: https://github.com/AsahiLinux/alsa-ucm-conf-asahi/compare/v8...v9 --- pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix b/pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix index ba4df31df4ea..f52781a1dbe2 100644 --- a/pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix +++ b/pkgs/by-name/al/alsa-ucm-conf-asahi/package.nix @@ -9,13 +9,13 @@ let alsa-ucm-conf-asahi = stdenvNoCC.mkDerivation (finalAttrs: { pname = "alsa-ucm-conf-asahi"; - version = "8"; + version = "9"; src = fetchFromGitHub { owner = "AsahiLinux"; repo = "alsa-ucm-conf-asahi"; tag = "v${finalAttrs.version}"; - hash = "sha256-FPrAzscc1ICSCQSqULaGLqG4UCq8GZU9XLV7TUSBBRM="; + hash = "sha256-F+NiEP4EKLUVV2oHSVY+fkXlzXcLyywNOolUy9DO8sI="; }; installPhase = '' From ce8593507d4acb823deae0d1e2775f5cfd8490a8 Mon Sep 17 00:00:00 2001 From: Yureka Date: Tue, 23 Jun 2026 10:57:18 +0200 Subject: [PATCH 056/115] asahi-audio: 3.4 -> 4.0 Changelog: https://github.com/AsahiLinux/asahi-audio/releases/tag/v4.0 Diff: https://github.com/AsahiLinux/asahi-audio/compare/v3.4...v4.0 --- pkgs/by-name/as/asahi-audio/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/as/asahi-audio/package.nix b/pkgs/by-name/as/asahi-audio/package.nix index edfe3364b1ba..c256a4221570 100644 --- a/pkgs/by-name/as/asahi-audio/package.nix +++ b/pkgs/by-name/as/asahi-audio/package.nix @@ -9,13 +9,13 @@ }: stdenvNoCC.mkDerivation (finalAttrs: { pname = "asahi-audio"; - version = "3.4"; + version = "4.0"; src = fetchFromGitHub { owner = "AsahiLinux"; repo = "asahi-audio"; tag = "v${finalAttrs.version}"; - hash = "sha256-7AuPkR/M1a4zB9+dJuOuv9uTp+kIqPlxVOXipsyGGz8="; + hash = "sha256-Tp+yL7SbzowYcCrfI7UU+5GeIJtyBMuE7KhcYmA1+hw="; }; makeFlags = [ From ae42e997011b885db89aa49adb71c61ec0e3f507 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= Date: Sun, 21 Jun 2026 20:26:39 +0200 Subject: [PATCH 057/115] intel-compute-runtime-legacy1: vendor old intel-graphics-compiler intel-graphics-compiler >= 2.36 does no longer support 8th Gen --- .../bump-cmake.patch | 45 +++++ ...low-llvm-free-nonheap-object-warning.patch | 14 ++ .../gcc15-llvm-header-fixes.patch | 13 ++ .../intel-graphics-compiler.nix | 156 ++++++++++++++++++ .../intel-compute-runtime-legacy1/package.nix | 4 +- 5 files changed, 231 insertions(+), 1 deletion(-) create mode 100644 pkgs/by-name/in/intel-compute-runtime-legacy1/bump-cmake.patch create mode 100644 pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-allow-llvm-free-nonheap-object-warning.patch create mode 100644 pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-llvm-header-fixes.patch create mode 100644 pkgs/by-name/in/intel-compute-runtime-legacy1/intel-graphics-compiler.nix diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/bump-cmake.patch b/pkgs/by-name/in/intel-compute-runtime-legacy1/bump-cmake.patch new file mode 100644 index 000000000000..2a15e8acd780 --- /dev/null +++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/bump-cmake.patch @@ -0,0 +1,45 @@ +From bc76a7087e4621269bdf9080581088a6c8f6b3a6 Mon Sep 17 00:00:00 2001 +From: Chris Mayo +Date: Tue, 20 May 2025 19:27:57 +0100 +Subject: [PATCH] Raise minimum CMake version to 3.5 + +For compatibility with CMake 4.0, which also removes CMP0043 OLD - there +are no uses of COMPILE_DEFINITIONS_. + +Signed-off-by: Chris Mayo +--- + external/SPIRV-Tools/CMakeLists.txt | 2 +- + visa/CMakeLists.txt | 7 +------ + visa/iga/GEDLibrary/GED_external/CMakeLists.txt | 6 +----- + 4 files changed, 4 insertions(+), 13 deletions(-) + +diff --git a/external/SPIRV-Tools/CMakeLists.txt b/external/SPIRV-Tools/CMakeLists.txt +index d2e3f63fb0d3..75f013409990 100644 +--- a/igc/external/SPIRV-Tools/CMakeLists.txt ++++ b/igc/external/SPIRV-Tools/CMakeLists.txt +@@ -6,7 +6,7 @@ + # + #============================ end_copyright_notice ============================= + +-cmake_minimum_required(VERSION 2.8.12) ++cmake_minimum_required(VERSION 3.5) + + message(STATUS "============================ SPIRV-Tools project ============================") + +diff --git a/visa/iga/GEDLibrary/GED_external/CMakeLists.txt b/visa/iga/GEDLibrary/GED_external/CMakeLists.txt +index e40313fc1944..275fff1114a6 100644 +--- a/igc/visa/iga/GEDLibrary/GED_external/CMakeLists.txt ++++ b/igc/visa/iga/GEDLibrary/GED_external/CMakeLists.txt +@@ -7,11 +7,7 @@ + #============================ end_copyright_notice ============================= + + # GEDLibrary/GED +-if(WIN32) +- cmake_minimum_required(VERSION 3.1) +-else() +- cmake_minimum_required(VERSION 2.8.12) +-endif(WIN32) ++cmake_minimum_required(VERSION 3.5) + + project(GEDLibrary) + diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-allow-llvm-free-nonheap-object-warning.patch b/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-allow-llvm-free-nonheap-object-warning.patch new file mode 100644 index 000000000000..90cd81176d12 --- /dev/null +++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-allow-llvm-free-nonheap-object-warning.patch @@ -0,0 +1,14 @@ +diff --git a/igc/IGC/common/LLVMWarningsPush.hpp b/igc/IGC/common/LLVMWarningsPush.hpp +index 12874dfcc2..38acd80943 100644 +--- a/igc/IGC/common/LLVMWarningsPush.hpp ++++ b/igc/IGC/common/LLVMWarningsPush.hpp +@@ -43,6 +43,9 @@ + #if __GNUC__ > 8 + #pragma GCC diagnostic ignored "-Winit-list-lifetime" + #endif ++#if __GNUC__ > 14 ++#pragma GCC diagnostic ignored "-Wfree-nonheap-object" ++#endif + #endif + + #if defined(_WIN32) || defined(_WIN64) diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-llvm-header-fixes.patch b/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-llvm-header-fixes.patch new file mode 100644 index 000000000000..d0b0964f5748 --- /dev/null +++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/gcc15-llvm-header-fixes.patch @@ -0,0 +1,13 @@ +diff --git a/llvm-project/llvm/include/llvm/Support/Threading.h b/llvm-project/llvm/include/llvm/Support/Threading.h +index ba6c531ab4..78aa5e7be5 100644 +--- a/llvm-project/llvm/include/llvm/Support/Threading.h ++++ b/llvm-project/llvm/include/llvm/Support/Threading.h +@@ -18,7 +18,7 @@ + #include "llvm/ADT/StringRef.h" + #include "llvm/Config/llvm-config.h" // for LLVM_ON_UNIX + #include "llvm/Support/Compiler.h" +-#include // So we can check the C++ standard lib macros. ++#include // So we can check the C++ standard lib macros. + #include + + #if defined(_MSC_VER) diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/intel-graphics-compiler.nix b/pkgs/by-name/in/intel-compute-runtime-legacy1/intel-graphics-compiler.nix new file mode 100644 index 000000000000..859ca5c54f5e --- /dev/null +++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/intel-graphics-compiler.nix @@ -0,0 +1,156 @@ +{ + lib, + stdenv, + fetchFromGitHub, + cmake, + ninja, + git, + bison, + flex, + zlib, + intel-compute-runtime, + python3, + spirv-tools, + spirv-headers, +}: + +let + llvmVersion = "16.0.6"; +in +stdenv.mkDerivation rec { + pname = "intel-graphics-compiler"; + version = "2.34.4"; + + # See the repository for expected versions: + # + srcs = [ + (fetchFromGitHub { + name = "igc"; + owner = "intel"; + repo = "intel-graphics-compiler"; + tag = "v${version}"; + hash = "sha256-w20nrn3wo9Dvv3BILYBzuJTTLXqcWaRAF7SiPtryhwk="; + }) + (fetchFromGitHub { + name = "llvm-project"; + owner = "llvm"; + repo = "llvm-project"; + tag = "llvmorg-${llvmVersion}"; + hash = "sha256-fspqSReX+VD+Nl/Cfq+tDcdPtnQPV1IRopNDfd5VtUs="; + }) + (fetchFromGitHub { + name = "vc-intrinsics"; + owner = "intel"; + repo = "vc-intrinsics"; + tag = "v0.25.0"; + hash = "sha256-ozc1w3V5RqWHwqNHuefZJMN8RAYxrJxH9bd1BEqxfiQ="; + }) + (fetchFromGitHub { + name = "opencl-clang"; + owner = "intel"; + repo = "opencl-clang"; + tag = "v16.0.11"; + hash = "sha256-ema1jTNMHs3pUituVb1NPllc6cA8eYJHtDOjuEzIDWM="; + }) + (fetchFromGitHub { + name = "llvm-spirv"; + owner = "KhronosGroup"; + repo = "SPIRV-LLVM-Translator"; + tag = "v16.0.24"; + hash = "sha256-aTcwfQt2WdOA44jfHdD7x7oxt8emSDexgZnI7MPVqvU="; + }) + ]; + + patches = [ + # Raise minimum CMake version to 3.5 + # https://github.com/intel/intel-graphics-compiler/commit/4f0123a7d67fb716b647f0ba5c1ab550abf2f97d + # https://github.com/intel/intel-graphics-compiler/pull/364 + ./bump-cmake.patch + + # Fix for GCC 15 by adding a previously-implicit `#include ` and + # replacing `` with `` in the the llvm directory. Based + # on https://github.com/intel/intel-graphics-compiler/pull/383. + ./gcc15-llvm-header-fixes.patch + + # Fix for GCC 15 by disabling `-Werror` for `-Wfree-nonheap-object` + # warnings within LLVM. This is in accordance with IGC disabling warnings + # that originate from within LLVM (see `IGC/common/LLVMWarningsPush.hpp`). + ./gcc15-allow-llvm-free-nonheap-object-warning.patch + ]; + + sourceRoot = "."; + + cmakeDir = "../igc"; + + postUnpack = '' + chmod -R +w . + mv opencl-clang llvm-spirv llvm-project/llvm/projects/ + ''; + + postPatch = '' + substituteInPlace igc/IGC/AdaptorOCL/igc-opencl.pc.in \ + --replace-fail '/@CMAKE_INSTALL_INCLUDEDIR@' "/include" \ + --replace-fail '/@CMAKE_INSTALL_LIBDIR@' "/lib" + + chmod +x igc/IGC/Scripts/igc_create_linker_script.sh + patchShebangs --build igc/IGC/Scripts/igc_create_linker_script.sh + + # The build system only applies patches when the sources are in a + # Git repository. + git -C llvm-project init + git -C llvm-project -c user.name=nixbld -c user.email= commit --allow-empty -m stub + substituteInPlace llvm-project/llvm/projects/opencl-clang/cmake/modules/CMakeFunctions.cmake \ + --replace-fail 'COMMAND ''${GIT_EXECUTABLE} am --3way --keep-non-patch --ignore-whitespace -C0 ' \ + 'COMMAND patch -p1 --ignore-whitespace -i ' + + # match default LLVM version with our provided version to apply correct patches + substituteInPlace igc/external/llvm/llvm_preferred_version.cmake \ + --replace-fail "16.0.6" "${llvmVersion}" + ''; + + nativeBuildInputs = [ + bison + cmake + flex + git + ninja + (python3.withPackages ( + ps: with ps; [ + mako + pyyaml + ] + )) + zlib + ]; + + buildInputs = [ + spirv-headers + spirv-tools + ]; + + strictDeps = true; + + # testing is done via intel-compute-runtime + doCheck = false; + + cmakeFlags = [ + "-DIGC_OPTION__SPIRV_TOOLS_MODE=Prebuilds" + "-DIGC_OPTION__USE_PREINSTALLED_SPIRV_HEADERS=ON" + "-DSPIRV-Headers_INCLUDE_DIR=${spirv-headers}/include" + "-DLLVM_EXTERNAL_SPIRV_HEADERS_SOURCE_DIR=${spirv-headers.src}" + "-Wno-dev" + ]; + + passthru.tests = { + inherit intel-compute-runtime; + }; + + meta = { + description = "LLVM-based compiler for OpenCL targeting Intel Gen graphics hardware"; + homepage = "https://github.com/intel/intel-graphics-compiler"; + changelog = "https://github.com/intel/intel-graphics-compiler/releases/tag/v${version}"; + license = lib.licenses.mit; + platforms = lib.platforms.linux; + maintainers = with lib.maintainers; [ fleaz ]; + }; +} diff --git a/pkgs/by-name/in/intel-compute-runtime-legacy1/package.nix b/pkgs/by-name/in/intel-compute-runtime-legacy1/package.nix index 424f8fe55c47..b91c58a244d3 100644 --- a/pkgs/by-name/in/intel-compute-runtime-legacy1/package.nix +++ b/pkgs/by-name/in/intel-compute-runtime-legacy1/package.nix @@ -1,11 +1,11 @@ { lib, + callPackage, stdenv, fetchFromGitHub, cmake, pkg-config, intel-gmmlib, - intel-graphics-compiler, level-zero, libva, gitUpdater, @@ -13,6 +13,8 @@ let inherit (lib) cmakeBool; + # intel-graphics-compiler >= 2.36 does no longer support 8th Gen + intel-graphics-compiler = callPackage ./intel-graphics-compiler.nix { }; in stdenv.mkDerivation (finalAttrs: { # https://github.com/intel/compute-runtime/blob/master/LEGACY_PLATFORMS.md From 360ca5a8635c28a1aaddcbfe30470a8543f70e0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?= =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= Date: Tue, 23 Jun 2026 18:22:07 +0700 Subject: [PATCH 058/115] =?UTF-8?q?h2o:=202.3.0-rolling-2026-06-22=20?= =?UTF-8?q?=E2=86=92=202.3.0-rolling-2026-06-23?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkgs/by-name/h2/h2o/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix index 85bc288af43e..26df1a269643 100644 --- a/pkgs/by-name/h2/h2o/package.nix +++ b/pkgs/by-name/h2/h2o/package.nix @@ -24,13 +24,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "h2o"; - version = "2.3.0-rolling-2026-06-22"; + version = "2.3.0-rolling-2026-06-23"; src = fetchFromGitHub { owner = "h2o"; repo = "h2o"; - rev = "f12fb3cca02ba31e89c87bc90041fe800dbed3f2"; - hash = "sha256-OJ/MF6A6lcxWKgcOntCVc0fkcnQ9FJx8Wn2Pewz0h84="; + rev = "21708fe347076047add1225349bbcc445c447002"; + hash = "sha256-3wvKqlyHU6igfzA5xmxngpNJbxWIJkVwXQB1arycS3c="; }; outputs = [ From cac02061f84ad05a4d8db7c6f245fbe21b70f4c2 Mon Sep 17 00:00:00 2001 From: r-vdp Date: Tue, 23 Jun 2026 14:21:17 +0200 Subject: [PATCH 059/115] switch-to-configuration-ng: pull common code out of the different conditional branches All branches here are restarting instead of reloading, so it makes sense to remove the unit from units_to_reload in all cases. --- .../sw/switch-to-configuration-ng/src/main.rs | 23 ++++--------------- 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs index b5d307d7bdb1..55d1d93bde34 100644 --- a/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs +++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/main.rs @@ -743,11 +743,6 @@ fn handle_modified_unit( // This unit should be restarted instead of stopped and started. units_to_restart.insert(unit.to_string(), ()); record_unit(&restart_list, unit); - // Remove from units to reload so we don't restart and reload - if units_to_reload.contains_key(unit) { - units_to_reload.remove(unit); - unrecord_unit(&reload_list, unit); - } } else { // If this unit is socket-activated, then stop the socket unit(s) as well, and // restart the socket(s) instead of the service. @@ -804,14 +799,6 @@ fn handle_modified_unit( } else if socket_in_new_config { // Transitioning to socket activation; let the socket start it. socket_activated = true; - } else { - continue; - } - - // Remove from units to reload so we don't restart and reload - if units_to_reload.contains_key(unit) { - units_to_reload.remove(unit); - unrecord_unit(&reload_list, unit); } } } @@ -840,11 +827,11 @@ fn handle_modified_unit( } else { units_to_stop.insert(unit.to_string(), ()); } - // Remove from units to reload so we don't restart and reload - if units_to_reload.contains_key(unit) { - units_to_reload.remove(unit); - unrecord_unit(&reload_list, unit); - } + } + + // Remove from units to reload so we don't restart and reload + if units_to_reload.remove(unit).is_some() { + unrecord_unit(&reload_list, unit); } } } From 3c2ca0601c6cbe2e29ddb2fe19edda57a2dd116b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 23 Jun 2026 12:43:34 +0000 Subject: [PATCH 060/115] ocamlPackages.eliom: 12.0.1 -> 12.1.0 --- pkgs/development/ocaml-modules/eliom/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/ocaml-modules/eliom/default.nix b/pkgs/development/ocaml-modules/eliom/default.nix index 11e53f052606..b2910394647b 100644 --- a/pkgs/development/ocaml-modules/eliom/default.nix +++ b/pkgs/development/ocaml-modules/eliom/default.nix @@ -19,13 +19,13 @@ buildDunePackage (finalAttrs: { pname = "eliom"; - version = "12.0.1"; + version = "12.1.0"; src = fetchFromGitHub { owner = "ocsigen"; repo = "eliom"; tag = finalAttrs.version; - hash = "sha256-Lja3Xe3FszzyILhpOXWTyA0ippaU6aW5CJ06WEKgbkA="; + hash = "sha256-VJHt64XheW+JPZ3pynlOvpTgXf5nE9HCB4K1bWUXmAs="; }; nativeBuildInputs = [ From f4dc0ef762f66c73124b5e51a712d6a24979a597 Mon Sep 17 00:00:00 2001 From: Alexander Sieg Date: Mon, 8 Jun 2026 13:53:30 +0200 Subject: [PATCH 061/115] mealie: switch to finalAttrs and structuredAttrs --- pkgs/by-name/me/mealie/package.nix | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix index 48a7a30fa2d9..5fd9680be008 100644 --- a/pkgs/by-name/me/mealie/package.nix +++ b/pkgs/by-name/me/mealie/package.nix @@ -32,6 +32,8 @@ let inherit version; src = "${src}/frontend"; + __structuredAttrs = true; + yarnOfflineCache = fetchYarnDeps { yarnLock = "${src}/frontend/yarn.lock"; hash = "sha256-F1dhdBHfT9N1Ejk7WLyz2BbKlTPfqqEDNi7ZTL3phWY="; @@ -45,6 +47,10 @@ let dart-sass ]; + env = { + NUXT_TELEMETRY_DISABLED = 1; + }; + configurePhase = '' runHook preConfigure @@ -64,7 +70,6 @@ let buildPhase = '' runHook preBuild - export NUXT_TELEMETRY_DISABLED=1 yarn --offline generate runHook postBuild ''; @@ -88,11 +93,13 @@ let python = python3; pythonpkgs = python.pkgs; in -pythonpkgs.buildPythonApplication rec { +pythonpkgs.buildPythonApplication (finalAttrs: { pname = "mealie"; inherit version src; pyproject = true; + __structuredAttrs = true; + build-system = with pythonpkgs; [ setuptools ]; nativeBuildInputs = [ makeWrapper ]; @@ -175,11 +182,11 @@ pythonpkgs.buildPythonApplication rec { rm -f $out/bin/* makeWrapper ${start_script} $out/bin/mealie \ - --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath dependencies}" \ + --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath finalAttrs.passthru.dependencies}" \ --set STATIC_FILES "${frontend}" makeWrapper ${init_db} $out/libexec/init_db \ - --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath dependencies}" \ + --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath finalAttrs.passthru.dependencies}" \ --set OUT "$out" ''; @@ -223,4 +230,4 @@ pythonpkgs.buildPythonApplication rec { ]; mainProgram = "mealie"; }; -} +}) From fb1c6281910f6d96d823f85c5ea6d3b5f5b1e42a Mon Sep 17 00:00:00 2001 From: Alexander Sieg Date: Mon, 8 Jun 2026 14:03:38 +0200 Subject: [PATCH 062/115] mealie: update frontend via update script --- pkgs/by-name/me/mealie/package.nix | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix index 5fd9680be008..2091aa86aa65 100644 --- a/pkgs/by-name/me/mealie/package.nix +++ b/pkgs/by-name/me/mealie/package.nix @@ -183,7 +183,7 @@ pythonpkgs.buildPythonApplication (finalAttrs: { makeWrapper ${start_script} $out/bin/mealie \ --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath finalAttrs.passthru.dependencies}" \ - --set STATIC_FILES "${frontend}" + --set STATIC_FILES "${finalAttrs.passthru.frontend}" makeWrapper ${init_db} $out/libexec/init_db \ --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath finalAttrs.passthru.dependencies}" \ @@ -206,7 +206,13 @@ pythonpkgs.buildPythonApplication (finalAttrs: { ]; passthru = { - updateScript = nix-update-script { }; + inherit frontend; + updateScript = nix-update-script { + extraArgs = [ + "-s" + "frontend" + ]; + }; tests = { inherit (nixosTests) mealie; }; From 6c1076f48007fd119ab5e558eeb67adf4b984ab4 Mon Sep 17 00:00:00 2001 From: Alexander Sieg Date: Mon, 8 Jun 2026 14:05:37 +0200 Subject: [PATCH 063/115] mealie: 3.16.0 -> 3.19.2 --- pkgs/by-name/me/mealie/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/me/mealie/package.nix b/pkgs/by-name/me/mealie/package.nix index 2091aa86aa65..ffcf70e2763f 100644 --- a/pkgs/by-name/me/mealie/package.nix +++ b/pkgs/by-name/me/mealie/package.nix @@ -19,12 +19,12 @@ }: let - version = "3.16.0"; + version = "3.19.2"; src = fetchFromGitHub { owner = "mealie-recipes"; repo = "mealie"; tag = "v${version}"; - hash = "sha256-DUwLCe221MQb6AEYNxNDWXoaEdf9q/dNklOXJncnnJ4="; + hash = "sha256-OH48XiOoaIdVCl5tm22OaI5UKKlhj8b0uVsGlgsjx6I="; }; frontend = stdenv.mkDerivation { @@ -36,7 +36,7 @@ let yarnOfflineCache = fetchYarnDeps { yarnLock = "${src}/frontend/yarn.lock"; - hash = "sha256-F1dhdBHfT9N1Ejk7WLyz2BbKlTPfqqEDNi7ZTL3phWY="; + hash = "sha256-q3dqJrzqEx0G3Q/EGhjVzBd6XTAn6cELfaqLJCD5kFs="; }; nativeBuildInputs = [ From 7601f8a10854992b594fc85ecb4685a1a0ec3346 Mon Sep 17 00:00:00 2001 From: Yuriy Taraday Date: Tue, 23 Jun 2026 15:42:14 +0200 Subject: [PATCH 064/115] pkgs-lib/formats: Add tests for serializing null values In the effort to pass values directly as structured values, we ran into issue with serializing null's. This adds tests for null for all formats that support it and negative tests for some others. See https://github.com/NixOS/nixpkgs/pull/524404#issuecomment-4665694636 --- pkgs/pkgs-lib/formats.nix | 8 +++- pkgs/pkgs-lib/tests/formats.nix | 83 +++++++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+), 1 deletion(-) diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix index ef7d104f20e4..a184b0cbce53 100644 --- a/pkgs/pkgs-lib/formats.nix +++ b/pkgs/pkgs-lib/formats.nix @@ -1017,7 +1017,13 @@ optionalAttrs allowAliases aliases }: if format == "badgerfish" then { - type = serializableValueWith { typeName = "XML"; }; + type = + attrsOf (serializableValueWith { + typeName = "XML"; + }) + // { + description = "XML value"; + }; generate = name: value: diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix index ee6d817287c2..242fd64bc70a 100644 --- a/pkgs/pkgs-lib/tests/formats.nix +++ b/pkgs/pkgs-lib/tests/formats.nix @@ -142,6 +142,14 @@ runBuildTests { ''; }; + jsonNull = shouldPass { + format = formats.json { }; + input = null; + expected = '' + null + ''; + }; + yaml_1_1Atoms = shouldPass { format = formats.yaml_1_1 { }; input = { @@ -176,6 +184,15 @@ runBuildTests { ''; }; + yaml_1_1Null = shouldPass { + format = formats.yaml_1_1 { }; + input = null; + expected = '' + null + ... + ''; + }; + yaml_1_2Atoms = shouldPass { format = formats.yaml_1_2 { }; input = { @@ -210,6 +227,16 @@ runBuildTests { ''; }; + yaml_1_2Null = shouldPass { + format = formats.yaml_1_2 { }; + input = null; + # nixfmt insists on removing indentation, so force it with ${" "} + expected = '' + + ${" "}null + ''; + }; + iniAtoms = shouldPass { format = formats.ini { }; input = { @@ -879,6 +906,14 @@ runBuildTests { ''; }; + cdnNull = shouldPass { + format = formats.cdn { }; + input = null; + expected = '' + null: null + ''; + }; + # This test is responsible for # 1. testing type coercions # 2. providing a more readable example test @@ -989,6 +1024,14 @@ runBuildTests { ''; }; + luaNull = shouldPass { + format = formats.lua { }; + input = null; + expected = '' + return nil + ''; + }; + nixConfAtoms = shouldPass { format = formats.nixConf { package = pkgs.nix; @@ -1014,6 +1057,15 @@ runBuildTests { ''; }; + nixConfNull = shouldFail { + format = formats.nixConf { + package = pkgs.nix; + version = pkgs.nix.version; + extraOptions = "ignore-try = false"; + }; + input = null; + }; + phpAtoms = shouldPass rec { format = formats.php { finalVariable = "config"; }; input = { @@ -1043,6 +1095,16 @@ runBuildTests { ''; }; + phpNull = shouldPass { + format = formats.php { finalVariable = "config"; }; + input = null; + expected = '' + ''; }; + PlistNull = shouldPass { + format = formats.plist { }; + input = null; + expected = '' + + + + + ''; + }; + hcl1Atoms = shouldPass { format = formats.hcl1 { }; input = { From 454d0460eb19a228db0f141c7c2c06de0d779afc Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 23 Jun 2026 17:05:10 +0000 Subject: [PATCH 065/115] misskey: 2026.5.4 -> 2026.6.0 --- pkgs/by-name/mi/misskey/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix index 58f4552604a4..35bfec707916 100644 --- a/pkgs/by-name/mi/misskey/package.nix +++ b/pkgs/by-name/mi/misskey/package.nix @@ -21,13 +21,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "misskey"; - version = "2026.5.4"; + version = "2026.6.0"; src = fetchFromGitHub { owner = "misskey-dev"; repo = "misskey"; tag = finalAttrs.version; - hash = "sha256-ENq5V1lIFGKIr1xZccy1LFRYVqZVEhDzBhAbDNcG5sM="; + hash = "sha256-jq1HtLabix9qxaAjaCgUN3nsY438ruHgHgC3MuGeR2E="; fetchSubmodules = true; }; @@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: { ; inherit pnpm; fetcherVersion = 4; - hash = "sha256-wEbYkfp+zfytOPBjEcyTHCaoohGRNRjG5oTUefI5BVw="; + hash = "sha256-GCkSASkgwUvlAlm8hiy4Yk/QMVerVGacxOh1AYouH0g="; }; buildPhase = '' From 2f3b8b58e9ed4f46fb5cdc7a37db07fc2ce49eb1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Tue, 23 Jun 2026 10:21:31 -0700 Subject: [PATCH 066/115] deltachat-desktop: 2.52.0 -> 2.53.1 Diff: https://github.com/deltachat/deltachat-desktop/compare/v2.52.0...v2.53.1 Changelog: https://github.com/deltachat/deltachat-desktop/blob/v2.53.1/CHANGELOG.md --- pkgs/by-name/de/deltachat-desktop/package.nix | 12 ++++++------ pkgs/by-name/de/deltachat-tauri/package.nix | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix index dbcc517399ae..bd2dc45d2ed6 100644 --- a/pkgs/by-name/de/deltachat-desktop/package.nix +++ b/pkgs/by-name/de/deltachat-desktop/package.nix @@ -22,38 +22,38 @@ let deltachat-rpc-server' = deltachat-rpc-server.overrideAttrs rec { - version = "2.52.0"; + version = "2.53.0"; src = fetchFromGitHub { owner = "chatmail"; repo = "core"; tag = "v${version}"; - hash = "sha256-AQo27qnHPCK6q/3+Umk6ueqkOIVBA8n4q9S5iEZ7TkM="; + hash = "sha256-W2Yh5+6MaJ47GqJioGKge2J3RetGGTcl+0YxPPlSdDo="; }; cargoDeps = rustPlatform.fetchCargoVendor { pname = "chatmail-core"; inherit version src; - hash = "sha256-ni8iaVPHXWhxfiBvtVzGRyPcxkbV0HiqcQCHGmAqk7s="; + hash = "sha256-aoPc5XvjwwuA9aOTvIOpTm15wozC9glJGqn3vPqsJF4="; }; }; electron = electron_41; in stdenv.mkDerivation (finalAttrs: { pname = "deltachat-desktop"; - version = "2.52.0"; + version = "2.53.1"; __structuredAttrs = true; src = fetchFromGitHub { owner = "deltachat"; repo = "deltachat-desktop"; tag = "v${finalAttrs.version}"; - hash = "sha256-/FdGI6Dr9lz0+g/xSzHXbMdqWHf4TliHDXXiAQKKkOs="; + hash = "sha256-UJ6005PeQBiL9Inj/VRZjgxZtR278Ky2RcD5MywcGD8="; }; pnpmDeps = fetchPnpmDeps { inherit (finalAttrs) pname version src; pnpm = pnpm_10; fetcherVersion = 4; - hash = "sha256-0VvyZzWAdVGsuYb8CI36KqkqvjgRsTLJov1L44MxUHQ="; + hash = "sha256-t5OHx1GCaTIgGo9193Z3Kkl+jHCBIgtRypcUaO6By3I="; }; strictDeps = true; diff --git a/pkgs/by-name/de/deltachat-tauri/package.nix b/pkgs/by-name/de/deltachat-tauri/package.nix index f812683ceae5..26cb46756bca 100644 --- a/pkgs/by-name/de/deltachat-tauri/package.nix +++ b/pkgs/by-name/de/deltachat-tauri/package.nix @@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: { ; __structuredAttrs = true; - cargoHash = "sha256-euRUA4LTmAdb9466DAMqKgAPX3N4KNXCh1ED9cL42lA="; + cargoHash = "sha256-iGgsG5V0cFzoudVASGqLakpuy2h4oD979LHuBclj+3o="; postPatch = lib.optionalString stdenv.hostPlatform.isLinux '' substituteInPlace $cargoDepsCopy/*/libappindicator-sys-*/src/lib.rs \ From 3aebc40624d576bd95cc17da7db374e2582d6df0 Mon Sep 17 00:00:00 2001 From: K900 Date: Tue, 23 Jun 2026 20:59:38 +0300 Subject: [PATCH 067/115] nixos/test-driver: abort if we didn't connect to the backdoor in 5 minutes This is a lot of minutes, but less than the 1 hour it would normally take to time out the entire build. --- nixos/lib/test-driver/src/test_driver/machine/__init__.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py index db96445af912..a202956abff4 100644 --- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py +++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py @@ -1044,12 +1044,16 @@ class QemuMachine(BaseMachine): assert self.shell tic = time.time() - # TODO: do we want to bail after a set number of attempts? - while not shell_ready(timeout_secs=30): + + for _ in range(10): + if shell_ready(timeout_secs=30): + break self.log("Guest root shell did not produce any data yet...") self.log( " To debug, enter the VM and run 'systemctl status backdoor.service'." ) + else: + raise RuntimeError("Shell did not start in time") while True: chunk = self.shell.recv(1024) From efdeeebcb9127136cdb83f2212d785f0d33b1407 Mon Sep 17 00:00:00 2001 From: Yuriy Taraday Date: Tue, 23 Jun 2026 14:40:23 +0200 Subject: [PATCH 068/115] Reapply "pkgs-lib/formats: Use .attrs.json where possible" This expands on https://github.com/NixOS/nixpkgs/pull/498928 that introduced __structuredAttrs here by actually using data in `.attrs.json` when it makes sense, instead of relying on environment variables. This reverts commit bf6ada5d786e8aa4faff128e7e73a4792c2e99fe. This reapplies commit 691dc02df0111c320cd6697aacd4b113ba632e40. --- pkgs/pkgs-lib/formats.nix | 60 ++++++++++----------- pkgs/pkgs-lib/formats/configobj/default.nix | 8 +-- pkgs/pkgs-lib/formats/configobj/generate.py | 5 +- 3 files changed, 36 insertions(+), 37 deletions(-) diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix index a184b0cbce53..f23f740ab7a9 100644 --- a/pkgs/pkgs-lib/formats.nix +++ b/pkgs/pkgs-lib/formats.nix @@ -146,14 +146,14 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ jq ]; - value = toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } + # NIX_ATTRS_JSON_FILE won't have `value` if it's null, but jq returns null for missing properties anyway + # jsonNull test keeps this in check '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - jq . "$valuePath" > $out + jq .value "$NIX_ATTRS_JSON_FILE" > $out '' ) { }; @@ -171,14 +171,16 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ remarshal_0_17 ]; - value = toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - json2yaml "$valuePath" "$out" + json2yaml ${ + # attributes with null values are omitted from the JSON with structured attrs + # yaml_1_1Null test keeps this in check + if value == null then ''<(echo "null")'' else ''--unwrap value "$NIX_ATTRS_JSON_FILE"'' + } "$out" '' ) { }; @@ -196,14 +198,16 @@ optionalAttrs allowAliases aliases runCommand name { nativeBuildInputs = [ remarshal ]; - value = toJSON value; + inherit value; preferLocalBuild = true; __structuredAttrs = true; } '' - valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - json2yaml "$valuePath" "$out" + json2yaml ${ + # attributes with null values are omitted from the JSON with structured attrs + # yaml_1_2Null test keeps this in check + if value == null then ''<(echo "null")'' else ''--unwrap value "$NIX_ATTRS_JSON_FILE"'' + } "$out" '' ) { }; @@ -960,8 +964,10 @@ optionalAttrs allowAliases aliases python3 black ]; - imports = toJSON (value._imports or [ ]); - value = toJSON (removeAttrs value [ "_imports" ]); + imports = value._imports or [ ]; + # value must be an attrset, type would verify that, + # otherwise removeAttrs will fail. + value = removeAttrs value [ "_imports" ]; pythonGen = pkgs.writeText "pythonGen" '' import json import os @@ -984,26 +990,20 @@ optionalAttrs allowAliases aliases else: return repr(value) - with open(os.environ["importsPath"], "r") as f: - imports = json.load(f) - if imports is not None: - for i in imports: + with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f: + attrs = json.load(f) + if attrs["imports"] is not None: + for i in attrs["imports"]: print(f"import {i}") print() - with open(os.environ["valuePath"], "r") as f: - for key, value in json.load(f).items(): + for key, value in attrs["value"].items(): print(f"{key} = {recursive_repr(value)}") ''; preferLocalBuild = true; __structuredAttrs = true; } '' - export importsPath="$TMPDIR/imports" - printf "%s" "$imports" > "$importsPath" - export valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" - cat "$valuePath" python3 "$pythonGen" > $out black $out '' @@ -1039,14 +1039,16 @@ optionalAttrs allowAliases aliases python3Packages.xmltodict libxml2Python ]; - value = toJSON value; + inherit value; pythonGen = pkgs.writeText "pythonGen" '' import json import os import xmltodict - with open(os.environ["valuePath"], "r") as f: - print(xmltodict.unparse(json.load(f), full_document=${ + with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f: + value = json.load(f).get("value") + assert type(value) is dict, "value must be an attrset" + print(xmltodict.unparse(value, full_document=${ if withHeader then "True" else "False" }, pretty=True, indent=" " * 2)) ''; @@ -1054,8 +1056,6 @@ optionalAttrs allowAliases aliases __structuredAttrs = true; } '' - export valuePath="$TMPDIR/value" - printf "%s" "$value" > "$valuePath" python3 "$pythonGen" > $out xmllint $out > /dev/null '' diff --git a/pkgs/pkgs-lib/formats/configobj/default.nix b/pkgs/pkgs-lib/formats/configobj/default.nix index 8179c4412e5f..227d8e7aa990 100644 --- a/pkgs/pkgs-lib/formats/configobj/default.nix +++ b/pkgs/pkgs-lib/formats/configobj/default.nix @@ -3,10 +3,6 @@ pkgs, }: let - inherit (lib) - toJSON - ; - inherit (lib.types) serializableValueWith ; @@ -25,12 +21,12 @@ in (pkgs.python3.withPackages (ps: [ ps.configobj ])) ]; - valuesJSON = toJSON value; + inherit value; __structuredAttrs = true; strictDeps = true; } '' - printf "%s" "$valuesJSON" | python3 ${./generate.py} > "$out" + python3 ${./generate.py} > "$out" ''; }; } diff --git a/pkgs/pkgs-lib/formats/configobj/generate.py b/pkgs/pkgs-lib/formats/configobj/generate.py index 5863396c120d..e531e68a4fbb 100644 --- a/pkgs/pkgs-lib/formats/configobj/generate.py +++ b/pkgs/pkgs-lib/formats/configobj/generate.py @@ -1,7 +1,10 @@ import json +import os import sys from configobj import ConfigObj config = ConfigObj(interpolation=False, encoding="UTF8") -config.update(json.load(sys.stdin)) +with open(os.environ["NIX_ATTRS_JSON_FILE"]) as f: + value = json.load(f).get("value") +config.update(value) config.write(sys.stdout.buffer) From 1b4f0e5a1f2cec72fdb52e32f5d7b7ccc1c11114 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Tue, 23 Jun 2026 21:40:11 +0100 Subject: [PATCH 069/115] qtwebapp: fix `sourceRoot` for `fetchedSourceNameDefault = "full"` Without the chnage the build fails on `master` as: $ nix build -f. qtwebapp --arg config ' { fetchedSourceNameDefault = "full"; }' -j1 ... > unpacking source archive /nix/store/yi6b975bbh7zd7wj15dan247mkbhlg5x-QtWebApp-1.9.1-github-source > source root is source/QtWebApp > chmod: cannot access 'source/QtWebApp': No such file or directory This happens because the `sourceRoot` hardcodes unpack source dir as `source`. Let's derive it from `src` instead. --- pkgs/by-name/qt/qtwebapp/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/qt/qtwebapp/package.nix b/pkgs/by-name/qt/qtwebapp/package.nix index c2f04ff5df82..52b17e7c0403 100644 --- a/pkgs/by-name/qt/qtwebapp/package.nix +++ b/pkgs/by-name/qt/qtwebapp/package.nix @@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: { __structuredAttrs = true; - sourceRoot = "source/QtWebApp"; + sourceRoot = "${finalAttrs.src.name}/QtWebApp"; postPatch = '' cat >>QtWebApp.pro < Date: Tue, 23 Jun 2026 15:56:04 -0500 Subject: [PATCH 070/115] python3Packages.skorch: add openssl to test dependencies --- pkgs/development/python-modules/skorch/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/python-modules/skorch/default.nix b/pkgs/development/python-modules/skorch/default.nix index 842ae617b8e0..b916413ab003 100644 --- a/pkgs/development/python-modules/skorch/default.nix +++ b/pkgs/development/python-modules/skorch/default.nix @@ -12,6 +12,7 @@ tqdm, flaky, llvmPackages, + openssl, pandas, pytest-cov-stub, pytestCheckHook, @@ -45,6 +46,7 @@ buildPythonPackage rec { nativeCheckInputs = [ flaky + openssl pytest-cov-stub pytestCheckHook safetensors From 1c7ed064df19fdeef8b13b90ae0132b41b92922c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 23 Jun 2026 22:39:54 +0000 Subject: [PATCH 071/115] git-pages-cli: 1.9.0 -> 1.10.0 --- pkgs/by-name/gi/git-pages-cli/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gi/git-pages-cli/package.nix b/pkgs/by-name/gi/git-pages-cli/package.nix index a4fb358e4ea8..98760b019b25 100644 --- a/pkgs/by-name/gi/git-pages-cli/package.nix +++ b/pkgs/by-name/gi/git-pages-cli/package.nix @@ -8,7 +8,7 @@ buildGoModule (finalAttrs: { pname = "git-pages-cli"; - version = "1.9.0"; + version = "1.10.0"; __structuredAttrs = true; @@ -16,7 +16,7 @@ buildGoModule (finalAttrs: { owner = "git-pages"; repo = "git-pages-cli"; rev = "v${finalAttrs.version}"; - hash = "sha256-toqL/BUj3MDAqqD+94nLyw7QwU5jsUqThQVK0hJbU8Y="; + hash = "sha256-GIZ6kdCd8BIBEZxBw4Srwnbbl3PtpS2IRyA+Hx5PbAc="; }; vendorHash = "sha256-SNLSkz38AgLfjpKaEYawBLdWznKWOz62bNzuaquk7Rs="; From b12656477c958885ea7469f18efe45967fee22c1 Mon Sep 17 00:00:00 2001 From: Atemu Date: Wed, 24 Jun 2026 00:43:16 +0200 Subject: [PATCH 072/115] Revert "nixos/system-path: don't link `/etc/xdg/` uncoditionally" This created more breakage than expected. Revert until the critical modules are patched. This reverts commit 603fc91c3326715ceb023220b193ff46046e7f08. --- doc/release-notes/rl-2611.section.md | 2 +- nixos/modules/config/system-path.nix | 1 + nixos/modules/config/xdg/autostart.nix | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md index d9e27a469008..c3d9415e5459 100644 --- a/doc/release-notes/rl-2611.section.md +++ b/doc/release-notes/rl-2611.section.md @@ -10,7 +10,6 @@ -- Paths under `/etc/xdg/` from packages in `environment.systemPackages` are no longer linked into the global `/etc/` by default. Modules depending on such directories must declare them explicitly using `environment.pathsToLink`. - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details. - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details. @@ -94,3 +93,4 @@ ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements} - Create the first release note entry in this section! + diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix index 5776c8ede413..c014f00da605 100644 --- a/nixos/modules/config/system-path.nix +++ b/nixos/modules/config/system-path.nix @@ -187,6 +187,7 @@ in environment.pathsToLink = [ "/bin" + "/etc/xdg" "/etc/gtk-2.0" "/etc/gtk-3.0" "/lib" # FIXME: remove and update debug-info.nix diff --git a/nixos/modules/config/xdg/autostart.nix b/nixos/modules/config/xdg/autostart.nix index a266b046de1a..46c90ae1793a 100644 --- a/nixos/modules/config/xdg/autostart.nix +++ b/nixos/modules/config/xdg/autostart.nix @@ -22,6 +22,8 @@ }; config = { + # FIXME this does not actually work because "/etc/xdg" is linked + # unconditionally in `nixos/modules/config/system-path.nix` environment.pathsToLink = lib.mkIf config.xdg.autostart.install [ "/etc/xdg/autostart" ]; From ffecd4cb362dd4b3a8542ebb9dfd141f401d4086 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 23 Jun 2026 22:49:51 +0000 Subject: [PATCH 073/115] md-tui: 0.10.1 -> 0.10.2 Diff: https://github.com/henriklovhaug/md-tui/compare/v0.10.1...v0.10.2 Changelog: https://github.com/henriklovhaug/md-tui/blob/v0.10.2/CHANGELOG.md --- pkgs/by-name/md/md-tui/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/md/md-tui/package.nix b/pkgs/by-name/md/md-tui/package.nix index e03046cbdc53..41c58989f376 100644 --- a/pkgs/by-name/md/md-tui/package.nix +++ b/pkgs/by-name/md/md-tui/package.nix @@ -8,7 +8,7 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "md-tui"; - version = "0.10.1"; + version = "0.10.2"; __structuredAttrs = true; @@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: { owner = "henriklovhaug"; repo = "md-tui"; tag = "v${finalAttrs.version}"; - hash = "sha256-bFL84y0735L93x0nWkKAAmTDMdZzs5DDoxqbQhgXUMQ="; + hash = "sha256-VSOAeFY3TsdeOlKt3f9cbEsSNSwvhcYQl129oQMOTaM="; }; - cargoHash = "sha256-xR9bWWDxerP2zGAb43ZWONLcsbmUn8KzMXwDEmrjioU="; + cargoHash = "sha256-l1VXrf19KB6zTrVmINyinz0YpGDDUH9B77CN6CMz/X8="; nativeBuildInputs = [ pkg-config ]; From e094bdeb32eccece6ee47ad163afd7952e65ff53 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 23 Jun 2026 22:58:20 +0000 Subject: [PATCH 074/115] blackfire: 2026.6.0 -> 2026.6.1 --- pkgs/by-name/bl/blackfire/package.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/bl/blackfire/package.nix b/pkgs/by-name/bl/blackfire/package.nix index 0652939fdc29..0205b58df2db 100644 --- a/pkgs/by-name/bl/blackfire/package.nix +++ b/pkgs/by-name/bl/blackfire/package.nix @@ -11,7 +11,7 @@ stdenv.mkDerivation rec { pname = "blackfire"; - version = "2026.6.0"; + version = "2026.6.1"; src = passthru.sources.${stdenv.hostPlatform.system} @@ -60,23 +60,23 @@ stdenv.mkDerivation rec { sources = { "x86_64-linux" = fetchurl { url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_amd64.deb"; - hash = "sha256-JPhh7LNiLZXLN5iycNobZ/uJQjOhKqqYSw9P78+/BKk="; + hash = "sha256-doeqXoS0B7AyzyhkLB9wUC6iuD0c2KIhAIEPeYaDC5E="; }; "i686-linux" = fetchurl { url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_i386.deb"; - hash = "sha256-uoqUDJ/bexqaRlf5Y692OGm91W1ErlS8Q8/l9MlsHwU="; + hash = "sha256-bQWhiSw9/gGyGoLEyz6BHaRPNLxuqouiobBMfB5ytYk="; }; "aarch64-linux" = fetchurl { url = "https://packages.blackfire.io/debian/pool/any/main/b/blackfire/blackfire_${version}_arm64.deb"; - hash = "sha256-kL9s17Bnt8UYj3IiX2b7e3OWSsRLq5TSzdK6OdByD40="; + hash = "sha256-B+rhmnM2sVICVLDcYq2OEp402Wz6kywCRqeS95Vdzlw="; }; "aarch64-darwin" = fetchurl { url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_arm64.pkg.tar.gz"; - hash = "sha256-p9D87uaDVu25SG4cclmzaq9oKaFDlIy8/XLx3rHuIQ4="; + hash = "sha256-Ofs9raAtx/duS8dXWfvjKGzhJr3j9+gkH8lP/VLfnkE="; }; "x86_64-darwin" = fetchurl { url = "https://packages.blackfire.io/blackfire/${version}/blackfire-darwin_amd64.pkg.tar.gz"; - hash = "sha256-ppCSvk259NNlujl9olyRlmwRdNbLu/uRs+gq71S79B8="; + hash = "sha256-+rMiD/vFFIA8dR3quUnpr8uDNTdvnXyYjT8brgiOxBI="; }; }; From 5ff50a92f88f3657a05688bfd3cbddf96e0fff50 Mon Sep 17 00:00:00 2001 From: Gaetan Lepage Date: Tue, 23 Jun 2026 22:46:18 +0000 Subject: [PATCH 075/115] python3Packages.executorch: fix CUDA build --- pkgs/development/python-modules/executorch/default.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pkgs/development/python-modules/executorch/default.nix b/pkgs/development/python-modules/executorch/default.nix index e4fe62894755..aa3ec5c2ea43 100644 --- a/pkgs/development/python-modules/executorch/default.nix +++ b/pkgs/development/python-modules/executorch/default.nix @@ -111,12 +111,15 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: { # But the build script is sensitive to this env variable. # Fixes: # Some binaries contain forbidden references to /build/. Check the error above! - CMAKE_ARGS = lib.concatStringsSep " " [ + CMAKE_ARGS = toString [ (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" true) # For some cmake-tier reason, cmakeBool does not work here (lib.cmakeFeature "EXECUTORCH_BUILD_CUDA" (if cudaSupport then "ON" else "OFF")) ]; + } + // lib.optionalAttrs cudaSupport { + TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" torch.cudaCapabilities; }; build-system = [ @@ -140,6 +143,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: { buildInputs = lib.optionals cudaSupport [ cudaPackages.cuda_cudart cudaPackages.cuda_nvrtc + cudaPackages.libcurand ]; pythonRemoveDeps = [ From 3753ce71e23a14692574b35a492f6020b81013c0 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 23 Jun 2026 23:15:26 +0000 Subject: [PATCH 076/115] bluesky-pds: 0.4.5001 -> 0.4.5006 --- pkgs/by-name/bl/bluesky-pds/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/bl/bluesky-pds/package.nix b/pkgs/by-name/bl/bluesky-pds/package.nix index 3c990477451a..3b8b4081ba7d 100644 --- a/pkgs/by-name/bl/bluesky-pds/package.nix +++ b/pkgs/by-name/bl/bluesky-pds/package.nix @@ -27,13 +27,13 @@ in stdenv.mkDerivation (finalAttrs: { pname = "pds"; - version = "0.4.5001"; + version = "0.4.5006"; src = fetchFromGitHub { owner = "bluesky-social"; repo = "pds"; tag = "v${finalAttrs.version}"; - hash = "sha256-j7XNZYZHHj5HdtEuTAhNU9TD7S7eMILMflZJn0nDVaY="; + hash = "sha256-Jb2qAB6P5KlRu4L99fcK/v0/Fspr8IFaFXuYg+PBxhM="; }; sourceRoot = "${finalAttrs.src.name}/service"; @@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: { ; inherit pnpm; fetcherVersion = 4; - hash = "sha256-3/gjhQIMxI/mwqmKV1wZ6oMiCGHutXuDY2CFSN3QnE4="; + hash = "sha256-YfwoUkTJJ2qANqwtSWKDGfFmahAtIDNyYFwCUE72oB0="; }; buildPhase = '' From c0a7116c34a7a760f1147ff38054bef9f175125c Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 23 Jun 2026 23:34:39 +0000 Subject: [PATCH 077/115] libretro.flycast: 0-unstable-2026-06-12 -> 0-unstable-2026-06-23 --- pkgs/applications/emulators/libretro/cores/flycast.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix index e1536e274d85..cf56b95d8026 100644 --- a/pkgs/applications/emulators/libretro/cores/flycast.nix +++ b/pkgs/applications/emulators/libretro/cores/flycast.nix @@ -8,13 +8,13 @@ }: mkLibretroCore { core = "flycast"; - version = "0-unstable-2026-06-12"; + version = "0-unstable-2026-06-23"; src = fetchFromGitHub { owner = "flyinghead"; repo = "flycast"; - rev = "c0f2cf4319d6c77d577599906ca0a90627a3afc8"; - hash = "sha256-ie0mP7IcvWsFX/k0UhJ6eMkdyDq69W8aCcjwkAoL5II="; + rev = "59ab660649d933f40cf281656ba949eb4c835d73"; + hash = "sha256-Hwav4vHppInUUbiSch3J84P7HIYkQ+DM431fFdq1qEg="; fetchSubmodules = true; }; From 9a1367a71220d854a77542293dc4d082dab53f1a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Tue, 23 Jun 2026 23:55:42 +0000 Subject: [PATCH 078/115] panache: 2.54.0 -> 2.58.0 --- pkgs/by-name/pa/panache/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pa/panache/package.nix b/pkgs/by-name/pa/panache/package.nix index e50261ff6653..9cbc05d6eaf5 100644 --- a/pkgs/by-name/pa/panache/package.nix +++ b/pkgs/by-name/pa/panache/package.nix @@ -8,16 +8,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "panache"; - version = "2.54.0"; + version = "2.58.0"; src = fetchFromGitHub { owner = "jolars"; repo = "panache"; tag = "v${finalAttrs.version}"; - hash = "sha256-JyLIsCJc/kmVBMp+9PRmkx2P1jrtTmmHfbk7mMcHQQ0="; + hash = "sha256-QLW+3xkAYPFVAXM2VwhZm175CksDG9HL9rCEkH7knlU="; }; - cargoHash = "sha256-LLEkdc6MstTfRGoTgtOncmRlSBXnNA2f1qFsR0O5XEM="; + cargoHash = "sha256-OXkkaXWFFOBsZEWL88UWy1dqpwZazk9i8ZAH/tprag4="; nativeBuildInputs = [ installShellFiles From 0974da23d0cccb87c2167cf929827a720eae6fe5 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 01:19:38 +0000 Subject: [PATCH 079/115] keifu: 0.4.0 -> 0.5.0 --- pkgs/by-name/ke/keifu/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ke/keifu/package.nix b/pkgs/by-name/ke/keifu/package.nix index 691f403a235e..2dd1254741c9 100644 --- a/pkgs/by-name/ke/keifu/package.nix +++ b/pkgs/by-name/ke/keifu/package.nix @@ -15,17 +15,17 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "keifu"; - version = "0.4.0"; + version = "0.5.0"; __structuredAttrs = true; src = fetchFromGitHub { owner = "trasta298"; repo = "keifu"; tag = "v${finalAttrs.version}"; - hash = "sha256-668ejr2pxjGfQ0/hhJSNBSZME2+hSGuNJmwmbLVqy0o="; + hash = "sha256-ndMWi//G9kwnoPf58YtICyytMv2t0e4h7cwBdfpaoVY="; }; - cargoHash = "sha256-6YmpsKkf/Mox98fRdrwbwzFohgOicRfCxcAIGSwmT7g="; + cargoHash = "sha256-lNctnxVntxRZaS9XeII1sQZ2ZNKkSvd8n+bq5Fwd6QM="; nativeBuildInputs = [ pkg-config From 4aca00d6dd2b599a4424645f0d977c0a6d1c9d4a Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 01:42:07 +0000 Subject: [PATCH 080/115] gickup: 0.10.44 -> 0.10.45 --- pkgs/by-name/gi/gickup/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/gi/gickup/package.nix b/pkgs/by-name/gi/gickup/package.nix index 1410b566346a..f68b4695e941 100644 --- a/pkgs/by-name/gi/gickup/package.nix +++ b/pkgs/by-name/gi/gickup/package.nix @@ -7,16 +7,16 @@ buildGoModule (finalAttrs: { pname = "gickup"; - version = "0.10.44"; + version = "0.10.45"; src = fetchFromGitHub { owner = "cooperspencer"; repo = "gickup"; tag = "v${finalAttrs.version}"; - hash = "sha256-AbeV/0CngNgCaLUIwv/uy8VgpiKiOXWGSjnW+xrd7gk="; + hash = "sha256-oVvL5BZYZZCfkGK9ABcppbddKuzykZv1OtBvKElaStI="; }; - vendorHash = "sha256-lCeUEReVh0Fg1gyyTvWq2CIdQLuGCN20u9TftiokI0I="; + vendorHash = "sha256-2SwjvITyo6z34MZ7gSbSQ1PeW0aO4MRi2DzYgqGcOvk="; ldflags = [ "-X main.version=${finalAttrs.version}" ]; From ad1fe50603c85c60c12e1593e9fb0cff72c43dc9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 02:47:35 +0000 Subject: [PATCH 081/115] renode-dts2repl: 0-unstable-2026-06-08 -> 0-unstable-2026-06-23 --- pkgs/by-name/re/renode-dts2repl/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix index 99a522a647b2..8fa74c3e2fd6 100644 --- a/pkgs/by-name/re/renode-dts2repl/package.nix +++ b/pkgs/by-name/re/renode-dts2repl/package.nix @@ -7,14 +7,14 @@ python3.pkgs.buildPythonApplication { pname = "renode-dts2repl"; - version = "0-unstable-2026-06-08"; + version = "0-unstable-2026-06-23"; pyproject = true; src = fetchFromGitHub { owner = "antmicro"; repo = "dts2repl"; - rev = "ecd06775c379e4b45b3f4d9176782695ee479014"; - hash = "sha256-hv+ulJEZdB38E9ljIeRa3LupouGGiBffjNWBidhNcoQ="; + rev = "ac3c1b8b0c030adadfcb266af39d7dc7379ceaf9"; + hash = "sha256-9Xxb2/B6ctm3HQpDGmAbL+v+n5EjcWWe46KCSMlvujs="; }; nativeBuildInputs = [ From f928a878a4ae2c9f6b495ea894362ce6aac78b28 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 04:15:19 +0000 Subject: [PATCH 082/115] graphite: 0-unstable-2026-06-15 -> 0-unstable-2026-06-23 --- pkgs/by-name/gr/graphite/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/gr/graphite/package.nix b/pkgs/by-name/gr/graphite/package.nix index 62bd785d1db6..2cac2d0bb464 100644 --- a/pkgs/by-name/gr/graphite/package.nix +++ b/pkgs/by-name/gr/graphite/package.nix @@ -30,13 +30,13 @@ }: let - version = "0-unstable-2026-06-15"; - rev = "34e0fd77574c30749d00d775df87a7e9362e7ce8"; + version = "0-unstable-2026-06-23"; + rev = "ebbbb6bd1b0add39969717d18563808cc6306a63"; - srcHash = "sha256-SyxteWavvyeRtKcGuJkOxojstJk1C2ndbNERuSM3Cng="; + srcHash = "sha256-8k30s/czdJ5uNHH75K4+XJo6Ncd1GA3NSlaa7yO4+mg="; shaderHash = "sha256-4lKBrGh1rfhTBczmCDvIF2KxLyEHzHdKVGgQ+jLd/Dw="; - cargoHash = "sha256-KktJj1c/OrJazNk40NND8irmNd30nzpZOxdwaTAqjIs="; - npmHash = "sha256-AX5Jqk2E+WyQJyHbgvvq74MRsYmWUju4bOkabhYoeig="; + cargoHash = "sha256-gpv4LZHEWKonQodW/uzdoAfkaxSRuCMKyX1SSit/gEQ="; + npmHash = "sha256-Rb0bLPk54QigNp7TkDkJJy/TEJXAhlXOCruckwvdXks="; brandingRev = "0d004aa61e6b48d316e8e5db6d59ccc4788f192d"; brandingHash = "sha256-wAA6fR+NSxlCAqgwWmpiIAnji9k/jsMXpR0Vt04Ntmk="; From f33092361f5dc2d14c9905b9269d4331c3a4b90d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?= =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= Date: Wed, 24 Jun 2026 11:52:39 +0700 Subject: [PATCH 083/115] =?UTF-8?q?h2o:=202.3.0-rolling-2026-06-23=20?= =?UTF-8?q?=E2=86=92=202.3.0-rolling-2026-06-24?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkgs/by-name/h2/h2o/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix index 26df1a269643..faa231744418 100644 --- a/pkgs/by-name/h2/h2o/package.nix +++ b/pkgs/by-name/h2/h2o/package.nix @@ -24,13 +24,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "h2o"; - version = "2.3.0-rolling-2026-06-23"; + version = "2.3.0-rolling-2026-06-24"; src = fetchFromGitHub { owner = "h2o"; repo = "h2o"; - rev = "21708fe347076047add1225349bbcc445c447002"; - hash = "sha256-3wvKqlyHU6igfzA5xmxngpNJbxWIJkVwXQB1arycS3c="; + rev = "66fcbfed806d7645577e4e78e4d536d38379764d"; + hash = "sha256-RzQHDHihcD+ife1CBCGliytrkt8eYVdL8AHdaYp3CFQ="; }; outputs = [ From effa6972ac44b7c4df584133ea15ca3e74b92398 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 05:09:13 +0000 Subject: [PATCH 084/115] gephgui-wry: 5.7.1 -> 5.7.2 --- pkgs/by-name/ge/gephgui-wry/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ge/gephgui-wry/package.nix b/pkgs/by-name/ge/gephgui-wry/package.nix index e3c36a091bb6..41941020239b 100644 --- a/pkgs/by-name/ge/gephgui-wry/package.nix +++ b/pkgs/by-name/ge/gephgui-wry/package.nix @@ -59,13 +59,13 @@ let in rustPlatform.buildRustPackage (finalAttrs: { pname = "gephgui-wry"; - version = "5.7.1"; + version = "5.7.2"; src = fetchFromGitHub { owner = "geph-official"; repo = "gephgui-pkg"; tag = "v${finalAttrs.version}"; - hash = "sha256-PpkhIfA1jTqiY+4UwonrUk2wq+wL2Rhltfhp0LSURMg="; + hash = "sha256-uY2m4TXy4+efRC6WzGjB5Vushgj8zkCp0ctnCJAR+FE="; fetchSubmodules = true; }; From 9d935d530c3b9aecd62039e0d2fd1ad248538847 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 05:09:24 +0000 Subject: [PATCH 085/115] apm-cli: 0.18.0 -> 0.21.0 --- pkgs/by-name/ap/apm-cli/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ap/apm-cli/package.nix b/pkgs/by-name/ap/apm-cli/package.nix index d04b256b65e9..4730ddb4720a 100644 --- a/pkgs/by-name/ap/apm-cli/package.nix +++ b/pkgs/by-name/ap/apm-cli/package.nix @@ -6,7 +6,7 @@ python3Packages.buildPythonApplication (finalAttrs: { pname = "apm-cli"; - version = "0.18.0"; + version = "0.21.0"; pyproject = true; __structuredAttrs = true; @@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: { owner = "microsoft"; repo = "apm"; tag = "v${finalAttrs.version}"; - hash = "sha256-mHu5r08y3OUTJjnl5Xvb23yhoJu9DupoZhkhL74K6UE="; + hash = "sha256-Wotyqsg/1nbjttMk+4wpGK76+kaL7j6oMH61NwsTuNc="; }; postPatch = '' From e7e96e8a3a94108cafa2f2f8d70127435d69dc1f Mon Sep 17 00:00:00 2001 From: Markus Hauck Date: Wed, 24 Jun 2026 07:41:34 +0200 Subject: [PATCH 086/115] claude-code: 2.1.186 -> 2.1.187 https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md Assisted-by: Claude Code (Claude Opus 4.8) --- pkgs/by-name/cl/claude-code/manifest.json | 38 +++++++++++------------ 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json index a9a23a745d73..d92c820fce8a 100644 --- a/pkgs/by-name/cl/claude-code/manifest.json +++ b/pkgs/by-name/cl/claude-code/manifest.json @@ -1,47 +1,47 @@ { - "version": "2.1.186", - "commit": "6a56aff51d9e9faf62f26f2748501c2e32eec5e8", - "buildDate": "2026-06-22T16:51:01Z", + "version": "2.1.187", + "commit": "6a53320fad5541a68d79e4b6c53677df77b98e33", + "buildDate": "2026-06-23T17:07:42Z", "platforms": { "darwin-arm64": { "binary": "claude", - "checksum": "463a79cc34a9787cff1b3361b4ec9e2dff928c18b077f41f0bb412e4cda78637", - "size": 216811232 + "checksum": "a59a16ba4922adab7a145728f215d042184d349f5f7e72cddb7fc114250a4ce3", + "size": 215994048 }, "darwin-x64": { "binary": "claude", - "checksum": "9e17e23d451cbbc64cf4b9536c1d25efd86808512617c855091fa608f77c9899", - "size": 224349952 + "checksum": "7f57b6935b4246d03cb7acee90dc22153083483a267da589c5c920dd04744c36", + "size": 224795776 }, "linux-arm64": { "binary": "claude", - "checksum": "817e5ff483568b78c49171be317b9b9190cade77248a5776e912789312961cb6", - "size": 231782112 + "checksum": "b49be8a5e565bf2d45b50d2de62017b25462131acc9425d2fdb98b8f29c9dce2", + "size": 232240864 }, "linux-x64": { "binary": "claude", - "checksum": "6a6d5d23486597c93138941c9b68caa0fbcd2dcedbf49e29a9c8d83e3a1cb329", - "size": 234436392 + "checksum": "bb02fcb33626f8c599d10d8bee38585d4cf8d4225c3b497869dee7454e7bf361", + "size": 234874664 }, "linux-arm64-musl": { "binary": "claude", - "checksum": "24906d06ab4cf312eb30a8d656a8d8c7fb22099ea8eb974e38ecfbc25d6631aa", - "size": 225161416 + "checksum": "972fc2e0bc8104edb593ce7723d4414c0ed8e4df6d90ad26ae48097b1d910478", + "size": 225620168 }, "linux-x64-musl": { "binary": "claude", - "checksum": "d0cb255cfb03513f6099af40f045b5852a1d8a1b59d0f405d84d2a01da6c9598", - "size": 229420432 + "checksum": "c5a783d13aac71d42324f2e9dcd395c266bd5774951faf0d94855c737024bee3", + "size": 229858704 }, "win32-x64": { "binary": "claude.exe", - "checksum": "6a286f0795d6dd46187b86e9124f819af35319169901cd883b80a75c47469516", - "size": 225908896 + "checksum": "24964d08c5100bac6071352e5837101b333de1c1afefd2b8b0e7a60db6c0ef5c", + "size": 226329760 }, "win32-arm64": { "binary": "claude.exe", - "checksum": "245869d5e5242aabfde49b091628aa4b3e7546f2cac52e1d6feb221a820910bc", - "size": 220571808 + "checksum": "04124c0ba09ece85a856de652e84386094c372f002ff767a94d4a43ecf776f96", + "size": 220992160 } } } From 2a1fa66d034a8a7f34956e02730c91598abad1f7 Mon Sep 17 00:00:00 2001 From: Markus Hauck Date: Wed, 24 Jun 2026 07:41:38 +0200 Subject: [PATCH 087/115] vscode-extensions.anthropic.claude-code: 2.1.186 -> 2.1.187 https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md Assisted-by: Claude Code (Claude Opus 4.8) --- .../extensions/anthropic.claude-code/default.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix index 01037d6d0d17..794db4af5815 100644 --- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix +++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix @@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: { sources = { "x86_64-linux" = { arch = "linux-x64"; - hash = "sha256-TEEv8R6VXuOhcX2OgTKY7A8L2akisJLsx6I6bUdV3a0="; + hash = "sha256-/ns84fHAyTY7sSvhUNzq1XQYq2Xy303zs2BxJY8DBVA="; }; "aarch64-linux" = { arch = "linux-arm64"; - hash = "sha256-wis4QqTuCiRAVpoGp+Ds83lWPsNUUPmXbZcYiWuY2zg="; + hash = "sha256-U69X5lpeJaeNVL4WWzCUpI6IfbKSJXGpl30AYnx1fBQ="; }; "x86_64-darwin" = { arch = "darwin-x64"; - hash = "sha256-2njmUMYxFAaKzCdwM//S5D0fqVZhIKG0JzbT1ye4Sr4="; + hash = "sha256-DHE09NtGNOjB0HdBqTKRtDsZXpxb651kiVGhRwO1tBU="; }; "aarch64-darwin" = { arch = "darwin-arm64"; - hash = "sha256-+cJhcXufpiNrpdL+HH3mW+rrzb7Si/4LGvoce1o0c/w="; + hash = "sha256-5YIZVBMsoF0bWP27sVEVHAaAiqvmoSUgdbc8wsqUCLA="; }; }; in { name = "claude-code"; publisher = "anthropic"; - version = "2.1.186"; + version = "2.1.187"; } // sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}"); From 657930d17e105187f59df037902852138ede17ea Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 07:10:33 +0000 Subject: [PATCH 088/115] perplexity-mcp: 0-unstable-2026-04-14 -> 0-unstable-2026-06-17 --- pkgs/by-name/pe/perplexity-mcp/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/pe/perplexity-mcp/package.nix b/pkgs/by-name/pe/perplexity-mcp/package.nix index 4784dfe39c19..e0516a6f023f 100644 --- a/pkgs/by-name/pe/perplexity-mcp/package.nix +++ b/pkgs/by-name/pe/perplexity-mcp/package.nix @@ -7,13 +7,13 @@ buildNpmPackage (finalAttrs: { pname = "perplexity-mcp"; - version = "0-unstable-2026-04-14"; + version = "0-unstable-2026-06-17"; src = fetchFromGitHub { owner = "perplexityai"; repo = "modelcontextprotocol"; - rev = "dd5e0785520833ebc95d5e97c8fa68971dcae07b"; - hash = "sha256-hMIPsUsI1e8bOdPQ9t6m4/vGv07NCuC8wnYLUKolNOo="; + rev = "7c8993499c808e5b3c11b8c16736687ecef0f457"; + hash = "sha256-6uGJJ+xEVoUZYSPTMr4DSh6j4bq8nYSsUG5XDC9WKag="; }; npmDepsHash = "sha256-UWxUjneYQeM9GlbIr/zW2TrZuPJ2QOTKwbXKNuVazFg="; From 8fd970f6c7aa3c4b85dca511a48b7ed268951790 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 07:18:06 +0000 Subject: [PATCH 089/115] repath-studio: 0.4.15 -> 0.4.16 --- pkgs/by-name/re/repath-studio/package.nix | 6 +++--- pkgs/by-name/re/repath-studio/pin-clojure.patch | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/re/repath-studio/package.nix b/pkgs/by-name/re/repath-studio/package.nix index 202b6f94480f..281bb39d9fbd 100644 --- a/pkgs/by-name/re/repath-studio/package.nix +++ b/pkgs/by-name/re/repath-studio/package.nix @@ -21,13 +21,13 @@ }: buildNpmPackage (finalAttrs: { pname = "repath-studio"; - version = "0.4.15"; + version = "0.4.16"; src = fetchFromGitHub { owner = "repath-studio"; repo = "repath-studio"; tag = "v${finalAttrs.version}"; - hash = "sha256-Fnu7tZ8chvnDMuMw4QD1NuQgaFOBzHfzl2ePQ5iwnao="; + hash = "sha256-wqDsjr+ZQDRFINzr38i7ClgREEmAaKt+U/Ma63vAH1k="; }; patches = [ @@ -38,7 +38,7 @@ buildNpmPackage (finalAttrs: { makeCacheWritable = true; - npmDepsHash = "sha256-0dSFEZ02D83yplqT3GV9TyUwJ3lDjxM47pGYwUXzatw="; + npmDepsHash = "sha256-IvKHLxX7rTB3AGDzNQIVNhfXs0C6TVATdVGUDHGrpOo="; nativeBuildInputs = [ finalAttrs.passthru.clojureWithHome diff --git a/pkgs/by-name/re/repath-studio/pin-clojure.patch b/pkgs/by-name/re/repath-studio/pin-clojure.patch index 38e3f57a074b..95bbbc0f452f 100644 --- a/pkgs/by-name/re/repath-studio/pin-clojure.patch +++ b/pkgs/by-name/re/repath-studio/pin-clojure.patch @@ -1,5 +1,5 @@ diff --git a/deps.edn b/deps.edn -index 027cf5e..648c635 100644 +index 6abd18c..d2f8e14 100644 --- a/deps.edn +++ b/deps.edn @@ -1,5 +1,6 @@ From 0dc4ca4c71e3264818087b678c050fdbb3e3f87b Mon Sep 17 00:00:00 2001 From: Nina Fromm Date: Mon, 22 Jun 2026 17:35:25 +0200 Subject: [PATCH 090/115] nixos/tests: Load root profile in nspawn tests This is currently a hacky workarround, but bettern than nothing until we come up with a better solution. --- .../test-driver/src/test_driver/machine/__init__.py | 2 +- nixos/tests/simple-container.nix | 11 ++++++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/nixos/lib/test-driver/src/test_driver/machine/__init__.py b/nixos/lib/test-driver/src/test_driver/machine/__init__.py index db96445af912..83e39c0be49b 100644 --- a/nixos/lib/test-driver/src/test_driver/machine/__init__.py +++ b/nixos/lib/test-driver/src/test_driver/machine/__init__.py @@ -1587,7 +1587,7 @@ class NspawnMachine(BaseMachine): # NOTE If the test calls switch-to-configuration (with a differently configured specialization) # this will use the /etc/profile of the new specialisation while `QemuMachine` nodes # will continue to use the original /etc/profile. - command = f"set -eo pipefail; source /etc/profile; set -u; {command}" + command = f"set -eo pipefail; USER=root HOME=/root source /etc/profile; set -u; {command}" cp = subprocess.run( [ diff --git a/nixos/tests/simple-container.nix b/nixos/tests/simple-container.nix index 269853423651..5cd3478f3d40 100644 --- a/nixos/tests/simple-container.nix +++ b/nixos/tests/simple-container.nix @@ -1,11 +1,16 @@ { name = "simple-container"; - containers.machine = { }; + containers = { + machine = { pkgs, ... }: { + users.users.root.packages = [ pkgs.hello ]; + }; + noprofile = { }; + }; testScript = '' start_all() - machine.wait_for_unit("multi-user.target") - machine.shutdown() + machine.succeed("hello") + noprofile.fail("hello") ''; } From 1a92b98cc8cdd4fa480c604c7198eea7ffdc62bc Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 07:45:37 +0000 Subject: [PATCH 091/115] gvm-libs: 23.3.0 -> 23.7.0 --- pkgs/by-name/gv/gvm-libs/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix index 0f2b9ba3cf14..574ef0cdaa39 100644 --- a/pkgs/by-name/gv/gvm-libs/package.nix +++ b/pkgs/by-name/gv/gvm-libs/package.nix @@ -26,13 +26,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "gvm-libs"; - version = "23.3.0"; + version = "23.7.0"; src = fetchFromGitHub { owner = "greenbone"; repo = "gvm-libs"; tag = "v${finalAttrs.version}"; - hash = "sha256-aS+3XMz37TJTI56y0EecRCbrdkO1JIYm5KamC54tFyI="; + hash = "sha256-cRSvrmasKrk0xMnq7/bF0F6wWSKNcXDRm+p/JlciPGo="; }; postPatch = '' From 9af57289b3a2887c8dac91efe914149878c09b81 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Sun, 19 Oct 2025 18:28:14 +0200 Subject: [PATCH 092/115] nixos/pam: allow changing pam_unix module path --- nixos/modules/security/pam.nix | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 586ae6fd9ede..9786d5737a87 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1008,7 +1008,7 @@ let { name = "unix"; control = "required"; - modulePath = "${package}/lib/security/pam_unix.so"; + modulePath = config.security.pam.pam_unixModulePath; } # pam_slurm_adopt must be the last module in the account stack. { @@ -1217,7 +1217,7 @@ let name = "unix-early"; enable = cfg.unixAuth; control = "optional"; - modulePath = "${package}/lib/security/pam_unix.so"; + modulePath = config.security.pam.pam_unixModulePath; settings = { nullok = cfg.allowNullPassword; inherit (cfg) nodelay; @@ -1315,7 +1315,7 @@ let name = "unix"; enable = cfg.unixAuth; control = "sufficient"; - modulePath = "${package}/lib/security/pam_unix.so"; + modulePath = config.security.pam.pam_unixModulePath; settings = { nullok = cfg.allowNullPassword; inherit (cfg) nodelay; @@ -1404,7 +1404,7 @@ let { name = "unix"; control = "sufficient"; - modulePath = "${package}/lib/security/pam_unix.so"; + modulePath = config.security.pam.pam_unixModulePath; settings = { nullok = true; yescrypt = true; @@ -1493,7 +1493,7 @@ let { name = "unix"; control = "required"; - modulePath = "${package}/lib/security/pam_unix.so"; + modulePath = config.security.pam.pam_unixModulePath; } { name = "loginuid"; @@ -1860,6 +1860,14 @@ in security.pam.package = lib.mkPackageOption pkgs "pam" { }; + security.pam.pam_unixModulePath = lib.mkOption { + type = lib.types.pathInStore; + default = "${package}/lib/security/pam_unix.so"; + defaultText = "\${config.security.pam.package}/lib/security/pam_unix.so"; + description = "The pam_unix module to use in all the default pam services."; + internal = true; + }; + security.pam.loginLimits = lib.mkOption { default = [ ]; type = limitsType; From ad462fc106b0f1003c349d044453e6dfc46019f0 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Wed, 24 Jun 2026 10:47:41 +0200 Subject: [PATCH 093/115] nixos/pam: introduce enableLegacySettings option --- nixos/modules/security/pam.nix | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 9786d5737a87..7d924bff8ca1 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1221,7 +1221,7 @@ let settings = { nullok = cfg.allowNullPassword; inherit (cfg) nodelay; - likeauth = true; + likeauth = lib.mkIf config.security.pam.enableLegacySettings true; }; } { @@ -1319,7 +1319,7 @@ let settings = { nullok = cfg.allowNullPassword; inherit (cfg) nodelay; - likeauth = true; + likeauth = lib.mkIf config.security.pam.enableLegacySettings true; try_first_pass = true; }; } @@ -1407,7 +1407,7 @@ let modulePath = config.security.pam.pam_unixModulePath; settings = { nullok = true; - yescrypt = true; + yescrypt = lib.mkIf config.security.pam.enableLegacySettings true; }; } { @@ -1912,6 +1912,19 @@ in ''; }; + security.pam.enableLegacySettings = lib.mkOption { + default = true; + type = lib.types.bool; + description = '' + Alternative implementations of pam_unix may not support all legacy arguments. + This option will disable all known legacy settings. + ::: {.note} + Setting this option to false will omit arguments, such as `yescrypt`. + Doing so is only safe if the defaults used by pam_unix are sensible. + ::: + ''; + }; + security.pam.makeHomeDir.skelDirectory = lib.mkOption { type = lib.types.str; default = "/var/empty"; From 9a2f22270ca659dc6e168289c34fc1f734b32adf Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Sun, 19 Oct 2025 14:24:45 +0200 Subject: [PATCH 094/115] libeconf: init at 0.8.3 --- pkgs/by-name/li/libeconf/package.nix | 40 ++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 pkgs/by-name/li/libeconf/package.nix diff --git a/pkgs/by-name/li/libeconf/package.nix b/pkgs/by-name/li/libeconf/package.nix new file mode 100644 index 000000000000..4c0b848c0ae9 --- /dev/null +++ b/pkgs/by-name/li/libeconf/package.nix @@ -0,0 +1,40 @@ +{ + lib, + stdenv, + fetchFromGitHub, + meson, + ninja, + nix-update-script, +}: + +stdenv.mkDerivation (finalAttrs: { + pname = "libeconf"; + version = "0.8.3"; + + src = fetchFromGitHub { + owner = "openSUSE"; + repo = "libeconf"; + tag = "v${finalAttrs.version}"; + hash = "sha256-ZXZcXQdG3hXAMwwftrIWL5GbVdPXk+AyqdhGTnaKL1I="; + }; + + __structuredAttrs = true; + strictDeps = true; + + nativeBuildInputs = [ + meson + ninja + ]; + + passthru.updateScript = nix-update-script { }; + + meta = { + description = "Enhanced config file parser, which merges config files placed in several locations into one"; + homepage = "https://github.com/openSUSE/libeconf"; + changelog = "https://github.com/openSUSE/libeconf/blob/${finalAttrs.src.tag}/NEWS"; + license = lib.licenses.mit; + maintainers = with lib.maintainers; [ grimmauld ]; + mainProgram = "econftool"; + platforms = lib.platforms.all; + }; +}) From 8a5b24082d2fb05c54bdd2d1eca962d3cc3fde32 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Sun, 19 Oct 2025 14:39:42 +0200 Subject: [PATCH 095/115] account-utils: init at 1.3.0 --- pkgs/by-name/ac/account-utils/package.nix | 72 +++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 pkgs/by-name/ac/account-utils/package.nix diff --git a/pkgs/by-name/ac/account-utils/package.nix b/pkgs/by-name/ac/account-utils/package.nix new file mode 100644 index 000000000000..cd0f3e8ff86e --- /dev/null +++ b/pkgs/by-name/ac/account-utils/package.nix @@ -0,0 +1,72 @@ +{ + lib, + stdenv, + fetchFromGitHub, + meson, + ninja, + pkg-config, + linux-pam, + systemdLibs, + libcap, + libxcrypt, + libeconf, + libselinux, + docbook-xsl-ns, + libxslt, +}: +let + selinuxSupport = lib.meta.availableOn stdenv.hostPlatform libselinux; +in +stdenv.mkDerivation (finalAttrs: { + pname = "account-utils"; + version = "1.3.0"; + + src = fetchFromGitHub { + owner = "thkukuk"; + repo = "account-utils"; + tag = "v${finalAttrs.version}"; + hash = "sha256-9l+y7FLb0IZXXp4RstlhNR6yA7b4b831obFuiVtO9+k="; + }; + + __structuredAttrs = true; + strictDeps = true; + + nativeBuildInputs = [ + meson + ninja + pkg-config + libxslt + docbook-xsl-ns + ]; + + buildInputs = [ + linux-pam + systemdLibs + libxcrypt + libeconf + libcap + ] + ++ lib.optional selinuxSupport libselinux; + + mesonFlags = [ + (lib.mesonEnable "selinux" selinuxSupport) + (lib.mesonOption "c_args" "-ffat-lto-objects") + ]; + + meta = { + description = "Services, utilities and PAM modules, which allow authentication and account management on systems with the NoNewPrivs flag set (no setuid/setgid binaries)"; + homepage = "https://github.com/thkukuk/account-utils"; + changelog = "https://github.com/thkukuk/account-utils/releases/tag/v${finalAttrs.version}"; + license = + with lib.licenses; + AND [ + gpl2Plus + lgpl21Plus + bsd2 + ]; + maintainers = with lib.maintainers; [ grimmauld ]; + platforms = lib.platforms.linux; + # take precedence over shadow + priority = -1; + }; +}) From ce6be70e00bf02b01923c135df4b29788c46240e Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Sun, 19 Oct 2025 18:29:39 +0200 Subject: [PATCH 096/115] nixos/account-utils: init --- nixos/modules/module-list.nix | 1 + nixos/modules/security/account-utils.nix | 65 ++++++++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 nixos/modules/security/account-utils.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 9e3d2f772b48..507eeb3a9ff0 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -387,6 +387,7 @@ ./programs/zsh/zsh-syntax-highlighting.nix ./programs/zsh/zsh.nix ./rename.nix + ./security/account-utils.nix ./security/acme ./security/agnos.nix ./security/apparmor.nix diff --git a/nixos/modules/security/account-utils.nix b/nixos/modules/security/account-utils.nix new file mode 100644 index 000000000000..bd2bf08f55b2 --- /dev/null +++ b/nixos/modules/security/account-utils.nix @@ -0,0 +1,65 @@ +{ + lib, + config, + pkgs, + ... +}: +let + cfg = config.security.account-utils; +in +{ + options.security.account-utils = { + enable = lib.mkEnableOption "the account-utils implementation of Unix user authentication and management"; + package = lib.mkPackageOption pkgs "account-utils" { }; + extraArgs = lib.mkOption { + type = lib.types.listOf lib.types.nonEmptyStr; + default = [ ]; + example = [ + "--debug" + "-v" + ]; + description = '' + List of arguments to pass to the socket activated service executables. + ::: {.note} + This is passed to both pwupdd and pwaccessd, which support identical flags. + ::: + ''; + }; + }; + + config = lib.mkIf cfg.enable { + # use account-utils reimplementation of pam_unix + security.pam = { + pam_unixModulePath = "${cfg.package}/lib/security/pam_unix_ng.so"; + enableLegacySettings = false; + }; + + systemd = { + packages = [ cfg.package ]; + sockets.pwaccessd.wantedBy = [ "sockets.target" ]; + sockets.pwupdd.wantedBy = lib.optional config.users.mutableUsers "sockets.target"; # immutable users do not need password updating + sockets.newidmapd.wantedBy = [ "sockets.target" ]; + services."pwupdd@".environment.PWUPDD_OPTS = lib.escapeShellArgs cfg.extraArgs; + services."pwaccessd".environment.PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs; + }; + + environment.systemPackages = [ cfg.package ]; + + security.pam.services = { + pwupd-passwd = { }; + pwupd-chsh = { }; + pwupd-chfn = { }; + }; + + # covered by account-utils via socket-activated service + security.wrappers = { + # shadow suid binaries are no longer necessary, but disabling the entire shadow module is too intrusive + newuidmap.enable = false; + newgidmap.enable = false; + chsh.enable = false; + passwd.enable = false; + + unix_chkpwd.enable = false; # Not necessary when using pam_unix_ng.so + }; + }; +} From ebc1d390ed9e4babb1a6ff84567c1acfabb73fa9 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Sun, 28 Dec 2025 15:14:49 +0100 Subject: [PATCH 097/115] nixos/tests/login-nosuid: init --- nixos/tests/all-tests.nix | 1 + nixos/tests/login-nosuid.nix | 105 ++++++++++++++++++++++ pkgs/by-name/ac/account-utils/package.nix | 5 ++ 3 files changed, 111 insertions(+) create mode 100644 nixos/tests/login-nosuid.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index d8971bd745e3..d6175df3d920 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -940,6 +940,7 @@ in localsend = runTest ./localsend.nix; locate = runTest ./locate.nix; login = runTest ./login.nix; + login-nosuid = runTest ./login-nosuid.nix; logkeys = runTest ./logkeys.nix; logrotate = runTest ./logrotate.nix; loki = runTest ./loki.nix; diff --git a/nixos/tests/login-nosuid.nix b/nixos/tests/login-nosuid.nix new file mode 100644 index 000000000000..1f00c37d0886 --- /dev/null +++ b/nixos/tests/login-nosuid.nix @@ -0,0 +1,105 @@ +{ + name = "login-nosuid"; + meta = { + maintainers = [ ]; + }; + + # node.pkgsReadOnly = false; # needed when overriding pam to debug mode + + nodes.machine = + { pkgs, ... }: + { + security.enableWrappers = false; + systemd.settings.Manager.NoNewPrivileges = true; + security.account-utils.enable = true; + users.mutableUsers = true; + security.account-utils.extraArgs = [ + "-v" + "--debug" + ]; + security.loginDefs.chfnRestrict = "f"; # allow allice to change name + + environment.systemPackages = [ + pkgs.which + pkgs.fish # environment.shells does not actually link fish to /run/current-system/sw/bin, causing chsh to fail unexpectedly + ]; + environment.shells = [ pkgs.fish ]; + + # pam debug without giant rebuild + # system.replaceDependencies.replacements = [ + # { + # oldDependency = pkgs.linux-pam; + # newDependency = pkgs.linux-pam.override { debugMode = true; }; + # } + # ]; + }; + + testScript = '' + machine.start(allow_reboot = True) + + machine.wait_for_unit("multi-user.target") + machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'") + machine.screenshot("postboot") + + with subtest("account-utils passwd has priority"): + passwd_path = machine.succeed("realpath $(which passwd)") + print(f"passwd path is: {passwd_path}") + assert "account-utils" in passwd_path + + with subtest("create user"): + machine.succeed("useradd -m alice") + machine.succeed("(echo foobar; echo foobar) | passwd alice") + + with subtest("Check whether switching VTs works"): + machine.fail("pgrep -f 'agetty.*tty2'") + machine.send_key("alt-f2") + machine.wait_until_succeeds("[ $(fgconsole) = 2 ]") + machine.wait_for_unit("getty@tty2.service") + machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'") + + with subtest("Log in as alice on a virtual console"): + machine.wait_until_tty_matches("2", "login: ") + machine.send_chars("alice\n") + machine.wait_until_tty_matches("2", "login: alice") + machine.wait_until_succeeds("pgrep login") + machine.wait_until_tty_matches("2", "Password: ") + machine.sleep(1) # something is racy here, so lets just sleep a bit... Not great, but seems to work + machine.send_chars("foobar\n") + machine.wait_until_succeeds("pgrep -u alice bash") + machine.send_chars("touch done\n") + machine.wait_for_file("/home/alice/done") + + with subtest("Systemd gives and removes device ownership as needed"): + machine.succeed("getfacl /dev/snd/timer | grep -q alice") + machine.send_key("alt-f1") + machine.wait_until_succeeds("[ $(fgconsole) = 1 ]") + machine.fail("getfacl /dev/snd/timer | grep -q alice") + machine.succeed("chvt 2") + machine.wait_until_succeeds("getfacl /dev/snd/timer | grep -q alice") + + with subtest("User can change their login shell"): + machine.send_chars("clear\n") # remove previous password prompts + machine.send_chars("chsh -s /run/current-system/sw/bin/fish\n") + machine.wait_until_tty_matches("2", "Password: ") + machine.send_chars("foobar\n") + machine.wait_until_fails("pgrep pwupdd") + login_shell = machine.succeed("getent passwd alice | cut -d: -f7").strip() + print(f"login shell of user alice: {login_shell}") + assert "/run/current-system/sw/bin/fish" == login_shell + + with subtest("User can change their name"): + machine.send_chars("clear\n") # remove previous password prompts + machine.send_chars("chfn -f 'Alice in Wonderland'\n") + machine.wait_until_tty_matches("2", "Password: ") + machine.send_chars("foobar\n") + machine.wait_until_fails("pgrep pwupdd") + full_name = machine.succeed("getent passwd alice | cut -d: -f5").strip() + print(f"full name of user alice: {full_name}") + assert "Alice in Wonderland" == full_name + + with subtest("Virtual console logout"): + machine.send_chars("exit\n") + machine.wait_until_fails("pgrep -u alice bash") + machine.screenshot("getty") + ''; +} diff --git a/pkgs/by-name/ac/account-utils/package.nix b/pkgs/by-name/ac/account-utils/package.nix index cd0f3e8ff86e..c0df5e64109d 100644 --- a/pkgs/by-name/ac/account-utils/package.nix +++ b/pkgs/by-name/ac/account-utils/package.nix @@ -13,6 +13,7 @@ libselinux, docbook-xsl-ns, libxslt, + nixosTests, }: let selinuxSupport = lib.meta.availableOn stdenv.hostPlatform libselinux; @@ -53,6 +54,10 @@ stdenv.mkDerivation (finalAttrs: { (lib.mesonOption "c_args" "-ffat-lto-objects") ]; + passthru.tests = { + inherit (nixosTests) login-nosuid; + }; + meta = { description = "Services, utilities and PAM modules, which allow authentication and account management on systems with the NoNewPrivs flag set (no setuid/setgid binaries)"; homepage = "https://github.com/thkukuk/account-utils"; From 6e628a4f796a67b7895f55a0b67b0b2e23732d9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Wed, 24 Jun 2026 10:55:53 +0200 Subject: [PATCH 098/115] Revert "staging-nixos merge for 2026-06-19" --- doc/release-notes/rl-2611.section.md | 1 - nixos/modules/config/system-path.nix | 1 + nixos/modules/config/xdg/autostart.nix | 2 + nixos/modules/system/boot/systemd/initrd.nix | 9 --- nixos/modules/system/etc/etc-activation.nix | 8 --- nixos/tests/all-tests.nix | 1 - nixos/tests/systemd-initrd-non-nixos.nix | 68 ------------------- pkgs/by-name/ni/nixos-init/src/find_etc.rs | 17 +---- pkgs/by-name/ni/nixos-init/src/lib.rs | 51 ++++++-------- pkgs/by-name/st/strace/package.nix | 4 +- .../os-specific/linux/kernel/kernels-org.json | 32 ++++----- 11 files changed, 45 insertions(+), 149 deletions(-) delete mode 100644 nixos/tests/systemd-initrd-non-nixos.nix diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md index d9e27a469008..27bff446bb6e 100644 --- a/doc/release-notes/rl-2611.section.md +++ b/doc/release-notes/rl-2611.section.md @@ -10,7 +10,6 @@ -- Paths under `/etc/xdg/` from packages in `environment.systemPackages` are no longer linked into the global `/etc/` by default. Modules depending on such directories must declare them explicitly using `environment.pathsToLink`. - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details. - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details. diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix index 5776c8ede413..c014f00da605 100644 --- a/nixos/modules/config/system-path.nix +++ b/nixos/modules/config/system-path.nix @@ -187,6 +187,7 @@ in environment.pathsToLink = [ "/bin" + "/etc/xdg" "/etc/gtk-2.0" "/etc/gtk-3.0" "/lib" # FIXME: remove and update debug-info.nix diff --git a/nixos/modules/config/xdg/autostart.nix b/nixos/modules/config/xdg/autostart.nix index a266b046de1a..46c90ae1793a 100644 --- a/nixos/modules/config/xdg/autostart.nix +++ b/nixos/modules/config/xdg/autostart.nix @@ -22,6 +22,8 @@ }; config = { + # FIXME this does not actually work because "/etc/xdg" is linked + # unconditionally in `nixos/modules/config/system-path.nix` environment.pathsToLink = lib.mkIf config.xdg.autostart.install [ "/etc/xdg/autostart" ]; diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix index b53365ff26cf..f242cb8c6a5b 100644 --- a/nixos/modules/system/boot/systemd/initrd.nix +++ b/nixos/modules/system/boot/systemd/initrd.nix @@ -763,7 +763,6 @@ in ]; }; serviceConfig.Type = "oneshot"; - serviceConfig.EnvironmentFile = "-/etc/switch-root.conf"; description = "NixOS Activation"; script = # bash @@ -771,14 +770,6 @@ in set -uo pipefail export PATH="/bin:${cfg.package.util-linux}/bin" - # A non-NixOS closure (e.g. init=/bin/sh) has no prepare-root; - # initrd-find-nixos-closure records this as a non-empty NEW_INIT. - # Skip activation and let initrd-switch-root hand over to it directly. - if [ -n "''${NEW_INIT:-}" ]; then - echo "$NEW_INIT is not a NixOS system - not activating" - exit 0 - fi - closure="$(realpath /nixos-closure)" # Initialize the system diff --git a/nixos/modules/system/etc/etc-activation.nix b/nixos/modules/system/etc/etc-activation.nix index 31842fc9c0c6..b00c25e37802 100644 --- a/nixos/modules/system/etc/etc-activation.nix +++ b/nixos/modules/system/etc/etc-activation.nix @@ -71,10 +71,6 @@ RequiresMountsFor = [ "/sysroot/nix/store" ]; - # find-etc only creates this symlink for a NixOS init. For a - # non-NixOS init= (e.g. init=/bin/sh) it is absent, so skip the - # mount instead of failing the whole initrd. - ConditionPathExists = "/etc-metadata-image"; }; requires = [ config.boot.initrd.systemd.services.initrd-find-etc.name @@ -127,8 +123,6 @@ "/run/nixos-etc-metadata" ]; DefaultDependencies = false; - # Skip for a non-NixOS init=, see the metadata mount above. - ConditionPathExists = "/etc-basedir"; }; } ]; @@ -146,8 +140,6 @@ # before the overlay is mounted. "/run/nixos-etc-metadata" ]; - # Skip for a non-NixOS init=, see the metadata mount above. - ConditionPathExists = "/etc-metadata-image"; }; serviceConfig = { Type = "oneshot"; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index d8971bd745e3..1c760d0648f0 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1645,7 +1645,6 @@ in "i686-linux" ] ./initrd-network-openvpn { systemdStage1 = true; }; systemd-initrd-networkd-ssh = runTest ./systemd-initrd-networkd-ssh.nix; - systemd-initrd-non-nixos = runTest ./systemd-initrd-non-nixos.nix; systemd-initrd-shutdown = runTest { imports = [ ./systemd-shutdown.nix ]; _module.args.systemdStage1 = true; diff --git a/nixos/tests/systemd-initrd-non-nixos.nix b/nixos/tests/systemd-initrd-non-nixos.nix deleted file mode 100644 index 0f564af6504a..000000000000 --- a/nixos/tests/systemd-initrd-non-nixos.nix +++ /dev/null @@ -1,68 +0,0 @@ -{ lib, pkgs, ... }: -let - marker = "REACHED NON-NIXOS INIT AS PID 1"; - - # A non-NixOS init (no prepare-root). We use a store path, not literal - # /bin/sh: a fresh disk has no /bin/sh yet (it is created by the activation a - # non-NixOS init skips), while the store is always mounted; init=/bin/sh works - # the same on a real system. Writes a marker, then stays alive so PID 1 lives. - nonNixosInit = pkgs.writeShellScriptBin "non-nixos" '' - echo "${marker}" > /dev/console - exec ${pkgs.coreutils}/bin/sleep infinity - ''; - - common = { - boot.initrd.systemd.enable = true; - - virtualisation = { - # tmpfs root, like real non-NixOS closure init= microvm consumers. - diskImage = null; - - graphics = false; - }; - - # Speed up wait_for_console. - boot.consoleLogLevel = lib.mkForce 3; - boot.initrd.systemd.managerEnvironment.SYSTEMD_LOG_LEVEL = "warning"; - - # switch-root needs an os-release on the target root. A real system has one - # on disk; our fresh tmpfs does not, so create it. - boot.initrd.systemd.tmpfiles.settings."10-os-release"."/sysroot/etc/os-release".f = { - mode = "0644"; - argument = "ID=test-non-nixos"; - }; - }; -in -{ - name = "systemd-initrd-non-nixos"; - - nodes = { - bashActivation = common; - - nixosInit = { - imports = [ common ]; - system.nixos-init.enable = true; - system.etc.overlay.enable = true; - services.userborn.enable = true; - }; - }; - - testScript = '' - import os - - # The last init= on the cmdline wins; QEMU_KERNEL_PARAMS is appended after - # the default one, so this boots our non-NixOS init. - os.environ["QEMU_KERNEL_PARAMS"] = "init=${lib.getExe nonNixosInit}" - - start_all() - - # If a code path does not skip the non-NixOS init, switch-root is blocked and - # the machine drops to emergency mode: the marker never appears and the wait - # times out. - with subtest("bash initrd-nixos-activation skips a non-NixOS init"): - bashActivation.wait_for_console_text("${marker}", timeout=300) - - with subtest("nixos-init switches to a non-NixOS init directly"): - nixosInit.wait_for_console_text("${marker}", timeout=300) - ''; -} diff --git a/pkgs/by-name/ni/nixos-init/src/find_etc.rs b/pkgs/by-name/ni/nixos-init/src/find_etc.rs index d06f7bbb0114..8b994e1d7534 100644 --- a/pkgs/by-name/ni/nixos-init/src/find_etc.rs +++ b/pkgs/by-name/ni/nixos-init/src/find_etc.rs @@ -3,7 +3,7 @@ use std::{os::unix, path::Path}; use anyhow::{Context, Result}; use crate::config::Config; -use crate::{SYSROOT_PATH, find_init_in_prefix, resolve_in_prefix, verify_init_is_nixos}; +use crate::{SYSROOT_PATH, find_toplevel_in_prefix, resolve_in_prefix}; /// Entrypoint for the `find-etc` binary. /// @@ -12,20 +12,7 @@ use crate::{SYSROOT_PATH, find_init_in_prefix, resolve_in_prefix, verify_init_is /// This avoids needing a reference to the toplevel embedded in the initrd and thus reduces the /// need to re-build it. pub fn find_etc() -> Result<()> { - let init_in_sysroot = - find_init_in_prefix(SYSROOT_PATH).context("Failed to find init in sysroot")?; - - // A non-NixOS init= (e.g. init=/bin/sh) has no etc metadata image. Skip - // without creating the symlinks: the etc-overlay mounts are gated on them - // and so skip too, and initrd-init switches root to the init directly. - let Ok(toplevel) = verify_init_is_nixos(SYSROOT_PATH, &init_in_sysroot) else { - log::info!( - "{} is not a NixOS system - not setting up the etc overlay.", - init_in_sysroot.display() - ); - return Ok(()); - }; - + let toplevel = find_toplevel_in_prefix(SYSROOT_PATH)?; let config = Config::from_toplevel(&toplevel, SYSROOT_PATH)?; let basedir = config diff --git a/pkgs/by-name/ni/nixos-init/src/lib.rs b/pkgs/by-name/ni/nixos-init/src/lib.rs index bbb4abdb829b..c781757c9b82 100644 --- a/pkgs/by-name/ni/nixos-init/src/lib.rs +++ b/pkgs/by-name/ni/nixos-init/src/lib.rs @@ -27,6 +27,16 @@ pub use crate::{ pub const SYSROOT_PATH: &str = "/sysroot"; +/// Find the path to the toplevel closure of the system in a prefix. +/// +/// Uses the `init=` parameter on the kernel command-line. +/// +/// Returns the relative path of the init to the prefix, e.g. without the `/sysroot` prefix. +pub fn find_toplevel_in_prefix(prefix: &str) -> Result { + let init_in_sysroot = find_init_in_prefix(prefix)?; + verify_init_is_nixos(prefix, init_in_sysroot) +} + /// Verify that an init path is inside a `NixOS` toplevel directory. /// /// If the path is verified, returns the path to the toplevel. @@ -77,16 +87,20 @@ pub fn find_init_in_prefix(prefix: &str) -> Result { } /// Extract the value of the `init` parameter from the given kernel `cmdline`. -/// -/// If `init=` appears multiple times the last one wins, matching the kernel. -/// This is what makes appending `init=/bin/sh` at the boot prompt work even -/// though the boot entry already has an `init=`. fn extract_init(cmdline: &str) -> Result { - let init = cmdline + let init_params: Vec<&str> = cmdline .split_ascii_whitespace() - .filter_map(|p| p.strip_prefix("init=")) - .next_back() - .with_context(|| format!("No init= parameter on kernel cmdline: {cmdline}"))?; + .filter(|p| p.starts_with("init=")) + .collect(); + + if init_params.len() != 1 { + bail!("Expected exactly one init param on kernel cmdline: {cmdline}") + } + + let init = init_params + .first() + .and_then(|s| s.split('=').next_back()) + .context("Failed to extract init path from kernel cmdline: {cmdline}")?; Ok(PathBuf::from(init)) } @@ -115,25 +129,4 @@ mod tests { Ok(()) } - - #[test] - fn test_extract_init_single() { - assert_eq!( - extract_init("root=fstab init=/nix/store/xxx-nixos/init quiet").unwrap(), - PathBuf::from("/nix/store/xxx-nixos/init") - ); - } - - #[test] - fn test_extract_init_last_wins() { - assert_eq!( - extract_init("init=/nix/store/xxx-nixos/init init=/bin/sh").unwrap(), - PathBuf::from("/bin/sh") - ); - } - - #[test] - fn test_extract_init_missing() { - assert!(extract_init("root=fstab quiet").is_err()); - } } diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix index 77345bd6a3ae..86f8b0fa4c42 100644 --- a/pkgs/by-name/st/strace/package.nix +++ b/pkgs/by-name/st/strace/package.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "strace"; - version = "7.1"; + version = "7.0"; src = fetchurl { url = "https://strace.io/files/${finalAttrs.version}/strace-${finalAttrs.version}.tar.xz"; - hash = "sha256-gXQ+zypbRBhrL1A4r9yL7aflxwrtFbT7+8xuns4kSQ8="; + hash = "sha256-bJJBm+Py7FYLMXKKRlIhfFmGTIZCunsbN3GxsBOtB0s="; }; separateDebugInfo = true; diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 54ff5434cfe3..43db58a4181e 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -5,43 +5,43 @@ "lts": false }, "6.1": { - "version": "6.1.176", - "hash": "sha256:1xj4ms4gd8ghd0l0dzsyi762dgpdrmqhc3f0arrp7sa0p8npf6da", + "version": "6.1.175", + "hash": "sha256:11fapr04y96p9ja6mfzm7bcd3zb4dzyw6qrh7c11bss9wjlq9s9p", "lts": true }, "5.15": { - "version": "5.15.210", - "hash": "sha256:008a55av0x9fa3fspcz43sycik143gqxg2agcalrax2yw5ma82wi", + "version": "5.15.209", + "hash": "sha256:1d0yhbpqlkr1znahky15dfavr6dzb3wb8c15k9qqvkf2xb3pfv9l", "lts": true }, "5.10": { - "version": "5.10.259", - "hash": "sha256:02dn8rf9p0afkl8kbdv28ijq974zfnv8zdsqcqbmapjm19c8wpma", + "version": "5.10.258", + "hash": "sha256:1rdldzb3g33v6zvcmxafqpkjgqpp4n5qlxwb77wfd5jpzhgcnz4y", "lts": true }, "6.6": { - "version": "6.6.143", - "hash": "sha256:0ci9b6kjp7r2xwqifs2963l9ihk2rllk4zpl2kgzbny0r66izkns", + "version": "6.6.142", + "hash": "sha256:0w1bdzp9x1sqcr9xlk7dvylhs7kycghjabfgd3iv49ydfmx61xmj", "lts": true }, "6.12": { - "version": "6.12.94", - "hash": "sha256:1ln83ljmc7wr1nrjjq1hp1m1vx54j7i6i15m3hqb73a1p4ra5679", + "version": "6.12.93", + "hash": "sha256:18sg154hqw8l98pfim2hjm1y604h5dwn9gj3gyncas8bgjl4h9j9", "lts": true }, "6.18": { - "version": "6.18.36", - "hash": "sha256:0kn4r43lnd5nb5c298b30030qyaxv05s7k40n9si1j3iyk4qdazv", + "version": "6.18.35", + "hash": "sha256:0dpjprjzc4w44kw49jcgx1ffrm6gxn2gsnsz3hhmw4hr4a9h51pp", "lts": true }, "7.0": { - "version": "7.0.13", - "hash": "sha256:04wrz38ldls7pv1yxa1m7p2hqn1731l93xnz93fs7b0nyz8fv09w", + "version": "7.0.12", + "hash": "sha256:1nk5lans9qg1avmmcwyadfps43d3hyjz9a5gjyvsc77w3sjckvap", "lts": false }, "7.1": { - "version": "7.1.1", - "hash": "sha256:0z8x6wafxzc5vkim9jh8wpycdkk9y5bpxgsirmdpyznw84szl5aj", + "version": "7.1", + "hash": "sha256:18344l5fv3hgsqjrjr3dgg96lll7f294qq11lg40sydygxwl87v9", "lts": false } } From 1f154903b389fd3b89f03df83533901d79e5d9b5 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:17:48 +0000 Subject: [PATCH 099/115] linux_7_1: 7.1 -> 7.1.1 (cherry picked from commit 5e942459511ea53d65e98291e3ac135e6b08339e) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 43db58a4181e..c0d8bb819a44 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -40,8 +40,8 @@ "lts": false }, "7.1": { - "version": "7.1", - "hash": "sha256:18344l5fv3hgsqjrjr3dgg96lll7f294qq11lg40sydygxwl87v9", + "version": "7.1.1", + "hash": "sha256:0z8x6wafxzc5vkim9jh8wpycdkk9y5bpxgsirmdpyznw84szl5aj", "lts": false } } From 3e41ed7c7b1c425b254785a60f04338d8ef995bb Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:17:51 +0000 Subject: [PATCH 100/115] linux_7_0: 7.0.12 -> 7.0.13 (cherry picked from commit c72e58ac6aa49f22c5e3197f0a324de4fb2d4907) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index c0d8bb819a44..3df6608d0865 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -35,8 +35,8 @@ "lts": true }, "7.0": { - "version": "7.0.12", - "hash": "sha256:1nk5lans9qg1avmmcwyadfps43d3hyjz9a5gjyvsc77w3sjckvap", + "version": "7.0.13", + "hash": "sha256:04wrz38ldls7pv1yxa1m7p2hqn1731l93xnz93fs7b0nyz8fv09w", "lts": false }, "7.1": { From 19c1d5416a9090265d0ad9e68849895f55116ca2 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:17:55 +0000 Subject: [PATCH 101/115] linux_6_12: 6.12.93 -> 6.12.94 (cherry picked from commit d2adc61ca588372307bc5838b09a9fa0b4fe778a) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index 3df6608d0865..e13c1273b796 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -25,8 +25,8 @@ "lts": true }, "6.12": { - "version": "6.12.93", - "hash": "sha256:18sg154hqw8l98pfim2hjm1y604h5dwn9gj3gyncas8bgjl4h9j9", + "version": "6.12.94", + "hash": "sha256:1ln83ljmc7wr1nrjjq1hp1m1vx54j7i6i15m3hqb73a1p4ra5679", "lts": true }, "6.18": { From 4f3634daa45ea53ea0f22be127f1490a782cdab6 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:17:57 +0000 Subject: [PATCH 102/115] linux_6_6: 6.6.142 -> 6.6.143 (cherry picked from commit 4a7bb41c664c5a7635833144edfa40ed225035ca) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index e13c1273b796..a81121c1805f 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -20,8 +20,8 @@ "lts": true }, "6.6": { - "version": "6.6.142", - "hash": "sha256:0w1bdzp9x1sqcr9xlk7dvylhs7kycghjabfgd3iv49ydfmx61xmj", + "version": "6.6.143", + "hash": "sha256:0ci9b6kjp7r2xwqifs2963l9ihk2rllk4zpl2kgzbny0r66izkns", "lts": true }, "6.12": { From 32bd18459d9eeb46a1ff222c52caf4eb39489025 Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:17:59 +0000 Subject: [PATCH 103/115] linux_6_1: 6.1.175 -> 6.1.176 (cherry picked from commit 783e466ec0dcbef6f3d49af8b4fd7d799ba820b2) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index a81121c1805f..c7d5aefd2edf 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -5,8 +5,8 @@ "lts": false }, "6.1": { - "version": "6.1.175", - "hash": "sha256:11fapr04y96p9ja6mfzm7bcd3zb4dzyw6qrh7c11bss9wjlq9s9p", + "version": "6.1.176", + "hash": "sha256:1xj4ms4gd8ghd0l0dzsyi762dgpdrmqhc3f0arrp7sa0p8npf6da", "lts": true }, "5.15": { From 375b4c2c67fdf8b02d84a4be464e74f70cf99f6c Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:18:01 +0000 Subject: [PATCH 104/115] linux_5_15: 5.15.209 -> 5.15.210 (cherry picked from commit f280904416c02cd2ef64adae28e8aa1528a58663) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index c7d5aefd2edf..dd3472de79e8 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -10,8 +10,8 @@ "lts": true }, "5.15": { - "version": "5.15.209", - "hash": "sha256:1d0yhbpqlkr1znahky15dfavr6dzb3wb8c15k9qqvkf2xb3pfv9l", + "version": "5.15.210", + "hash": "sha256:008a55av0x9fa3fspcz43sycik143gqxg2agcalrax2yw5ma82wi", "lts": true }, "5.10": { From 12dad4d55c440caf41bdc8778beeef9f6c2b7f1c Mon Sep 17 00:00:00 2001 From: zowoq <59103226+zowoq@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:18:02 +0000 Subject: [PATCH 105/115] linux_5_10: 5.10.258 -> 5.10.259 (cherry picked from commit 46b89aa95826b4b8756a6d806112f35ed1c29fde) --- pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index dd3472de79e8..d3dd8012c508 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -15,8 +15,8 @@ "lts": true }, "5.10": { - "version": "5.10.258", - "hash": "sha256:1rdldzb3g33v6zvcmxafqpkjgqpp4n5qlxwb77wfd5jpzhgcnz4y", + "version": "5.10.259", + "hash": "sha256:02dn8rf9p0afkl8kbdv28ijq974zfnv8zdsqcqbmapjm19c8wpma", "lts": true }, "6.6": { From 6f5d20fe0cbd2d6769120f8bc5886065d4c71050 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 24 Jun 2026 10:56:49 +0200 Subject: [PATCH 106/115] nixos/mysql: fix initalScript option after security fix services.mysql.initalScript runs with the root@localhost mysql user. This seems consistent with the other invocations that run in the first startup of mysql. After the security fix, the mysql command executing the initial script was broken as it tried to connect to root@localhost while being the mysql system user. We could instead use the mysql@localhost mysql user, but this would be inconsistent with the other invocations. Co-Authored-By: osnyx --- nixos/modules/services/databases/mysql.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix index c31b6b7ebbf8..cfd7c8c76af3 100644 --- a/nixos/modules/services/databases/mysql.nix +++ b/nixos/modules/services/databases/mysql.nix @@ -662,11 +662,6 @@ in ) | ${cfg.package}/bin/mysql -u ${superUser} -N ''} - # Secure root@localhost for MySQL/Percona on first initialization - ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) '' - echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N - ''} - ${lib.optionalString (cfg.initialScript != null) '' # Execute initial script # using toString to avoid copying the file to nix store if given as path instead of string, @@ -674,6 +669,11 @@ in cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N ''} + # Secure root@localhost for MySQL/Percona on first initialization + ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) '' + echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N + ''} + rm ${cfg.dataDir}/mysql_init fi From 3f3a5310c82eaf953642933d8ae435364555e57f Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Wed, 24 Jun 2026 11:02:55 +0200 Subject: [PATCH 107/115] mysql84: add nixosTests.mysql.mysql84 to passthru.tests Co-Authored-By: osnyx --- pkgs/by-name/my/mysql84/package.nix | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix index 129355bfb336..7f5b682121a5 100644 --- a/pkgs/by-name/my/mysql84/package.nix +++ b/pkgs/by-name/my/mysql84/package.nix @@ -112,10 +112,14 @@ stdenv.mkDerivation (finalAttrs: { connector-c = finalAttrs.finalPackage; server = finalAttrs.finalPackage; mysqlVersion = lib.versions.majorMinor finalAttrs.version; - tests.mysql-secure-root-by-default = - nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}"; - tests.mysql-root-can-be-kept-insecure = - nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}"; + tests = { + mysql = + nixosTests.mysql."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}"; + mysql-secure-root-by-default = + nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}"; + mysql-root-can-be-kept-insecure = + nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}"; + }; }; meta = { From 7ce36dfd7f7a3ae674625950e1a9ee8ea01b4954 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Wed, 24 Jun 2026 11:09:02 +0200 Subject: [PATCH 108/115] goshs: 2.1.1 -> 2.1.2 Diff: https://github.com/patrickhener/goshs/compare/v2.1.1...v2.1.2 Changelog: https://github.com/patrickhener/goshs/releases/tag/refs/tags/v2.1.2 --- pkgs/by-name/go/goshs/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/go/goshs/package.nix b/pkgs/by-name/go/goshs/package.nix index c7c3a79c9e48..59073c6866b1 100644 --- a/pkgs/by-name/go/goshs/package.nix +++ b/pkgs/by-name/go/goshs/package.nix @@ -8,13 +8,13 @@ buildGoModule (finalAttrs: { pname = "goshs"; - version = "2.1.1"; + version = "2.1.2"; src = fetchFromGitHub { owner = "patrickhener"; repo = "goshs"; tag = "v${finalAttrs.version}"; - hash = "sha256-BbkAt+pL3M/LBugaUgIV26ziUsMnWe+fOHKpmddE2Ng="; + hash = "sha256-/9z5WjJN6JTVZO0b0ScPmxegZVb2PhjvDl5BbPwDxSw="; }; vendorHash = "sha256-CAl4yYAM/GQaLbUUNjgMN6A3Vqw4D+kpG9G2WXw6mRU="; From 078bcb823850a4e1537ee84f76aa4888996c9f31 Mon Sep 17 00:00:00 2001 From: Pasquale Di Maria Date: Wed, 24 Jun 2026 11:11:44 +0200 Subject: [PATCH 109/115] itch: fix changelog --- pkgs/by-name/it/itch/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/it/itch/package.nix b/pkgs/by-name/it/itch/package.nix index a35d83f41f23..8fd0def5db54 100644 --- a/pkgs/by-name/it/itch/package.nix +++ b/pkgs/by-name/it/itch/package.nix @@ -94,7 +94,7 @@ stdenvNoCC.mkDerivation (finalAttrs: { meta = { description = "Best way to play itch.io games"; homepage = "https://github.com/itchio/itch"; - changelog = "https://github.com/itchio/itch/releases/tag/v${version}-canary"; + changelog = "https://github.com/itchio/itch/releases/tag/v${version}"; license = lib.licenses.mit; platforms = [ "x86_64-linux" ]; sourceProvenance = [ lib.sourceTypes.binaryBytecode ]; From a48a4bfd8db927371f2a661e0bc63098d1e1eca2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 09:33:39 +0000 Subject: [PATCH 110/115] witr: 0.3.2 -> 0.3.3 --- pkgs/by-name/wi/witr/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/wi/witr/package.nix b/pkgs/by-name/wi/witr/package.nix index 6c8dd966efc7..e4a46cf2f4b2 100644 --- a/pkgs/by-name/wi/witr/package.nix +++ b/pkgs/by-name/wi/witr/package.nix @@ -6,13 +6,13 @@ }: buildGoModule (finalAttrs: { pname = "witr"; - version = "0.3.2"; + version = "0.3.3"; src = fetchFromGitHub { owner = "pranshuparmar"; repo = "witr"; tag = "v${finalAttrs.version}"; - hash = "sha256-kNiBcLk+rxJno1ZHPxr28EI5T3tpJnFXgh8zIvEYy6M="; + hash = "sha256-xlVzDEYm/45jmEZKQQeEMSGk2ySjOdkkynRs9Q9qIiY="; # populate values that require us to use git. By doing this in postFetch we # can delete .git afterwards and maintain better reproducibility of the src. leaveDotGit = true; From 105327541bf13621cf79d3674543c17e2e5861a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Wed, 24 Jun 2026 12:17:06 +0200 Subject: [PATCH 111/115] Reapply "staging-nixos merge for 2026-06-19" (#534864) This reverts commit 532f984da08d27af048ed8664238f97f38ede850, reversing changes made to 421ceaeef8fa1bb8b0729aec488d42b3af69a3fa. --- doc/release-notes/rl-2611.section.md | 1 + nixos/modules/config/system-path.nix | 1 - nixos/modules/config/xdg/autostart.nix | 2 - nixos/modules/system/boot/systemd/initrd.nix | 9 +++ nixos/modules/system/etc/etc-activation.nix | 8 +++ nixos/tests/all-tests.nix | 1 + nixos/tests/systemd-initrd-non-nixos.nix | 68 +++++++++++++++++++ pkgs/by-name/ni/nixos-init/src/find_etc.rs | 17 ++++- pkgs/by-name/ni/nixos-init/src/lib.rs | 51 ++++++++------ pkgs/by-name/st/strace/package.nix | 4 +- .../os-specific/linux/kernel/kernels-org.json | 4 +- 11 files changed, 135 insertions(+), 31 deletions(-) create mode 100644 nixos/tests/systemd-initrd-non-nixos.nix diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md index 27bff446bb6e..d9e27a469008 100644 --- a/doc/release-notes/rl-2611.section.md +++ b/doc/release-notes/rl-2611.section.md @@ -10,6 +10,7 @@ +- Paths under `/etc/xdg/` from packages in `environment.systemPackages` are no longer linked into the global `/etc/` by default. Modules depending on such directories must declare them explicitly using `environment.pathsToLink`. - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details. - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details. diff --git a/nixos/modules/config/system-path.nix b/nixos/modules/config/system-path.nix index c014f00da605..5776c8ede413 100644 --- a/nixos/modules/config/system-path.nix +++ b/nixos/modules/config/system-path.nix @@ -187,7 +187,6 @@ in environment.pathsToLink = [ "/bin" - "/etc/xdg" "/etc/gtk-2.0" "/etc/gtk-3.0" "/lib" # FIXME: remove and update debug-info.nix diff --git a/nixos/modules/config/xdg/autostart.nix b/nixos/modules/config/xdg/autostart.nix index 46c90ae1793a..a266b046de1a 100644 --- a/nixos/modules/config/xdg/autostart.nix +++ b/nixos/modules/config/xdg/autostart.nix @@ -22,8 +22,6 @@ }; config = { - # FIXME this does not actually work because "/etc/xdg" is linked - # unconditionally in `nixos/modules/config/system-path.nix` environment.pathsToLink = lib.mkIf config.xdg.autostart.install [ "/etc/xdg/autostart" ]; diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix index 6a52b920c2e2..311bf9cc9aa1 100644 --- a/nixos/modules/system/boot/systemd/initrd.nix +++ b/nixos/modules/system/boot/systemd/initrd.nix @@ -774,6 +774,7 @@ in ]; }; serviceConfig.Type = "oneshot"; + serviceConfig.EnvironmentFile = "-/etc/switch-root.conf"; description = "NixOS Activation"; script = # bash @@ -781,6 +782,14 @@ in set -uo pipefail export PATH="/bin:${cfg.package.util-linux}/bin" + # A non-NixOS closure (e.g. init=/bin/sh) has no prepare-root; + # initrd-find-nixos-closure records this as a non-empty NEW_INIT. + # Skip activation and let initrd-switch-root hand over to it directly. + if [ -n "''${NEW_INIT:-}" ]; then + echo "$NEW_INIT is not a NixOS system - not activating" + exit 0 + fi + closure="$(realpath /nixos-closure)" # Initialize the system diff --git a/nixos/modules/system/etc/etc-activation.nix b/nixos/modules/system/etc/etc-activation.nix index b00c25e37802..31842fc9c0c6 100644 --- a/nixos/modules/system/etc/etc-activation.nix +++ b/nixos/modules/system/etc/etc-activation.nix @@ -71,6 +71,10 @@ RequiresMountsFor = [ "/sysroot/nix/store" ]; + # find-etc only creates this symlink for a NixOS init. For a + # non-NixOS init= (e.g. init=/bin/sh) it is absent, so skip the + # mount instead of failing the whole initrd. + ConditionPathExists = "/etc-metadata-image"; }; requires = [ config.boot.initrd.systemd.services.initrd-find-etc.name @@ -123,6 +127,8 @@ "/run/nixos-etc-metadata" ]; DefaultDependencies = false; + # Skip for a non-NixOS init=, see the metadata mount above. + ConditionPathExists = "/etc-basedir"; }; } ]; @@ -140,6 +146,8 @@ # before the overlay is mounted. "/run/nixos-etc-metadata" ]; + # Skip for a non-NixOS init=, see the metadata mount above. + ConditionPathExists = "/etc-metadata-image"; }; serviceConfig = { Type = "oneshot"; diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 1c760d0648f0..d8971bd745e3 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -1645,6 +1645,7 @@ in "i686-linux" ] ./initrd-network-openvpn { systemdStage1 = true; }; systemd-initrd-networkd-ssh = runTest ./systemd-initrd-networkd-ssh.nix; + systemd-initrd-non-nixos = runTest ./systemd-initrd-non-nixos.nix; systemd-initrd-shutdown = runTest { imports = [ ./systemd-shutdown.nix ]; _module.args.systemdStage1 = true; diff --git a/nixos/tests/systemd-initrd-non-nixos.nix b/nixos/tests/systemd-initrd-non-nixos.nix new file mode 100644 index 000000000000..0f564af6504a --- /dev/null +++ b/nixos/tests/systemd-initrd-non-nixos.nix @@ -0,0 +1,68 @@ +{ lib, pkgs, ... }: +let + marker = "REACHED NON-NIXOS INIT AS PID 1"; + + # A non-NixOS init (no prepare-root). We use a store path, not literal + # /bin/sh: a fresh disk has no /bin/sh yet (it is created by the activation a + # non-NixOS init skips), while the store is always mounted; init=/bin/sh works + # the same on a real system. Writes a marker, then stays alive so PID 1 lives. + nonNixosInit = pkgs.writeShellScriptBin "non-nixos" '' + echo "${marker}" > /dev/console + exec ${pkgs.coreutils}/bin/sleep infinity + ''; + + common = { + boot.initrd.systemd.enable = true; + + virtualisation = { + # tmpfs root, like real non-NixOS closure init= microvm consumers. + diskImage = null; + + graphics = false; + }; + + # Speed up wait_for_console. + boot.consoleLogLevel = lib.mkForce 3; + boot.initrd.systemd.managerEnvironment.SYSTEMD_LOG_LEVEL = "warning"; + + # switch-root needs an os-release on the target root. A real system has one + # on disk; our fresh tmpfs does not, so create it. + boot.initrd.systemd.tmpfiles.settings."10-os-release"."/sysroot/etc/os-release".f = { + mode = "0644"; + argument = "ID=test-non-nixos"; + }; + }; +in +{ + name = "systemd-initrd-non-nixos"; + + nodes = { + bashActivation = common; + + nixosInit = { + imports = [ common ]; + system.nixos-init.enable = true; + system.etc.overlay.enable = true; + services.userborn.enable = true; + }; + }; + + testScript = '' + import os + + # The last init= on the cmdline wins; QEMU_KERNEL_PARAMS is appended after + # the default one, so this boots our non-NixOS init. + os.environ["QEMU_KERNEL_PARAMS"] = "init=${lib.getExe nonNixosInit}" + + start_all() + + # If a code path does not skip the non-NixOS init, switch-root is blocked and + # the machine drops to emergency mode: the marker never appears and the wait + # times out. + with subtest("bash initrd-nixos-activation skips a non-NixOS init"): + bashActivation.wait_for_console_text("${marker}", timeout=300) + + with subtest("nixos-init switches to a non-NixOS init directly"): + nixosInit.wait_for_console_text("${marker}", timeout=300) + ''; +} diff --git a/pkgs/by-name/ni/nixos-init/src/find_etc.rs b/pkgs/by-name/ni/nixos-init/src/find_etc.rs index 8b994e1d7534..d06f7bbb0114 100644 --- a/pkgs/by-name/ni/nixos-init/src/find_etc.rs +++ b/pkgs/by-name/ni/nixos-init/src/find_etc.rs @@ -3,7 +3,7 @@ use std::{os::unix, path::Path}; use anyhow::{Context, Result}; use crate::config::Config; -use crate::{SYSROOT_PATH, find_toplevel_in_prefix, resolve_in_prefix}; +use crate::{SYSROOT_PATH, find_init_in_prefix, resolve_in_prefix, verify_init_is_nixos}; /// Entrypoint for the `find-etc` binary. /// @@ -12,7 +12,20 @@ use crate::{SYSROOT_PATH, find_toplevel_in_prefix, resolve_in_prefix}; /// This avoids needing a reference to the toplevel embedded in the initrd and thus reduces the /// need to re-build it. pub fn find_etc() -> Result<()> { - let toplevel = find_toplevel_in_prefix(SYSROOT_PATH)?; + let init_in_sysroot = + find_init_in_prefix(SYSROOT_PATH).context("Failed to find init in sysroot")?; + + // A non-NixOS init= (e.g. init=/bin/sh) has no etc metadata image. Skip + // without creating the symlinks: the etc-overlay mounts are gated on them + // and so skip too, and initrd-init switches root to the init directly. + let Ok(toplevel) = verify_init_is_nixos(SYSROOT_PATH, &init_in_sysroot) else { + log::info!( + "{} is not a NixOS system - not setting up the etc overlay.", + init_in_sysroot.display() + ); + return Ok(()); + }; + let config = Config::from_toplevel(&toplevel, SYSROOT_PATH)?; let basedir = config diff --git a/pkgs/by-name/ni/nixos-init/src/lib.rs b/pkgs/by-name/ni/nixos-init/src/lib.rs index c781757c9b82..bbb4abdb829b 100644 --- a/pkgs/by-name/ni/nixos-init/src/lib.rs +++ b/pkgs/by-name/ni/nixos-init/src/lib.rs @@ -27,16 +27,6 @@ pub use crate::{ pub const SYSROOT_PATH: &str = "/sysroot"; -/// Find the path to the toplevel closure of the system in a prefix. -/// -/// Uses the `init=` parameter on the kernel command-line. -/// -/// Returns the relative path of the init to the prefix, e.g. without the `/sysroot` prefix. -pub fn find_toplevel_in_prefix(prefix: &str) -> Result { - let init_in_sysroot = find_init_in_prefix(prefix)?; - verify_init_is_nixos(prefix, init_in_sysroot) -} - /// Verify that an init path is inside a `NixOS` toplevel directory. /// /// If the path is verified, returns the path to the toplevel. @@ -87,20 +77,16 @@ pub fn find_init_in_prefix(prefix: &str) -> Result { } /// Extract the value of the `init` parameter from the given kernel `cmdline`. +/// +/// If `init=` appears multiple times the last one wins, matching the kernel. +/// This is what makes appending `init=/bin/sh` at the boot prompt work even +/// though the boot entry already has an `init=`. fn extract_init(cmdline: &str) -> Result { - let init_params: Vec<&str> = cmdline + let init = cmdline .split_ascii_whitespace() - .filter(|p| p.starts_with("init=")) - .collect(); - - if init_params.len() != 1 { - bail!("Expected exactly one init param on kernel cmdline: {cmdline}") - } - - let init = init_params - .first() - .and_then(|s| s.split('=').next_back()) - .context("Failed to extract init path from kernel cmdline: {cmdline}")?; + .filter_map(|p| p.strip_prefix("init=")) + .next_back() + .with_context(|| format!("No init= parameter on kernel cmdline: {cmdline}"))?; Ok(PathBuf::from(init)) } @@ -129,4 +115,25 @@ mod tests { Ok(()) } + + #[test] + fn test_extract_init_single() { + assert_eq!( + extract_init("root=fstab init=/nix/store/xxx-nixos/init quiet").unwrap(), + PathBuf::from("/nix/store/xxx-nixos/init") + ); + } + + #[test] + fn test_extract_init_last_wins() { + assert_eq!( + extract_init("init=/nix/store/xxx-nixos/init init=/bin/sh").unwrap(), + PathBuf::from("/bin/sh") + ); + } + + #[test] + fn test_extract_init_missing() { + assert!(extract_init("root=fstab quiet").is_err()); + } } diff --git a/pkgs/by-name/st/strace/package.nix b/pkgs/by-name/st/strace/package.nix index 86f8b0fa4c42..77345bd6a3ae 100644 --- a/pkgs/by-name/st/strace/package.nix +++ b/pkgs/by-name/st/strace/package.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation (finalAttrs: { pname = "strace"; - version = "7.0"; + version = "7.1"; src = fetchurl { url = "https://strace.io/files/${finalAttrs.version}/strace-${finalAttrs.version}.tar.xz"; - hash = "sha256-bJJBm+Py7FYLMXKKRlIhfFmGTIZCunsbN3GxsBOtB0s="; + hash = "sha256-gXQ+zypbRBhrL1A4r9yL7aflxwrtFbT7+8xuns4kSQ8="; }; separateDebugInfo = true; diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json index d3dd8012c508..54ff5434cfe3 100644 --- a/pkgs/os-specific/linux/kernel/kernels-org.json +++ b/pkgs/os-specific/linux/kernel/kernels-org.json @@ -30,8 +30,8 @@ "lts": true }, "6.18": { - "version": "6.18.35", - "hash": "sha256:0dpjprjzc4w44kw49jcgx1ffrm6gxn2gsnsz3hhmw4hr4a9h51pp", + "version": "6.18.36", + "hash": "sha256:0kn4r43lnd5nb5c298b30030qyaxv05s7k40n9si1j3iyk4qdazv", "lts": true }, "7.0": { From 23cbb6daa6e96467f3c357f301225e72bb7abffe Mon Sep 17 00:00:00 2001 From: Kirill Radzikhovskyy Date: Wed, 24 Jun 2026 20:57:57 +1000 Subject: [PATCH 112/115] seaweedfs: fix build on Darwin --- pkgs/by-name/se/seaweedfs/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/se/seaweedfs/package.nix b/pkgs/by-name/se/seaweedfs/package.nix index 86a1e9121b4e..e64d55b6cef6 100644 --- a/pkgs/by-name/se/seaweedfs/package.nix +++ b/pkgs/by-name/se/seaweedfs/package.nix @@ -43,11 +43,13 @@ buildGoModule (finalAttrs: { ldflags = [ "-s" + ] + ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ "-extldflags=-static" ]; env = { - CGO_ENABLED = 0; + CGO_ENABLED = if stdenv.hostPlatform.isDarwin then 1 else 0; GODEBUG = "http2client=0"; }; @@ -93,6 +95,5 @@ buildGoModule (finalAttrs: { wozeparrot ]; mainProgram = "weed"; - broken = stdenv.hostPlatform.isDarwin; }; }) From 247ebbd7c697e338d9b87fdc8a2a47d0315d7b37 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 24 Jun 2026 11:06:52 +0000 Subject: [PATCH 113/115] librewolf-bin-unwrapped: 152.0-1 -> 152.0.2-1 --- pkgs/by-name/li/librewolf-bin-unwrapped/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix index 618284f333df..4ccf3c299e9e 100644 --- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix +++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix @@ -36,7 +36,7 @@ let pname = "librewolf-bin-unwrapped"; - version = "152.0-1"; + version = "152.0.2-1"; in stdenv.mkDerivation { @@ -46,8 +46,8 @@ stdenv.mkDerivation { url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz"; hash = { - x86_64-linux = "sha256-sIpyCpfo9igZ0PMd1Y7sdIoui88dC9DjlwjN5M5HLsQ="; - aarch64-linux = "sha256-H1HtyZPcE8RpJTuqTnCOMC5gb+s1Dp80OE66KCdRM4g="; + x86_64-linux = "sha256-Tq2bj75oZXSH2YHXShjRRs4Aqxo86BuwONXu+IsdCuA="; + aarch64-linux = "sha256-xk3o5FODm5ge2I8JzgwXTpgu/SI6VcROIJ7005ew2PY="; } .${stdenv.hostPlatform.system} or throwSystem; }; From bf6f5d1300af2e1cfce00236d4d92e9577597f4e Mon Sep 17 00:00:00 2001 From: TornaxO7 Date: Wed, 24 Jun 2026 13:44:45 +0200 Subject: [PATCH 114/115] crowdsec: refactor - add tornax to maintainer list - add notification binaries - remove provided systemd-service file of upstream crowdsec --- pkgs/by-name/cr/crowdsec/package.nix | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/cr/crowdsec/package.nix b/pkgs/by-name/cr/crowdsec/package.nix index 41776f0e0418..f146ec766583 100644 --- a/pkgs/by-name/cr/crowdsec/package.nix +++ b/pkgs/by-name/cr/crowdsec/package.nix @@ -3,6 +3,7 @@ buildGoModule, fetchFromGitHub, installShellFiles, + makeBinaryWrapper, }: buildGoModule (finalAttrs: { @@ -18,11 +19,21 @@ buildGoModule (finalAttrs: { vendorHash = "sha256-RDkttsV4PNOfjWPr4v+uIwdkmXYH83vkYFQQIO3CYGE="; - nativeBuildInputs = [ installShellFiles ]; + nativeBuildInputs = [ + installShellFiles + makeBinaryWrapper + ]; subPackages = [ "cmd/crowdsec" "cmd/crowdsec-cli" + "cmd/notification-dummy" + "cmd/notification-email" + "cmd/notification-file" + "cmd/notification-http" + "cmd/notification-sentinel" + "cmd/notification-slack" + "cmd/notification-splunk" ]; ldflags = [ @@ -39,13 +50,12 @@ buildGoModule (finalAttrs: { postBuild = "mv $GOPATH/bin/{crowdsec-cli,cscli}"; postInstall = '' + # so that `bin/crowdsec` is available for `cscli explain` for example + wrapProgram $out/bin/cscli --prefix PATH : $out/bin/ + mkdir -p $out/share/crowdsec cp -r ./config $out/share/crowdsec/ - mkdir -p $out/lib/systemd/system - substitute ./config/crowdsec.service $out/lib/systemd/system/crowdsec.service \ - --replace-fail /usr/local $out - installShellCompletion --cmd cscli \ --bash <($out/bin/cscli completion bash) \ --fish <($out/bin/cscli completion fish) \ @@ -63,6 +73,7 @@ buildGoModule (finalAttrs: { ''; meta = { + mainProgram = "crowdsec"; homepage = "https://crowdsec.net/"; changelog = "https://github.com/crowdsecurity/crowdsec/releases/tag/v${finalAttrs.version}"; description = "Free, open-source and collaborative IPS"; @@ -80,6 +91,7 @@ buildGoModule (finalAttrs: { license = lib.licenses.mit; maintainers = with lib.maintainers; [ jk + tornax ]; }; }) From fef886e90e8cd5a722669efc571d7083650809e5 Mon Sep 17 00:00:00 2001 From: Atemu Date: Wed, 24 Jun 2026 01:19:04 +0200 Subject: [PATCH 115/115] openblas: disable checks on i686-linux (cherry picked from commit 89e0f58061bbae3fb73505d8fd7366bdeca08f28) --- pkgs/development/libraries/science/math/openblas/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix index 4acddd306b5f..97b7596b937c 100644 --- a/pkgs/development/libraries/science/math/openblas/default.nix +++ b/pkgs/development/libraries/science/math/openblas/default.nix @@ -271,7 +271,9 @@ stdenv.mkDerivation (finalAttrs: { (lib.cmakeBool "USE_OPENMP" false) # openblas will refuse building with both USE_OPENMP=ON and USE_THREAD=OFF ]; - doCheck = true; + # FIXME: this broke some time between a0374025a863d007d98e3297f6aa46cc3141c2f0 and 34268251cf5547d39063f2c5ea9a196246f7f3a6 + # This just serves to unbreak stable + doCheck = stdenv.hostPlatform.system != "i686-linux"; postInstall = '' # Provide headers in /include directly for compat with some consumers like flint