python3Packages.calmjs-types: broken with setuptools 82

https://github.com/SparseDifferentiation/SparseDiffPy/blob/v0.6.1/RELEASES.md

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -0,0 +1,24 @@
+# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
+
+This hook defaults a variety of environment variables known
+to control thread counts to 1. Many of these otherwise default
+to `$(nproc)`, which causes massive overloads on build machines
+if nix build jobs and build cores are already tuned to fully utilize
+compute capacity of a builder without additional parallelism.
+
+Currently sets the following environment variables:
+- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
+- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
+- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
+- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
+- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
+- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
+- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
+
+The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
+can be used to override the default thread count limit.
+`dontLimitCheckPhaseThreads = true;` can be used to disable
+thread limiting on an individual package.
+
+This hook will not attempt to override already existing
+definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,6 +13,7 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
+check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -34,7 +35,6 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
-openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -1,10 +0,0 @@
-# openmpCheckPhaseHook {#setup-hook-omp-check}
-
-
-This hook can be used to setup a check phase that
-requires running a OpenMP application. It mostly
-serves to limit `OMP_NUM_THREADS` to avoid overloading
-build machines.
-
-This hook will not attempt to override an already existing
-definition of `OMP_NUM_THREADS` in the environment.

doc/redirects.json

@@ -2920,7 +2920,8 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-omp-check": [
+  "setup-hook-check-phase-thread-limit": [
+    "index.html#setup-hook-check-phase-thread-limit",
     "index.html#setup-hook-omp-check"
   ],
   "ninja": [

doc/release-notes/rl-2611.section.md

@@ -31,6 +31,9 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
+- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
+  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
+
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.

nixos/modules/misc/version.nix

@@ -54,7 +54,8 @@ let
       BUG_REPORT_URL = optionalString isNixos "https://github.com/NixOS/nixpkgs/issues";
       ANSI_COLOR = optionalString isNixos "0;38;2;126;186;228";
       IMAGE_ID = optionalString (config.system.image.id != null) config.system.image.id;
-      IMAGE_VERSION = optionalString (config.system.image.version != null) config.system.image.version;
+      ${if config.system.image.version != null then "IMAGE_VERSION" else null} =
+        config.system.image.version;
       VARIANT = optionalString (cfg.variantName != null) cfg.variantName;
       VARIANT_ID = optionalString (cfg.variant_id != null) cfg.variant_id;
       DEFAULT_HOSTNAME = config.system.nixos.distroId;

nixos/modules/virtualisation/nspawn-container/default.nix

@@ -81,34 +81,6 @@ in
           which is prohibited within the Nix build sandbox where the test is run.
         '';
       }
-      {
-        # Check every interface defined in allInterfaces.
-        # Containers try to create a bridge "${config.system.name}-${interfaceName}"
-        assertion = lib.all (
-          iface:
-          let
-            hostName = "${config.system.name}-${iface.name}";
-          in
-          lib.stringLength hostName <= 15
-        ) (lib.attrValues cfg.allInterfaces);
-
-        message =
-          let
-            offendingInterfaces = lib.filter (
-              iface: lib.stringLength "${config.system.name}-${iface.name}" > 15
-            ) (lib.attrValues cfg.allInterfaces);
-            offenderList = map (
-              i:
-              "${config.system.name}-${i.name} (${toString (lib.stringLength "${config.system.name}-${i.name}")} chars)"
-            ) offendingInterfaces;
-          in
-          ''
-            The following generated host interface names exceed the Linux 15-character limit:
-              ${lib.concatStringsSep "\n            " offenderList}
-
-            Please shorten 'config.system.name' or the interface names in 'virtualisation.interfaces'.
-          '';
-      }
     ];
 
     virtualisation.systemd-nspawn.options = [

nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py

@@ -1,6 +1,7 @@
 import contextlib
 import dataclasses
 import fcntl
+import hashlib
 import logging
 import os
 import signal
@@ -124,6 +125,13 @@ def mk_veth(
     vlan: int,
 ) -> typing.Generator[None, None, None]:
     host_intf_name = f"{container_name}-{container_intf_name}"
+    # If the names for systemd-nspawn containers are too long,
+    # the generated bridge interface names will surpass the
+    # kernel limit IFNAMSIZ (15 characters + '\0').
+    if len(host_intf_name) > 15:
+        hashed = hashlib.sha256(host_intf_name.encode()).hexdigest()[:6]
+        host_intf_name = f"{host_intf_name[:8]}-{hashed}"
+
     with ensure_vlan_bridge(vlan) as bridge_name:
         logger.info("creating interface %s", host_intf_name)
         run_ip(

nixos/tests/grafana/basic.nix

@@ -84,7 +84,7 @@ import ../make-test-python.nix (
       };
     };
 
-    nodes = builtins.mapAttrs (
+    containers = builtins.mapAttrs (
       _: val:
       mkMerge [
         val
@@ -97,7 +97,7 @@ import ../make-test-python.nix (
 
     meta.maintainers = [ ];
 
-    inherit nodes;
+    inherit containers;
 
     testScript = ''
       start_all()

nixos/tests/grafana/provision/default.nix

@@ -183,7 +183,7 @@ import ../../make-test-python.nix (
         };
     };
 
-    nodes = builtins.mapAttrs (
+    containers = builtins.mapAttrs (
       _: val:
       mkMerge [
         val
@@ -196,7 +196,7 @@ import ../../make-test-python.nix (
 
     meta.maintainers = [ ];
 
-    inherit nodes;
+    inherit containers;
 
     testScript = ''
       start_all()

pkgs/applications/audio/mpg123/default.nix

@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.5";
+  version = "1.33.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-DX68jaCv88o4PIxrWmrb5ALuW7JWaFuMVJnzpzn51t0=";
+    hash = "sha256-kpp8GLpmK4knrtTeIprZroqytIBt0PMLkBE+sbTiGVo=";
   };
 
   outputs = [

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0541";
+  version = "9.2.0782";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
+    hash = "sha256-D4IyDgl1JdmumDzO0uMg2LhoSnFUeqhcMJ6ImC17wzs=";
   };
 
   enableParallelBuilding = true;

pkgs/build-support/build-typst-package.nix

@@ -40,6 +40,9 @@ lib.extendMkDerivation {
     {
       name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       dontBuild = true;
 
       installPhase =

pkgs/build-support/go/module.nix

@@ -320,10 +320,15 @@ lib.extendMkDerivation {
               }
 
               getGoDirs() {
-                local type;
-                type="$1"
-                if [ -n "$subPackages" ]; then
-                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+                local -r type="$1"
+
+                # Support strucuredAttrs, they are not space seperated
+                local -a subPackagesArray
+                concatTo subPackagesArray subPackages
+
+                # Outputs each element prefixed with './' if the array is not empty
+                if [[ ''${#subPackagesArray[@]} -gt 0 ]]; then
+                  echo "''${subPackagesArray[*]/#/./}"
                 else
                   find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
                 fi

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -3,6 +3,8 @@
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
+    [[ -e "$file" ]] || \
+        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }

pkgs/by-name/al/alsa-lib/package.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.16";
+  version = "1.2.16.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
+    hash = "sha256-90Dbf0iCVZRP/UQoQW7jOQqWdChWkWQz30aMKBQ2SA4=";
   };
 
   patches = [
@@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-lib/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture libraries";
     mainProgram = "aserver";
 

pkgs/by-name/al/alsa-ucm-conf/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.16";
+  version = "1.2.16.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
+    hash = "sha256-zz0cB+CJqDxOziwg8F3WqKq3/NEIdow4gROGiAV1SSs=";
   };
 
   patches = [
@@ -47,6 +47,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-ucm-conf/releases/tag/v${finalAttrs.version}";
     description = "ALSA Use Case Manager configuration";
 
     longDescription = ''

pkgs/by-name/al/alsa-utils/package.nix

@@ -85,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-utils/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture utils";
     longDescription = ''
       The Advanced Linux Sound Architecture (ALSA) provides audio and

pkgs/by-name/ap/apparmor-parser/package.nix

@@ -30,15 +30,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
   '';
 
-  patches = [
-    (fetchpatch {
-      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
-      # Patches generated yacc parser code to compile with format-security
-      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
-      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
-    })
-  ];
-
   nativeBuildInputs = [
     bison
     flex

pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 
 import argparse
+import errno
 import os
 import pprint
 import subprocess
@@ -195,6 +196,12 @@ def populate_cache(initial: list[Path], recursive: bool =False) -> None:
             except ELFError:
                 # Not an ELF file in the right format
                 pass
+            except OSError as e:
+                if e.errno == errno.EINVAL:
+                    # pyelftools can raise EINVAL for certain compressed sections.
+                    pass
+                else:
+                    raise
 
 
 def find_dependency(soname: str, soarch: str, soabi: str) -> Optional[Path]:
@@ -343,6 +350,10 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
 
     except ELFError:
         return []
+    except OSError as e:
+        if e.errno == errno.EINVAL:
+            return []
+        raise
 
     # these platforms are packaged in nixpkgs with ld.so in a separate derivation
     # than libc.so and friends. keep_libc is mandatory.

pkgs/by-name/ba/bash-completion/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bash-completion";
-  version = "2.17.0";
+  version = "2.18.0";
 
   # Using fetchurl because fetchGithub or fetchzip will have trouble on
   # e.g. APFS filesystems (macOS) because of non UTF-8 characters in some of the
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   # See discussion in https://github.com/NixOS/nixpkgs/issues/107768
   src = fetchurl {
     url = "https://github.com/scop/bash-completion/releases/download/${finalAttrs.version}/bash-completion-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3Z2CXklkNfs766Oue+qfd+gh6JRmfQdDHR1MjFcLnlg=";
+    hash = "sha256-iLz4UST3f3Ty8vi80WrEOC2AeoJ+3nQqZJQMcRauoz8=";
   };
 
   postPatch = ''

pkgs/by-name/bl/blas/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   lapack-reference,
   openblas,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
   isILP64 ? false,
   blasProvider ? openblas,
 }:
@@ -188,7 +188,7 @@ stdenv.mkDerivation {
   ];
 
   propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
   ];
 
   meta = (blasProvider'.meta or { }) // {

pkgs/by-name/bl/blis/package.nix

@@ -5,6 +5,12 @@
   perl,
   python3,
 
+  # sets BLIS_NUM_THREADS and OMP_NUM_THREADS for packages
+  # invoking blis during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading
+  checkPhaseThreadLimitHook,
+
   # Enable BLAS interface with 64-bit integer width.
   blas64 ? false,
 
@@ -36,6 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
+  propagatedNativeBuildInputs = [
+    checkPhaseThreadLimitHook
+  ];
+
   doCheck = true;
 
   enableParallelBuilding = true;

pkgs/by-name/bo/borgbackup/package.nix

@@ -4,6 +4,7 @@
   acl,
   e2fsprogs,
   fetchFromGitHub,
+  fetchpatch,
   libb2,
   lz4,
   openssh,
@@ -32,6 +33,26 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     hash = "sha256-pMZr9cVr84b948b5Iuevpy6AtMeYo/Ma8uFLuagAYy4=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "msgspec-1.2.0-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/364438f58c86aebd157b55bd2202afaf5945e008.patch";
+      excludes = [ "docs/changes.rst" ];
+      hash = "sha256-YhZDD6i2cn7p00Dgmpqi8uGJzFZzixMZmHPcZroB1sE=";
+    })
+    (fetchpatch {
+      name = "msgspec-1.2.1-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/8abdd3b8bf065dceecd52d2b22d92b3c407a7c1d.patch";
+      excludes = [ "docs/changes.rst" ];
+      hash = "sha256-bvSRxEzNvejG6PQFkeNDuQB7Zd4/EYPEZkrgjpgQ9Ss=";
+    })
+    (fetchpatch {
+      name = "msgspec-1.2.1-unpacker-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/b09bbed3de095d6ac9d69a42a486ec18523046dc.patch";
+      hash = "sha256-F8CIqOcQOLdYn7srsev2op0pgkgt8zdkc5DQUH1c6xg=";
+    })
+  ];
+
   postPatch = ''
     # sandbox does not support setuid/setgid/sticky bits
     substituteInPlace src/borg/testsuite/archiver.py \
@@ -103,7 +124,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     py
     pytest-benchmark
     pytest-xdist
-    pytestCheckHook
+    pytest9_0CheckHook
     versionCheckHook
   ];
 

pkgs/by-name/c-/c-ares/package.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "c-ares";
-  version = "1.34.6";
+  version = "1.34.8";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     # Note: tag name varies in some versions, e.g. v1.30.0, c-ares-1_17_0.
     url = "https://github.com/c-ares/c-ares/releases/download/v${version}/c-ares-${version}.tar.gz";
-    hash = "sha256-kS3XzDs+innFL9f7nA9Ozwqqc+Re/aiAJmotbia4TvU=";
+    hash = "sha256-wiK21oEJb5RE0sSGPSwRdAGeJ8rMoKSlwRTTbdfXv3g=";
   };
 
   outputs = [

pkgs/by-name/ca/cargo-auditable/builder.nix

@@ -42,20 +42,9 @@ lib.extendMkDerivation {
         # https://github.com/rust-secure-code/cargo-auditable/issues/235
         "--skip=test_proc_macro"
         "--skip=test_self_hosting"
-      ]
-      # TODO: Clean up on `staging`.
-      ++
-        lib.optionals
-          (
-            stdenv.hostPlatform.isMusl
-            || stdenv.hostPlatform.isAarch32
-            || stdenv.hostPlatform.isDarwin
-            || stdenv.hostPlatform.isMsvc
-          )
-          [
-            # Expects `linker = "rust-lld"` to work.
-            "--skip=test_bare_linker"
-          ];
+        # Expects `linker = "rust-lld"` to work.
+        "--skip=test_bare_linker"
+      ];
 
       postInstall = ''
         installManPage cargo-auditable/cargo-auditable.1

pkgs/by-name/ch/checkPhaseThreadLimitHook/hook.sh

@@ -0,0 +1,32 @@
+setupThreadLimit() {
+  # Limit number of threads used during checks. Default is "all cores".
+  # Using all cores causes high load on builders if checks are executed with NIX_BUILD_CORE parallelism.
+  # This gets even worse if multiple builds are scheduled on the same machine, potentially growing O(n^3) without explicit core limits.
+
+  # global value to override all of these at once
+  NIX_CHECK_PHASE_DEFAULT_NUM_THREADS="${NIX_CHECK_PHASE_DEFAULT_NUM_THREADS:-1}"
+
+  thread_vars=(
+    OMP_NUM_THREADS
+    OPENBLAS_NUM_THREADS
+    MKL_NUM_THREADS
+    BLIS_NUM_THREADS
+    VECLIB_MAXIMUM_THREADS
+    NUMBA_NUM_THREADS
+    NUMEXPR_NUM_THREADS
+  )
+
+  echo "setting known thread variables to default: $NIX_CHECK_PHASE_DEFAULT_NUM_THREADS"
+  for var in "${thread_vars[@]}"; do
+    export "$var=${!var:-$NIX_CHECK_PHASE_DEFAULT_NUM_THREADS}"
+    printf " %s=%s" "$var" "${!var}"
+  done
+  printf "\n"
+}
+
+
+if [[ -z "${dontLimitCheckPhaseThreads-}" ]]; then
+    echo "Using checkPhaseThreadLimitHook"
+    preCheckHooks+=('setupThreadLimit')
+    preInstallCheckHooks+=('setupThreadLimit')
+fi

pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "check-phase-thread-limit-hook";
+
+  __structuredAttrs = true;
+
+  meta = {
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+} ./hook.sh

pkgs/by-name/cm/cmake/darwin-binary-paths.patch

@@ -46,16 +46,3 @@ index 15a1e2c0c3..33bb304cf7 100644
          OUTPUT_VARIABLE OSX_VERSION
          OUTPUT_STRIP_TRAILING_WHITESPACE
          )
-diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index ddc975c202..8ff651fd90 100644
---- a/Utilities/cmcurl/CMakeLists.txt
-+++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -127,7 +127,7 @@
-     set(OSX_VERSION ${CMAKE_OSX_DEPLOYMENT_TARGET})
-   else()
-     execute_process(
--      COMMAND sw_vers -productVersion
-+      COMMAND @sw_vers@ -productVersion
-       OUTPUT_VARIABLE OSX_VERSION
-       OUTPUT_STRIP_TRAILING_WHITESPACE
-       )

pkgs/by-name/cm/cmake/darwin-bsd-binary-paths.patch

@@ -39,13 +39,13 @@ index 260b6631c0..ffb8fcd8d2 100644
      if(ProcessorCount_cmd_sysctl)
        execute_process(COMMAND ${ProcessorCount_cmd_sysctl} -n hw.ncpu
 diff --git a/Source/kwsys/ProcessUNIX.c b/Source/kwsys/ProcessUNIX.c
-index a918b8d9a7..36145707e1 100644
+index 8c22b4e43a..6d9ccef5e7 100644
 --- a/Source/kwsys/ProcessUNIX.c
 +++ b/Source/kwsys/ProcessUNIX.c
-@@ -2503,7 +2503,7 @@
-    have two integers to store: the pid and then the ppid.  */
+@@ -2503,7 +2503,7 @@ static pid_t kwsysProcessFork(kwsysProcess* cp,
  #if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__) ||       \
-   defined(__OpenBSD__) || defined(__GLIBC__) || defined(__GNU__)
+   defined(__NetBSD__) || defined(__OpenBSD__) || defined(__GLIBC__) ||        \
+   defined(__GNU__)
 -#  define KWSYSPE_PS_COMMAND "ps axo pid,ppid"
 +#  define KWSYSPE_PS_COMMAND "@ps@ axo pid,ppid"
  #  define KWSYSPE_PS_FORMAT "%d %d\n"

pkgs/by-name/cm/cmake/package.nix

@@ -50,11 +50,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "4.1.2";
+  version = "4.3.4";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ZD8EGCt7oyOrMfUm94UTT7ecujGIqFIgbvBHP+4oKhU=";
+    hash = "sha256-/e/4l7nrSddkU58rHtxut+FEDfMlZ4qXwZeEmekxrdo=";
   };
 
   patches = [

pkgs/by-name/cm/cmake/remove-impure-search-paths.patch

@@ -157,10 +157,10 @@ index 2a2f478fd7..f22281bdca 100644
  list(REMOVE_DUPLICATES _CPACK_IFW_PATHS)
  
 diff --git a/Modules/FindBLAS.cmake b/Modules/FindBLAS.cmake
-index b45a279b94..884ccc0e32 100644
+index 9f986a78e7..5a6a9758ea 100644
 --- a/Modules/FindBLAS.cmake
 +++ b/Modules/FindBLAS.cmake
-@@ -1098,16 +1098,8 @@
+@@ -1112,16 +1112,10 @@ if(BLA_VENDOR MATCHES "ACML" OR BLA_VENDOR STREQUAL "All")
      ((BLA_VENDOR STREQUAL "ACML_GPU") AND (NOT BLAS_ACML_GPU_LIB_DIRS))
      )
    # try to find acml in "standard" paths
@@ -176,9 +176,11 @@ index b45a279b94..884ccc0e32 100644
 -  endif()
 +  set(_ACML_ROOT)
 +  set(_ACML_GPU_ROOT)
-   list(GET _ACML_ROOT 0 _ACML_ROOT)
-   list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
++  list(GET _ACML_ROOT 0 _ACML_ROOT)
++  list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
    if(_ACML_ROOT)
+     list(GET _ACML_ROOT 0 _ACML_ROOT)
+     list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
 diff --git a/Modules/FindCUDA.cmake b/Modules/FindCUDA.cmake
 index bceb615ca0..2350b15655 100644
 --- a/Modules/FindCUDA.cmake
@@ -229,26 +231,13 @@ index bceb615ca0..2350b15655 100644
  
  # Example of how to find an include file from the CUDA_SDK_ROOT_DIR
 diff --git a/Modules/FindCUDAToolkit.cmake b/Modules/FindCUDAToolkit.cmake
-index b00cd26b7e..f5f74ebe1d 100644
+index df36f9a19b..825d1e7386 100644
 --- a/Modules/FindCUDAToolkit.cmake
 +++ b/Modules/FindCUDAToolkit.cmake
-@@ -776,12 +776,6 @@
-       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
-         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
-         break()
--      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
--        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
--        break()
--      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
--        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
--        break()
-       endif()
-     endforeach()
-   endfunction()
-@@ -864,18 +858,8 @@
-   # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
-   # directory is the desired location.
-   if(NOT CUDAToolkit_ROOT_DIR)
+@@ -830,18 +830,9 @@ else()
+     # We will also search the default symlink location /usr/local/cuda first since
+     # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
+     # directory is the desired location.
 -    if(UNIX)
 -      if(NOT APPLE)
 -        set(platform_base "/usr/local/cuda-")
@@ -258,14 +247,14 @@ index b00cd26b7e..f5f74ebe1d 100644
 -    else()
 -      set(platform_base "C:\\Program Files\\NVIDIA GPU Computing Toolkit\\CUDA\\v")
 -    endif()
--
+ 
      # Build out a descending list of possible cuda installations, e.g.
 -    file(GLOB possible_paths "${platform_base}*")
 +    set(possible_paths)
      # Iterate the glob results and create a descending list.
      set(versions)
      foreach(p ${possible_paths})
-@@ -891,14 +875,6 @@
+@@ -857,14 +848,6 @@ else()
  
      # With a descending list of versions, populate possible paths to search.
      set(search_paths)
@@ -280,6 +269,19 @@ index b00cd26b7e..f5f74ebe1d 100644
  
      # Now search for the toolkit again using the platform default search paths.
      _CUDAToolkit_find_root_dir(SEARCH_PATHS "${search_paths}" FIND_FLAGS PATH_SUFFIXES bin)
+@@ -889,12 +872,6 @@ else()
+       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
+         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
+         break()
+-      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+-      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+       endif()
+     endforeach()
+   endfunction()
 diff --git a/Modules/FindCoin3D.cmake b/Modules/FindCoin3D.cmake
 index 1d89c604e0..5b70e71a87 100644
 --- a/Modules/FindCoin3D.cmake
@@ -579,10 +581,10 @@ index 82156747d3..cc3f2a64af 100644
         "Ice-${Ice_VERSION_SLICE2CPP_FULL}/slice"
         "Ice-${Ice_VERSION_SLICE2CPP_SHORT}/slice"
 diff --git a/Modules/FindJNI.cmake b/Modules/FindJNI.cmake
-index 10dcc51776..e272bd9583 100644
+index a70b00f330..1962b55d4a 100644
 --- a/Modules/FindJNI.cmake
 +++ b/Modules/FindJNI.cmake
-@@ -363,51 +363,6 @@
+@@ -367,56 +367,6 @@ if (WIN32)
  endif()
  
  set(_JNI_JAVA_DIRECTORIES_BASE
@@ -604,6 +606,11 @@ index 10dcc51776..e272bd9583 100644
 -  # Arch Linux specific paths for default JVM
 -  /usr/lib/jvm/default
 -  # Ubuntu specific paths for default JVM
+-  /usr/lib/jvm/java-26-openjdk-{libarch}
+-  /usr/lib/jvm/java-25-openjdk-{libarch}    # Ubuntu 24.04 LTS
+-  /usr/lib/jvm/java-24-openjdk-{libarch}
+-  /usr/lib/jvm/java-23-openjdk-{libarch}
+-  /usr/lib/jvm/java-22-openjdk-{libarch}
 -  /usr/lib/jvm/java-21-openjdk-{libarch}    # Ubuntu 23.04
 -  /usr/lib/jvm/java-20-openjdk-{libarch}    # Ubuntu 22.10
 -  /usr/lib/jvm/java-19-openjdk-{libarch}    # Ubuntu 22.04 LTS
@@ -1093,28 +1100,28 @@ index edef791cb8..5515f44710 100644
  
  find_path(PHP4_FOUND_INCLUDE_PATH main/php.h
 diff --git a/Modules/FindPerlLibs.cmake b/Modules/FindPerlLibs.cmake
-index 330700e183..7fc89df6eb 100644
+index fbe1aade72..34562e7807 100644
 --- a/Modules/FindPerlLibs.cmake
 +++ b/Modules/FindPerlLibs.cmake
-@@ -141,10 +141,6 @@
+@@ -176,10 +176,6 @@ if (PERL_EXECUTABLE)
      PATHS
        "${PERL_UPDATE_ARCHLIB}/CORE"
        "${PERL_ARCHLIB}/CORE"
--      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/CORE
    )
  
    ### PERL_LIBRARY
-@@ -154,10 +150,6 @@
+@@ -189,10 +185,6 @@ if (PERL_EXECUTABLE)
      PATHS
        "${PERL_UPDATE_ARCHLIB}/CORE"
        "${PERL_ARCHLIB}/CORE"
--      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/CORE
    )
  
  endif ()
@@ -1343,17 +1350,21 @@ index 2c62a5f17f..772a8d88f6 100644
    PATH_SUFFIXES
      bin lib/qt lib/qt3 qt qt3 qt/bin qt3/bin lib/qt/bin lib/qt3/bin
 diff --git a/Modules/FindRuby.cmake b/Modules/FindRuby.cmake
-index 18b9e35855..dba9976565 100644
+index 863f70a7f2..17e3ac606a 100644
 --- a/Modules/FindRuby.cmake
 +++ b/Modules/FindRuby.cmake
-@@ -367,7 +367,6 @@
-           HINTS
-           ${Ruby_HDR_DIR}
-           ${Ruby_ARCH_DIR}
--          /usr/lib/ruby/${_Ruby_VERSION_SHORT}/i586-linux-gnu/
- )
+@@ -366,11 +366,6 @@ if (NOT Ruby_EXECUTABLE AND Ruby_FIND_VIRTUALENV MATCHES "^(FIRST|ONLY)$")
+   endif ()
+ endif ()
  
- set(Ruby_INCLUDE_DIRS ${Ruby_INCLUDE_DIR})
+-# Check for Homebrew Ruby (non-virtualenv, common on MacOS)
+-if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
+-  _RUBY_CHECK_BREW()
+-endif ()
+-
+ # Fallback to system installed Ruby
+ if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
+   _RUBY_CHECK_SYSTEM()
 diff --git a/Modules/FindSDL.cmake b/Modules/FindSDL.cmake
 index a720dcc3df..73e222a27c 100644
 --- a/Modules/FindSDL.cmake
@@ -1644,6 +1655,20 @@ index 7c4f123a1d..4cfd53de9f 100644
  
  if(NOT CMAKE_CROSSCOMPILING)
    execute_process(COMMAND @sw_vers@ -productVersion
+@@ -277,13 +277,6 @@ if(NOT CMAKE_OSX_SYSROOT)
+     RESULT_VARIABLE _result
+   )
+   unset(_sdk_macosx)
+-
+-  list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES_EXCLUDE
+-    # Without -isysroot, some compiler drivers implicitly pass -L/usr/local/lib
+-    # to the linker.  Since the macOS dynamic loader does not search it by
+-    # default, it is not a fully-implemented implicit link directory.
+-    /usr/local/lib
+-  )
+ endif()
+ 
+ #----------------------------------------------------------------------------
 diff --git a/Modules/Platform/Darwin.cmake b/Modules/Platform/Darwin.cmake
 index 42c6b35424..f2985f3765 100644
 --- a/Modules/Platform/Darwin.cmake
@@ -1905,10 +1930,10 @@ index b977d955ca..5ff835298d 100644
      set(_jar_doc "NOTSET")
  
 diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index 8ff651fd90..9659deedf5 100644
+index 2c6a6e6a19..3a43da619a 100644
 --- a/Utilities/cmcurl/CMakeLists.txt
 +++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -1826,43 +1826,6 @@
+@@ -1566,43 +1566,6 @@ if(_curl_ca_bundle_supported)
    endif()
    mark_as_advanced(CURL_CA_PATH_SET)
  
@@ -1929,8 +1954,8 @@ index 8ff651fd90..9659deedf5 100644
 -        if(EXISTS "${_search_ca_bundle_path}")
 -          message(STATUS "Found CA bundle: ${_search_ca_bundle_path}")
 -          set(CURL_CA_BUNDLE "${_search_ca_bundle_path}" CACHE
--            STRING "Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
--          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+-            STRING "Absolute path to the CA bundle. ${_ca_opt_desc}")
+-          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
 -          break()
 -        endif()
 -      endforeach()
@@ -1943,8 +1968,8 @@ index 8ff651fd90..9659deedf5 100644
 -        unset(_curl_ca_files_found)
 -        message(STATUS "Found CA path: ${_search_ca_path}")
 -        set(CURL_CA_PATH "${_search_ca_path}" CACHE
--          STRING "Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
--        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+-          STRING "Absolute path to a directory containing CA certificates stored individually. ${_ca_opt_desc}")
+-        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
 -      endif()
 -    endif()
 -  endif()

pkgs/by-name/co/codespell/package.nix

@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   nativeCheckInputs = with python3.pkgs; [
-    aspell-python
+    aspell-python-py3
     chardet
     pytestCheckHook
     pytest-cov-stub

pkgs/by-name/cu/curlMinimal/package.nix

@@ -6,6 +6,8 @@
   perl,
   nixosTests,
   autoreconfHook,
+  buildPackages,
+  runtimeShellPackage,
   brotliSupport ? false,
   brotli,
   c-aresSupport ? false,
@@ -82,6 +84,9 @@ assert
     ]) > 1
   );
 
+let
+  isCross = !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
   version = "8.21.0";
@@ -241,7 +246,20 @@ stdenv.mkDerivation (finalAttrs: {
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4.4.0
+  ''
+  # The wcurl shell script found in `''${!outputBin}/bin`, is located in the
+  # source along with all the scripts patched in `postPatch` above.
+  # `patchShebangs` at that stage causes the host intended wcurl script to get
+  # the buildPlatform's runtimeShell shebang, instead of the hostPlatform's. To
+  # make sure this doesn't happen we disallow it, and fix it above in the
+  # postInstall, and also with the conditional hostPlatform's
+  # runtimeShellPackage added in buildInputs.
+  + lib.optionalString isCross ''
+    patchShebangs --update --host "''${!outputBin}/bin"
   '';
+  outputChecks.bin.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  outputChecks.out.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  buildInputs = lib.optional isCross runtimeShellPackage;
 
   passthru =
     let

pkgs/by-name/di/diffoscope/package.nix

@@ -98,6 +98,11 @@ let
             tag = version;
             hash = "sha256-ZYEjT/yShfA4+zpbGOtaFOx1nSSOWPtMvskPhHv3c9U=";
           };
+
+          postPatch = ''
+            substituteInPlace py_ext/setup.py \
+              --replace-fail "0.2.0" "${version}"
+          '';
         }
       );
     };

pkgs/by-name/dm/dmarc-metrics-exporter/package.nix

@@ -1,16 +1,11 @@
 {
   lib,
   stdenv,
-  python312,
+  python3Packages,
   fetchFromGitHub,
 }:
 
-let
-  # more-itertools unsupported on 3.13
-  python3 = python312;
-in
-
-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "dmarc-metrics-exporter";
   version = "1.3.1";
 
@@ -25,15 +20,14 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   pythonRelaxDeps = true;
 
-  build-system = with python3.pkgs; [
+  build-system = with python3Packages; [
     poetry-core
   ];
 
   dependencies =
-    with python3.pkgs;
+    with python3Packages;
     [
       bite-parser
-      dataclasses-serialization
       prometheus-client
       pydantic
       structlog
@@ -42,7 +36,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     ]
     ++ uvicorn.optional-dependencies.standard;
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     aiohttp
     pytest-asyncio
     pytestCheckHook

pkgs/by-name/du/duckdb/versions.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.5.3",
-  "rev": "14eca11bd9d4a0de2ea0f078be588a9c1c5b279c",
-  "hash": "sha256-k7mtYXHS8IcBAuOCJ/09lPYLxF3RMODIeDaz3tKmQAA=",
-  "python_hash": "sha256-r0jfYIyBHN5z4QKKxS/yjnkGjUy/yg9Kt/O6adBbH7Q="
+  "version": "1.5.4",
+  "rev": "08e34c447bae34eaee3723cac61f2878b6bdf787",
+  "hash": "sha256-6xpKZKfH5/nwE2nU5kcpgITKFm3ilb1PYf9QEk+bKoM=",
+  "python_hash": "sha256-2TgMuaeAehJ5rvpfA57KTmHtTZnvfa/nl/Y9ASCwVs0="
 }

pkgs/by-name/fr/freeipa/package.nix

@@ -60,7 +60,7 @@ let
     yubico
     setuptools
     jinja2
-    augeas
+    python-augeas
     samba
     ifaddr
   ];

pkgs/by-name/gi/git/osxkeychain-link-rust_lib.patch

@@ -1,15 +0,0 @@
-diff -ur a/Makefile b/Makefile
---- a/Makefile	2026-02-14 15:58:16.624434564 -0500
-+++ b/Makefile	2026-02-14 15:59:25.701016105 -0500
-@@ -4059,9 +4059,9 @@
- contrib/libgit-sys/libgitpub.a: $(LIBGIT_HIDDEN_EXPORT)
- 	$(AR) $(ARFLAGS) $@ $^
- 
--contrib/credential/osxkeychain/git-credential-osxkeychain: contrib/credential/osxkeychain/git-credential-osxkeychain.o $(LIB_FILE) GIT-LDFLAGS
-+contrib/credential/osxkeychain/git-credential-osxkeychain: contrib/credential/osxkeychain/git-credential-osxkeychain.o $(LIB_FILE) $(RUST_LIB) GIT-LDFLAGS
- 	$(QUIET_LINK)$(CC) $(ALL_CFLAGS) -o $@ $(ALL_LDFLAGS) \
--		$(filter %.o,$^) $(LIB_FILE) $(EXTLIBS) -framework Security -framework CoreFoundation
-+		$(filter %.o,$^) $(LIB_FILE) $(RUST_LIB) $(EXTLIBS) -framework Security -framework CoreFoundation
- 
- contrib/credential/osxkeychain/git-credential-osxkeychain.o: contrib/credential/osxkeychain/git-credential-osxkeychain.c GIT-CFLAGS
- 	$(QUIET_LINK)$(CC) -o $@ -c $(dep_args) $(compdb_args) $(ALL_CFLAGS) $(EXTRA_CPPFLAGS) $<

pkgs/by-name/gi/git/package.nix

@@ -55,6 +55,7 @@
   rustSupport ? lib.meta.availableOn stdenv.hostPlatform rustc,
   cargo,
   rustc,
+  nix-update-script,
 }:
 
 assert osxkeychainSupport -> stdenv.hostPlatform.isDarwin;
@@ -62,7 +63,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.54.0";
+  version = "2.55.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [
     CGI
@@ -104,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
         }.tar.xz"
       else
         "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-9okWI2TBDeee+Jqo2/SHMesFfjTtu9IKylEM4BVGgaM=";
+    hash = "sha256-RX/bBNyHKOAH1GiGleaRLm9oByeSDypAvxHqzBdQU1c=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -132,17 +133,6 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://lore.kernel.org/git/20260504101429.340123-1-joerg@thalheim.io/raw";
       hash = "sha256-44EPfEJ39LjPWjqjFb52EKNaJGzYxZzJaJOis8QnazU=";
     })
-    # Address test failure (new in 2.52.0) caused by `git-gui--askyesno` being
-    # installed by `make install`.
-    (fetchurl {
-      name = "expect-gui--askyesno-failure-in-t1517.patch";
-      url = "https://lore.kernel.org/git/20251201031040.1120091-1-brianmlyles@gmail.com/raw";
-      hash = "sha256-vvhbvg74OIMzfksHiErSnjOZ+W0M/T9J8GOQ4E4wKbU=";
-    })
-  ]
-  ++ lib.optionals rustSupport [
-    # The above patch doesn’t work with Rust support enabled.
-    ./osxkeychain-link-rust_lib.patch
   ]
   ++ lib.optionals withSsh [
     # Hard-code the ssh executable to ${pkgs.openssh}/bin/ssh instead of
@@ -271,7 +261,7 @@ stdenv.mkDerivation (finalAttrs: {
   # See https://github.com/Homebrew/homebrew-core/commit/dfa3ccf1e7d3901e371b5140b935839ba9d8b706
   ++ lib.optional stdenv.hostPlatform.isDarwin "TKFRAMEWORK=/nonexistent"
   # Starting with future Git version 3.0.0, rust will be mandatory. For now, it's optional.
-  ++ lib.optional rustSupport "WITH_RUST=YesPlease";
+  ++ lib.optional (!rustSupport) "NO_RUST=YesPlease";
 
   disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     stdenv.shellPackage
@@ -492,6 +482,13 @@ stdenv.mkDerivation (finalAttrs: {
   installCheckFlags = [
     "DEFAULT_TEST_TARGET=prove"
     "PERL_PATH=${buildPackages.perl}/bin/perl"
+
+    # Without setting debug explicitly, the test suite inherits the value of
+    # debug from the environment, which -- if separateDebugInfo is true -- will
+    # be the debug output path.  The test suite then prints out extra debug
+    # info, as if `--debug` were passed on the command line, which causes test
+    # failures because that info can't be interpreted by the test harness.
+    "debug="
   ];
 
   nativeInstallCheckInputs = lib.optional (
@@ -552,6 +549,18 @@ stdenv.mkDerivation (finalAttrs: {
     disable_test t7513-interpret-trailers
     disable_test t2200-add-update
 
+    # Fails when run with GIT_TEST_INSTALLED, that is, when we're testing an
+    # installed package rather than the build output prior to installation.
+    # This test is fragile when testing an installed package even in Nix's
+    # otherwise clean build environment, upstream haven't been keen on patching
+    # individual failures when they crop up, and nobody has yet managed to
+    # rewrite the test to be less fragile.
+    #
+    # See in particular the below messages and discussions around them:
+    # https://lore.kernel.org/git/xmqqect7fhnp.fsf@gitster.g/
+    # https://lore.kernel.org/git/20251201031040.1120091-1-brianmlyles@gmail.com/
+    disable_test t1517-outside-repo
+
     # Fails reproducibly on ZFS on Linux with formD normalization
     disable_test t0021-conversion
     disable_test t3910-mac-os-precompose
@@ -616,7 +625,17 @@ stdenv.mkDerivation (finalAttrs: {
       };
     }
     // tests.fetchgit;
-    updateScript = ./update.sh;
+
+    # We get the source from the release packages, since that contains a few
+    # extra files that make the build easier without already having a Git
+    # installation.  We get the version from GitHub, however, as that provides
+    # a nicer API for checking what the latest version is.
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--url"
+        "https://github.com/git/git"
+      ];
+    };
   };
 
   meta = {

pkgs/by-name/gi/git/update.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl common-updater-scripts jq git
-
-set -eu -o pipefail
-
-oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion git" | tr -d '"')"
-latestTag="$(git ls-remote --tags --sort="v:refname" https://github.com/git/git.git | grep -v '{}' | grep -v '\-rc' | tail -1 | sed 's|^.*/v\(.*\)|\1|')"
-targetVersion="${1:-$latestTag}"
-
-if [ ! "${oldVersion}" = "${targetVersion}" ]; then
-  update-source-version git "${targetVersion}"
-  nixpkgs="$(git rev-parse --show-toplevel)"
-  default_nix="$nixpkgs/pkgs/applications/version-management/git/default.nix"
-  nix-build -A git
-  git add "${default_nix}"
-  git commit -m "git: ${oldVersion} -> ${targetVersion}"
-else
-  echo "git is already up-to-date"
-fi

pkgs/by-name/gi/github-runner/package.nix

@@ -17,10 +17,8 @@
   runtimeShell,
   # List of Node.js runtimes the package should support
   nodeRuntimes ? [
-    # Node.js 20.x has reached EOL and is marked as insecure in Nixpkgs, thus omitted here
     "node24"
   ],
-  nodejs_20,
   nodejs_24,
 }:
 
@@ -28,7 +26,7 @@
 assert builtins.all (
   x:
   builtins.elem x [
-    "node20"
+    # Node.js 20.x has reached EOL and was removed from Nixpkgs, thus omitted here
     "node24"
   ]
 ) nodeRuntimes;
@@ -250,9 +248,6 @@ buildDotnetModule (finalAttrs: {
     export GITHUB_ACTIONS_RUNNER_TRACE=1
     mkdir -p _layout/externals
   ''
-  + lib.optionalString (lib.elem "node20" nodeRuntimes) ''
-    ln -s ${nodejs_20} _layout/externals/node20
-  ''
   + lib.optionalString (lib.elem "node24" nodeRuntimes) ''
     ln -s ${nodejs_24} _layout/externals/node24
   '';
@@ -294,9 +289,6 @@ buildDotnetModule (finalAttrs: {
     # link the Alpine Node flavors.
     mkdir -p $out/lib/externals
   ''
-  + lib.optionalString (lib.elem "node20" nodeRuntimes) ''
-    ln -s ${nodejs_20} $out/lib/externals/node20
-  ''
   + lib.optionalString (lib.elem "node24" nodeRuntimes) ''
     ln -s ${nodejs_24} $out/lib/externals/node24
   ''

pkgs/by-name/gl/glog/package.nix

@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
     # consumers of the CMake config file to fail at the configuration step.
     # Explicitly disabling unwind support sidesteps the issue.
     "-DWITH_UNWIND=OFF"
+    # Enable pkg-config support so that a `.pc` file is generated.
+    "-DWITH_PKGCONFIG=ON"
   ];
 
   doCheck = true;

pkgs/by-name/gn/gnutar/acl-2.4.0-name-conflicts.patch

@@ -0,0 +1,85 @@
+diff --git a/src/xattrs.c b/src/xattrs.c
+index 86a7e59cbc..c872ae308d 100644
+--- a/src/xattrs.c
++++ b/src/xattrs.c
+@@ -139,13 +139,13 @@
+ #ifdef HAVE_POSIX_ACLS
+ 
+ /* acl-at wrappers, TODO: move to gnulib in future? */
+-static acl_t acl_get_file_at (int, const char *, acl_type_t);
+-static int acl_set_file_at (int, const char *, acl_type_t, acl_t);
++static acl_t tar_acl_get_file_at (int, const char *, acl_type_t);
++static int tar_acl_set_file_at (int, const char *, acl_type_t, acl_t);
+ static int file_has_acl_at (int, char const *, struct stat const *);
+-static int acl_delete_def_file_at (int, char const *);
++static int tar_acl_delete_def_file_at (int, char const *);
+ 
+-/* acl_get_file_at */
+-#define AT_FUNC_NAME acl_get_file_at
++/* tar_acl_get_file_at */
++#define AT_FUNC_NAME tar_acl_get_file_at
+ #define AT_FUNC_RESULT acl_t
+ #define AT_FUNC_FAIL (acl_t)NULL
+ #define AT_FUNC_F1 acl_get_file
+@@ -159,8 +159,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+ 
+-/* acl_set_file_at */
+-#define AT_FUNC_NAME acl_set_file_at
++/* tar_acl_set_file_at */
++#define AT_FUNC_NAME tar_acl_set_file_at
+ #define AT_FUNC_F1 acl_set_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS   , acl_type_t type, acl_t acl
+ #define AT_FUNC_POST_FILE_ARGS          , type, acl
+@@ -170,8 +170,8 @@
+ #undef AT_FUNC_POST_FILE_PARAM_DECLS
+ #undef AT_FUNC_POST_FILE_ARGS
+ 
+-/* acl_delete_def_file_at */
+-#define AT_FUNC_NAME acl_delete_def_file_at
++/* tar_acl_delete_def_file_at */
++#define AT_FUNC_NAME tar_acl_delete_def_file_at
+ #define AT_FUNC_F1 acl_delete_def_file
+ #define AT_FUNC_POST_FILE_PARAM_DECLS
+ #define AT_FUNC_POST_FILE_ARGS
+@@ -299,10 +299,10 @@
+       /* No "default" IEEE 1003.1e ACL set for directory.  At this moment,
+          FILE_NAME may already have inherited default acls from parent
+          directory;  clean them up. */
+-      if (acl_delete_def_file_at (chdir_fd, file_name))
++      if (tar_acl_delete_def_file_at (chdir_fd, file_name))
+         WARNOPT (WARN_XATTR_WRITE,
+                 (0, errno,
+-                 _("acl_delete_def_file_at: Cannot drop default POSIX ACLs "
++                 _("tar_acl_delete_def_file_at: Cannot drop default POSIX ACLs "
+                    "for file '%s'"),
+                  file_name));
+       return;
+@@ -316,11 +316,11 @@
+       return;
+     }
+ 
+-  if (acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
++  if (tar_acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
+     /* warn even if filesystem does not support acls */
+     WARNOPT (WARN_XATTR_WRITE,
+ 	     (0, errno,
+-	      _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
++	      _ ("tar_acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
+ 	      file_name));
+ 
+   acl_free (acl);
+@@ -357,10 +357,10 @@
+   char *val = NULL;
+   acl_t acl;
+ 
+-  if (!(acl = acl_get_file_at (parentfd, file_name, type)))
++  if (!(acl = tar_acl_get_file_at (parentfd, file_name, type)))
+     {
+       if (errno != ENOTSUP)
+-        call_arg_warn ("acl_get_file_at", file_name);
++        call_arg_warn ("tar_acl_get_file_at", file_name);
+       return;
+     }
+ 

pkgs/by-name/gn/gnutar/package.nix

@@ -24,9 +24,17 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-TWL/NzQux67XSFNTI5MMfPlKz3HDWRiCsmp+pQ8+3BY=";
   };
 
-  # GNU tar fails to link libiconv even though the configure script detects it.
-  # https://savannah.gnu.org/bugs/index.php?64441
-  patches = [ ./link-libiconv.patch ];
+  patches = [
+    # GNU tar fails to link libiconv even though the configure script detects it.
+    # https://savannah.gnu.org/bugs/index.php?64441
+    ./link-libiconv.patch
+
+    # acl 2.4.0 adds functions that have name conflicts with internal
+    # (`static`) functions from GNU tar. we prefix `tar_` to these names to
+    # avoid this, matching the approach from
+    # https://lists.gnu.org/archive/html/bug-tar/2026-06/msg00013.html
+    ./acl-2.4.0-name-conflicts.patch
+  ];
 
   # gnutar tries to call into gettext between `fork` and `exec`,
   # which is not safe on darwin.

pkgs/by-name/gp/gpgme/package.nix

@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpgme";
-  version = "2.1.0";
+  version = "2.1.2";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnupg/gpgme/gpgme-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-hBxepT/CYln0+/DovemC3qG4ocoMt35oHIKwUFZr+Ss=";
+    hash = "sha256-BoepWymYccQUH1B8D3QN5rQpyawGfQ+k4GLjJk31+3c=";
   };
 
   postPatch = ''

pkgs/by-name/gr/graphviz/package.nix

@@ -22,7 +22,7 @@
   libxrender,
   python3,
   withXorg ? true,
-  withQuartz ? false,
+  withQuartz ? stdenv.hostPlatform.isDarwin,
 
   # for passthru.tests
   exiv2,

pkgs/by-name/gr/grpc/package.nix

@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation (finalAttrs: {
   pname = "grpc";
-  version = "1.81.0"; # N.B: if you change this, please update:
+  version = "1.82.1"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "grpc";
     repo = "grpc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o1wfHrgD2VE6HcPPEWQPQZXrMh+8+GNoUjbCQoRlIWg=";
+    hash = "sha256-w4tl1y1GITlfeHTsSAZm45d8HQVzqSBVEQXoEqO0h5g=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/gs/gssdp_1_6/package.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gssdp";
-  version = "1.6.5";
+  version = "1.6.6";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor finalAttrs.version}/gssdp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-NP2CTDbvn1dVlNVXJyhBLduMUi9ga2yRPvi1qACq/E4=";
+    hash = "sha256-dn0idSVM4O/q6sZEGf+fTwrUcNE072cvXFVrKrt4a8s=";
   };
 
   depsBuildBuild = [

pkgs/by-name/hd/hdrhistogram_c/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hdrhistogram_c";
-  version = "0.11.9";
+  version = "0.11.10";
 
   src = fetchFromGitHub {
     owner = "HdrHistogram";
     repo = "HdrHistogram_c";
     tag = finalAttrs.version;
-    hash = "sha256-9Xp+gPqJpB7xZr5dzyc9Via9gxG9q/EriCx3cm++0kU=";
+    hash = "sha256-LMZj7vuxOA1bgU/J10IKnyNe3R0dk2AA1ydLTHun4vg=";
   };
 
   buildInputs = [ zlib ];

pkgs/by-name/hw/hwdata/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.408";
+  version = "0.409";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fgKOvVGAdB3uBFuKfGPFfF9wQEdLtnlMdQrLNIr3teo=";
+    hash = "sha256-WJ7oe94rTb+gzuawafpx7YyNTUzZe7ZWE0ZWWQKoyCA=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)

pkgs/by-name/is/isa-l/package.nix

@@ -4,9 +4,13 @@
   fetchFromGitHub,
 
   # nativeBuildInputs
+  cmake,
   nasm,
-  autoreconfHook,
 
+  # buildInputs
+  zlib,
+
+  # nativeInstallCheckInputs
   versionCheckHook,
 
   # passthru
@@ -18,32 +22,45 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "isa-l";
-  version = "2.32.0";
+  version = "2.32.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "isa-l";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LvxAlyBUSYEVLrMGcLii7bGvN1GZY/noYRSrBqsGiMI=";
+    hash = "sha256-JizQXhfDCL8aWEv52TBuXw06HA/8t7Ram/q9vSp5/DI=";
   };
 
   nativeBuildInputs = [
+    cmake
     nasm
-    autoreconfHook
   ];
 
-  # configure.ac has two code paths for assembler detection:
-  # 1. When AS is unset: searches for nasm and tests with correct nasm syntax
-  # 2. When AS is set: tests with yasm-style syntax that nasm rejects
-  # AM_PROG_AS sets AS=as, so we must unset it to use path 1.
-  preConfigure = ''
-    unset AS
-  '';
+  buildInputs = [
+    zlib
+  ];
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-DVERSION=\"${finalAttrs.version}\""
+    ];
+  };
+  cmakeFlags = [
+    (lib.cmakeBool "ISAL_BUILD_IGZIP_CLI" true)
+
+    # https://github.com/NixOS/nixpkgs/issues/144170
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+  ];
 
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
   doInstallCheck = true;
+  doCheck = true;
 
   passthru = {
     tests = {
@@ -96,12 +113,5 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/intel/isa-l/releases/tag/v${finalAttrs.version}";
     maintainers = with lib.maintainers; [ jbedo ];
     platforms = lib.platforms.all;
-    badPlatforms = [
-      # <instantiation>:4:26: error: unexpected token in argument list
-      #  movk x7, p4_low_b1, lsl 16
-      "aarch64-darwin"
-      # https://github.com/intel/isa-l/issues/188
-      "i686-linux"
-    ];
   };
 })

pkgs/by-name/je/jemalloc/package.nix

@@ -51,6 +51,14 @@ stdenv.mkDerivation (finalAttrs: {
     # `rtree_read.constprop.0` shows up in some builds but
     # not others, so we fall back to O2:
     ./o3-to-o2.patch
+
+    # Active profiling may make xallocx decline to grow non-page-aligned
+    # allocations, so test/integration/extent can observe decommit without
+    # the matching commit on platforms with real decommit/commit.
+    #
+    # A (longer) patch addressing the failure posted upstream at:
+    # https://github.com/jemalloc/jemalloc/pull/2954
+    ./skip-extent-test-with-prof-active.patch
   ];
 
   nativeBuildInputs = [
@@ -60,6 +68,8 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     "--with-version=${finalAttrs.version}-0-g0000000000000000000000000000000000000000"
     "--with-lg-vaddr=${with stdenv.hostPlatform; toString (if isILP32 then 32 else parsed.cpu.bits)}"
+    # Profiling is inert unless enabled at runtime
+    "--enable-prof"
   ]
   # see the comment on stripPrefix
   ++ lib.optional stripPrefix "--with-jemalloc-prefix="

pkgs/by-name/je/jemalloc/skip-extent-test-with-prof-active.patch

@@ -0,0 +1,24 @@
+diff --git a/test/integration/extent.sh b/test/integration/extent.sh
+index 39fb0a73..ee9f3ed4 100644
+--- a/test/integration/extent.sh
++++ b/test/integration/extent.sh
+@@ -1,5 +1,19 @@
+ #!/bin/sh
+ 
++# With active profiling, xallocx may decline to grow non-page-aligned
++# allocations.  On platforms with real decommit/commit, this can make this
++# test observe a successful decommit without the matching commit.
++case ",${MALLOC_CONF_ALL}," in
++  *,prof:true,*)
++    case ",${MALLOC_CONF_ALL}," in
++      *,prof_active:false,*)
++        ;;
++      *)
++        return 1
++        ;;
++    esac
++esac
++
+ if [ "x${enable_fill}" = "x1" ] ; then
+   export MALLOC_CONF="junk:false"
+ fi

pkgs/by-name/kn/knot-resolver-manager_6/package.nix

@@ -77,7 +77,7 @@ python3Packages.buildPythonPackage {
 
   doCheck = python3Packages.stdenv.hostPlatform.isLinux; # maybe in future
   nativeCheckInputs = with python3Packages; [
-    augeas
+    python-augeas
     dnspython
     lief
     pytestCheckHook

pkgs/by-name/le/lerc/package.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lerc";
-  version = "4.1.0";
+  version = "4.1.1";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "esri";
     repo = "lerc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+X30DQuq2oT/sTe8usUaNK1V+UTNvXJW7IAJVIr8m78=";
+    hash = "sha256-YTNIydQLCBzsuvPWA6qnOkOIPf9JlByJdNHkTevE7Z0=";
   };
 
   # Required to get the freebsd-ports patch to apply.

pkgs/by-name/li/libadwaita/package.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.9.1";
+  version = "1.9.2";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-Oy3WcsymNbbmAacm5hEOrorI1wKXjSp063mh4jCJRAE=";
+    hash = "sha256-XKKjnZz4CII6w9fKFptPK3aTNa5eMfyE7rcerbgaDco=";
   };
 
   depsBuildBuild = [

pkgs/by-name/li/libajantv2/package.nix

@@ -47,11 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postInstall = ''
-    mkdir -p "$out/lib/pkgconfig"
-    cat >"$out/lib/pkgconfig/libajantv2.pc" <<EOF
+    mkdir -p "$dev/lib/pkgconfig"
+    cat >"$dev/lib/pkgconfig/libajantv2.pc" <<EOF
     prefix=$out
     libdir=\''${prefix}/lib
-    includedir=\''${prefix}/include/libajantv2
+    includedir=$dev/include/libajantv2
 
     Name: libajantv2
     Description: Library for controlling AJA NTV2 video devices

pkgs/by-name/li/libapparmor/package.nix

@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-seEREIc83alEPyZGD/GY48hjpqiw3QENnqYsdjHOGgs=";
+    hash = "sha256-y5r8X7Cpwp7TSsKYXNoAeyy0MbgxLSW8gNtLsIvKP8c=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

pkgs/by-name/li/libevent/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libevent";
-  version = "2.1.12";
+  version = "2.1.13";
 
   src = fetchurl {
     url = "https://github.com/libevent/libevent/releases/download/release-${finalAttrs.version}-stable/libevent-${finalAttrs.version}-stable.tar.gz";
-    sha256 = "1fq30imk8zd26x8066di3kpc5zyfc5z6frr3zll685zcx4dxxrlj";
+    hash = "sha256-9+k4O4wLqoG2h+W17swBvu+vGxm2QVHZXtYWR/56MVw=";
   };
 
   patches = [

pkgs/by-name/li/libffiReal/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.5.2";
+  version = "3.7.0";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-86MIKiOzfCk6T80QUxR7Nx8v+R+n6hsqUuM1Z2usgtw=";
+    hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -32,6 +32,9 @@ stdenv.mkDerivation (finalAttrs: {
     ./freebsd-tsan-pthread.patch
   ];
 
+  # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file:
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c";
+
   strictDeps = true;
   outputs = [
     "out"

pkgs/by-name/li/libjxl/package.nix

@@ -31,7 +31,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "libjxl";
-  version = "0.11.2";
+  version = "0.12.0";
 
   outputs = [
     "out"
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     owner = "libjxl";
     repo = "libjxl";
     tag = "v${version}";
-    hash = "sha256-L4/BY68ZBCpebQxryR7D1CxrsneYvw8B8EvW2mkF7bA=";
+    hash = "sha256-rJyvJo1ZveE1pvMErK9ilFQA0NXkD2ka93L+1gXeqf8=";
     # There are various submodules in `third_party/`.
     fetchSubmodules = true;
   };
@@ -69,7 +69,6 @@ stdenv.mkDerivation rec {
   # that the cmake build can apparently use:
   #     OpenGL/GLUT (for Examples -> comparison with sjpeg)
   #     viewer (see `cmakeFlags`)
-  #     plugins like for GDK and GIMP (see `cmakeFlags`)
 
   # Vendored libraries:
   # `libjxl` currently vendors many libraries as git submodules that they
@@ -127,7 +126,6 @@ stdenv.mkDerivation rec {
   ++ lib.optionals enablePlugins [
     # Enable plugins, such as:
     # * the `gdk-pixbuf` one, which allows applications like `eog` to load jpeg-xl files
-    # * the `gimp` one, which allows GIMP to load jpeg-xl files
     "-DJPEGXL_ENABLE_PLUGINS=ON"
   ]
   ++ lib.optionals stdenv.hostPlatform.isStatic [

pkgs/by-name/li/libmemcached/package.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-jEw6L2/139oo4sGprl9Xp0DTarxAK1bEF2ak2kHWSAs=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [
+  patches = [
     (fetchpatch {
       name = "libcxx-compat.patch";
       url = "https://github.com/awesomized/libmemcached/commit/547460c12287a34a5993045157a0e13e14203f92.patch";

pkgs/by-name/li/libressl/default.nix

@@ -64,7 +64,7 @@ let
         export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
         export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
       ''
-      + lib.optionalString stdenv.hostPlatform.isElf ''
+      + lib.optionalString (stdenv.hostPlatform.isElf && buildShared) ''
         # Bail if any shared object has executable stack enabled. This can
         # happen when an object produced from an assmbly file in libcrypto is
         # missing a .note.GNU-stack section. An executable stack is dangerous
@@ -151,23 +151,10 @@ in
     ];
   };
 
-  # 4.3 was released April 2026 and will become unsupported one year after the
-  # release of OpenBSD 7.9.
+  # 4.3 was released April 2026 and will become unsupported on May 19, 2027,
+  # one year after the release of OpenBSD 7.9.
   libressl_4_3 = generic {
-    version = "4.3.1";
-    hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
-    patches = [
-      # Fix for https://github.com/libressl/portable/issues/1278, where LibreSSL
-      # 4.3 started requiring executable stack because some objects were missing
-      # a .note.GNU-stack section; will probably be included in the next release.
-      (fetchpatch {
-        url = "https://raw.githubusercontent.com/libressl/portable/4dae91d056c6c75ba5cf2bc5e6148b8e02239119/patches/gnu-stack.patch";
-        hash = "sha256-Q1oWL4N8w5Zmjfq5QkTJR53NgZ4GqChSDaBicli5G2I=";
-        # This patch is written to be applied with -p0, with no leading path
-        # component, but Nix applies with -p1 by default, so we add it to not
-        # break compatibility with how other patches must be applied.
-        decode = "sed 's|^--- |--- a/|; s|^+++ |+++ b/|'";
-      })
-    ];
+    version = "4.3.2";
+    hash = "sha256-7fAa7iTGXWnmqe/LnUS82mgv+dTzu72V55Th36kIR7U=";
   };
 }

pkgs/by-name/li/libressl/package.nix

@@ -1,5 +1,5 @@
 {
-  libressl_4_2,
+  libressl_4_3,
 }:
 
-libressl_4_2
+libressl_4_3

pkgs/by-name/li/libseccomp/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   getopt,
   util-linuxMinimal,
   which,
@@ -13,31 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libseccomp";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchurl {
     url = "https://github.com/seccomp/libseccomp/releases/download/v${finalAttrs.version}/libseccomp-${finalAttrs.version}.tar.gz";
-    hash = "sha256-g7YIUjLRWIw3ncm5yuR7s3QHzyYubnSZPGG6ctKnhNw=";
+    hash = "sha256-UB9mxmciXVN5G5fh18+Fq3ZMKX0EiB9g849FHEsO4b4=";
   };
 
-  patches = [
-    # Remove when version > 2.6.0
-    # Fixes test failures on big-endian archs
-    (fetchpatch {
-      name = "0001-libseccomp-remove-fuzzer-from-test-62-sim-arch_transactions.patch";
-      url = "https://github.com/seccomp/libseccomp/commit/2f0f3b0e9121720108431c5d054164016f476230.patch";
-      hash = "sha256-AKAQyALJlLgxnS23OEoqfyDswp0kU2vmja5ohgvFojw=";
-    })
-
-    # Remove when version > 2.6.0
-    # Fixes OOB reads & tests on musl
-    (fetchpatch {
-      name = "0002-libseccomp-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch";
-      url = "https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec.patch";
-      hash = "sha256-TdfQ5T8FrGE6+P24MIi9rKSC3fQu/Jlr4bsFiJd4yVY=";
-    })
-  ];
-
   outputs = [
     "out"
     "lib"

pkgs/by-name/li/libsepol/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsepol";
-  version = "3.10";
+  version = "3.11";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "${finalAttrs.se_url}/${finalAttrs.version}/libsepol-${finalAttrs.version}.tar.gz";
-    hash = "sha256-1VVYZ5f6nzg0RJbSp+wRR7bKrz/MRMQtjVFz7denmnE=";
+    hash = "sha256-efPSyI9Et+tc9U2XkuAyMil+F/l6F5Fj8nUAmaAPFk0=";
   };
 
   nativeBuildInputs = [ flex ];

pkgs/by-name/li/libssh/package.nix

@@ -8,6 +8,9 @@
   openssl,
   libsodium,
 
+  withGssapi ? false,
+  krb5,
+
   # for passthru.tests
   ffmpeg,
   sshping,
@@ -28,20 +31,29 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
+  strictDeps = true;
+
+  __structuredAttrs = true;
+
   postPatch = ''
     # Fix headers to use libsodium instead of NaCl
     sed -i 's,nacl/,sodium/,g' ./include/libssh/curve25519.h src/curve25519.c
   '';
 
-  # Don’t build examples, which are not installed and require additional dependencies not
-  # included in `buildInputs` such as libx11.
-  cmakeFlags = [ "-DWITH_EXAMPLES=OFF" ];
+  cmakeFlags = [
+    # Don’t build examples, which are not installed and require additional dependencies not
+    # included in `buildInputs` such as libx11.
+    "-DWITH_EXAMPLES=OFF"
+
+    (lib.cmakeBool "USE_GSSAPI" withGssapi)
+  ];
 
   buildInputs = [
     zlib
     openssl
     libsodium
-  ];
+  ]
+  ++ lib.optional withGssapi krb5;
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/li/libsshWithGssapi/package.nix

@@ -0,0 +1,3 @@
+{ libssh }:
+
+libssh.override { withGssapi = true; }

pkgs/by-name/li/libxfont_2/package.nix

@@ -15,7 +15,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxfont_2";
-  version = "2.0.7";
+  version = "2.0.8";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libXfont2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-i3uC/eukh2m2lDPo4/u5hKX2vzaLDV9Hq+7EnePljvs=";
+    hash = "sha256-9VbA4Qk6TmkRzJC8SxBtIBkC7hh/10ryBv8WL35qJNU=";
   };
 
   strictDeps = true;

pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh

@@ -6,6 +6,8 @@ set -euo pipefail
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
+    [[ -e "$file" ]] || \
+        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }

pkgs/by-name/mc/mctc-lib/package.nix

@@ -10,7 +10,7 @@
   pkg-config,
   python3,
   jonquil,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
 }:
 
 assert (
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     gfortran
     pkg-config
     python3
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
   ]
   ++ lib.optionals (buildType == "meson") [
     meson

pkgs/by-name/md/mdbook/package.nix

@@ -8,7 +8,7 @@
   installShellFiles,
 }:
 let
-  version = "0.5.3";
+  version = "0.5.4";
 in
 rustPlatform.buildRustPackage rec {
   inherit version;
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage rec {
     owner = "rust-lang";
     repo = "mdBook";
     tag = "v${version}";
-    hash = "sha256-RMJQn58hshBGQSpu30NdUOb3Prywn6NfhauSzFZ35xQ=";
+    hash = "sha256-1bUMFxPpb9H/pRdCOX0u8Tn8RPmJElDs7o9t5JtRFuU=";
   };
 
-  cargoHash = "sha256-LlImOjTQjMQURQ81Gn73v+DEHXqyyiz39K9T+MrE7S0=";
+  cargoHash = "sha256-OmlcPZuQ1RbyFrF5tuztucgtCA544UHJxEaXh/mfSHQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/me/merve/package.nix

@@ -26,16 +26,14 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" (!static))
     (lib.cmakeBool "MERVE_TESTING" finalAttrs.finalPackage.doCheck)
-    (lib.cmakeBool "MERVE_USE_SIMDUTF" true)
-  ];
+  ]
+  ++ lib.optional (simdutf != null) (lib.cmakeBool "MERVE_USE_SIMDUTF" true);
 
   nativeBuildInputs = [
     cmake
     validatePkgConfig
   ];
-  buildInputs = [
-    simdutf
-  ];
+  buildInputs = lib.optional (simdutf != null) simdutf;
   checkInputs = [
     gtest
   ];

pkgs/by-name/mk/mkl/package.nix

@@ -8,6 +8,11 @@
   _7zz,
   cctools,
   validatePkgConfig,
+  # sets MKL_NUM_THREADS for packages
+  # invoking mkl during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html
+  checkPhaseThreadLimitHook,
   enableStatic ? stdenv.hostPlatform.isStatic,
 }:
 
@@ -86,6 +91,10 @@ stdenvNoCC.mkDerivation (
         [ rpmextract ]
     );
 
+    propagatedNativeBuildInputs = [
+      checkPhaseThreadLimitHook
+    ];
+
     buildPhase =
       if stdenvNoCC.hostPlatform.isDarwin then
         ''

pkgs/by-name/mp/mpiCheckPhaseHook/package.nix

@@ -2,7 +2,7 @@
   lib,
   makeSetupHook,
   stdenv,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
 }:
 
 makeSetupHook {
@@ -14,7 +14,7 @@ makeSetupHook {
   };
 
   propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
   ];
 
   meta.license = lib.licenses.mit;

pkgs/by-name/na/nasm/package.nix

@@ -9,23 +9,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nasm";
-  version = "3.01";
+  version = "3.02";
 
   src = fetchurl {
     url = "https://www.nasm.us/pub/nasm/releasebuilds/${finalAttrs.version}/nasm-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tzJMvobnZ7ZfJvRn7YsSrYDhJOPMuJB2hVyY5Dqe3dQ=";
+    hash = "sha256-hzNuulO0rP6RdCSrXVANKwBU2fUUjTXCJzzPLPtxLw0=";
   };
 
   patches = [
-    # Backport patches fixing nasm with gcc 15 and musl (and other?) platforms
-    # https://github.com/netwide-assembler/nasm/issues/169
+    # Backport the fix for https://github.com/netwide-assembler/nasm/issues/203
+    # buffer overflow.
     (fetchpatch {
-      url = "https://github.com/netwide-assembler/nasm/commit/44e89ba9b650b5e1533bca43682e167f51a3511f.patch";
-      hash = "sha256-zVeMFhoSY/HGYr4meIWBgt5Unq1fA8lM6h1Cl5fpbxo=";
-    })
-    (fetchpatch {
-      url = "https://github.com/netwide-assembler/nasm/commit/746e7c9efa37cec9a44d84a1e96b8c38f385cc1f.patch";
-      hash = "sha256-aXVS70O/wUkW8xtkwF7uwrQfTgGcNvxHrtGC0sjIPto=";
+      name = "output-oob-fix.patch";
+      url = "https://github.com/netwide-assembler/nasm/commit/8890d723d0aa9ed1a790e2ce1c55eee8dfa0cf94.patch";
+      hash = "sha256-m03+bhKTgKlqeRLGZIy6GO5BTPIJ3r398VQrtN4waaw=";
     })
   ];
 

pkgs/by-name/ne/neo-cowsay/package.nix

@@ -15,6 +15,7 @@ buildGoModule (finalAttrs: {
     hash = "sha256-DmIjqBTIzwkQ8aJ6xCgIwjDtczlTH5AKbPKFUGx3qQ8=";
   };
 
+  __structuredAttrs = true;
   vendorHash = "sha256-gBURmodXkod4fukw6LWEY+MBxPcf4vn/f6K78UR77n0=";
 
   modRoot = "./cmd";

pkgs/by-name/ne/netbox_4_4/package.nix

@@ -66,7 +66,7 @@ py.pkgs.buildPythonApplication rec {
         social-auth-app-django
         sorl-thumbnail
         strawberry-graphql
-        strawberry-django
+        strawberry-graphql-django
         svgwrite
         tablib
 

pkgs/by-name/ne/netbox_4_5/package.nix

@@ -73,7 +73,7 @@ py.pkgs.buildPythonApplication rec {
         social-auth-app-django
         sorl-thumbnail
         strawberry-graphql
-        strawberry-django
+        strawberry-graphql-django
         svgwrite
         tablib
 

pkgs/by-name/ne/netcdf/package.nix

@@ -20,11 +20,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "netcdf" + lib.optionalString mpiSupport "-mpi";
-  version = "4.9.3";
+  version = "4.10.1";
 
   src = fetchurl {
     url = "https://downloads.unidata.ucar.edu/netcdf-c/${finalAttrs.version}/netcdf-c-${finalAttrs.version}.tar.gz";
-    hash = "sha256-pHQUmETmFEVmZz+s8Jf+olPchDw3vAp9PeBH3Irdpd0=";
+    hash = "sha256-2ztp/0pe4afXmlw2Zk0hKLdSwmbpZjafz3MR7F+SdWQ=";
   };
 
   postPatch = ''

pkgs/by-name/ne/netpbm/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.14.0";
+  version = "11.15.1";
 
   outputs = [
     "bin"
@@ -31,8 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "5182";
-    sha256 = "sha256-VbVN08WVXQYXlEBK1yIKj5aIWWaBhim4rQc68ViA/vA=";
+    rev = "5227";
+    sha256 = "sha256-Lr02cu7OAPv+wjKjPkA0wyZ0VvurUuCf5IJXjmCAE0I=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ni/nixos-rebuild-ng/nixos-rebuild.8.scd

@@ -379,6 +379,11 @@ NIX_PATH
 NIX_SSHOPTS
 	Additional options to be passed to ssh on the command line.
 
+NIXOS_REBUILD_SSH_DEFAULT_OPTS
+	Replaces the built-in default ssh options (connection sharing via a
+	private _ControlMaster_ that is closed on exit). If empty, no
+	default options are added.
+
 NIX_SUDOOPTS
 	Additional options to be passed to sudo on the command line.
 

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/__init__.py

@@ -240,7 +240,7 @@ def parse_args(
         }
     )
 
-    if args.help or args.action is None:
+    if args.help:
         if WITH_SHELL_FILES:
             r = run(["man", "8", EXECUTABLE], check=False)
             parser.exit(r.returncode)
@@ -248,6 +248,11 @@ def parse_args(
             parser.print_help()
             parser.exit()
 
+    if args.action is None:
+        parser.error(
+            f"No valid subcommands. Type {parser.prog} --help for more information"
+        )
+
     def parser_warn(msg: str) -> None:
         print(f"{parser.prog}: warning: {msg}", file=sys.stderr)
 

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py

@@ -26,7 +26,7 @@ from .models import (
     Profile,
     Remote,
 )
-from .process import SSH_DEFAULT_OPTS, run_wrapper
+from .process import run_wrapper, ssh_default_opts
 from .utils import Args, dict_to_flags
 
 FLAKE_FLAGS: Final = ["--extra-experimental-features", "nix-command flakes"]
@@ -193,7 +193,7 @@ def copy_closure(
     Also supports copying a closure from a remote to another remote."""
 
     sshopts = os.getenv("NIX_SSHOPTS", "")
-    env = {"NIX_SSHOPTS": " ".join(filter(lambda x: x, [sshopts, *SSH_DEFAULT_OPTS]))}
+    env = {"NIX_SSHOPTS": " ".join(filter(lambda x: x, [sshopts, *ssh_default_opts()]))}
 
     def nix_copy_closure(host: Remote, to: bool) -> None:
         run_wrapper(

pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py

@@ -31,6 +31,14 @@ SSH_DEFAULT_OPTS: Final = [
 ]
 
 
+def ssh_default_opts() -> list[str]:
+    "Default ssh options appended after NIX_SSHOPTS."
+    env = os.getenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS")
+    if env is None:
+        return SSH_DEFAULT_OPTS
+    return shlex.split(env)
+
+
 @dataclass(frozen=True)
 class Remote:
     host: str
@@ -133,7 +141,7 @@ def run_wrapper(
         ssh_args: list[Arg] = [
             "ssh",
             *remote.opts,
-            *SSH_DEFAULT_OPTS,
+            *ssh_default_opts(),
             remote.ssh_host(),
             "--",
             *[_quote_remote_arg(a) for a in remote_run_args],
@@ -282,7 +290,7 @@ def _kill_long_running_ssh_process(args: Args, remote: Remote) -> None:
             [
                 "ssh",
                 *remote.opts,
-                *SSH_DEFAULT_OPTS,
+                *ssh_default_opts(),
                 remote.ssh_host(),
                 "--",
                 "pkill",

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py

@@ -275,6 +275,17 @@ def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
             },
         )
 
+    # NIXOS_REBUILD_SSH_DEFAULT_OPTS replaces the ControlMaster defaults
+    monkeypatch.setenv("NIX_SSHOPTS", "-oControlPath=/run/user/1000/%C")
+    monkeypatch.setenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS", "")
+    with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:
+        n.copy_closure(closure, target_host)
+        mock_run.assert_called_with(
+            ["nix-copy-closure", "--to", "user@target.host", closure],
+            append_local_env={"NIX_SSHOPTS": "-oControlPath=/run/user/1000/%C"},
+        )
+    monkeypatch.delenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS")
+
     monkeypatch.setenv("NIX_SSHOPTS", "--ssh build-target-opt")
     env = {"NIX_SSHOPTS": " ".join(["--ssh build-target-opt", *p.SSH_DEFAULT_OPTS])}
     with patch(get_qualified_name(n.run_wrapper, n), autospec=True) as mock_run:

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py

@@ -234,6 +234,52 @@ def test_remote_from_name(monkeypatch: MonkeyPatch) -> None:
     )
 
 
+def test_ssh_default_opts(monkeypatch: MonkeyPatch) -> None:
+    monkeypatch.delenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS", raising=False)
+    assert p.ssh_default_opts() == p.SSH_DEFAULT_OPTS
+
+    monkeypatch.setenv(
+        "NIXOS_REBUILD_SSH_DEFAULT_OPTS", "-o ControlPath=/run/user/1000/%C"
+    )
+    assert p.ssh_default_opts() == ["-o", "ControlPath=/run/user/1000/%C"]
+
+    monkeypatch.setenv("NIXOS_REBUILD_SSH_DEFAULT_OPTS", "")
+    assert p.ssh_default_opts() == []
+
+
+@patch.dict(
+    p.os.environ,
+    {"PATH": "/path/to/bin", "NIXOS_REBUILD_SSH_DEFAULT_OPTS": ""},
+    clear=True,
+)
+@patch("subprocess.run", autospec=True)
+def test_run_wrapper_ssh_default_opts_override(mock_run: Any) -> None:
+    p.run_wrapper(
+        ["test"],
+        check=True,
+        remote=m.Remote("user@localhost", ["-p", "2222"], "ssh"),
+    )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            "-p",
+            "2222",
+            "user@localhost",
+            "--",
+            "/bin/sh",
+            "-c",
+            """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+            "sh",
+            "test",
+        ],
+        check=True,
+        text=True,
+        errors="surrogateescape",
+        env=None,
+        input=None,
+    )
+
+
 def test_ssh_host() -> None:
     ssh_remotes = {
         "user@[fe80::1%25eth0]": "user@fe80::1%eth0",

pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_tmpdir.py

@@ -8,49 +8,43 @@ from nixos_rebuild.tmpdir import MAX_TMPDIR_LENGTH, make_tmpdir
 
 
 @contextlib.contextmanager
-def system_tempdir(path: Path) -> typing.Generator[None]:
-    path.mkdir(exist_ok=True)
-
-    # `tempfile` caches the tempdir, you must clear it for it to recompute.
-    tempfile.tempdir = None
-
-    og_tmpdir = os.environ.get("TMPDIR")
-
+def tempfile_tempdir(path: str) -> typing.Generator[None]:
+    Path(path).mkdir(exist_ok=True)
+    og_tmpdir = tempfile.tempdir
     try:
-        os.environ["TMPDIR"] = str(path)
-        assert Path(tempfile.gettempdir()) == path
+        tempfile.tempdir = path
+        assert tempfile.gettempdir() == path
         yield
     finally:
-        if og_tmpdir is None:
-            del os.environ["TMPDIR"]
-        else:
-            os.environ["TMPDIR"] = og_tmpdir
+        tempfile.tempdir = og_tmpdir
 
 
 def test_make_tmpdir() -> None:
-    # Basic test: whatever the default system temp dir happens to be.
-    tmpdir = make_tmpdir()
-    tmp = Path(tmpdir.name)
-    assert tmp.exists()
-    assert tmp.is_dir()
-    assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
-
-    # Test with a short system temp dir. We should use it unmodified.
-    with system_tempdir(Path("/tmp/not-too-long")):
-        tmpdir = make_tmpdir()
-        tmp = Path(tmpdir.name)
-
+    def assert_tmpdir(tmp: Path) -> None:
         assert tmp.exists()
         assert tmp.is_dir()
         assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
 
+    # Basic test: whatever the default system temp dir happens to be.
+    tmpdir = make_tmpdir()
+    tmp = Path(tmpdir.name)
+
+    assert_tmpdir(tmp)
+
+    # Test with a short system temp dir. We should use it unmodified.
+    short_tempdir = "/tmp/not-too-long"
+    with tempfile_tempdir(short_tempdir):
+        tmpdir = make_tmpdir()
+        tmp = Path(tmpdir.name)
+
+        assert tmp.parent == Path(short_tempdir)
+        assert_tmpdir(tmp)
+
     # Test with a long system temp dir. We should ignore
     # it and fall back to something short enough for OpenSSH to
     # create sockets in.
-    with system_tempdir(Path("/tmp/long" + ("g" * MAX_TMPDIR_LENGTH))):
+    with tempfile_tempdir("/tmp/long" + ("g" * MAX_TMPDIR_LENGTH)):
         tmpdir = make_tmpdir()
         tmp = Path(tmpdir.name)
 
-        assert tmp.exists()
-        assert tmp.is_dir()
-        assert len(os.fsencode(str(tmp))) <= MAX_TMPDIR_LENGTH
+        assert_tmpdir(tmp)

pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh

@@ -1,11 +0,0 @@
-preCheckHooks+=('setupOmpCheck')
-preInstallCheckHooks+=('setupOmpCheck')
-
-
-setupOmpCheck() {
-  # Limit number of OpenMP threads. Default is "all cores".
-  # Using all cores causes high load on builders if checks are executed with NIX_BUILD_CORE parallelism.
-  # This gets even worse if multiple builds are scheduled on the same machine, potentially growing O(n^3) without explicit core limits.
-  export OMP_NUM_THREADS="${OMP_NUM_THREADS:-1}"
-}
-

pkgs/by-name/op/openmpCheckPhaseHook/package.nix

@@ -1,12 +0,0 @@
-{
-  lib,
-  makeSetupHook,
-}:
-
-makeSetupHook {
-  name = "omp-checkPhase-hook";
-
-  __structuredAttrs = true;
-
-  meta.license = lib.licenses.mit;
-} ./omp-check-hook.sh

pkgs/by-name/pa/paperless-ngx/package.nix

@@ -109,6 +109,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
   ];
 
   pythonRelaxDeps = [
+    "bleach"
     "celery"
     "django-allauth"
     "django-auditlog"
@@ -119,6 +120,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     "redis"
     "scikit-learn"
     "tika-client"
+    "tqdm"
     # requested by maintainer
     "imap-tools"
     "ocrmypdf"

pkgs/by-name/pc/pcre2/package.nix

@@ -8,15 +8,19 @@
   withJitSealloc ? !(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isAbiElfv1),
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "pcre2";
-  version = "10.46";
+  version = "10.47";
 
   src = fetchurl {
-    url = "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${version}/pcre2-${version}.tar.bz2";
-    hash = "sha256-FfvFq6a+7gsXrssEYCrjlDI5OroevY45t8q/fbiDKZ8=";
+    url = "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${finalAttrs.version}/pcre2-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-R/6MmUYSUNQviebo/a66naBXhV0G63/AjZygP9CNe8c=";
   };
 
+  __structuredAttrs = true;
+  strictDeps = true;
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
   configureFlags = [
@@ -43,6 +47,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://www.pcre.org/";
+    changelog = "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-${finalAttrs.version}";
     description = "Perl Compatible Regular Expressions";
     license = lib.licenses.bsd3;
     maintainers = [ ];
@@ -53,6 +58,6 @@ stdenv.mkDerivation rec {
       "libpcre2-16"
       "libpcre2-32"
     ];
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "pcre" version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "pcre" finalAttrs.version;
   };
-}
+})

pkgs/by-name/pi/pipewire/package.nix

@@ -88,7 +88,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pipewire";
-  version = "1.6.7";
+  version = "1.6.8";
 
   outputs = [
     "out"
@@ -104,7 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pipewire";
     repo = "pipewire";
     tag = finalAttrs.version;
-    hash = "sha256-DSW9ho+NLikW/stlxvHLhRguMZy/4b7VEcC938ObJmQ=";
+    hash = "sha256-sxS6+LtvpEWCKoKLDUSYkW4+rrcIXPjWPBglReIDh/k=";
   };
 
   patches = [

pkgs/by-name/pi/pixman/package.nix

@@ -6,7 +6,7 @@
   ninja,
   pkg-config,
   libpng,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
   glib, # just passthru
 
   # for passthru.tests
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
     __flattenIncludeHackHook
   ];
 

pkgs/by-name/ps/psqlodbc/package.nix

@@ -18,13 +18,13 @@ assert lib.xor withLibiodbc withUnixODBC;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "psqlodbc";
-  version = "18.00.0001";
+  version = "18.00.0002";
 
   src = fetchFromGitHub {
     owner = "postgresql-interfaces";
     repo = "psqlodbc";
     tag = "REL-${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-gCacZjP0FkCEuZRBfawZ2B3BcjR/sV1fypuT8XD2l+A=";
+    hash = "sha256-qzbyo9P/o784Ux3KDA8NDMbcm0EbnfG8LiBLRk6n698=";
   };
 
   buildInputs = [

pkgs/by-name/pu/publicsuffix-list/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-05-13";
+  version = "0-unstable-2026-06-24";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "e452c7058d6946bd76952b128c12f5ce87a5acb8";
-    hash = "sha256-5D4RZAyJOL4hMU32Rmp3SYmjgqEtF36mZJr4YBG0k7E=";
+    rev = "18ecca5d54471f21918798da451dd8d03a18f3c7";
+    hash = "sha256-xvOAZpWhuOU3koEHgNfVK6aHy+VMYRoHj3fq9PxaAFo=";
   };
 
   dontBuild = true;

pkgs/by-name/qe/qemu/package.nix

@@ -144,11 +144,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "11.0.1";
+  version = "11.0.2";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DSNfWCAnjZFKMVXsJ6+OQljWl+qJKJVXCAfWnAy4zWQ=";
+    hash = "sha256-N0X26oji6H/g3IOLKx1OCncL9I4BodWhhoQqH/92zPU=";
   };
 
   depsBuildBuild = [

pkgs/by-name/re/remarshal_0_17/package.nix

@@ -59,6 +59,8 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     u-msgpack-python
   ];
 
+  pythonRelaxDeps = [ "cbor2" ];
+
   nativeCheckInputs = [ pythonPackages.pytestCheckHook ];
 
   # nixpkgs-update: no auto update

pkgs/by-name/ru/ruff/package.nix

@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.15.20";
+  version = "0.15.21";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-8PFMGKG15kWBpG4YXg37940WtSe/e5pQDqIe3iJRh5A=";
+    hash = "sha256-dhBdz4jgE2ZoQsTdKmzyzGHC1fDQ54sz2g5m01TETSY=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-Bf6nsUnNMYapP0YN0SBkTPoP1czmj35tPwN1awyKhUw=";
+  cargoHash = "sha256-usviiAc7tWy/fqxE5fD/1B8rsUY0UnSA5EKgk0JLDpA=";
 
   nativeBuildInputs = [ installShellFiles ];