Merge master into staging-nixos

doc/redirects.json

@@ -788,6 +788,9 @@
   "var-stdenv-depsTargetTargetPropagated": [
     "index.html#var-stdenv-depsTargetTargetPropagated"
   ],
+  "var-stdenv-strictDeps": [
+    "index.html#var-stdenv-strictDeps"
+  ],
   "ssec-stdenv-attributes": [
     "index.html#ssec-stdenv-attributes"
   ],

doc/stdenv/stdenv.chapter.md

@@ -487,6 +487,14 @@ The propagated equivalent of `buildInputs`. This would be called `depsHostTarget
 
 The propagated equivalent of `depsTargetTarget`. This is prefixed for the same reason of alerting potential users.
 
+##### `strictDeps` {#var-stdenv-strictDeps}
+
+When using native compilation, `stdenv` is lenient towards incorrect placement of a dependency into one of the dependency lists described above. That means a dependency needed at runtime often works, even if it is only present in `nativeBuildInputs`. Vice-versa, dependencies containing binaries that need to be executed during the build will work even if they are only listed in `buildInputs`.
+
+While convenient for getting to a package quickly, this behavior can break cross-compilation. Adding `strictDeps = true` as a parameter to `mkDerivation` or any of its language specific wrappers disables this behavior.
+
+The specialized `build*` functions for dlang, emacs, go, nim, ocaml, python, and rust enable this option by default.
+
 ## Attributes {#ssec-stdenv-attributes}
 
 ### Variables affecting `stdenv` initialisation {#variables-affecting-stdenv-initialisation}

maintainers/maintainer-list.nix

@@ -17478,6 +17478,12 @@
     name = "Maciej Krüger";
     keys = [ { fingerprint = "E90C BA34 55B3 6236 740C  038F 0D94 8CE1 9CF4 9C5F"; } ];
   };
+  mkleczek = {
+    name = "Michal Kleczek";
+    email = "michal@kleczek.org";
+    github = "mkleczek";
+    githubId = 11559480;
+  };
   mksafavi = {
     name = "MK Safavi";
     email = "mksafavi@gmail.com";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -70,3 +70,5 @@ of pulling the upstream container image from Docker Hub. If you want the old beh
 - `services.frp` now supports multiple instances through `services.frp.instances` to make it possible to run multiple frp clients or servers at the same time.
 
 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.
+
+- `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options.

nixos/modules/services/computing/slurm/slurm.nix

@@ -130,6 +130,45 @@ in
         enable = lib.mkEnableOption "slurm client daemon";
       };
 
+      rest = {
+        enable = lib.mkEnableOption "slurm REST daemon";
+
+        options = lib.mkOption {
+          type = lib.types.str;
+          default = "";
+          description = "Extra command-line options to pass to slurmrestd.";
+        };
+
+        environment = lib.mkOption {
+          default = { };
+          description = "Environment variables to set for the slurmrestd daemon, see slurmrestd(8).";
+          type = lib.types.submodule {
+            freeformType = with lib.types; attrsOf str;
+            options = {
+              SLURM_JWT = lib.mkOption {
+                type = lib.types.str;
+                default = "daemon";
+                description = "This variable must be set to use JWT token authentication.";
+              };
+              SLURMRESTD_LISTEN = lib.mkOption {
+                type = lib.types.str;
+                default = ":6820";
+                description = "Comma-delimited list of host:port pairs or unix sockets to listen on.";
+              };
+              SLURMRESTD_DEBUG = lib.mkOption {
+                type = lib.types.str;
+                default = "info";
+                description = ''
+                  Set debug level explicitly. Valid values are 0-9, or the same
+                  string values as the debug options such as SlurmctldDebug in
+                  slurm.conf(5).
+                '';
+              };
+            };
+          };
+        };
+      };
+
       enableStools = lib.mkOption {
         type = lib.types.bool;
         default = false;
@@ -359,131 +398,174 @@ in
       '';
 
     in
-    lib.mkIf (cfg.enableStools || cfg.client.enable || cfg.server.enable || cfg.dbdserver.enable) {
+    lib.mkIf
+      (
+        cfg.enableStools
+        || cfg.client.enable
+        || cfg.server.enable
+        || cfg.dbdserver.enable
+        || cfg.rest.enable
+      )
+      {
 
-      environment.systemPackages = [ wrappedSlurm ];
+        environment.systemPackages = [ wrappedSlurm ];
 
-      services.munge.enable = lib.mkDefault true;
+        services.munge.enable = lib.mkDefault true;
 
-      # use a static uid as default to ensure it is the same on all nodes
-      users.users.slurm = lib.mkIf (cfg.user == defaultUser) {
-        name = defaultUser;
-        group = "slurm";
-        uid = config.ids.uids.slurm;
-      };
-
-      users.groups.slurm.gid = config.ids.uids.slurm;
-
-      systemd.services.slurmd = lib.mkIf (cfg.client.enable) {
-        path =
-          with pkgs;
-          [
-            wrappedSlurm
-            coreutils
-          ]
-          ++ lib.optional cfg.enableSrunX11 slurm-spank-x11;
-
-        wantedBy = [ "multi-user.target" ];
-        after = [
-          "systemd-tmpfiles-clean.service"
-          "munge.service"
-          "network-online.target"
-          "remote-fs.target"
-        ];
-        wants = [ "network-online.target" ];
-
-        serviceConfig = {
-          Type = "forking";
-          KillMode = "process";
-          ExecStart = "${wrappedSlurm}/bin/slurmd";
-          PIDFile = "/run/slurmd.pid";
-          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-          LimitMEMLOCK = "infinity";
-          Delegate = "Yes";
-        };
-      };
-
-      systemd.tmpfiles.rules = lib.optionals cfg.client.enable [
-        "d /var/spool/slurmd 755 root root -"
-        "d ${cfg.mpi.PmixCliTmpDirBase} 755 root root -"
-      ];
-
-      services.openssh.settings.X11Forwarding = lib.mkIf cfg.client.enable (lib.mkDefault true);
-
-      systemd.services.slurmctld = lib.mkIf (cfg.server.enable) {
-        path =
-          with pkgs;
-          [
-            wrappedSlurm
-            munge
-            coreutils
-          ]
-          ++ lib.optional cfg.enableSrunX11 slurm-spank-x11;
-
-        wantedBy = [ "multi-user.target" ];
-        after = [
-          "network.target"
-          "munged.service"
-        ];
-        requires = [ "munged.service" ];
-
-        serviceConfig = {
-          Type = "forking";
-          ExecStart = "${wrappedSlurm}/bin/slurmctld";
-          PIDFile = "/run/slurmctld.pid";
-          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        # use a static uid as default to ensure it is the same on all nodes
+        users.users.slurm = lib.mkIf (cfg.user == defaultUser) {
+          name = defaultUser;
+          group = "slurm";
+          uid = config.ids.uids.slurm;
         };
 
-        preStart = ''
-          mkdir -p ${cfg.stateSaveLocation}
-          chown -R ${cfg.user}:slurm ${cfg.stateSaveLocation}
-        '';
-      };
+        users.groups.slurm.gid = config.ids.uids.slurm;
 
-      systemd.services.slurmdbd =
-        let
-          # slurm strips the last component off the path
-          configPath = "$RUNTIME_DIRECTORY/slurmdbd.conf";
-        in
-        lib.mkIf (cfg.dbdserver.enable) {
-          path = with pkgs; [
-            wrappedSlurm
-            munge
-            coreutils
+        users.users.slurmrestd = lib.mkIf (cfg.rest.enable) {
+          name = "slurmrestd";
+          group = "slurmrestd";
+          isSystemUser = true;
+        };
+
+        users.groups.slurmrestd = lib.mkIf (cfg.rest.enable) { };
+
+        systemd.services.slurmd = lib.mkIf (cfg.client.enable) {
+          path =
+            with pkgs;
+            [
+              wrappedSlurm
+              coreutils
+            ]
+            ++ lib.optional cfg.enableSrunX11 slurm-spank-x11;
+
+          wantedBy = [ "multi-user.target" ];
+          after = [
+            "systemd-tmpfiles-clean.service"
+            "munge.service"
+            "network-online.target"
+            "remote-fs.target"
           ];
+          wants = [ "network-online.target" ];
+
+          serviceConfig = {
+            Type = "forking";
+            KillMode = "process";
+            ExecStart = "${wrappedSlurm}/bin/slurmd";
+            PIDFile = "/run/slurmd.pid";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+            LimitMEMLOCK = "infinity";
+            Delegate = "Yes";
+          };
+        };
+
+        systemd.tmpfiles.rules = lib.optionals cfg.client.enable [
+          "d /var/spool/slurmd 755 root root -"
+          "d ${cfg.mpi.PmixCliTmpDirBase} 755 root root -"
+        ];
+
+        services.openssh.settings.X11Forwarding = lib.mkIf cfg.client.enable (lib.mkDefault true);
+
+        systemd.services.slurmctld = lib.mkIf (cfg.server.enable) {
+          path =
+            with pkgs;
+            [
+              wrappedSlurm
+              munge
+              coreutils
+            ]
+            ++ lib.optional cfg.enableSrunX11 slurm-spank-x11;
 
           wantedBy = [ "multi-user.target" ];
           after = [
             "network.target"
             "munged.service"
-            "mysql.service"
           ];
-          requires = [
-            "munged.service"
-            "mysql.service"
-          ];
-
-          preStart = ''
-            install -m 600 -o ${cfg.user} -T ${slurmdbdConf} ${configPath}
-            ${lib.optionalString (cfg.dbdserver.storagePassFile != null) ''
-              echo "StoragePass=$(cat ${cfg.dbdserver.storagePassFile})" \
-                >> ${configPath}
-            ''}
-          '';
-
-          script = ''
-            export SLURM_CONF=${configPath}
-            exec ${cfg.package}/bin/slurmdbd -D
-          '';
+          requires = [ "munged.service" ];
 
           serviceConfig = {
-            RuntimeDirectory = "slurmdbd";
-            Type = "simple";
-            PIDFile = "/run/slurmdbd.pid";
+            Type = "forking";
+            ExecStart = "${wrappedSlurm}/bin/slurmctld";
+            PIDFile = "/run/slurmctld.pid";
             ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           };
+
+          preStart = ''
+            mkdir -p ${cfg.stateSaveLocation}
+            chown -R ${cfg.user}:slurm ${cfg.stateSaveLocation}
+          '';
         };
 
-    };
+        systemd.services.slurmdbd =
+          let
+            # slurm strips the last component off the path
+            configPath = "$RUNTIME_DIRECTORY/slurmdbd.conf";
+          in
+          lib.mkIf (cfg.dbdserver.enable) {
+            path = with pkgs; [
+              wrappedSlurm
+              munge
+              coreutils
+            ];
+
+            wantedBy = [ "multi-user.target" ];
+            after = [
+              "network.target"
+              "munged.service"
+              "mysql.service"
+            ];
+            requires = [
+              "munged.service"
+              "mysql.service"
+            ];
+
+            preStart = ''
+              install -m 600 -o ${cfg.user} -T ${slurmdbdConf} ${configPath}
+              ${lib.optionalString (cfg.dbdserver.storagePassFile != null) ''
+                echo "StoragePass=$(cat ${cfg.dbdserver.storagePassFile})" \
+                  >> ${configPath}
+              ''}
+            '';
+
+            script = ''
+              export SLURM_CONF=${configPath}
+              exec ${cfg.package}/bin/slurmdbd -D
+            '';
+
+            serviceConfig = {
+              RuntimeDirectory = "slurmdbd";
+              Type = "simple";
+              PIDFile = "/run/slurmdbd.pid";
+              ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+            };
+          };
+
+        systemd.services.slurmrestd = lib.mkIf (cfg.rest.enable) {
+          path = with pkgs; [
+            wrappedSlurm
+            coreutils
+          ];
+
+          wantedBy = [ "multi-user.target" ];
+          after = [
+            "systemd-tmpfiles-clean.service"
+            "network-online.target"
+            "remote-fs.target"
+            "slurmctld.service"
+          ];
+          wants = [ "network-online.target" ];
+
+          serviceConfig = {
+            Type = "simple";
+            ExecStart = "${wrappedSlurm}/bin/slurmrestd ${cfg.rest.options}";
+            PIDFile = "/run/slurmrestd.pid";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+            LimitMEMLOCK = "infinity";
+            User = "slurmrestd";
+            Group = "slurmrestd";
+          };
+
+          environment = cfg.rest.environment;
+        };
+      };
 
 }

nixos/modules/services/desktop-managers/plasma6.nix

@@ -167,6 +167,7 @@ in
           spectacle
           ffmpegthumbs
           krdp
+          kconfig # required for xdg-terminal from xdg-utils
         ]
         ++ lib.optionals config.hardware.sensor.iio.enable [
           # This is required for autorotation in Plasma 6

nixos/modules/services/networking/knot-resolver.nix

@@ -36,10 +36,9 @@ in
         If you want to use knot-resolver 5, please use services.kresd.
       '';
     };
-    package = lib.mkPackageOption pkgs "knot-resolver-manager_6.knot-resolver" {
-      example = "knot-resolver_6.override { extraFeatures = true; }";
+    managerPackage = lib.mkPackageOption pkgs "knot-resolver-manager_6" {
+      example = "pkgs.knot-resolver-manager_6.override { extraFeatures = true; }";
     };
-    managerPackage = lib.mkPackageOption pkgs "knot-resolver-manager_6" { };
     settings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = (pkgs.formats.yaml { }).type;
@@ -113,16 +112,6 @@ in
     users.groups.knot-resolver = { };
     networking.resolvconf.useLocalResolver = lib.mkDefault true;
 
-    assertions = [
-      {
-        assertion = lib.versionAtLeast cfg.package.version "6.0.0";
-        message = ''
-          services.knot-resolver only works with knot-resolver 6 or later.
-          Please use services.kresd for knot-resolver 5.
-        '';
-      }
-    ];
-
     environment = {
       etc."knot-resolver/config.yaml".source = configFile;
       systemPackages = [
@@ -134,10 +123,9 @@ in
       ];
     };
 
-    systemd.packages = [ cfg.package ]; # the unit gets patched a bit just below
+    systemd.packages = [ cfg.managerPackage.kresd ]; # the unit gets patched a bit just below
     systemd.services."knot-resolver" = {
       wantedBy = [ "multi-user.target" ];
-      path = [ (lib.getBin cfg.package) ];
       stopIfChanged = false;
       reloadTriggers = [
         configFile

nixos/tests/os-prober.nix

@@ -35,6 +35,7 @@ import ./make-test-python.nix (
           update-grub
       '';
     };
+    zfsSupport = false;
 
     # a part of the configuration of the test vm
     simpleConfig = {
@@ -52,6 +53,8 @@ import ./make-test-python.nix (
       };
       # save some memory
       documentation.enable = false;
+      # this option is only there to enable more direct copy paste from the installer test
+      boot.supportedFilesystems.zfs = zfsSupport;
     };
     # /etc/nixos/configuration.nix for the vm
     configFile = pkgs.writeText "configuration.nix" ''
@@ -84,6 +87,11 @@ import ./make-test-python.nix (
           # The test cannot access the network, so any packages
           # nixos-rebuild needs must be included in the VM.
           system.extraDependencies = with pkgs; [
+            os-prober
+
+            # list copied from installer test nixos/tests/installer.nix
+            stdenv
+
             bintools
             brotli
             brotli.dev
@@ -91,25 +99,22 @@ import ./make-test-python.nix (
             desktop-file-utils
             docbook5
             docbook_xsl_ns
-            grub2
-            nixos-artwork.wallpapers.simple-dark-gray-bootloader
-            perlPackages.FileCopyRecursive
-            perlPackages.XMLSAX
-            perlPackages.XMLSAXBase
-            kbd
             kbd.dev
             kmod.dev
-            libarchive
             libarchive.dev
             libxml2.bin
             libxslt.bin
             nixos-artwork.wallpapers.simple-dark-gray-bottom
+            (nixos-rebuild-ng.override {
+              withNgSuffix = false;
+              withReexec = true;
+            })
+            ntp
             perlPackages.ConfigIniFiles
             perlPackages.FileSlurp
             perlPackages.JSON
             perlPackages.ListCompare
             perlPackages.XMLLibXML
-            # make-options-doc/default.nix
             (python3.withPackages (p: [ p.mistune ]))
             shared-mime-info
             sudo
@@ -117,11 +122,23 @@ import ./make-test-python.nix (
             texinfo
             unionfs-fuse
             xorg.lndir
-            os-prober
+            shellcheck-minimal
+
+            # Only the out output is included here, which is what is
+            # required to build the NixOS udev rules
+            # See the comment in services/hardware/udev.nix
+            systemdMinimal.out
 
             # add curl so that rather than seeing the test attempt to download
             # curl's tarball, we see what it's trying to download
             curl
+
+            (pkgs.grub2.override { inherit zfsSupport; })
+            (pkgs.grub2_efi.override { inherit zfsSupport; })
+            pkgs.nixos-artwork.wallpapers.simple-dark-gray-bootloader
+            pkgs.perlPackages.FileCopyRecursive
+            pkgs.perlPackages.XMLSAX
+            pkgs.perlPackages.XMLSAXBase
           ];
         }
       );

nixos/tests/slurm.nix

@@ -8,6 +8,7 @@ let
       extraConfig = ''
         AccountingStorageHost=dbd
         AccountingStorageType=accounting_storage/slurmdbd
+        AuthAltTypes=auth/jwt
       '';
     };
     environment.systemPackages = [ mpitest ];
@@ -87,6 +88,9 @@ in
           services.slurm = {
             server.enable = true;
           };
+          systemd.tmpfiles.rules = [
+            "f /var/spool/slurmctld/jwt_hs256.key 0400 slurm slurm - thisisjustanexamplejwttoken0000"
+          ];
         };
 
       submit =
@@ -131,6 +135,13 @@ in
           };
         };
 
+      rest =
+        { ... }:
+        {
+          imports = [ slurmconfig ];
+          services.slurm.rest.enable = true;
+        };
+
       node1 = computeNode;
       node2 = computeNode;
       node3 = computeNode;
@@ -170,5 +181,10 @@ in
     with subtest("run_sbatch"):
         submit.succeed("sbatch --wait ${sbatchScript}")
         submit.succeed("grep 'sbatch success' ${sbatchOutput}")
+
+    with subtest("rest"):
+        rest.wait_for_unit("slurmrestd.service")
+        token = control.succeed("scontrol token").split('=')[1].rstrip()
+        rest.succeed("${pkgs.curl}/bin/curl -sk -H X-SLURM-USER-TOKEN:%s -X GET 'http://localhost:6820/slurm/v0.0.43/diag'" % token)
   '';
 }

pkgs/applications/display-managers/sddm/default.nix

@@ -3,41 +3,41 @@
   callPackage,
   runCommand,
   wrapQtAppsHook,
-  unwrapped ? callPackage ./unwrapped.nix { },
+  sddm-unwrapped,
   extraPackages ? [ ],
 }:
 runCommand "sddm-wrapped"
   {
-    inherit (unwrapped) version outputs;
+    inherit (sddm-unwrapped) version outputs;
 
-    buildInputs = unwrapped.buildInputs ++ extraPackages;
+    buildInputs = sddm-unwrapped.buildInputs ++ extraPackages;
     nativeBuildInputs = [ wrapQtAppsHook ];
 
     strictDeps = true;
 
     passthru = {
-      inherit unwrapped;
-      inherit (unwrapped.passthru) tests;
+      unwrapped = sddm-unwrapped;
+      inherit (sddm-unwrapped.passthru) tests;
     };
 
-    meta = unwrapped.meta;
+    meta = sddm-unwrapped.meta;
   }
   ''
     mkdir -p $out/bin
 
-    cd ${unwrapped}
+    cd ${sddm-unwrapped}
 
     for i in *; do
       if [ "$i" == "bin" ]; then
         continue
       fi
-      ln -s ${unwrapped}/$i $out/$i
+      ln -s ${sddm-unwrapped}/$i $out/$i
     done
 
     for i in bin/*; do
-      makeQtWrapper ${unwrapped}/$i $out/$i --set SDDM_GREETER_DIR $out/bin
+      makeQtWrapper ${sddm-unwrapped}/$i $out/$i --set SDDM_GREETER_DIR $out/bin
     done
 
     mkdir -p $man
-    ln -s ${lib.getMan unwrapped}/* $man/
+    ln -s ${lib.getMan sddm-unwrapped}/* $man/
   ''

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2025-11-28";
+  version = "0-unstable-2025-12-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "1420c90299b1d9f4ef59373b3e5fa538a1e17a65";
-    hash = "sha256-w7Mcg80LiErWQdFiTfd+RTqJgCjH8qVf/N73KGOwyO4=";
+    rev = "ee3e73cf7b3959ad75f01f30afde286d427a5bee";
+    hash = "sha256-w0ADn4R7KzYokKtBDuKcdrTD/3XAZ1uz4LM2zPOhic8=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/by-name/ap/apk-tools/package.nix

@@ -6,20 +6,21 @@
   scdoc,
   openssl,
   zlib,
+  zstd,
   luaSupport ? stdenv.hostPlatform == stdenv.buildPlatform,
-  lua,
+  lua5_3,
 }:
 
 stdenv.mkDerivation rec {
   pname = "apk-tools";
-  version = "2.14.10";
+  version = "3.0.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.alpinelinux.org";
     owner = "alpine";
     repo = "apk-tools";
     rev = "v${version}";
-    sha256 = "sha256-9TSkcJe7FVdTtfcCmwp+IWMYa/OL9OXJwPcKLyj5AAA=";
+    sha256 = "sha256-ydqJiLkz80TQGyf9m/l8HSXfoTAvi0av7LHETk1c0GI=";
   };
 
   nativeBuildInputs = [
@@ -27,14 +28,15 @@ stdenv.mkDerivation rec {
     scdoc
   ]
   ++ lib.optionals luaSupport [
-    lua
-    lua.pkgs.lua-zlib
+    lua5_3
+    lua5_3.pkgs.lua-zlib
   ];
   buildInputs = [
     openssl
     zlib
+    zstd
   ]
-  ++ lib.optional luaSupport lua;
+  ++ lib.optional luaSupport lua5_3;
   strictDeps = true;
 
   makeFlags = [
@@ -42,7 +44,7 @@ stdenv.mkDerivation rec {
     "SBINDIR=$(out)/bin"
     "LIBDIR=$(out)/lib"
     "LUA=${if luaSupport then "lua" else "no"}"
-    "LUA_LIBDIR=$(out)/lib/lua/${lib.versions.majorMinor lua.version}"
+    "LUA_LIBDIR=$(out)/lib/lua/${lib.versions.majorMinor lua5_3.version}"
     "MANDIR=$(out)/share/man"
     "DOCDIR=$(out)/share/doc/apk"
     "INCLUDEDIR=$(out)/include"

pkgs/by-name/bq/bqn386/package.nix

@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "bqn386";
-  version = "0-unstable-2022-05-16";
+  version = "0-unstable-2025-03-23";
 
   src = fetchFromGitHub {
     owner = "dzaima";
     repo = "BQN386";
-    rev = "81e18d1eb8cb6b66df9e311b3b63ec086d910d18";
-    hash = "sha256-f0MbrxdkEiOqod41U07BvdDFDbFCqJuGyDIcx2Y24D0=";
+    rev = "4d8b9f668ba76a15ca9cd44d9bfedaf95a4c0d96";
+    hash = "sha256-7GW4W08d5sB9EIlPPTol29nWA64pPF+8PvrugrRkXtA=";
   };
 
   outputs = [

pkgs/by-name/co/conntrack-tools/package.nix

@@ -13,7 +13,7 @@
   libnetfilter_cthelper,
   libtirpc,
   systemdSupport ? true,
-  systemd,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     libtirpc
   ]
   ++ lib.optionals systemdSupport [
-    systemd
+    systemdLibs
   ];
   nativeBuildInputs = [
     flex

pkgs/by-name/co/copybara/package.nix

@@ -13,11 +13,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "copybara";
-  version = "20251215";
+  version = "20251222";
 
   src = fetchurl {
     url = "https://github.com/google/copybara/releases/download/v${finalAttrs.version}/copybara_deploy.jar";
-    hash = "sha256-URmJ7bFyOcvM77dY2L/N7Im0KU8R5ccN9pStiWmPKrM=";
+    hash = "sha256-QRr/3McBxf88T2eO0DH+Ka/i6j4/HV6wgS+fLkw07sE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/di/dioxus-cli/package.nix

@@ -74,7 +74,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
     ];
     maintainers = with lib.maintainers; [
-      xanderio
       cathalmullan
     ];
     platforms = lib.platforms.all;

pkgs/by-name/du/duktape/package.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   # https://github.com/svaarala/duktape/issues/2464
-  LDFLAGS = [ "-lm" ];
+  env.LDFLAGS = "-lm";
 
   nativeBuildInputs = [
     validatePkgConfig

pkgs/by-name/ed/edmarketconnector/package.nix

@@ -18,19 +18,19 @@ let
       })
       semantic-version
       psutil
+      tomli-w
     ];
-    ignoreCollisions = true;
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "edmarketconnector";
-  version = "5.13.3";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "EDCD";
     repo = "EDMarketConnector";
     tag = "Release/${finalAttrs.version}";
-    hash = "sha256-bcfLPrAIGBB8S7GtEpWpawiP2KFEG0xHeKXZAzqOjuU=";
+    hash = "sha256-FByD4JC/MZ++LcA6tWgvLpZs76Os8KZuv0quG8yW0kw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     longDescription = "Downloads commodity market and other station data from the game Elite: Dangerous for use with all popular online and offline trading tools.";
     changelog = "https://github.com/EDCD/EDMarketConnector/releases/tag/Release%2F${finalAttrs.version}";
     license = lib.licenses.gpl2Only;
-    platforms = lib.platforms.x86_64;
+    platforms = lib.platforms.linux;
     mainProgram = "edmarketconnector";
     maintainers = with lib.maintainers; [
       jiriks74

pkgs/by-name/es/esphome/package.nix

@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.12.1";
+  version = "2025.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-SElaxk81Psv1fkXGazMlUqmjlGLgNMm1t588zT+7r44=";
+    hash = "sha256-+9pWInWG7pWOrdU7OkdjRVy8YcN2JtIq5BIj0BopPms=";
   };
 
   patches = [

pkgs/by-name/fr/freetype/package.nix

@@ -82,13 +82,15 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-freetype-config"
   ];
 
-  # native compiler to generate building tool
-  CC_BUILD = "${buildPackages.stdenv.cc}/bin/cc";
+  env = {
+    # native compiler to generate building tool
+    CC_BUILD = "${buildPackages.stdenv.cc}/bin/cc";
 
-  # The asm for armel is written with the 'asm' keyword.
-  CFLAGS =
-    lib.optionalString stdenv.hostPlatform.isAarch32 "-std=gnu99"
-    + lib.optionalString stdenv.hostPlatform.is32bit " -D_FILE_OFFSET_BITS=64";
+    # The asm for armel is written with the 'asm' keyword.
+    CFLAGS =
+      lib.optionalString stdenv.hostPlatform.isAarch32 "-std=gnu99"
+      + lib.optionalString stdenv.hostPlatform.is32bit " -D_FILE_OFFSET_BITS=64";
+  };
 
   enableParallelBuilding = true;
 

pkgs/by-name/kn/knot-resolver-manager_6/package.nix

@@ -1,15 +1,16 @@
 {
+  lib,
   knot-resolver_6,
   python3Packages,
-  extraFeatures ? false,
+  extraFeatures ? false, # catch-all if defaults aren't enough
 }:
 let
-  knot-resolver = knot-resolver_6.override { inherit extraFeatures; };
+  kresd = knot-resolver_6.finalPackage; # TODO: does the finalPackage help us?
 in
+assert lib.versionAtLeast kresd.version "6.0.0";
 python3Packages.buildPythonPackage {
   pname = "knot-resolver-manager_6";
-  inherit (knot-resolver) version;
-  inherit (knot-resolver.unwrapped) src;
+  inherit (kresd) version src;
   pyproject = true;
 
   patches = [
@@ -20,11 +21,8 @@ python3Packages.buildPythonPackage {
   ];
 
   # Propagate meson config from the C part to the python part.
-  # But the install-time etc differs from a sensible run-time etc.
   postPatch = ''
-    substitute '${knot-resolver.unwrapped.config_py}'/knot_resolver/constants.py ./python/knot_resolver/constants.py \
-      --replace-fail '${knot-resolver.unwrapped.out}/etc' '/etc' \
-      --replace-fail '${knot-resolver.unwrapped.out}/sbin' '${knot-resolver}/bin'
+    cp '${kresd.config_py}'/knot_resolver/constants.py ./python/knot_resolver/
   ''
   # On non-Linux let's simplify construction of the knot-resolver command line,
   # as it would break because of nixpkgs-specific wrapping of python packages.
@@ -48,6 +46,34 @@ python3Packages.buildPythonPackage {
     typing-extensions
   ];
 
+  # set up (additional) Lua dependencies
+  buildInputs =
+    with kresd.lua;
+    lib.optionals extraFeatures [
+      # For http module, prefill module, trust anchor bootstrap.
+      # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
+      http
+      # used by policy.slice_randomize_psl()
+      psl
+    ];
+  makeWrapperArgs = [
+    "--set"
+    "LUA_PATH"
+    ''"$LUA_PATH"''
+    "--set"
+    "LUA_CPATH"
+    ''"$LUA_CPATH"''
+  ];
+  # basic test that the wrapping works
+  postCheck = lib.optionalString extraFeatures ''
+    makeWrapper '${kresd}/bin/kresd' ./kresd \
+      --set LUA_PATH  "$LUA_PATH" \
+      --set LUA_CPATH "$LUA_CPATH"
+    echo "Checking that 'http' module loads, i.e. lua search paths work:"
+    echo "modules.load('http')" > test-http.lua
+    echo -e 'quit()' | env -i ./kresd -a 127.0.0.1#53535 -c test-http.lua
+  '';
+
   doCheck = python3Packages.stdenv.isLinux; # maybe in future
   nativeCheckInputs = with python3Packages; [
     augeas
@@ -79,10 +105,11 @@ python3Packages.buildPythonPackage {
   ];
 
   passthru = {
-    inherit knot-resolver;
+    inherit kresd;
   };
 
-  meta = knot-resolver.meta // {
+  meta = kresd.meta // {
     mainProgram = "knot-resolver";
+    inherit (kresd.meta) description; # explicit to make e.g. `nix edit` point here
   };
 }

pkgs/by-name/kn/knot-resolver_6/package.nix

@@ -26,14 +26,12 @@
   cmocka,
   which,
   cacert,
-  extraFeatures ? false, # catch-all if defaults aren't enough
 }:
 let
-  result = if extraFeatures then wrapped-full else unwrapped;
-
   inherit (lib) optional optionals optionalString;
   lua = luajitPackages;
 
+  # TODO: we could cut the `let` short here, but it would de-indent everything.
   unwrapped = stdenv.mkDerivation (finalAttrs: {
     pname = "knot-resolver_6";
     version = "6.0.17";
@@ -56,20 +54,12 @@ let
         excludes = [ "NEWS" ];
         hash = "sha256-3w33v8UfhGdA50BlkfHpQLFxg+5ELk0lp7RzgvkSzK8=";
       })
+      # Install-time paths sometimes differ from run-time paths in nixpkgs.
+      ./paths.patch
     ];
 
-    # Path fixups for the NixOS service.
     # systemd Exec* options are difficult to override in NixOS *if present*, so we drop them.
     postPatch = ''
-      patch meson.build <<EOF
-      @@ -50,2 +50,3 @@
-      -systemd_work_dir = prefix / get_option('localstatedir') / 'lib' / 'knot-resolver'
-      -systemd_cache_dir = prefix / get_option('localstatedir') / 'cache' / 'knot-resolver'
-      +systemd_work_dir  = '/var/lib/knot-resolver'
-      +systemd_cache_dir = '/var/cache/knot-resolver'
-      +run_dir = '/run/knot-resolver'
-      EOF
-
       sed -e '/^ExecStart=/d' -e '/^ExecReload=/d' \
         -i systemd/knot-resolver.service.in
     ''
@@ -147,7 +137,8 @@ let
     '';
 
     passthru = {
-      unwrapped = finalAttrs.finalPackage;
+      inherit lua;
+      inherit (finalAttrs) finalPackage;
     };
 
     meta = {
@@ -163,42 +154,5 @@ let
     };
   });
 
-  wrapped-full =
-    runCommand unwrapped.name
-      {
-        nativeBuildInputs = [ makeWrapper ];
-        buildInputs = with luajitPackages; [
-          # For http module, prefill module, trust anchor bootstrap.
-          # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
-          http
-          # used by policy.slice_randomize_psl()
-          psl
-        ];
-        preferLocalBuild = true;
-        allowSubstitutes = false;
-        inherit (unwrapped) version meta;
-        passthru = {
-          inherit unwrapped;
-        };
-      }
-      (
-        ''
-          mkdir -p "$out"/bin
-          makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
-            --set LUA_PATH  "$LUA_PATH" \
-            --set LUA_CPATH "$LUA_CPATH"
-
-          ln -sr '${unwrapped}/bin/kres-cache-gc' "$out"/bin/
-          ln -sr '${unwrapped}/share' "$out"/
-          ln -sr '${unwrapped}/lib'   "$out"/ # useful in NixOS service
-          ln -sr "$out"/{bin,sbin}
-        ''
-        + lib.optionalString unwrapped.doInstallCheck ''
-          echo "Checking that 'http' module loads, i.e. lua search paths work:"
-          echo "modules.load('http')" > test-http.lua
-          echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
-        ''
-      );
-
 in
-result
+unwrapped

pkgs/by-name/kn/knot-resolver_6/paths.patch

@@ -0,0 +1,14 @@
+--- a/meson.build
++++ b/meson.build
+@@ -50,2 +50,3 @@
+-systemd_work_dir = prefix / get_option('localstatedir') / 'lib' / 'knot-resolver'
+-systemd_cache_dir = prefix / get_option('localstatedir') / 'cache' / 'knot-resolver'
++systemd_work_dir  = '/var/lib/knot-resolver'
++systemd_cache_dir = '/var/cache/knot-resolver'
++run_dir = '/run/knot-resolver'
+
+--- a/python/knot_resolver/constants.py.in
++++ b/python/knot_resolver/constants.py.in
+@@ -12 +12 @@
+-ETC_DIR = Path("@etc_dir@")
++ETC_DIR = Path("/etc/knot-resolver")

pkgs/by-name/li/libvgm/package.nix

@@ -38,13 +38,13 @@ assert enableTools -> enableAudio && enableEmulation && enableLibplayer;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libvgm";
-  version = "0-unstable-2025-12-11";
+  version = "0-unstable-2025-12-15";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "f10668e07f0f29721a71b1711e5b05d865fd21a2";
-    hash = "sha256-5zYljieUrD14JF8buK9bDcBQXYRCrmFodNvi9hgx+CQ=";
+    rev = "455a0898761269d8e158c5e1c799976940f01dd4";
+    hash = "sha256-9gqIjBzqUZIse0O+u/mZAmkx6Cb7AtEGYo3M1z53gYo=";
   };
 
   outputs = [

pkgs/by-name/nu/numr/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "numr";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "nasedkinpv";
     repo = "numr";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fa/F1bE/iUdtLe4kgHIQF3lcT/LLyUgdiYSgE9pCCSc=";
+    hash = "sha256-VmI9GpmwDrR8LAH4OhbHeI2AnShx2K5Upg+CCBUpSsU=";
   };
 
-  cargoHash = "sha256-onIhdgcB7MDiLCOi4qMysnu3VVpZ138jro9mZXDp9LI=";
+  cargoHash = "sha256-gVlZT3Buh8XQnR5kpknTuJ8nQPYKKGGqqCHve1JhFNA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/op/opa-envoy-plugin/package.nix

@@ -14,16 +14,16 @@ assert
 
 buildGoModule rec {
   pname = "opa-envoy-plugin";
-  version = "1.11.0-envoy";
+  version = "1.12.1-envoy";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa-envoy-plugin";
     tag = "v${version}";
-    hash = "sha256-BYNwr4smlY5evtja1CdCeVzKZIY0pFjiJwwhWOFHIm0=";
+    hash = "sha256-8JfzdmgXkdwbcjMxo1KnEe2YfYnEff0O27KiWeww6n4=";
   };
 
-  vendorHash = "sha256-wwXl115vhqUro5yhaMmlR8ms/uJMhFw9IzsX9mGRy+0=";
+  vendorHash = "sha256-Zv9tx3bT4hEzegQoqd/u1oD+tvgQlypeqv3KXJFDWLE=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/pe/pear-desktop/package.nix

@@ -14,12 +14,12 @@
   nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  pname = "youtube-music";
+  pname = "pear-desktop";
   version = "3.11.0";
 
   src = fetchFromGitHub {
-    owner = "th-ch";
-    repo = "youtube-music";
+    owner = "pear-devs";
+    repo = "pear-desktop";
     tag = "v${finalAttrs.version}";
     hash = "sha256-M8YFpeauM55fpNyHSGQm8iZieV0oWqOieVThhglKKPE=";
   };
@@ -63,9 +63,9 @@ stdenv.mkDerivation (finalAttrs: {
   desktopItems = [
     (makeDesktopItem {
       name = "com.github.th_ch.youtube_music";
-      exec = "youtube-music %u";
-      icon = "youtube-music";
-      desktopName = "YouTube Music";
+      exec = "pear-desktop %u";
+      icon = "pear-desktop";
+      desktopName = "Pear Desktop";
       startupWMClass = "com.github.th_ch.youtube_music";
       categories = [ "AudioVideo" ];
     })
@@ -78,15 +78,15 @@ stdenv.mkDerivation (finalAttrs: {
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/{Applications,bin}
     mv pack/mac*/YouTube\ Music.app $out/Applications
-    ln -s "$out/Applications/YouTube Music.app/Contents/MacOS/YouTube Music" $out/bin/youtube-music
+    ln -s "$out/Applications/YouTube Music.app/Contents/MacOS/YouTube Music" $out/bin/pear-desktop
   ''
   + lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    mkdir -p "$out/share/youtube-music"
-    cp -r pack/*-unpacked/{locales,resources{,.pak}} "$out/share/youtube-music"
+    mkdir -p "$out/share/pear-desktop"
+    cp -r pack/*-unpacked/{locales,resources{,.pak}} "$out/share/pear-desktop"
 
     pushd assets/generated/icons/png
     for file in *.png; do
-      install -Dm0644 $file $out/share/icons/hicolor/''${file//.png}/apps/youtube-music.png
+      install -Dm0644 $file $out/share/icons/hicolor/''${file//.png}/apps/pear-desktop.png
     done
     popd
   ''
@@ -96,8 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postFixup = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    makeWrapper ${electron}/bin/electron $out/bin/youtube-music \
-      --add-flags $out/share/youtube-music/resources/app.asar \
+    makeWrapper ${electron}/bin/electron $out/bin/pear-desktop \
+      --add-flags $out/share/pear-desktop/resources/app.asar \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
       --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
       --set-default ELECTRON_IS_DEV 0 \
@@ -108,8 +108,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Electron wrapper around YouTube Music";
-    homepage = "https://th-ch.github.io/youtube-music/";
-    changelog = "https://github.com/th-ch/youtube-music/blob/master/changelog.md#${
+    homepage = "https://github.com/pear-devs/pear-desktop";
+    changelog = "https://github.com/pear-devs/pear-desktop/blob/master/changelog.md#${
       lib.replaceStrings [ "." ] [ "" ] finalAttrs.src.tag
     }";
     license = lib.licenses.mit;
@@ -117,7 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
       aacebedo
       SuperSandro2000
     ];
-    mainProgram = "youtube-music";
+    mainProgram = "pear-desktop";
     platforms = [
       "x86_64-linux"
       "aarch64-linux"

pkgs/by-name/ph/phpactor/package.nix

@@ -7,16 +7,16 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpactor";
-  version = "2025.10.17.0";
+  version = "2025.12.21.0";
 
   src = fetchFromGitHub {
     owner = "phpactor";
     repo = "phpactor";
     tag = finalAttrs.version;
-    hash = "sha256-A/ajGQ75z/EdWFFJK0kLjcSFfa9z15TZCNZZpwq9k2E=";
+    hash = "sha256-wMyHkkN15kd2Q9BN3H2gJ3iNlRodric2DqWiWLU1Fj0=";
   };
 
-  vendorHash = "sha256-Y0U5GH2NGOhwDSqsJnDxUe+VOQbKrCOZDX6f2pCeUqY=";
+  vendorHash = "sha256-T4YiYL2RBpmLluk5rm4hkpD96wXKmrlX/1pzHRb//68=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/pt/pt2-clone/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pt2-clone";
-  version = "1.78";
+  version = "1.80.1";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-qbzs+EaypbulB1jkKQHMbhXwJIQwoyqVCdSvx5vYk2A=";
+    sha256 = "sha256-GJT9TxlM6O1PT1CKAgRtnivbC3RtzcglROx26S4G0Bc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/qu/quarkus/package.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.30.4";
+  version = "3.30.5";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-0EDFWcv3IujCxmBbqPTgFOGdv977pWgx8ujO2NZ5EJQ=";
+    hash = "sha256-x+G4DwqRMNEO75NND5r388pWnDZMjG7o/6MoCfVZyvk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ra/rain/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "rain";
-  version = "1.24.1";
+  version = "1.24.2";
 
   src = fetchFromGitHub {
     owner = "aws-cloudformation";
     repo = "rain";
     rev = "v${version}";
-    sha256 = "sha256-3Otjy6cZBEUCJI9l0B1+pL3/qmLI9PjPTl3Wd/mhaIE=";
+    sha256 = "sha256-xCozToZJRJvebS9H5NH6rHQprgTM3cy0cssJNh9AQmI=";
   };
 
   vendorHash = "sha256-Egh7NzjHHgQATezlqFOk6FjUwhvtM0MJqCUJTDeHZG0=";

pkgs/by-name/re/resources/package.nix

@@ -23,18 +23,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "resources";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "nokyan";
     repo = "resources";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ayptMBniaqVQwLThxTbMn5498kURjwRkC9lVPs7pryo=";
+    hash = "sha256-AMBaXGF7Sf13JE/neBO32MqEO142w51wMnTrf4wTeKY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-b6zWjSTkqdLaWRtMIHTLT0rEHlIxEKejYuoJkr4C3nY=";
+    hash = "sha256-IFZW0kg4bV1Msaly9sy4phz31TEIQhIdGlYG+rSA3hQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ri/rio/package.nix

@@ -50,16 +50,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rio";
-  version = "0.2.36";
+  version = "0.2.37";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-c/+agFoGRB+kvVSUo5+yc1LlSvLsgD5J1yk2ufDRgc4=";
+    hash = "sha256-5otVXZf8C1yGpfJ8EC5cs8a97KB3+EOI8ulnCI1dspU=";
   };
 
-  cargoHash = "sha256-KITGepJC6luNwA7ypGDjajLtmBx5faV2ruJ0aXyrFVo=";
+  cargoHash = "sha256-MGCH3l37ldBYygRv7IMDV5Coy1kjMi1a7ihjRS63ESA=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook

pkgs/by-name/sa/samrewritten/package.nix

@@ -16,16 +16,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "samrewritten";
-  version = "20250919.1";
+  version = "20251216.1";
 
   src = fetchFromGitHub {
     owner = "PaulCombal";
     repo = "SamRewritten";
     tag = finalAttrs.version;
-    hash = "sha256-IbWURGWiCRjTJSD8qPc1TmJeOm/WdCAFuK57laIXfXY=";
+    hash = "sha256-pMHkgB7z4coXS9N8+bBCo0gqtNKrXQO1qOTi4pNo19Y=";
   };
 
-  cargoHash = "sha256-Px/TlR3BhiFCv73v06VNq0/W0bQM/ORRE/9ndv5hbpY=";
+  cargoHash = "sha256-7FVjWiNzAQTN9ITmdoRZaQRnwg+epJyphil1e8QAHfo=";
 
   # Tests require network access and a running Steam client. Skipping.
   doCheck = false;

pkgs/by-name/sl/slurm/package.nix

@@ -35,6 +35,8 @@
   enableX11 ? true,
   enableNVML ? config.cudaSupport,
   cudaPackages,
+  symlinkJoin,
+  s2n-tls,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -105,6 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
     dbus
     libbpf
     http-parser
+    s2n-tls
   ]
   ++ lib.optionals enableX11 [ xauth ]
   ++ lib.optionals enableNVML [
@@ -128,6 +131,15 @@ stdenv.mkDerivation (finalAttrs: {
     "--sysconfdir=/etc/slurm"
     "--with-pmix=${lib.getDev pmix}"
     "--with-bpf=${libbpf}"
+    "--with-s2n=${
+      symlinkJoin {
+        name = s2n-tls.name;
+        paths = [
+          s2n-tls
+          (lib.getDev s2n-tls)
+        ];
+      }
+    }"
     "--without-rpath" # Required for configure to pick up the right dlopen path
   ]
   ++ (lib.optional (!enableX11) "--disable-x11")

pkgs/by-name/sp/spotify/darwin.nix

@@ -11,7 +11,7 @@
 stdenv.mkDerivation {
   inherit pname;
 
-  version = "1.2.75.510";
+  version = "1.2.78.418";
 
   src =
     # WARNING: This Wayback Machine URL redirects to the closest timestamp.
@@ -20,13 +20,13 @@ stdenv.mkDerivation {
     # https://web.archive.org/web/*/https://download.scdn.co/Spotify.dmg
     if stdenv.hostPlatform.isAarch64 then
       (fetchurl {
-        url = "https://web.archive.org/web/20251029235406/https://download.scdn.co/SpotifyARM64.dmg";
-        hash = "sha256-gEZxRBT7Jo2m6pirf+CreJiMeE2mhIkpe9Mv5t0RI58=";
+        url = "https://web.archive.org/web/20251212105149/https://download.scdn.co/SpotifyARM64.dmg";
+        hash = "sha256-/rrThZOpjzaHPX1raDe5X8PqtJeTI4GDS5sXSfthXTQ=";
       })
     else
       (fetchurl {
-        url = "https://web.archive.org/web/20251029235833/https://download.scdn.co/Spotify.dmg";
-        hash = "sha256-fhQYm7yMrlvY57gMuWGU31EbWidZ2l9bd44mhokZKTw=";
+        url = "https://web.archive.org/web/20251212105140/https://download.scdn.co/Spotify.dmg";
+        hash = "sha256-N2tQTS9vHp93cRI0c5riVZ/8FSaq3ovDqh5K9aU6jV0=";
       });
 
   nativeBuildInputs = [ undmg ];

pkgs/by-name/st/stable-diffusion-cpp/package.nix

@@ -42,13 +42,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "stable-diffusion-cpp";
-  version = "master-427-78e15bd";
+  version = "master-445-860a78e";
 
   src = fetchFromGitHub {
     owner = "leejet";
     repo = "stable-diffusion.cpp";
-    rev = "master-427-78e15bd";
-    hash = "sha256-5x0y02Jmiyp61bKZsERLWZo6gsmL5/ezTEc1P26by08=";
+    rev = "master-445-860a78e";
+    hash = "sha256-G/f0X+kxKAr/jDKDKpAppAsfsnmuq1/xMFFyUHB+3iI=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/tl/tlsinfo/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "tlsinfo";
-  version = "0.1.51";
+  version = "0.1.52";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "tlsinfo";
     tag = "v${version}";
-    hash = "sha256-UD/dy8pEulsoNOC5W+hkC+n4y8SjpZ0QOOECGPVy1ws=";
+    hash = "sha256-ZAK8F6qQo3lAwtal1fh7OVLYC3gjBTeLQPQQjrmfTSM=";
   };
 
-  vendorHash = "sha256-SkCuyYUwVcbCDSN0NtX29BNP/pPlFHqo0jU0Qo02mNk=";
+  vendorHash = "sha256-2jO7pd90gD0CWrj18gOwK7vBVKDeWARzvkcutOlmggc=";
 
   ldflags = [
     "-s"

pkgs/by-name/un/unzip/package.nix

@@ -53,21 +53,11 @@ stdenv.mkDerivation rec {
       sha256 = "1jvs7dkdqs97qnsqc6hk088alhv8j4c638k65dbib9chh40jd7pf";
     })
     (fetchurl {
-      urls = [
-        # original link (will be dead eventually):
-        "https://sources.debian.org/data/main/u/unzip/6.0-26%2Bdeb11u1/debian/patches/06-initialize-the-symlink-flag.patch"
-
-        "https://gist.github.com/veprbl/41261bb781571e2246ea42d3f37795f5/raw/d8533d8c6223150f76b0f31aec03e185fcde3579/06-initialize-the-symlink-flag.patch"
-      ];
+      url = "https://gist.github.com/veprbl/41261bb781571e2246ea42d3f37795f5/raw/d8533d8c6223150f76b0f31aec03e185fcde3579/06-initialize-the-symlink-flag.patch";
       sha256 = "1h00djdvgjhwfb60wl4qrxbyfsbbnn1qw6l2hkldnif4m8f8r1zj";
     })
     (fetchurl {
-      urls = [
-        # original link (will be dead eventually):
-        "https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch"
-
-        "https://web.archive.org/web/20230106200319/https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch"
-      ];
+      url = "https://web.archive.org/web/20230106200319/https://sources.debian.org/data/main/u/unzip/6.0-27/debian/patches/28-cve-2022-0529-and-cve-2022-0530.patch";
       sha256 = "sha256-on79jElQ+z2ULWAq14RpluAqr9d6itHiZwDkKubBzTc=";
     })
     # Clang 16 makes implicit declarations an error by default for C99 and newer, causing the

pkgs/by-name/xe/xenia-canary/package.nix

@@ -19,14 +19,14 @@
 }:
 llvmPackages_20.stdenv.mkDerivation {
   pname = "xenia-canary";
-  version = "0-unstable-2025-12-18";
+  version = "0-unstable-2025-12-25";
 
   src = fetchFromGitHub {
     owner = "xenia-canary";
     repo = "xenia-canary";
     fetchSubmodules = true;
-    rev = "d78bc3a78934bab4bf609cd3ecee62af2aa3bc48";
-    hash = "sha256-w760nQwqHxsNHJJLogtevRbiqxpo2I7bAUh0N1QfhMY=";
+    rev = "c42aeacf2518b7001d9192b555247503fd314869";
+    hash = "sha256-ztiqkjFIvMQrm+sRb3MDrjMdkPyYJd6Z5+hAbsc55pg=";
   };
 
   dontConfigure = true;

pkgs/by-name/xn/xnec2c/package.nix

@@ -16,13 +16,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xnec2c";
-  version = "4.4.17";
+  version = "4.4.18";
 
   src = fetchFromGitHub {
     owner = "KJ7LNW";
     repo = "xnec2c";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZxKpClB5IBfcpIOJsGVSiZU8WGu/8Yzeru96uCKkCGQ=";
+    hash = "sha256-bmbSuk/bgjLVs6IOIYpOTdeDCYKTZbsCgMv57cLKsEw=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/ghc/Cabal-3.16-paths-fix-cycle-aarch64-darwin.patch

@@ -0,0 +1,835 @@
+This patch is based on https://github.com/sternenseemann/cabal/tree/sterni-cabal-3.16-for-aarch64-darwin and has been created using
+git diff 77afa40961a686d36717604864b4c48ed5233bea eeed4f92625bbe2dbfb57f51d953e3b9a495d884 --patch --src-prefix=a/libraries/Cabal/ --dst-prefix=b/libraries/Cabal/
+
+Reasoning and explanation of the patch can be found in the comment in the diff for PathsModule.hs below.
+
+diff --git a/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule.hs b/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule.hs
+index 9392acf3c..3417e613a 100644
+--- a/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule.hs
++++ b/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule.hs
+@@ -52,6 +52,7 @@ generatePathsModule pkg_descr lbi clbi =
+       , Z.zIsI386 = buildArch == I386
+       , Z.zIsX8664 = buildArch == X86_64
+       , Z.zIsAArch64 = buildArch == AArch64
++      , Z.zOr = (||)
+       , Z.zNot = not
+       , Z.zManglePkgName = showPkgName
+       , Z.zPrefix = show flat_prefix
+@@ -61,8 +62,110 @@ generatePathsModule pkg_descr lbi clbi =
+       , Z.zDatadir = zDatadir
+       , Z.zLibexecdir = zLibexecdir
+       , Z.zSysconfdir = zSysconfdir
++      , -- Sadly we can't be cleverer about this – we can't have literals in the template
++        Z.zShouldEmitDataDir = shouldEmit "DataDir"
++      , Z.zShouldEmitLibDir = shouldEmit "LibDir"
++      , Z.zShouldEmitDynLibDir = shouldEmit "DynLibDir"
++      , Z.zShouldEmitLibexecDir = shouldEmit "LibexecDir"
++      , Z.zShouldEmitSysconfDir = shouldEmit "SysconfDir"
++      , Z.zWarning = zWarning
++      , Z.zShouldEmitWarning = zShouldEmitWarning
+       }
+   where
++    -- GHC's NCG backend for aarch64-darwin does not support link-time dead code
++    -- elimination to the extent that NCG does for other targets. Consequently,
++    -- we struggle with unnecessarily retained store path references due to the
++    -- use of `Paths_*` modules – even if `getLibDir` is not used, it'll end up
++    -- in the final library or executables we build.
++    --
++    -- When using a different output for the executables and library, this
++    -- becomes more sinister: The library will contain a reference to the bin
++    -- output and itself due to `getLibDir` and `getBinDir`, but the executables
++    -- will do so, too. Either due to linking dynamically or because the library
++    -- is linked statically into the executable and retains those references.
++    -- Since Nix disallows cyclical references between two outputs, it becomes
++    -- impossible to use the `Paths_*` module and a separate `bin` output for
++    -- aarch64-darwin.
++    --
++    -- The solution we have resorted to for now, is to trim the `Paths_*` module
++    -- dynamically depending on what references *could* be used without causing
++    -- a cyclical reference. That has the effect that any code that would not
++    -- cause a cyclical reference with dead code elimination will compile and
++    -- work for aarch64-darwin. If the code would use a `get*Dir` function that
++    -- has been omitted, this would indicate that the code would have caused a
++    -- cyclical reference anyways.
++    --
++    -- The logic for this makes some pretty big assumptions about installation
++    -- prefixes that probably only hold fully in nixpkgs with
++    -- `haskellPackages.mkDerivation`. Simple uses outside nixpkgs that have
++    -- everything below the same prefix should continue to work as expected,
++    -- though.
++    --
++    -- We assume the following:
++    --
++    -- - flat_prefix is `$out`.
++    -- - flat_libdir etc. are always below `$out`.
++    --
++    -- Since in the normal case due to static linking `$bin` and `$out` will
++    -- have the same references in libraries/executables, we need to either
++    -- prevent usage of `getBinDir` or `getLibDir` to break the cycle in case
++    -- `flat_bindir` is not below `$out`. We have decided to always allow usage
++    -- of `getBinDir`, so `getLibDir` gets dropped if a separate `bin` output is
++    -- used. This has the simple reason that `$out` which contains `flat_libdir`
++    -- tends to be quite big – we would like to have a `bin` output that doesn't
++    -- require keeping that around.
++    pathEmittable :: FilePath -> Bool
++    pathEmittable p
++      -- If the executable installation target is below `$out` the reference
++      -- cycle is within a single output (since libs are installed to `$out`)
++      -- and thus unproblematic. We can use any and all `get*Dir` functions.
++      | flat_prefix `isPrefixOf` flat_bindir = True
++      -- Otherwise, we need to disallow all `get*Dir` functions that would cause
++      -- a reference to `$out` which contains the libraries that would in turn
++      -- reference `$bin`. This always include `flat_libdir` and friends, but
++      -- can also include `flat_datadir` if no separate output for data files is
++      -- used.
++      | otherwise = not (flat_prefix `isPrefixOf` p)
++
++    -- This list maps the "name" of the directory to whether we want to include
++    -- it in the `Paths_*` module or not. `shouldEmit` performs a lookup in this.
++    dirs :: [(String, Bool)]
++    dirs =
++      map
++        (\(name, path) -> (name, pathEmittable path))
++        [ ("LibDir", flat_libdir)
++        , ("DynLibDir", flat_dynlibdir)
++        , ("DataDir", flat_datadir)
++        , ("LibexecDir", flat_libexecdir)
++        , ("SysconfDir", flat_sysconfdir)
++        ]
++
++    shouldEmit :: String -> Bool
++    shouldEmit name =
++      case lookup name dirs of
++        Just b -> b
++        Nothing -> error "panic! BUG in Cabal Paths_ patch for aarch64-darwin, report this at https://github.com/nixos/nixpkgs/issues"
++
++    -- This is a comma separated list of all functions that have been omitted.
++    -- This is included in a GHC warning which will be attached to the `Paths_*`
++    -- module in case we are dropping any `get*Dir` functions that would
++    -- normally exist.
++    --
++    -- TODO: getDataFileName is not accounted for at the moment.
++    omittedFunctions :: String
++    omittedFunctions =
++      intercalate ", " $
++        map (("get" ++) . fst) $
++          filter (not . snd) dirs
++
++    zWarning :: String
++    zWarning =
++      show $
++        "The following functions have been omitted by a nixpkgs-specific patch to Cabal: "
++          ++ omittedFunctions
++    zShouldEmitWarning :: Bool
++    zShouldEmitWarning = any (not . snd) dirs
++
+     supports_cpp = supports_language_pragma
+     supports_rebindable_syntax = ghc_newer_than (mkVersion [7, 0, 1])
+     supports_language_pragma = ghc_newer_than (mkVersion [6, 6, 1])
+diff --git a/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule/Z.hs b/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule/Z.hs
+index 8f33717bb..b89775893 100644
+--- a/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule/Z.hs
++++ b/libraries/Cabal/Cabal/src/Distribution/Simple/Build/PathsModule/Z.hs
+@@ -20,6 +20,14 @@ data Z
+          zDatadir :: FilePath,
+          zLibexecdir :: FilePath,
+          zSysconfdir :: FilePath,
++         zShouldEmitLibDir :: Bool,
++         zShouldEmitDynLibDir :: Bool,
++         zShouldEmitLibexecDir :: Bool,
++         zShouldEmitDataDir :: Bool,
++         zShouldEmitSysconfDir :: Bool,
++         zShouldEmitWarning :: Bool,
++         zWarning :: String,
++         zOr :: (Bool -> Bool -> Bool),
+          zNot :: (Bool -> Bool),
+          zManglePkgName :: (PackageName -> String)}
+     deriving Generic
+@@ -74,10 +82,51 @@ render z_root = execWriter $ do
+   tell "\n"
+   tell "module Paths_"
+   tell (zManglePkgName z_root (zPackageName z_root))
+-  tell " (\n"
++  tell "\n"
++  tell "  "
++  if (zShouldEmitWarning z_root)
++  then do
++    tell "{-# WARNING "
++    tell (zWarning z_root)
++    tell " #-}"
++    return ()
++  else do
++    return ()
++  tell "\n"
++  tell "  (\n"
+   tell "    version,\n"
+-  tell "    getBinDir, getLibDir, getDynLibDir, getDataDir, getLibexecDir,\n"
+-  tell "    getDataFileName, getSysconfDir\n"
++  tell "    getBinDir,\n"
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitLibDir z_root))
++  then do
++    tell "    getLibDir,\n"
++    return ()
++  else do
++    return ()
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitDynLibDir z_root))
++  then do
++    tell "    getDynLibDir,\n"
++    return ()
++  else do
++    return ()
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitLibexecDir z_root))
++  then do
++    tell "    getLibexecDir,\n"
++    return ()
++  else do
++    return ()
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitDataDir z_root))
++  then do
++    tell "    getDataFileName,\n"
++    tell "    getDataDir,\n"
++    return ()
++  else do
++    return ()
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitSysconfDir z_root))
++  then do
++    tell "    getSysconfDir\n"
++    return ()
++  else do
++    return ()
+   tell "  ) where\n"
+   tell "\n"
+   if (zNot z_root (zAbsolute z_root))
+@@ -126,57 +175,19 @@ render z_root = execWriter $ do
+   tell (zVersionDigits z_root)
+   tell " []\n"
+   tell "\n"
+-  tell "-- |If the argument is a filename, the result is the name of a corresponding\n"
+-  tell "-- file on the system on which the program is running, if the file were listed\n"
+-  tell "-- in the @data-files@ field of the package's Cabal package description file.\n"
+-  tell "-- No check is performed that the given filename is listed in that field.\n"
+-  tell "getDataFileName :: FilePath -> IO FilePath\n"
+-  tell "getDataFileName name = do\n"
+-  tell "  dir <- getDataDir\n"
+-  tell "  return (dir `joinFileName` name)\n"
+-  tell "\n"
+-  tell "-- |The location of the directory specified by Cabal's @--bindir@ option (where\n"
+-  tell "-- executables that the user might invoke are installed). This can be overridden\n"
+-  tell "-- at runtime using the environment variable "
+-  tell (zManglePkgName z_root (zPackageName z_root))
+-  tell "_bindir.\n"
+-  tell "getBinDir :: IO FilePath\n"
+-  tell "\n"
+-  tell "-- |The location of the directory specified by Cabal's @--libdir@ option (where\n"
+-  tell "-- object libraries are installed). This can be overridden at runtime using the\n"
+-  tell "-- environment variable "
+-  tell (zManglePkgName z_root (zPackageName z_root))
+-  tell "_libdir.\n"
+-  tell "getLibDir :: IO FilePath\n"
+-  tell "\n"
+-  tell "-- |The location of the directory specified by Cabal's @--dynlibdir@ option\n"
+-  tell "-- (where dynamic libraries are installed). This can be overridden at runtime\n"
+-  tell "-- using the environment variable "
+-  tell (zManglePkgName z_root (zPackageName z_root))
+-  tell "_dynlibdir.\n"
+-  tell "getDynLibDir :: IO FilePath\n"
+-  tell "\n"
+-  tell "-- |The location of the directory specified by Cabal's @--datadir@ option (where\n"
+-  tell "-- architecture-independent data files are installed). This can be overridden at\n"
+-  tell "-- runtime using the environment variable "
+-  tell (zManglePkgName z_root (zPackageName z_root))
+-  tell "_datadir.\n"
+-  tell "getDataDir :: IO FilePath\n"
+-  tell "\n"
+-  tell "-- |The location of the directory specified by Cabal's @--libexedir@ option\n"
+-  tell "-- (where executables that are not expected to be invoked directly by the user\n"
+-  tell "-- are installed). This can be overridden at runtime using the environment\n"
+-  tell "-- variable "
+-  tell (zManglePkgName z_root (zPackageName z_root))
+-  tell "_libexedir.\n"
+-  tell "getLibexecDir :: IO FilePath\n"
+-  tell "\n"
+-  tell "-- |The location of the directory specified by Cabal's @--sysconfdir@ option\n"
+-  tell "-- (where configuration files are installed). This can be overridden at runtime\n"
+-  tell "-- using the environment variable "
+-  tell (zManglePkgName z_root (zPackageName z_root))
+-  tell "_sysconfdir.\n"
+-  tell "getSysconfDir :: IO FilePath\n"
++  if (zOr z_root (zNot z_root (zAbsolute z_root)) (zShouldEmitDataDir z_root))
++  then do
++    tell "-- |If the argument is a filename, the result is the name of a corresponding\n"
++    tell "-- file on the system on which the program is running, if the file were listed\n"
++    tell "-- in the @data-files@ field of the package's Cabal package description file.\n"
++    tell "-- No check is performed that the given filename is listed in that field.\n"
++    tell "getDataFileName :: FilePath -> IO FilePath\n"
++    tell "getDataFileName name = do\n"
++    tell "  dir <- getDataDir\n"
++    tell "  return (dir `joinFileName` name)\n"
++    return ()
++  else do
++    return ()
+   tell "\n"
+   let
+     z_var0_function_defs = do
+@@ -204,6 +215,7 @@ render z_root = execWriter $ do
+   tell "\n"
+   if (zRelocatable z_root)
+   then do
++    tell "\n"
+     tell "\n"
+     tell "getPrefixDirReloc :: FilePath -> IO FilePath\n"
+     tell "getPrefixDirReloc dirRel = do\n"
+@@ -213,31 +225,68 @@ render z_root = execWriter $ do
+     tell (zBindir z_root)
+     tell ") `joinFileName` dirRel)\n"
+     tell "\n"
++    tell "-- |The location of the directory specified by Cabal's @--bindir@ option (where\n"
++    tell "-- executables that the user might invoke are installed). This can be overridden\n"
++    tell "-- at runtime using the environment variable "
++    tell (zManglePkgName z_root (zPackageName z_root))
++    tell "_bindir.\n"
++    tell "getBinDir     :: IO FilePath\n"
+     tell "getBinDir     = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_bindir\")     (\\_ -> getPrefixDirReloc $ "
+     tell (zBindir z_root)
+     tell ")\n"
++    tell "-- |The location of the directory specified by Cabal's @--libdir@ option (where\n"
++    tell "-- object libraries are installed). This can be overridden at runtime using the\n"
++    tell "-- environment variable "
++    tell (zManglePkgName z_root (zPackageName z_root))
++    tell "_libdir.\n"
++    tell "getLibDir     :: IO FilePath\n"
+     tell "getLibDir     = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_libdir\")     (\\_ -> getPrefixDirReloc $ "
+     tell (zLibdir z_root)
+     tell ")\n"
++    tell "-- |The location of the directory specified by Cabal's @--dynlibdir@ option\n"
++    tell "-- (where dynamic libraries are installed). This can be overridden at runtime\n"
++    tell "-- using the environment variable "
++    tell (zManglePkgName z_root (zPackageName z_root))
++    tell "_dynlibdir.\n"
++    tell "getDynLibDir  :: IO FilePath\n"
+     tell "getDynLibDir  = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_dynlibdir\")  (\\_ -> getPrefixDirReloc $ "
+     tell (zDynlibdir z_root)
+     tell ")\n"
++    tell "-- |The location of the directory specified by Cabal's @--datadir@ option (where\n"
++    tell "-- architecture-independent data files are installed). This can be overridden at\n"
++    tell "-- runtime using the environment variable "
++    tell (zManglePkgName z_root (zPackageName z_root))
++    tell "_datadir.\n"
++    tell "getDataDir    :: IO FilePath\n"
+     tell "getDataDir    = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_datadir\")    (\\_ -> getPrefixDirReloc $ "
+     tell (zDatadir z_root)
+     tell ")\n"
++    tell "-- |The location of the directory specified by Cabal's @--libexedir@ option\n"
++    tell "-- (where executables that are not expected to be invoked directly by the user\n"
++    tell "-- are installed). This can be overridden at runtime using the environment\n"
++    tell "-- variable "
++    tell (zManglePkgName z_root (zPackageName z_root))
++    tell "_libexedir.\n"
++    tell "getLibexecDir :: IO FilePath\n"
+     tell "getLibexecDir = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_libexecdir\") (\\_ -> getPrefixDirReloc $ "
+     tell (zLibexecdir z_root)
+     tell ")\n"
++    tell "-- |The location of the directory specified by Cabal's @--sysconfdir@ option\n"
++    tell "-- (where configuration files are installed). This can be overridden at runtime\n"
++    tell "-- using the environment variable "
++    tell (zManglePkgName z_root (zPackageName z_root))
++    tell "_sysconfdir.\n"
++    tell "getSysconfDir :: IO FilePath\n"
+     tell "getSysconfDir = catchIO (getEnv \""
+     tell (zManglePkgName z_root (zPackageName z_root))
+     tell "_sysconfdir\") (\\_ -> getPrefixDirReloc $ "
+@@ -251,72 +300,186 @@ render z_root = execWriter $ do
+     if (zAbsolute z_root)
+     then do
+       tell "\n"
+-      tell "bindir, libdir, dynlibdir, datadir, libexecdir, sysconfdir :: FilePath\n"
++      tell "bindir     :: FilePath\n"
+       tell "bindir     = "
+       tell (zBindir z_root)
+       tell "\n"
+-      tell "libdir     = "
+-      tell (zLibdir z_root)
+       tell "\n"
+-      tell "dynlibdir  = "
+-      tell (zDynlibdir z_root)
++      tell "-- |The location of the directory specified by Cabal's @--bindir@ option (where\n"
++      tell "-- executables that the user might invoke are installed). This can be overridden\n"
++      tell "-- at runtime using the environment variable "
++      tell (zManglePkgName z_root (zPackageName z_root))
++      tell "_bindir.\n"
++      tell "getBinDir     :: IO FilePath\n"
++      tell "getBinDir     = catchIO (getEnv \""
++      tell (zManglePkgName z_root (zPackageName z_root))
++      tell "_bindir\")     (\\_ -> return bindir)\n"
+       tell "\n"
+-      tell "datadir    = "
+-      tell (zDatadir z_root)
++      if (zShouldEmitLibDir z_root)
++      then do
++        tell "libdir     :: FilePath\n"
++        tell "libdir     = "
++        tell (zLibdir z_root)
++        tell "\n"
++        tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--libdir@ option (where\n"
++        tell "-- object libraries are installed). This can be overridden at runtime using the\n"
++        tell "-- environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_libdir.\n"
++        tell "getLibDir     :: IO FilePath\n"
++        tell "getLibDir     = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_libdir\")     (\\_ -> return libdir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
+-      tell "libexecdir = "
+-      tell (zLibexecdir z_root)
++      if (zShouldEmitDynLibDir z_root)
++      then do
++        tell "dynlibdir  :: FilePath\n"
++        tell "dynlibdir  = "
++        tell (zDynlibdir z_root)
++        tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--dynlibdir@ option\n"
++        tell "-- (where dynamic libraries are installed). This can be overridden at runtime\n"
++        tell "-- using the environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_dynlibdir.\n"
++        tell "getDynLibDir  :: IO FilePath\n"
++        tell "getDynLibDir  = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_dynlibdir\")  (\\_ -> return dynlibdir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
+-      tell "sysconfdir = "
+-      tell (zSysconfdir z_root)
++      if (zShouldEmitDataDir z_root)
++      then do
++        tell "datadir    :: FilePath\n"
++        tell "datadir    = "
++        tell (zDatadir z_root)
++        tell "\n"
++        tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--datadir@ option (where\n"
++        tell "-- architecture-independent data files are installed). This can be overridden at\n"
++        tell "-- runtime using the environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_datadir.\n"
++        tell "getDataDir    :: IO FilePath\n"
++        tell "getDataDir    = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_datadir\")    (\\_ -> return datadir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
++      if (zShouldEmitLibexecDir z_root)
++      then do
++        tell "libexecdir :: FilePath\n"
++        tell "libexecdir = "
++        tell (zLibexecdir z_root)
++        tell "\n"
++        tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--libexedir@ option\n"
++        tell "-- (where executables that are not expected to be invoked directly by the user\n"
++        tell "-- are installed). This can be overridden at runtime using the environment\n"
++        tell "-- variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_libexedir.\n"
++        tell "getLibexecDir :: IO FilePath\n"
++        tell "getLibexecDir = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_libexecdir\") (\\_ -> return libexecdir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
+-      tell "getBinDir     = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_bindir\")     (\\_ -> return bindir)\n"
+-      tell "getLibDir     = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_libdir\")     (\\_ -> return libdir)\n"
+-      tell "getDynLibDir  = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_dynlibdir\")  (\\_ -> return dynlibdir)\n"
+-      tell "getDataDir    = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_datadir\")    (\\_ -> return datadir)\n"
+-      tell "getLibexecDir = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_libexecdir\") (\\_ -> return libexecdir)\n"
+-      tell "getSysconfDir = catchIO (getEnv \""
+-      tell (zManglePkgName z_root (zPackageName z_root))
+-      tell "_sysconfdir\") (\\_ -> return sysconfdir)\n"
++      if (zShouldEmitSysconfDir z_root)
++      then do
++        tell "sysconfdir :: FilePath\n"
++        tell "sysconfdir = "
++        tell (zSysconfdir z_root)
++        tell "\n"
++        tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--sysconfdir@ option\n"
++        tell "-- (where configuration files are installed). This can be overridden at runtime\n"
++        tell "-- using the environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_sysconfdir.\n"
++        tell "getSysconfDir :: IO FilePath\n"
++        tell "getSysconfDir = catchIO (getEnv \""
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_sysconfdir\") (\\_ -> return sysconfdir)\n"
++        return ()
++      else do
++        return ()
+       tell "\n"
+       return ()
+     else do
+       if (zIsWindows z_root)
+       then do
++        tell "\n"
+         tell "\n"
+         tell "prefix :: FilePath\n"
+         tell "prefix = "
+         tell (zPrefix z_root)
+         tell "\n"
+         tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--bindir@ option (where\n"
++        tell "-- executables that the user might invoke are installed). This can be overridden\n"
++        tell "-- at runtime using the environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_bindir.\n"
++        tell "getBinDir     :: IO FilePath\n"
+         tell "getBinDir     = getPrefixDirRel $ "
+         tell (zBindir z_root)
+         tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--libdir@ option (where\n"
++        tell "-- object libraries are installed). This can be overridden at runtime using the\n"
++        tell "-- environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_libdir.\n"
++        tell "getLibDir     :: IO FilePath\n"
+         tell "getLibDir     = "
+         tell (zLibdir z_root)
+         tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--dynlibdir@ option\n"
++        tell "-- (where dynamic libraries are installed). This can be overridden at runtime\n"
++        tell "-- using the environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_dynlibdir.\n"
++        tell "getDynLibDir  :: IO FilePath\n"
+         tell "getDynLibDir  = "
+         tell (zDynlibdir z_root)
+         tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--datadir@ option (where\n"
++        tell "-- architecture-independent data files are installed). This can be overridden at\n"
++        tell "-- runtime using the environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_datadir.\n"
++        tell "getDataDir    :: IO FilePath\n"
+         tell "getDataDir    = catchIO (getEnv \""
+         tell (zManglePkgName z_root (zPackageName z_root))
+         tell "_datadir\")    (\\_ -> "
+         tell (zDatadir z_root)
+         tell ")\n"
++        tell "-- |The location of the directory specified by Cabal's @--libexedir@ option\n"
++        tell "-- (where executables that are not expected to be invoked directly by the user\n"
++        tell "-- are installed). This can be overridden at runtime using the environment\n"
++        tell "-- variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_libexedir.\n"
++        tell "getLibexecDir :: IO FilePath\n"
+         tell "getLibexecDir = "
+         tell (zLibexecdir z_root)
+         tell "\n"
++        tell "-- |The location of the directory specified by Cabal's @--sysconfdir@ option\n"
++        tell "-- (where configuration files are installed). This can be overridden at runtime\n"
++        tell "-- using the environment variable "
++        tell (zManglePkgName z_root (zPackageName z_root))
++        tell "_sysconfdir.\n"
++        tell "getSysconfDir :: IO FilePath\n"
+         tell "getSysconfDir = "
+         tell (zSysconfdir z_root)
+         tell "\n"
+diff --git a/libraries/Cabal/cabal-dev-scripts/src/GenPathsModule.hs b/libraries/Cabal/cabal-dev-scripts/src/GenPathsModule.hs
+index 7c5c947a5..3b7a67498 100644
+--- a/libraries/Cabal/cabal-dev-scripts/src/GenPathsModule.hs
++++ b/libraries/Cabal/cabal-dev-scripts/src/GenPathsModule.hs
+@@ -42,6 +42,16 @@ $(capture "decls" [d|
+         , zLibexecdir :: FilePath
+         , zSysconfdir :: FilePath
+ 
++        , zShouldEmitLibDir     :: Bool
++        , zShouldEmitDynLibDir  :: Bool
++        , zShouldEmitLibexecDir :: Bool
++        , zShouldEmitDataDir    :: Bool
++        , zShouldEmitSysconfDir :: Bool
++
++        , zShouldEmitWarning :: Bool
++        , zWarning           :: String
++
++        , zOr                         :: Bool -> Bool -> Bool
+         , zNot                        :: Bool -> Bool
+         , zManglePkgName              :: PackageName -> String
+         }
+diff --git a/libraries/Cabal/templates/Paths_pkg.template.hs b/libraries/Cabal/templates/Paths_pkg.template.hs
+index a9b02b0ef..d99252a29 100644
+--- a/libraries/Cabal/templates/Paths_pkg.template.hs
++++ b/libraries/Cabal/templates/Paths_pkg.template.hs
+@@ -31,10 +31,31 @@ For further information about Cabal's options for its configuration step, and
+ their default values, see the Cabal User Guide.
+ -}
+ 
+-module Paths_{{ manglePkgName packageName }} (
++module Paths_{{ manglePkgName packageName }}
++  {% if shouldEmitWarning %}{-# WARNING {{ warning }} #-}{% endif %}
++  (
+     version,
+-    getBinDir, getLibDir, getDynLibDir, getDataDir, getLibexecDir,
+-    getDataFileName, getSysconfDir
++    getBinDir,
++{# We only care about the absolute case for our emit logic, since only in this
++   case references are incurred. We are not going to hit isWindows and relocatable
++   has no absolute references to begin with.
++#}
++{% if or (not absolute) shouldEmitLibDir %}
++    getLibDir,
++{% endif %}
++{% if or (not absolute) shouldEmitDynLibDir %}
++    getDynLibDir,
++{% endif %}
++{% if or (not absolute) shouldEmitLibexecDir %}
++    getLibexecDir,
++{% endif %}
++{% if or (not absolute) shouldEmitDataDir %}
++    getDataFileName,
++    getDataDir,
++{% endif %}
++{% if or (not absolute) shouldEmitSysconfDir %}
++    getSysconfDir
++{% endif %}
+   ) where
+ 
+ {% if not absolute %}
+@@ -73,6 +94,7 @@ catchIO = Exception.catch
+ version :: Version
+ version = Version {{ versionDigits }} []
+ 
++{% if or (not absolute) shouldEmitDataDir %}
+ -- |If the argument is a filename, the result is the name of a corresponding
+ -- file on the system on which the program is running, if the file were listed
+ -- in the @data-files@ field of the package's Cabal package description file.
+@@ -81,37 +103,7 @@ getDataFileName :: FilePath -> IO FilePath
+ getDataFileName name = do
+   dir <- getDataDir
+   return (dir `joinFileName` name)
+-
+--- |The location of the directory specified by Cabal's @--bindir@ option (where
+--- executables that the user might invoke are installed). This can be overridden
+--- at runtime using the environment variable {{ manglePkgName packageName }}_bindir.
+-getBinDir :: IO FilePath
+-
+--- |The location of the directory specified by Cabal's @--libdir@ option (where
+--- object libraries are installed). This can be overridden at runtime using the
+--- environment variable {{ manglePkgName packageName }}_libdir.
+-getLibDir :: IO FilePath
+-
+--- |The location of the directory specified by Cabal's @--dynlibdir@ option
+--- (where dynamic libraries are installed). This can be overridden at runtime
+--- using the environment variable {{ manglePkgName packageName }}_dynlibdir.
+-getDynLibDir :: IO FilePath
+-
+--- |The location of the directory specified by Cabal's @--datadir@ option (where
+--- architecture-independent data files are installed). This can be overridden at
+--- runtime using the environment variable {{ manglePkgName packageName }}_datadir.
+-getDataDir :: IO FilePath
+-
+--- |The location of the directory specified by Cabal's @--libexedir@ option
+--- (where executables that are not expected to be invoked directly by the user
+--- are installed). This can be overridden at runtime using the environment
+--- variable {{ manglePkgName packageName }}_libexedir.
+-getLibexecDir :: IO FilePath
+-
+--- |The location of the directory specified by Cabal's @--sysconfdir@ option
+--- (where configuration files are installed). This can be overridden at runtime
+--- using the environment variable {{ manglePkgName packageName }}_sysconfdir.
+-getSysconfDir :: IO FilePath
++{% endif %}
+ 
+ {% defblock function_defs %}
+ minusFileName :: FilePath -> String -> FilePath
+@@ -140,48 +132,155 @@ splitFileName p = (reverse (path2++drive), reverse fname)
+ 
+ {% if relocatable %}
+ 
++{# Relocatable can not incur any absolute references, so we can ignore it.
++   Additionally, --enable-relocatable is virtually useless in Nix builds
++#}
++
+ getPrefixDirReloc :: FilePath -> IO FilePath
+ getPrefixDirReloc dirRel = do
+   exePath <- getExecutablePath
+   let (dir,_) = splitFileName exePath
+   return ((dir `minusFileName` {{ bindir }}) `joinFileName` dirRel)
+ 
++-- |The location of the directory specified by Cabal's @--bindir@ option (where
++-- executables that the user might invoke are installed). This can be overridden
++-- at runtime using the environment variable {{ manglePkgName packageName }}_bindir.
++getBinDir     :: IO FilePath
+ getBinDir     = catchIO (getEnv "{{ manglePkgName packageName }}_bindir")     (\_ -> getPrefixDirReloc $ {{ bindir }})
++-- |The location of the directory specified by Cabal's @--libdir@ option (where
++-- object libraries are installed). This can be overridden at runtime using the
++-- environment variable {{ manglePkgName packageName }}_libdir.
++getLibDir     :: IO FilePath
+ getLibDir     = catchIO (getEnv "{{ manglePkgName packageName }}_libdir")     (\_ -> getPrefixDirReloc $ {{ libdir }})
++-- |The location of the directory specified by Cabal's @--dynlibdir@ option
++-- (where dynamic libraries are installed). This can be overridden at runtime
++-- using the environment variable {{ manglePkgName packageName }}_dynlibdir.
++getDynLibDir  :: IO FilePath
+ getDynLibDir  = catchIO (getEnv "{{ manglePkgName packageName }}_dynlibdir")  (\_ -> getPrefixDirReloc $ {{ dynlibdir }})
++-- |The location of the directory specified by Cabal's @--datadir@ option (where
++-- architecture-independent data files are installed). This can be overridden at
++-- runtime using the environment variable {{ manglePkgName packageName }}_datadir.
++getDataDir    :: IO FilePath
+ getDataDir    = catchIO (getEnv "{{ manglePkgName packageName }}_datadir")    (\_ -> getPrefixDirReloc $ {{ datadir }})
++-- |The location of the directory specified by Cabal's @--libexedir@ option
++-- (where executables that are not expected to be invoked directly by the user
++-- are installed). This can be overridden at runtime using the environment
++-- variable {{ manglePkgName packageName }}_libexedir.
++getLibexecDir :: IO FilePath
+ getLibexecDir = catchIO (getEnv "{{ manglePkgName packageName }}_libexecdir") (\_ -> getPrefixDirReloc $ {{ libexecdir }})
++-- |The location of the directory specified by Cabal's @--sysconfdir@ option
++-- (where configuration files are installed). This can be overridden at runtime
++-- using the environment variable {{ manglePkgName packageName }}_sysconfdir.
++getSysconfDir :: IO FilePath
+ getSysconfDir = catchIO (getEnv "{{ manglePkgName packageName }}_sysconfdir") (\_ -> getPrefixDirReloc $ {{ sysconfdir }})
+ 
+ {% useblock function_defs %}
+ 
+ {% elif absolute %}
+ 
+-bindir, libdir, dynlibdir, datadir, libexecdir, sysconfdir :: FilePath
++bindir     :: FilePath
+ bindir     = {{ bindir }}
+-libdir     = {{ libdir }}
+-dynlibdir  = {{ dynlibdir }}
+-datadir    = {{ datadir }}
+-libexecdir = {{ libexecdir }}
+-sysconfdir = {{ sysconfdir }}
+ 
++-- |The location of the directory specified by Cabal's @--bindir@ option (where
++-- executables that the user might invoke are installed). This can be overridden
++-- at runtime using the environment variable {{ manglePkgName packageName }}_bindir.
++getBinDir     :: IO FilePath
+ getBinDir     = catchIO (getEnv "{{ manglePkgName packageName }}_bindir")     (\_ -> return bindir)
++
++{% if shouldEmitLibDir %}
++libdir     :: FilePath
++libdir     = {{ libdir }}
++
++-- |The location of the directory specified by Cabal's @--libdir@ option (where
++-- object libraries are installed). This can be overridden at runtime using the
++-- environment variable {{ manglePkgName packageName }}_libdir.
++getLibDir     :: IO FilePath
+ getLibDir     = catchIO (getEnv "{{ manglePkgName packageName }}_libdir")     (\_ -> return libdir)
++{% endif %}
++
++{% if shouldEmitDynLibDir %}
++dynlibdir  :: FilePath
++dynlibdir  = {{ dynlibdir }}
++-- |The location of the directory specified by Cabal's @--dynlibdir@ option
++-- (where dynamic libraries are installed). This can be overridden at runtime
++-- using the environment variable {{ manglePkgName packageName }}_dynlibdir.
++getDynLibDir  :: IO FilePath
+ getDynLibDir  = catchIO (getEnv "{{ manglePkgName packageName }}_dynlibdir")  (\_ -> return dynlibdir)
++{% endif %}
++
++{% if shouldEmitDataDir %}
++datadir    :: FilePath
++datadir    = {{ datadir }}
++
++-- |The location of the directory specified by Cabal's @--datadir@ option (where
++-- architecture-independent data files are installed). This can be overridden at
++-- runtime using the environment variable {{ manglePkgName packageName }}_datadir.
++getDataDir    :: IO FilePath
+ getDataDir    = catchIO (getEnv "{{ manglePkgName packageName }}_datadir")    (\_ -> return datadir)
++{% endif %}
++
++{% if shouldEmitLibexecDir %}
++libexecdir :: FilePath
++libexecdir = {{ libexecdir }}
++
++-- |The location of the directory specified by Cabal's @--libexedir@ option
++-- (where executables that are not expected to be invoked directly by the user
++-- are installed). This can be overridden at runtime using the environment
++-- variable {{ manglePkgName packageName }}_libexedir.
++getLibexecDir :: IO FilePath
+ getLibexecDir = catchIO (getEnv "{{ manglePkgName packageName }}_libexecdir") (\_ -> return libexecdir)
++{% endif %}
++
++{% if shouldEmitSysconfDir %}
++sysconfdir :: FilePath
++sysconfdir = {{ sysconfdir }}
++
++-- |The location of the directory specified by Cabal's @--sysconfdir@ option
++-- (where configuration files are installed). This can be overridden at runtime
++-- using the environment variable {{ manglePkgName packageName }}_sysconfdir.
++getSysconfDir :: IO FilePath
+ getSysconfDir = catchIO (getEnv "{{ manglePkgName packageName }}_sysconfdir") (\_ -> return sysconfdir)
++{% endif %}
+ 
+ {% elif isWindows %}
+ 
++{# We are only trying to fix the problem for aarch64-darwin with this patch,
++   so let's ignore Windows which we can reach via pkgsCross, for example.
++#}
++
+ prefix :: FilePath
+ prefix = {{ prefix }}
+ 
++-- |The location of the directory specified by Cabal's @--bindir@ option (where
++-- executables that the user might invoke are installed). This can be overridden
++-- at runtime using the environment variable {{ manglePkgName packageName }}_bindir.
++getBinDir     :: IO FilePath
+ getBinDir     = getPrefixDirRel $ {{ bindir }}
++-- |The location of the directory specified by Cabal's @--libdir@ option (where
++-- object libraries are installed). This can be overridden at runtime using the
++-- environment variable {{ manglePkgName packageName }}_libdir.
++getLibDir     :: IO FilePath
+ getLibDir     = {{ libdir }}
++-- |The location of the directory specified by Cabal's @--dynlibdir@ option
++-- (where dynamic libraries are installed). This can be overridden at runtime
++-- using the environment variable {{ manglePkgName packageName }}_dynlibdir.
++getDynLibDir  :: IO FilePath
+ getDynLibDir  = {{ dynlibdir }}
++-- |The location of the directory specified by Cabal's @--datadir@ option (where
++-- architecture-independent data files are installed). This can be overridden at
++-- runtime using the environment variable {{ manglePkgName packageName }}_datadir.
++getDataDir    :: IO FilePath
+ getDataDir    = catchIO (getEnv "{{ manglePkgName packageName }}_datadir")    (\_ -> {{ datadir }})
++-- |The location of the directory specified by Cabal's @--libexedir@ option
++-- (where executables that are not expected to be invoked directly by the user
++-- are installed). This can be overridden at runtime using the environment
++-- variable {{ manglePkgName packageName }}_libexedir.
++getLibexecDir :: IO FilePath
+ getLibexecDir = {{ libexecdir }}
++-- |The location of the directory specified by Cabal's @--sysconfdir@ option
++-- (where configuration files are installed). This can be overridden at runtime
++-- using the environment variable {{ manglePkgName packageName }}_sysconfdir.
++getSysconfDir :: IO FilePath
+ getSysconfDir = {{ sysconfdir }}
+ 
+ getPrefixDirRel :: FilePath -> IO FilePath

pkgs/development/compilers/ghc/common-hadrian.nix

@@ -205,8 +205,10 @@
         (
           if lib.versionOlder version "9.10" then
             ./Cabal-at-least-3.6-paths-fix-cycle-aarch64-darwin.patch
-          else
+          else if lib.versionOlder version "9.14" then
             ./Cabal-3.12-paths-fix-cycle-aarch64-darwin.patch
+          else
+            ./Cabal-3.16-paths-fix-cycle-aarch64-darwin.patch
         )
       ]
       ++ lib.optionals stdenv.targetPlatform.isWindows [

pkgs/development/haskell-modules/configuration-common.nix

@@ -322,6 +322,15 @@ with haskellLib;
   # 2025-02-10: Too strict bounds on tasty < 1.5
   tasty-hunit-compat = doJailbreak super.tasty-hunit-compat;
 
+  # Makes cross-compilation hang
+  # https://github.com/composewell/streamly/issues/2840
+  streamly-core = overrideCabal (drv: {
+    postPatch = ''
+      substituteInPlace src/Streamly/Internal/Data/Array/Stream.hs \
+        --replace-fail '{-# INLINE splitAtArrayListRev #-}' ""
+    '';
+  }) super.streamly-core;
+
   # Expected failures are fixed as of GHC-9.10,
   # but the tests haven't been updated yet.
   # https://github.com/ocharles/weeder/issues/198

pkgs/development/libraries/itk/5.x.nix

@@ -1,5 +1,5 @@
 import ./generic.nix rec {
-  version = "5.4.4";
+  version = "5.4.5";
   tag = "v${version}";
-  sourceSha256 = "sha256-vHcMlWr/Dy5CnX165ihpCKNTVvw1eWncxzPho+73wB0=";
+  sourceSha256 = "sha256-THGtG3gc4LnUEn8tU735dCyIKoaIxPYPzeXCvKKGRRk=";
 }

pkgs/development/python-modules/google-cloud-audit-log/default.nix

@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-audit-log";
-  version = "0.3.3";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_audit_log";
     inherit version;
-    hash = "sha256-zKeB4fG1SY3xgyoLaDqZ6GwAsxAVu77vMAI4H3qWpj8=";
+    hash = "sha256-hGfU3MqfPmFgUgwk1xWS5J6HSDjxdHYicuwQ55ULb+s=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/llm-gemini/default.nix

@@ -15,14 +15,14 @@
 }:
 buildPythonPackage rec {
   pname = "llm-gemini";
-  version = "0.28.1";
+  version = "0.28.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "llm-gemini";
     tag = version;
-    hash = "sha256-0knOCT0UniaGugRH/f3hIIdq56TTusYuPyT1KBgYszQ=";
+    hash = "sha256-lPap9EWVue7VdqDQ5io5Al53gzfChuylJChDUIMBDow=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/netbox-contract/default.nix

@@ -11,7 +11,7 @@
 }:
 buildPythonPackage rec {
   pname = "netbox-contract";
-  version = "2.4.2";
+  version = "2.4.3";
   pyproject = true;
 
   disabled = python.pythonVersion != netbox.python.pythonVersion;
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "mlebreuil";
     repo = "netbox-contract";
     tag = "v${version}";
-    hash = "sha256-hJz6+vJWhwZJId5Otf1LaFkyaLncuuvai83aCu/aKu0=";
+    hash = "sha256-6xJ/c2VsAL2WlV/djbYeZIZ1FHWCtHy+UC3U4cMSIZA=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/oslo-log/default.nix

@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "oslo-log";
-  version = "7.2.1";
+  version = "8.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "oslo.log";
     tag = version;
-    hash = "sha256-DEKRkVaGJeHx/2k3pC/OxtJ0lzFj1IXtRFz1uJJPgR8=";
+    hash = "sha256-XCQc0ByjnXU4/ArgJ6sGgm/EO2DevDdBgma85pjhdSc=";
   };
 
   # Manually set version because prb wants to get it from the git upstream repository (and we are

pkgs/development/python-modules/streamlit/default.nix

@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "streamlit";
-  version = "1.51.0";
+  version = "1.52.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HnQqnAtpj0Zsb1v1jTM77aWh++jeZgdDl2eRtcFEbvY=";
+    hash = "sha256-ZKTdqLxc3Te/1JDpO7U9o1qu+Ub8/Cg6eYDazfFlEIs=";
   };
 
   build-system = [

pkgs/development/python-modules/urlman/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "urlman";
-  version = "2.0.1";
+  version = "2.0.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "andrewgodwin";
     repo = "urlman";
     rev = version;
-    hash = "sha256-p6lRuMHM2xJrlY5LDa0XLCGQPDE39UwCouK6e0U9zJE=";
+    hash = "sha256-uhIFH8/zRTIGV4ABO+0frp0z8voWl5Ji6rSVRzcx4Og=";
   };
 
   pythonImportsCheck = [ "urlman" ];

pkgs/development/web/nodejs/nodejs.nix

@@ -556,7 +556,12 @@ let
         changelog = "https://github.com/nodejs/node/releases/tag/v${version}";
         license = lib.licenses.mit;
         maintainers = with lib.maintainers; [ aduh95 ];
-        platforms = lib.platforms.linux ++ lib.platforms.darwin ++ lib.platforms.freebsd;
+        # https://github.com/nodejs/node/blob/732ab9d658e057af5191d4ecd156d38487509462/BUILDING.md#platform-list
+        platforms =
+          (lib.lists.intersectLists (
+            lib.platforms.linux ++ lib.platforms.darwin ++ lib.platforms.freebsd
+          ) lib.platforms.littleEndian)
+          ++ [ "s390x-linux" ];
         # This broken condition is likely too conservative. Feel free to loosen it if it works.
         broken =
           !canExecute && !canEmulate && (stdenv.buildPlatform.parsed.cpu != stdenv.hostPlatform.parsed.cpu);

pkgs/os-specific/linux/kernel/hardened/patches.json

@@ -2,11 +2,11 @@
     "6.12": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.12.56-hardened1.patch",
-            "sha256": "1s6z7ypkrvd0da5k8wjyidbsi33mgsrj7813nsblrfcs50f65wi4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.56-hardened1/linux-hardened-v6.12.56-hardened1.patch"
+            "name": "linux-hardened-v6.12.61-hardened1.patch",
+            "sha256": "19imsxjwrfkw0rnjwn35inmqpaxm4bj8nrvqlxf8nxs9llb2784f",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.61-hardened1/linux-hardened-v6.12.61-hardened1.patch"
         },
-        "sha256": "15pclwn3nbwccdfwcqd3lkmdxwpjkmadhj63acqbzxsjycm2nhsm",
-        "version": "6.12.56"
+        "sha256": "0d8pbx0j5g2ag4im5k3dcqiwp5jxjja29p195zqpd1jj0m8p8s8s",
+        "version": "6.12.61"
     }
 }

pkgs/servers/sql/postgresql/ext/pg_background.nix

@@ -0,0 +1,30 @@
+{
+  fetchFromGitHub,
+  lib,
+  postgresql,
+  postgresqlBuildExtension,
+  openssl,
+}:
+
+postgresqlBuildExtension (finalAttrs: {
+  pname = "pg_background";
+  version = "1.5";
+
+  src = fetchFromGitHub {
+    owner = "vibhorkum";
+    repo = "pg_background";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9fW5wHdo9r5fLwU8zN2EEVSWxa+7q2qMjPpMo6iCavg=";
+  };
+
+  buildInputs = postgresql.buildInputs;
+
+  meta = {
+    description = "Run PostgreSQL Commands in Background Workers";
+    homepage = "https://github.com/vibhorkum/pg_background";
+    changelog = "https://github.com/vibhorkum/pg_background/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ mkleczek ];
+    platforms = postgresql.meta.platforms;
+    license = lib.licenses.gpl3Only;
+  };
+})

pkgs/tools/security/aflplusplus/default.nix

@@ -37,13 +37,13 @@ let
   libtokencap = callPackage ./libtokencap.nix { inherit aflplusplus; };
   aflplusplus = stdenvNoCC.mkDerivation rec {
     pname = "aflplusplus";
-    version = "4.34c";
+    version = "4.35c";
 
     src = fetchFromGitHub {
       owner = "AFLplusplus";
       repo = "AFLplusplus";
       tag = "v${version}";
-      hash = "sha256-ymHt746cuZ+jyWs0vB3R1qNgpgAu6pUVXp9/g9Km9JI=";
+      hash = "sha256-j5YH39JKcjYuDqyl+KRMtgn3UoeWEW1z7m4ysf2uilc=";
     };
 
     enableParallelBuilding = true;

pkgs/top-level/aliases.nix

@@ -1754,6 +1754,7 @@ mapAliases {
   yaml-cpp_0_3 = throw "yaml-cpp_0_3 has been removed, as it was unused"; # Added 2025-09-16
   yamlpath = throw "'yamlpath' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01
   yeahwm = throw "'yeahwm' has been removed, as it was broken and unmaintained upstream."; # Added 2025-06-12
+  youtube-music = lib.warnOnInstantiate "'youtube-music' has been renamed to 'pear-desktop'" pear-desktop; # Added 2025-12-23
   yubikey-manager-qt = throw "'yubikey-manager-qt' has been removed due to being archived upstream. Consider using 'yubioath-flutter' instead."; # Added 2025-06-07
   yubikey-personalization-gui = throw "'yubikey-personalization-gui' has been removed due to being archived upstream. Consider using 'yubioath-flutter' instead."; # Added 2025-06-07
   zandronum-alpha = throw "'zandronum-alpha' has been removed as it was broken and the stable version has caught up"; # Added 2025-10-19

pkgs/top-level/all-packages.nix

@@ -1456,10 +1456,6 @@ with pkgs;
 
   angie-console-light = callPackage ../servers/http/angie/console-light.nix { };
 
-  apk-tools = callPackage ../tools/package-management/apk-tools {
-    lua = lua5_3;
-  };
-
   appimage-run = callPackage ../tools/package-management/appimage-run { };
   appimage-run-tests = callPackage ../tools/package-management/appimage-run/test.nix {
     appimage-run = appimage-run.override {
@@ -1865,9 +1861,12 @@ with pkgs;
 
   dune_2 = callPackage ../by-name/du/dune/package.nix {
     version = "2.9.3";
+    inherit ocamlPackages;
   };
 
-  dune_3 = callPackage ../by-name/du/dune/package.nix { };
+  dune_3 = callPackage ../by-name/du/dune/package.nix {
+    inherit ocamlPackages;
+  };
 
   dvc = with python3.pkgs; toPythonApplication dvc;
 
@@ -2069,6 +2068,8 @@ with pkgs;
 
   online-judge-tools = with python3.pkgs; toPythonApplication online-judge-tools;
 
+  opaline = callPackage ../by-name/op/opaline/package.nix { inherit ocamlPackages; };
+
   inherit (ocamlPackages) patdiff;
 
   patool = with python3Packages; toPythonApplication patool;
@@ -12478,8 +12479,6 @@ with pkgs;
 
   youtube-dl-light = with python3Packages; toPythonApplication youtube-dl-light;
 
-  youtube-music = callPackage ../applications/audio/youtube-music { };
-
   yt-dlp-light = yt-dlp.override {
     atomicparsleySupport = false;
     ffmpegSupport = false;

pkgs/top-level/qt6-packages.nix

@@ -138,6 +138,7 @@ makeScopeWithSplicing' {
         callPackage ../development/libraries/sailfish-access-control-plugin
           { };
 
+      sddm-unwrapped = kdePackages.callPackage ../applications/display-managers/sddm/unwrapped.nix { };
       sddm = kdePackages.callPackage ../applications/display-managers/sddm { };
 
       sierra-breeze-enhanced =