ruff: 0.16.6 -> 0.16.7 (#562416)

This gets us `--print-errorlogs` and `--timeout-multiplier=0` for free.

Port of upstream [0] and [1].

[0]: e6da29ad6b
[1]: 52872026fb

Co-authored-by: Emily <hello@emily.moe>

doc/release-notes/rl-2611.section.md

@@ -137,6 +137,9 @@
 
 - `davmail` no longer supports building with GTK 2, and the `preferGtk3` override flag has been removed as GTK 3 is always used.
 
+- `fetchurl` now always enables `strictDeps`.
+  This is a backwards incompatible change if inputs other than `nativeBuildInputs` were used.
+
 - Support for the legacy U‐Boot image format has been removed from the Linux kernel builders, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
 - `etcd_3_4` package was dropped, as it's gone EOL. Please upgrade to either 3.5 or 3.6. See [migration notes](https://etcd.io/docs/v3.6/upgrades/upgrade_3_6/) for incompatibilities and upgrade procedure.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -244,6 +244,8 @@
 
 - `services.plantuml-server.packages.jetty` now supports `jetty_12`, it no longer supports `jetty_11`.
 
+- `services.sickbeard` has been removed because all remaining compatible forks were removed from Nixpkgs due to security concerns. See [#560697](https://github.com/NixOS/nixpkgs/issues/560697) for details.
+
 - `services.komodo-periphery` has been updated to support version 2.0.0. Some options have been renamed to match the new configuration structure; compatibility aliases are provided for the renamed options. The `passkeys` and `outbound.onboardingKey` options have been removed; use `passkeyFiles`, `auth.privateKey`/`auth.corePublicKeys`, or `outbound.onboardingKeyFile` instead. New outbound mode configuration is available under `outbound.*`.
 
 - `services.pdfding` has been updated to support pdfding version 1.14.0. The automated backup functionality `services.pdfding.backup` option has been removed.

nixos/modules/installer/tools/tools.nix

@@ -84,7 +84,7 @@ let
         # If you prefer a stable release instead, you can change the word unstable to the latest number shown here: https://nixos.org/download
         # i.e. nixos-24.11
         # Use `nix flake update` to update the flake to the latest revision of the chosen release channel.
-        nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+        nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
       };
       outputs = inputs\@{ self, nixpkgs, ... }: {
         # NOTE: '${options.networking.hostName.default}' is the default hostname

nixos/modules/misc/ids.nix

@@ -302,7 +302,7 @@ in
       # stanchion = 262; # unused, removed 2020-10-14
       # riak-cs = 263; # unused, removed 2020-10-14
       infinoted = 264;
-      sickbeard = 265;
+      # sickbeard = 265; # unused, removed 2026-09-13
       headphones = 266;
       # couchpotato = 267; # unused, removed 2022-01-01
       # gogs = 268; # unused, removed in 2024-10-12
@@ -629,7 +629,7 @@ in
       # stanchion = 262; # unused, removed 2020-10-14
       # riak-cs = 263; # unused, removed 2020-10-14
       infinoted = 264;
-      sickbeard = 265;
+      # sickbeard = 265; # unused, removed 2026-09-13
       headphones = 266;
       # couchpotato = 267; # unused, removed 2022-01-01
       # gogs = 268; # unused, removed in 2024-10-12

nixos/modules/module-list.nix

@@ -1002,7 +1002,6 @@
   ./services/misc/serviio.nix
   ./services/misc/shelfmark.nix
   ./services/misc/shoko.nix
-  ./services/misc/sickbeard.nix
   ./services/misc/snapper.nix
   ./services/misc/soft-serve.nix
   ./services/misc/spice-autorandr.nix

nixos/modules/services/misc/sickbeard.nix

@@ -1,94 +0,0 @@
-{
-  config,
-  lib,
-  options,
-  pkgs,
-  ...
-}:
-let
-
-  name = "sickbeard";
-
-  cfg = config.services.sickbeard;
-  opt = options.services.sickbeard;
-  sickbeard = cfg.package;
-
-in
-{
-
-  ###### interface
-
-  options = {
-    services.sickbeard = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "Whether to enable the sickbeard server.";
-      };
-      package = lib.mkPackageOption pkgs "sickbeard" {
-        example = "sickrage";
-        extraDescription = ''
-          Enable `pkgs.sickrage` or `pkgs.sickgear`
-          as an alternative to SickBeard
-        '';
-      };
-      dataDir = lib.mkOption {
-        type = lib.types.path;
-        default = "/var/lib/${name}";
-        description = "Path where to store data files.";
-      };
-      configFile = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.dataDir}/config.ini";
-        defaultText = lib.literalExpression ''"''${config.${opt.dataDir}}/config.ini"'';
-        description = "Path to config file.";
-      };
-      port = lib.mkOption {
-        type = lib.types.port;
-        default = 8081;
-        description = "Port to bind to.";
-      };
-      user = lib.mkOption {
-        type = lib.types.str;
-        default = name;
-        description = "User to run the service as";
-      };
-      group = lib.mkOption {
-        type = lib.types.str;
-        default = name;
-        description = "Group to run the service as";
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = lib.mkIf cfg.enable {
-
-    users.users = lib.optionalAttrs (cfg.user == name) {
-      ${name} = {
-        uid = config.ids.uids.sickbeard;
-        group = cfg.group;
-        description = "sickbeard user";
-        home = cfg.dataDir;
-        createHome = true;
-      };
-    };
-
-    users.groups = lib.optionalAttrs (cfg.group == name) {
-      ${name}.gid = config.ids.gids.sickbeard;
-    };
-
-    systemd.services.sickbeard = {
-      description = "Sickbeard Server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        ExecStart = "${sickbeard}/bin/${sickbeard.pname} --datadir ${cfg.dataDir} --config ${cfg.configFile} --port ${toString cfg.port}";
-      };
-    };
-  };
-}

nixos/modules/virtualisation/qemu-vm.nix

@@ -24,6 +24,8 @@ let
 
   hostPkgs = cfg.host.pkgs;
 
+  useVirtiofs = hostPkgs.stdenv.hostPlatform.isLinux;
+
   consoles = lib.concatMapStringsSep " " (c: "console=${c}") cfg.qemu.consoles;
 
   driveOptions =
@@ -324,23 +326,25 @@ let
         ''
     )}
 
-    echo "Starting virtiofs daemons..."
-    NIX_VIRTIOFS_DIR=$(mktemp -d)
-    ${lib.concatLines (
-      lib.mapAttrsToList (tag: share: ''
-        ${lib.getExe hostPkgs.virtiofsd} \
-          --socket-path="$NIX_VIRTIOFS_DIR"/"${tag}" \
-          --shared-dir="${share.source}" \
-          ${if share.writable then "--writeback" else "--readonly"} \
-          --sandbox=none \
-          --seccomp=none \
-          --cache=always \
-          --no-announce-submounts \
-          --translate-uid=host:65534:0:1 \
-          --translate-gid=host:65534:0:1 \
-          &
-      '') cfg.sharedDirectories
-    )}
+    ${lib.optionalString useVirtiofs ''
+      echo "Starting virtiofs daemons..."
+      NIX_VIRTIOFS_DIR=$(mktemp -d)
+      ${lib.concatLines (
+        lib.mapAttrsToList (tag: share: ''
+          ${lib.getExe hostPkgs.virtiofsd} \
+            --socket-path="$NIX_VIRTIOFS_DIR"/"${tag}" \
+            --shared-dir="${share.source}" \
+            ${if share.writable then "--writeback" else "--readonly"} \
+            --sandbox=none \
+            --seccomp=none \
+            --cache=always \
+            --no-announce-submounts \
+            --translate-uid=host:65534:0:1 \
+            --translate-gid=host:65534:0:1 \
+            &
+        '') cfg.sharedDirectories
+      )}
+    ''}
 
     # Start QEMU.
     exec ${
@@ -437,11 +441,11 @@ in
     (mkRemovedOptionModule [
       "virtualisation"
       "msize"
-    ] "9p was replaced with virtiofs and thus this option is obsolete.")
+    ] "The 9p msize is no longer configurable.")
     (mkRemovedOptionModule [
       "virtualisation"
       "nixStore9pCache"
-    ] "9p was replaced with virtiofs and thus this option is obsolete.")
+    ] "The 9p cache mode for the Nix store is no longer configurable.")
   ];
 
   options = {
@@ -592,8 +596,9 @@ in
       };
       description = ''
         An attributes set of directories that will be shared with the
-        virtual machine using VirtFS (9P filesystem over VirtIO).
-        The attribute name will be used as the 9P mount tag.
+        virtual machine using virtiofs on Linux hosts and VirtFS (9P filesystem
+        over VirtIO) on other hosts. The attribute name will be used as the
+        mount tag.
       '';
     };
 
@@ -1278,10 +1283,20 @@ in
         "-machine memory-backend=mem0"
       ])
       (lib.flatten (
-        lib.mapAttrsToList (tag: share: [
-          "-chardev socket,id=${tag},path=$NIX_VIRTIOFS_DIR/${tag}"
-          "-device vhost-user-fs-pci,chardev=${tag},tag=${tag}"
-        ]) cfg.sharedDirectories
+        lib.mapAttrsToList (
+          tag: share:
+          if useVirtiofs then
+            [
+              "-chardev socket,id=${tag},path=$NIX_VIRTIOFS_DIR/${tag}"
+              "-device vhost-user-fs-pci,chardev=${tag},tag=${tag}"
+            ]
+          else
+            [
+              "-virtfs local,path=${share.source},security_model=none,mount_tag=${tag}${
+                lib.optionalString (!share.writable) ",readonly=on"
+              }"
+            ]
+        ) cfg.sharedDirectories
       ))
       (
         let
@@ -1373,9 +1388,20 @@ in
         name = share.target;
         value = {
           device = tag;
-          fsType = "virtiofs";
+          fsType = if useVirtiofs then "virtiofs" else "9p";
           neededForBoot = true;
-          options = lib.mkIf (!share.writable) [ "ro" ];
+          options =
+            if useVirtiofs then
+              lib.mkIf (!share.writable) [ "ro" ]
+            else
+              [
+                "trans=virtio"
+                "version=9p2000.L"
+                "msize=16384"
+                "x-systemd.requires=modprobe@9pnet_virtio.service"
+              ]
+              ++ lib.optional (tag == "nix-store") "cache=loose"
+              ++ lib.optional (!share.writable) "ro";
         };
       }) cfg.sharedDirectories)
       {
@@ -1488,8 +1514,6 @@ in
         (isEnabled "VIRTIO_PCI")
         (isEnabled "VIRTIO_NET")
         (isEnabled "EXT4_FS")
-        (isEnabled "NET_9P_VIRTIO")
-        (isEnabled "9P_FS")
         (isYes "BLK_DEV")
         (isYes "PCI")
         (isYes "NETDEVICES")
@@ -1497,6 +1521,15 @@ in
         (isYes "INET")
         (isYes "NETWORK_FILESYSTEMS")
       ]
+      ++ (
+        if useVirtiofs then
+          [ (isEnabled "VIRTIO_FS") ]
+        else
+          [
+            (isEnabled "NET_9P_VIRTIO")
+            (isEnabled "9P_FS")
+          ]
+      )
       ++ optionals (!cfg.graphics) [
         (isYes "SERIAL_8250_CONSOLE")
         (isYes "SERIAL_8250")

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2148,8 +2148,8 @@ let
         mktplcRef = {
           name = "vscode-graphql-syntax";
           publisher = "GraphQL";
-          version = "1.3.10";
-          hash = "sha256-EY6BHl5ICcs3FuuenoadDXLLPSe8+2VAAydqo/YrtaE=";
+          version = "1.3.13";
+          hash = "sha256-hGiqdkR1INLf29KLrZmxbFUILO8bA0pgjALQzskbn2Q=";
         };
         meta = {
           description = "Adds full GraphQL syntax highlighting and language support such as bracket matching";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1049,13 +1049,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-U5F5pcCMGsJqVfIOt6sYUnlr1CkNnwnhUm22F+YekRQ=",
+    "hash": "sha256-8YCFGtVOzXOvmZGoy3T43RTttgLM7ebWQ6z8ypLtr6A=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.37.7",
+    "rev": "v1.37.8",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-5YKZqyNUDgyY5dC7tJie8IcrLCkeKV92PPJZ+DVLq4w="
+    "vendorHash": "sha256-UeCpP05dG2OISRx6u1gV4b9SMk2rlyTr1OxpAsx2gts="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",

pkgs/applications/science/logic/coq/default.nix

@@ -147,6 +147,7 @@ let
     ocamlPackages.ocaml
     ocamlPackages.findlib
   ]
+  ++ lib.optional (!coqAtLeast "8.10") ocamlPackages.camlp5
   ++ lib.optional (coqAtLeast "8.14") dune;
   ocamlBuildInputs = [
     ocamlPackages.findlib

pkgs/build-support/fetchurl/builder.sh

@@ -1,5 +1,9 @@
 source "$NIX_ATTRS_SH_FILE"
-source $mirrorsFile
+
+# This file will bring variables of the form "_mirror_<mirrorname>" into scope.
+# DO NOT USE the "_mirror" prefix for variables in this script to avoid
+# accidentally clobbering them.
+source "$mirrorsListFile"
 
 # Normalize `curlOpts` as a string.
 # If defined as a list (deprecated), it would be a bash array.
@@ -41,11 +45,8 @@ if [[ -n "${netrcPhase-}" ]]; then
     curl+=(--netrc-file "$PWD/netrc")
 fi
 
-curl+=(
-    "${curlOptsList[@]}"
-    $curlOpts
-    $NIX_CURL_FLAGS
-)
+curl+=("${curlOptsList[@]}")
+concatTo curl curlOpts NIX_CURL_FLAGS
 
 downloadedFile="$out"
 if [ -n "$downloadToTemp" ]; then downloadedFile="$TMPDIR/file"; fi
@@ -60,7 +61,7 @@ tryDownload() {
     success=
 
     # if we get error code 18, resume partial download
-    while [ $curlexit -eq 18 ]; do
+    while [ "$curlexit" -eq 18 ]; do
        # keep this inside an if statement, since on failure it doesn't abort the script
        if "${curl[@]}" -C - --fail "$url" --output "$target" 2> >(tr '\r' '\n'); then
           success=1
@@ -77,8 +78,8 @@ finish() {
 
     set +o noglob
 
-    if [[ $executable == "1" ]]; then
-      chmod +x $downloadedFile
+    if [[ "$executable" == "1" ]]; then
+      chmod +x "$downloadedFile"
     fi
 
     if [ -z "$skipPostFetch" ]; then
@@ -90,12 +91,15 @@ finish() {
 
 
 tryHashedMirrors() {
+    # The hashed mirrors are stored in the mirrorsListFile,
+    # so we have to use the "_mirror_" prefix, the same as for any other mirror
     if test -n "$NIX_HASHED_MIRRORS"; then
-        hashedMirrors="$NIX_HASHED_MIRRORS"
+        IFS=' ' read -r -a _mirror_hashedMirrors <<< "$NIX_HASHED_MIRRORS"
     fi
 
-    for mirror in $hashedMirrors; do
-        url="$mirror/$outputHashAlgo/$outputHash"
+    local mirror
+    for mirror in "${_mirror_hashedMirrors[@]}"; do
+        local url="$mirror/$outputHashAlgo/$outputHash"
         if "${curl[@]}" --retry 0 --connect-timeout "${NIX_CONNECT_TIMEOUT:-15}" \
             --fail --silent --show-error --head "$url" \
             --write-out "%{http_code}" --output /dev/null > code 2> log; then
@@ -125,34 +129,62 @@ tryHashedMirrors() {
 set -o noglob
 
 resolvedUrls=()
-for url in "${urls[@]}"; do
-    if test "${url:0:9}" != "mirror://"; then
-        resolvedUrls+=("$url")
-    else
-        url2="${url:9}"; echo "${url2/\// }" > split; read site fileName < split
-        #varName="mirror_$site"
-        varName="$site" # !!! danger of name clash, fix this
-        if test -z "${!varName}"; then
-            echo "warning: unknown mirror:// site \`$site'"
-        else
-            mirrors=${!varName}
 
-            # Allow command-line override by setting NIX_MIRRORS_$site.
-            varName="NIX_MIRRORS_$site"
-            if test -n "${!varName}"; then mirrors="${!varName}"; fi
-
-            for url3 in $mirrors; do
-                resolvedUrls+=("$url3$fileName");
-            done
+_resolveUrls() {
+    local url
+    for url in "${urls[@]}"; do
+        # Direct URL: just add it and we're done
+        if test "${url:0:9}" != "mirror://"; then
+            resolvedUrls+=("${url}")
+            continue
         fi
-    fi
-done
+
+        # Try to get appropriate mirrors via the sourced mirrorsListFile or
+        # environment variable NIX_MIRROR_site
+        # Start by looking for mirror:// and splitting everything after that
+        # into a site and a path - the site part should lead us to an array
+        # with the URLs, or the appropriate env variable
+        if ! [[ "$url" =~ ^mirror://([^/ ]+)[/]([^ ]+)$ ]]; then
+          echo "error: fetchurl: $name: invalid mirror:// URL format: $url" >&2
+          exit 1
+        fi
+        local site="${BASH_REMATCH[1]}"
+        local filePath="${BASH_REMATCH[2]}"
+
+        # The name of the array containing mirrors for site
+        local varName="_mirror_${site}"
+        # Needed to iterate over the array using an indirect reference
+        local arrName="${varName}[@]"
+        # The environment variable that can potentially override the mirrors
+        local envVarName="NIX_MIRRORS_${site}"
+
+        local mirrorUrls
+        if test -v "${arrName}"; then
+            if test -n "${!envVarName}"; then
+                echo "resolving url via NIX_MIRRORS_${site}"
+                IFS=' ' read -r -a mirrorUrls <<< "${!envVarName}"
+            else
+                mirrorUrls=("${!arrName}")
+            fi
+        else
+            echo "warning: unknown mirror:// site \`${site}'"
+            continue
+        fi
+
+        local mirrorUrl
+        for mirrorUrl in "${mirrorUrls[@]}"; do
+            resolvedUrls+=("${mirrorUrl}${filePath}");
+        done
+    done
+}
+
+_resolveUrls
 
 # Restore globbing settings
 set +o noglob
 
 if test -n "$showURLs"; then
-    echo "${resolvedUrls[*]}" > $out
+    echo "${resolvedUrls[*]}" > "$out"
     exit 0
 fi
 
@@ -173,6 +205,8 @@ for url in "${resolvedUrls[@]}"; do
            https://gitlab.com/*/-/archive/*)
                echo "warning: archives from GitLab revisions should use fetchFromGitLab"
                ;;
+           *)
+               ;;
        esac
     fi
     tryDownload "$url" "$downloadedFile"

pkgs/build-support/fetchurl/default.nix

@@ -1,8 +1,5 @@
 {
   lib,
-  buildPackages ? {
-    inherit stdenvNoCC;
-  },
   stdenvNoCC,
   curl, # Note that `curl' may be `null', in case of the native stdenvNoCC.
   cacert ? null,
@@ -24,7 +21,11 @@ let
     isList
     isString
     length
+    mapAttrs'
     match
+    nameValuePair
+    toFile
+    toShellVars
     warn
     ;
   nixpkgsVersion = lib.trivial.release;
@@ -38,15 +39,12 @@ let
   # fetchurl instantiations via environment variables.  This makes the
   # resulting store derivations (.drv files) much smaller, which in
   # turn makes nix-env/nix-instantiate faster.
-  mirrorsFile = buildPackages.stdenvNoCC.mkDerivation (
-    {
-      name = "mirrors-list";
-      strictDeps = true;
-      builder = ./write-mirror-list.sh;
-      preferLocalBuild = true;
-    }
-    // mirrors
-  );
+  mirrorsListFile =
+    let
+      # Add a prefix to the names of the mirrors to avoid variable name clashes in the builder
+      mirrorsPrefixed = mapAttrs' (n: v: nameValuePair ("_mirror_" + n) v) mirrors;
+    in
+    toFile "mirrors-list" (toShellVars mirrorsPrefixed);
 
   # Names of the master sites that are mirrored (i.e., "sourceforge",
   # "gnu", etc.).
@@ -304,6 +302,8 @@ lib.extendMkDerivation {
 
       nativeBuildInputs = defaultNativeBuildInputs ++ nativeBuildInputs;
 
+      strictDeps = true;
+
       urls = urls_;
 
       # If set, prefer the content-addressable mirrors
@@ -331,19 +331,22 @@ lib.extendMkDerivation {
 
       # Disable TLS verification only when we know the hash and no credentials are
       # needed to access the resource
-      env.SSL_CERT_FILE =
-        if
-          (
-            hash_.outputHash == ""
-            || hash_.outputHash == fakeSha256
-            || hash_.outputHash == fakeSha512
-            || hash_.outputHash == fakeHash
-            || netrcPhase != null
-          )
-        then
-          "${cacert}/etc/ssl/certs/ca-bundle.crt"
-        else
-          "/no-cert-file.crt";
+      env = {
+        SSL_CERT_FILE =
+          if
+            (
+              hash_.outputHash == ""
+              || hash_.outputHash == fakeSha256
+              || hash_.outputHash == fakeSha512
+              || hash_.outputHash == fakeHash
+              || netrcPhase != null
+            )
+          then
+            "${cacert}/etc/ssl/certs/ca-bundle.crt"
+          else
+            "/no-cert-file.crt";
+      }
+      // (derivationArgs.env or { });
 
       outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
 
@@ -373,7 +376,7 @@ lib.extendMkDerivation {
         curlOptsList
         downloadToTemp
         executable
-        mirrorsFile
+        mirrorsListFile
         postFetch
         showURLs
         ;

pkgs/build-support/fetchurl/tests.nix

@@ -61,11 +61,13 @@ let
       );
 in
 {
+  # Tests that we can add curl flags via curlOpts (space separated)
   flag-appending-curlOpts = testFlagAppending {
     name = "test-fetchurl-flag-appending-curlOpts";
     curlOpts = "--foo --bar";
   };
 
+  # Tests that we can add curl flags via curlOptsList
   flag-appending-curlOptsList = testFlagAppending {
     name = "test-fetchurl-flag-appending-curlOptsList";
     curlOptsList = [
@@ -74,6 +76,13 @@ in
     ];
   };
 
+  # Tests that we can add curl flags via NIX_CURL_FLAGS (space separated)
+  flag-appending-curlOptsEnv = testFlagAppending {
+    name = "test-fetchurl-flag-appending-env";
+    derivationArgs.env.NIX_CURL_FLAGS = "--foo --bar";
+  };
+
+  # Tests that we can use the netrcPhase and add curl flags
   flag-appending-netrcPhase-curlOpts = testFlagAppending {
     name = "test-fetchurl-flag-appending-netrcPhase-curlOpts";
     netrcPhase = ''
@@ -82,6 +91,7 @@ in
     '';
   };
 
+  # Tests that we can use the netrcPhase and add curl flags
   flag-appending-netrcPhase-curlOptsList = testFlagAppending {
     name = "test-fetchurl-flag-appending-netrcPhase-curlOptsList";
     netrcPhase = ''
@@ -121,6 +131,47 @@ in
     ];
   };
 
+  # Tests that multiple hashedMirrors are handled correctly
+  multipleHashedMirrors =
+    let
+      fetchurlWithBrokenMirror = fetchurl.override (prevArgs: {
+        hashedMirrors = [ "http://brokenMirror" ] ++ prevArgs.hashedMirrors;
+      });
+    in
+    testers.invalidateFetcherByDrvHash fetchurlWithBrokenMirror {
+      # Make sure that we can only download from hashed mirrors
+      url = "http://broken";
+      # A file with this hash is definitely on tarballs.nixos.org
+      sha256 = "1j1y3cq6ys30m734axc0brdm2q9n2as4h32jws15r7w5fwr991km";
+
+      # No chance
+      curlOptsList = [
+        "--retry"
+        "0"
+      ];
+    };
+
+  # Tests that mirrors provided via NIX_HASHED_MIRRORS are handled correctly
+  # and that env.SSL_CERT_FILE is not clobbered
+  hashedMirrorsFromEnv =
+    let
+      fetchurlWithOnlyEnvMirrors = fetchurl.override { hashedMirrors = [ ]; };
+    in
+    testers.invalidateFetcherByDrvHash fetchurlWithOnlyEnvMirrors {
+      # Make sure that we can only download from hashed mirrors
+      url = "http://broken";
+      # A file with this hash is definitely on tarballs.nixos.org
+      sha256 = "1j1y3cq6ys30m734axc0brdm2q9n2as4h32jws15r7w5fwr991km";
+
+      derivationArgs.env.NIX_HASHED_MIRRORS = "http://brokenMirror https://tarballs.nixos.org";
+
+      # No chance
+      curlOptsList = [
+        "--retry"
+        "0"
+      ];
+    };
+
   # Tests that downloadToTemp works with hashedMirrors
   no-skipPostFetch = testers.invalidateFetcherByDrvHash fetchurl {
     # Make sure that we can only download from hashed mirrors
@@ -141,6 +192,7 @@ in
     # tarballs.nixos.org, which provides pre-built derivation outputs.
   };
 
+  # Tests that showURLs writes the expected URLs to $out
   showURLs-urls-mirrors = testers.invalidateFetcherByDrvHash fetchurl (finalAttrs: {
     name = "test-fetchurl-showURLs-urls-mirrors";
     showURLs = true;
@@ -159,6 +211,7 @@ in
       );
   });
 
+  # Tests that multiple URLs are tried until we find a working one
   urls-simple = testers.invalidateFetcherByDrvHash fetchurl {
     name = "test-fetchurl-urls-simple";
     urls = [
@@ -168,8 +221,9 @@ in
     hash = hello.src.outputHash;
   };
 
-  urls-mirrors = testers.invalidateFetcherByDrvHash fetchurl rec {
-    name = "test-fetchurl-urls-simple";
+  # Tests that build-time resolved URLs are the same as evaluation-resolved URLs
+  urls-mirrors = testers.invalidateFetcherByDrvHash fetchurl (finalAttrs: {
+    name = "test-fetchurl-urls-mirrors";
     urls = [
       "http://broken"
     ]
@@ -178,12 +232,43 @@ in
     postFetch = hello.postFetch or "" + ''
       if ! diff -u ${
         builtins.toFile "urls-resolved-by-eval" (
-          lib.concatStringsSep "\n" (lib.concatMap fetchurl.resolveUrl urls) + "\n"
+          lib.concatStringsSep "\n" (lib.concatMap fetchurl.resolveUrl finalAttrs.urls) + "\n"
         )
       } <(printf '%s\n' "''${resolvedUrls[@]}"); then
         echo "ERROR: fetchurl: build-time-resolved URLs \`urls' differ from the evaluation-resolved URLs." >&2
         exit 1
       fi
     '';
-  };
+  });
+
+  # Tests that alternative mirror URLs can be provided via the NIX_MIRRORS_* environment variables.
+  # NIX_MIRRORS_ variables for known mirrors are added to impureEnvVars.
+  urls-env-mirrors = testers.invalidateFetcherByDrvHash fetchurl (finalAttrs: {
+    name = "test-fetchurl-urls-env-mirrors";
+    inherit (hello.src) urls;
+    hash = hello.src.outputHash;
+    derivationArgs.env = {
+      # Two mirrors taken from the mirrors.nix file
+      NIX_MIRRORS_gnu = toString [
+        "https://ftp.nluug.nl/pub/gnu/"
+        "https://mirrors.kernel.org/gnu/"
+      ];
+    };
+
+    curlOptsList = [
+      "--retry"
+      "0"
+    ];
+
+    postFetch = hello.postFetch or "" + ''
+      if ! diff -u ${builtins.toFile "urls-resolved-by-hand" ''
+        https://ftp.nluug.nl/pub/gnu/hello/hello-${hello.version}.tar.gz
+        https://mirrors.kernel.org/gnu/hello/hello-${hello.version}.tar.gz
+      ''} <(printf '%s\n' "''${resolvedUrls[@]}"); then
+        echo "ERROR: fetchurl: build-time-resolved URLs \`urls' differ from the manually resolved URLs." >&2
+        exit 1
+      fi
+    '';
+  });
+
 }

pkgs/build-support/fetchurl/write-mirror-list.sh

@@ -1,2 +0,0 @@
-# !!! this is kinda hacky.
-set | grep -E '^[a-zA-Z]+=.*://' > $out

pkgs/by-name/bc/bcachefs-tools/package.nix

@@ -32,18 +32,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.39.5";
+  version = "1.39.6";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k9JW6GMXFwphkYGcYMwA59uafNj0EV96wTnbzeuVM1w=";
+    hash = "sha256-cBYn/g6eLT5rTumo4Y24rWSHS2Sc7gFthPuCg1AQ22k=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-hbh4+vpZtVpda2yVZK+fkdPXWd5+GYLbWYPfJsYtPfM=";
+    hash = "sha256-djiIwZie9HjQ/+bCEGniMFkJA66oI0n+9y9Iax4GHOM=";
   };
 
   postPatch = ''

pkgs/by-name/bi/bitrise/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bitrise";
-  version = "2.43.2";
+  version = "2.45.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QRgOoqk+A79MSXkRX3N8oUHhzatxMm/nzXemKRJ4JHU=";
+    hash = "sha256-WqW0ryP29kmKtSk88bbZ2E+VwesJbqXwB3k+PM6iLb8=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access

pkgs/by-name/co/copyparty/package.nix

@@ -71,11 +71,11 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "copyparty${nameSuffix}";
-  version = "1.20.21";
+  version = "1.20.23";
 
   src = fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/v${version}/copyparty-${version}.tar.gz";
-    hash = "sha256-ZU70dVW7QC4n2JBckAyZ9Ut/HW24dKdJ7/35qyPPQiM=";
+    hash = "sha256-wJV84HewSUKSVBEWuUc/29oeZZe12RWLL8Rw2woYNN0=";
   };
 
   pyproject = true;

pkgs/by-name/cu/cuneiform/package.nix

@@ -1,14 +1,14 @@
 {
   lib,
-  stdenv,
+  gcc14Stdenv,
   fetchurl,
   cmake,
   imagemagick,
   testers,
 }:
 
-# Deprecated: unmaintained, no consumers in nixpkgs as of 2025-10-05, and doesn't compile with gcc 15.
-stdenv.mkDerivation (finalAttrs: {
+# Deprecated: unmaintained, no consumers in nixpkgs as of 2025-10-05, and doesn't compile with gcc 15. Switched to gcc14Stdenv as of 2026-09-13 to fix hydra build error
+gcc14Stdenv.mkDerivation (finalAttrs: {
   pname = "cuneiform";
   version = "1.1.0";
 

pkgs/by-name/cy/cyme/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cyme";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "tuna-f1sh";
     repo = "cyme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yc4oV5Sm5BuABEcfQVu7otNtHGDWVmSkV/FjTLER78Q=";
+    hash = "sha256-7+7OGG++UmUfSut/P5HWbim7dAw+dT9FxvNxkpBJciI=";
   };
 
-  cargoHash = "sha256-zNRZOOrKvYhDgCaNRS5P+UIZ8uzSW9nePciOn13LLB8=";
+  cargoHash = "sha256-nnZ0vquGARZ/JlUVBVPzPpwSBYdmZ2bjOMx6fQe1jis=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/db/dblab/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dblab";
-  version = "0.49.0";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "danvergara";
     repo = "dblab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3dZCKF8hwFDQHOA2zMzPdMsbk5KCq9JbV2TTqge9NxI=";
+    hash = "sha256-cOUWl7ZWQ7iuOg3+eyKGq2jl6BVLlRmnMrftcY6H05E=";
   };
 
   vendorHash = "sha256-nFgwoX2GxjRdqXcocTvz7L0NA+kN1+67uTpler8di/E=";

pkgs/by-name/ec/ecs-agent/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "amazon-ecs-agent";
-  version = "1.106.0";
+  version = "1.106.2";
 
   src = fetchFromGitHub {
     rev = "v${finalAttrs.version}";
     owner = "aws";
     repo = "amazon-ecs-agent";
-    hash = "sha256-eKl0sgpN5/sQXFqKrkXkan3CJ5T8Q5FpV8q+bhEEPww=";
+    hash = "sha256-OMoAsHqcr6DGlRP4PLWmX5RxlpP4UlPQEEpWzmyL9hQ=";
   };
 
   vendorHash = null;

pkgs/by-name/gi/gitcomet/package.nix

@@ -23,17 +23,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitcomet";
-  version = "0.2.1";
+  version = "0.2.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Auto-Explore";
     repo = "GitComet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VRd3HHYuHfOebAT3yC5Tv4CJdFUJkZJHQ8vTzY78OQ0=";
+    hash = "sha256-V8OFHimks8QzV1sSz0DKR5j1HzMFF3mm81SueH87S9E=";
   };
 
-  cargoHash = "sha256-L/UXaXC1zymbNfv7SGmOYSvUy/767mAWqL+3jwJwWcE=";
+  cargoHash = "sha256-RwrSuN8xaE/QyX5IUbdWc5q7qWnm5MSbbSoq1iKTobY=";
 
   # Disable upstream's rustflags overrides to avoid linker and CPU target issues
   postPatch = ''

pkgs/by-name/in/inputplumber/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inputplumber";
-  version = "0.79.0";
+  version = "0.79.5";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YMqQ4reaFr30ZIlIusDMyi+WeugKodxD8IW57bW1YSo=";
+    hash = "sha256-DZrVYimY0zcs4bZcZBsH6SBREbOpSfi3gXGnuD1VSQA=";
   };
 
-  cargoHash = "sha256-nGOXqvkR7mN02SOXnG1I5EZhWwe0wPT/4X6YCPG2Mi4=";
+  cargoHash = "sha256-Wcb9RFgrKwSj9+oyBiyUfHLZ1gxo2HcEh/nBgxYL+yQ=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/je/jetuml/package.nix

@@ -14,11 +14,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "jetuml";
-  version = "3.9";
+  version = "3.10";
 
   src = fetchurl {
     url = "https://github.com/prmr/JetUML/releases/download/v${finalAttrs.version}/JetUML-${finalAttrs.version}.jar";
-    hash = "sha256-wACGbHeRQ5rXcuI1J3eTfQraWp8eWtkIAPo7BNGcFUU=";
+    hash = "sha256-X3mLfK06gQnZ9vzYX1CDw6r6krIuZU9DtujgcferxsM=";
   };
 
   dontUnpack = true;

pkgs/by-name/li/linyaps/fix-host-path.patch

@@ -1,17 +1,16 @@
 diff --git a/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp b/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
-index 787e70cb..a71df46a 100644
+index 72d5890..ac63c57 100644
 --- a/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
 +++ b/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
-@@ -19,6 +19,8 @@
+@@ -30,6 +30,7 @@
  #include <iomanip>
  #include <iostream>
- #include <vector>
+ #include <sstream>
 +#include <unordered_map>
-+#include <unordered_set>
+ #include <vector>
  
- #include <sys/stat.h>
- #include <sys/types.h>
-@@ -432,19 +434,67 @@ ContainerCfgBuilder &ContainerCfgBuilder::bindHostRoot() noexcept
+ #include <grp.h>
+@@ -596,19 +597,36 @@ ContainerCfgBuilder &ContainerCfgBuilder::bindHostRoot() noexcept
  
  ContainerCfgBuilder &ContainerCfgBuilder::bindHostStatics() noexcept
  {
@@ -27,16 +26,27 @@ index 787e70cb..a71df46a 100644
 +        { "/etc/machine-id", "" },
 +        { "/var/cache/fontconfig", "" },
 +
-+        { "/run/current-system/sw/lib/locale", "/usr/lib/locale"},
++        { "/run/current-system/sw/lib/locale", "/usr/lib/locale" },
 +        { "/run/current-system/sw/share/X11/fonts", "/usr/share/fonts" },
 +        { "/run/current-system/sw/share/icons", "/usr/share/icons" },
 +        { "/run/current-system/sw/share/themes", "/usr/share/themes" },
++
++        // Bind the whole host store read-only instead of chasing symlinks under
++        // /run/current-system/sw/share/{X11/fonts,icons,themes} and mounting each
++        // resolved /nix/store/<hash> entry at the same volatile path inside the
++        // sandbox: whenever a system update changes any store path, ll-box would
++        // have to create the new mount point below the cached (persistent,
++        // deepin-linglong-owned) overlay layer, which fails with EACCES and
++        // leaves the container permanently unstartable. A single stable
++        // destination decouples the mount set from the host generation. This is
++        // not a sandbox boundary change: the sandbox already exposes the whole
++        // host rootfs at /run/host/rootfs.
++        { "/nix/store", "" },
      };
  
      hostStaticsMount = std::vector<Mount>{};
 -    for (const auto &loc : statics) {
 -        bindIfExist(*hostStaticsMount, loc);
-+    auto nixStorePaths = std::unordered_set<std::string>{};
 +    for (const auto &[source, destination] : statics) {
 +        if (!std::filesystem::exists(source)) {
 +            std::cerr << "[bindHostStatics] Skipping non-existent path: " << source << std::endl;
@@ -44,48 +54,6 @@ index 787e70cb..a71df46a 100644
 +        }
 +
 +        bindIfExist(*hostStaticsMount, source, destination);
-+
-+        std::string sourcePathPrefix = "/run/current-system/sw/share/";
-+        std::string nixStorePrefix = "/nix/store/";
-+
-+        if (source.string().rfind(sourcePathPrefix, 0) != 0)
-+            continue;
-+
-+        std::error_code ec;
-+        for (const std::filesystem::directory_entry &dir_entry :
-+             std::filesystem::recursive_directory_iterator(source, std::filesystem::directory_options::skip_permission_denied, ec)) 
-+        {
-+            if (ec) {
-+                std::cerr << "[bindHostStatics] Failed to iterate directory: " << source << ", error: " << ec.message() << std::endl;
-+                break;
-+            }
-+
-+            if (!dir_entry.is_symlink(ec) || ec) {
-+                if (ec)
-+                    std::cerr << "[bindHostStatics] Failed to check symlink: " << dir_entry.path() << ", error: " << ec.message() << std::endl;
-+                continue;
-+            }
-+
-+            std::filesystem::path targetPath = std::filesystem::canonical(dir_entry.path(), ec);
-+            if (ec) {
-+                std::cerr << "[bindHostStatics] Failed to resolve symlink: " << dir_entry.path() << ", error: " << ec.message() << std::endl;
-+                continue;
-+            }
-+
-+            std::string target = targetPath.string();
-+            if (target.rfind(nixStorePrefix, 0) != 0)
-+                continue;
-+
-+            auto endPos = target.find('/', nixStorePrefix.length());
-+            if (endPos != std::string::npos)
-+                nixStorePaths.insert(target.substr(0, endPos));
-+            else
-+                nixStorePaths.insert(target);
-+        }
-+    }
-+
-+    for (const std::string &path : nixStorePaths) {
-+        bindIfExist(*hostStaticsMount, path);
      }
  
      return *this;

pkgs/by-name/md/mdschema/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "mdschema";
-  version = "0.15.2";
+  version = "0.15.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "jackchuka";
     repo = "mdschema";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T7sBYkdxqp8VDRyhWZqP/giKJYjnsywWegSkE4cR02M=";
+    hash = "sha256-XI7KsxfPgVKSYjUOoVXLU6SIhYMVjlJyq05FgrLPL0k=";
   };
 
-  vendorHash = "sha256-lfmzPOu/OJ7wWnO2upkMmai9iI7HMEpAj7fSZU0jdUs=";
+  vendorHash = "sha256-m2nwsdYab7w+aT7a4eXXKjnTRCaddm5z9aJRk2KTyN4=";
 
   ldflags = [
     "-s"

pkgs/by-name/mu/musescore-evolution/package.nix

@@ -28,13 +28,13 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "musescore-evolution";
-  version = "3.7.0-unstable-2026-08-14";
+  version = "3.7.0-unstable-2026-09-13";
 
   src = fetchFromGitHub {
     owner = "Jojo-Schmitz";
     repo = "MuseScore";
-    rev = "1e7162d93eb088f5f3d6752528c728bc073d4098";
-    hash = "sha256-uFgZpkau2p78nR4K1MM6tGj/76u3ZrQ1dDHLoNeGKwQ=";
+    rev = "2cdb852980595176f95442c06cb7960afae40e1b";
+    hash = "sha256-Ghmcd2dEc2H2lNwEiSwax1LDTHVMn0MbUiud564O0ds=";
   };
 
   patches = [

pkgs/by-name/ok/okteto/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "okteto";
-  version = "3.23.0";
+  version = "3.23.1";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     tag = finalAttrs.version;
-    hash = "sha256-P5dHpv2CEoJYr4rj3hQbavlsNNBRBIx4mzE3KhtLTXg=";
+    hash = "sha256-uy+1ahjaFwz3Mgt/BIPfAa9dFoE/WBmnIUPRYBLn8x8=";
   };
 
-  vendorHash = "sha256-/ZC5p5TAJOD8Wx1MDaI2NMPIL2QLfCeP0+XzdK346vI=";
+  vendorHash = "sha256-VVYIlrPrB5+RqW6lQa5NhKMpPjuu46tuRXluUqNiRvQ=";
 
   postPatch = ''
     # Disable some tests that need file system & network access.

pkgs/by-name/ol/oldstandard/package.nix

@@ -2,23 +2,25 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  installFonts,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "oldstandard";
   version = "2.2";
 
   src = fetchzip {
-    url = "https://github.com/akryukov/oldstand/releases/download/v${version}/${pname}-${version}.otf.zip";
+    url = "https://github.com/akryukov/oldstand/releases/download/v${finalAttrs.version}/oldstandard-${finalAttrs.version}.otf.zip";
     stripRoot = false;
     hash = "sha256-cDB5KJm87DK+GczZ3Nmn4l5ejqViswVbwrJ9XbhEh8I=";
   };
 
+  nativeBuildInputs = [ installFonts ];
+
   installPhase = ''
     runHook preInstall
 
-    install -m444 -Dt $out/share/fonts/opentype *.otf
-    install -m444 -Dt $out/share/doc/${pname}-${version}    FONTLOG.txt
+    install -m444 -Dt $out/share/doc/oldstandard-${finalAttrs.version}    FONTLOG.txt
 
     runHook postInstall
   '';
@@ -30,4 +32,4 @@ stdenvNoCC.mkDerivation rec {
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;
   };
-}
+})

pkgs/by-name/ri/rime-wanxiang/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-wanxiang";
-  version = "17.9.3";
+  version = "17.10.0";
 
   src = fetchFromGitHub {
     owner = "amzxyz";
     repo = "rime-wanxiang";
     tag = "v" + finalAttrs.version;
-    hash = "sha256-RKQy47FIRbBH12fDoPA2e1Ypg76YZUpX1iQ+VHrYlME=";
+    hash = "sha256-BB+KvPLjtigiJwmS+lRSlIGhDZrKimGG3t/Q5fA4Rck=";
   };
 
   installPhase = ''

pkgs/by-name/ru/ruff/package.nix

@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.16.6";
+  version = "0.16.7";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-D4/bCgMlaa+hBp9exisCuab6h2aJXxdj014qE1+60JM=";
+    hash = "sha256-djWM6RWAgMpvRnuRyyAAjb7OmfVB+whyB3q35C8z1u8=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-GCsUqGuWXfP9WiCzq20Xjl70mXv8a1RtvUg1+IK3TKo=";
+  cargoHash = "sha256-EknMZ4fuWJs0/iB+AkX4ZLMY9E6DAxk+k2tKtTbA1yo=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/sa/samrewritten/package.nix

@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "samrewritten";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "PaulCombal";
     repo = "SamRewritten";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bgvtw4oaHIIbNyhKtploCuS6R6civcXqxi2ISTmpHBU=";
+    hash = "sha256-W3CZjYnKMZAo/Y1FIz0gRk744HDpWt8KI+wNB0m7Ya4=";
   };
 
-  cargoHash = "sha256-UjU05Kb0W/y9urSjGwnRXS5YQbJxV0Ds+dHhSPP5bP0=";
+  cargoHash = "sha256-lMTD36gayiuAfAgGWV/M1blKRLu6uJQmP6kyW8/RHhY=";
 
   # Tests require network access and a running Steam client. Skipping.
   doCheck = false;

pkgs/by-name/si/sickgear/package.nix

@@ -1,53 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  python3,
-  makeWrapper,
-  libarchive,
-}:
-
-let
-  pythonEnv = python3.withPackages (
-    ps: with ps; [
-      ct3
-      lxml
-    ]
-  );
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "sickgear";
-  version = "3.36.0";
-
-  src = fetchFromGitHub {
-    owner = "SickGear";
-    repo = "SickGear";
-    tag = "release_${finalAttrs.version}";
-    hash = "sha256-+ih4UHgoyZpg9kpl3ldzaFLzd0UJ6YDrXAhV36jr+hA=";
-  };
-
-  dontBuild = true;
-  doCheck = false;
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [
-    pythonEnv
-    libarchive
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin $out/opt/sickgear
-    cp -R {autoProcessTV,gui,lib,sickgear,sickgear.py} $out/opt/sickgear/
-
-    makeWrapper $out/opt/sickgear/sickgear.py $out/bin/sickgear \
-      --suffix PATH : ${lib.makeBinPath [ libarchive ]}
-  '';
-
-  meta = {
-    description = "Most reliable stable TV fork of the great Sick-Beard to fully automate TV enjoyment with innovation";
-    mainProgram = "sickgear";
-    license = lib.licenses.gpl3;
-    homepage = "https://github.com/SickGear/SickGear";
-    maintainers = with lib.maintainers; [ rembo10 ];
-  };
-})

pkgs/development/libraries/ogre/default.nix

@@ -121,11 +121,11 @@ let
 in
 {
   ogre_14 = common {
-    version = "14.5.2";
-    hash = "sha256-qI5z6a5WD1WCQZarogQb4c9KRac/szQLsvs/9/5BNCI=";
-    # https://github.com/OGRECave/ogre/blob/v14.5.2/Components/Overlay/CMakeLists.txt
-    imguiVersion = "1.91.9b";
-    imguiHash = "sha256-dkukDP0HD8CHC2ds0kmqy7KiGIh4148hMCyA1QF3IMo=";
+    version = "14.6.0";
+    hash = "sha256-dgMSn3kwgcToAhFDWRfL+E8zz/4rF4qqc7lCSiyeV68=";
+    # https://github.com/OGRECave/ogre/blob/v14.6.0/Components/Overlay/CMakeLists.txt
+    imguiVersion = "1.92.9b";
+    imguiHash = "sha256-IjW+qddzKu9jOj3QCGhkChVK2UOvwl493ffUIIn/ZVQ=";
   };
 
   ogre_13 = common {

pkgs/development/ocaml-modules/camlpdf/default.nix

@@ -8,14 +8,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.9.1";
+  version = "2.9.2";
   pname = "ocaml${ocaml.version}-camlpdf";
 
   src = fetchFromGitHub {
     owner = "johnwhitington";
     repo = "camlpdf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f3Bm64T27eiIzOY2nwdzMRH68VlyNp2jXpOPyBouSCs=";
+    hash = "sha256-MZ3RZCAHqw0PSADxOV3CO4deAuQo2IM867f1kWSb1Wo=";
   };
 
   nativeBuildInputs = [

pkgs/development/ocaml-modules/cpdf/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-cpdf";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "johnwhitington";
     repo = "cpdf-source";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P3CQwYp23URVBDcdnrRAg7gAsOMIifwraIcFSJh8pd0=";
+    hash = "sha256-uhgriPA/y5nElQjbNtzx8CJ8O6ZORKCJAzXYrIOWd60=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/python-xbox/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "python-xbox";
-  version = "0.2.1";
+  version = "0.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tr4nt0r";
     repo = "python-xbox";
     tag = "v${version}";
-    hash = "sha256-zI0eFbIw1BL1MsBle1hMs8WuBaN3FHJMgPSlZ2aOjBo=";
+    hash = "sha256-hYkxoypKqG+UtATplR3j5aSpGxsyyXGsINlYHBMlBvw=";
   };
 
   build-system = [

pkgs/tools/package-management/lix/common-lix.nix

@@ -463,8 +463,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   installCheckPhase = ''
     runHook preInstallCheck
-    flagsArray=($mesonInstallCheckFlags "''${mesonInstallCheckFlagsArray[@]}")
-    meson test --no-rebuild "''${flagsArray[@]}"
+
+    (
+      unset -v preCheck preCheckHooks postCheck postCheckHooks
+      mesonCheckFlags=("''${mesonInstallCheckFlags[@]}")
+      mesonCheckPhase
+    )
+
     runHook postInstallCheck
   '';
   hardeningDisable = [

pkgs/top-level/aliases.nix

@@ -2302,6 +2302,7 @@ mapAliases {
   shipyard = throw "'shipyard' has been renamed to/replaced by 'jumppad'"; # Converted to throw 2025-10-27
   shisho = throw "'shisho' has been removed, as it is archived upstream. Consider using 'semgrep', 'opengrep', or 'ast-grep' instead"; # Added 2026-04-28
   sic-image-cli = warnAlias "'sic-image-cli' has been renamed to 'imagineer'" imagineer; # Added 2026-03-29
+  sickgear = throw "'sickgear' has been removed from Nixpkgs due to security concerns. See https://github.com/NixOS/nixpkgs/issues/560697 for details."; # Added 2026-09-13
   siduck76-st = throw "'siduck76-st' has been renamed to/replaced by 'st-snazzy'"; # Converted to throw 2025-10-27
   sierra-breeze-enhanced = throw "'sierra-breeze-enhanced' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
   sierra-gtk-theme = throw "'sierra-gtk-theme' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22

pkgs/top-level/all-packages.nix

@@ -563,7 +563,7 @@ with pkgs;
       buildPackages.fetchurl # No need to do special overrides twice,
     else
       makeOverridable (import ../build-support/fetchurl) {
-        inherit lib stdenvNoCC buildPackages;
+        inherit lib stdenvNoCC;
         inherit cacert;
         inherit (config) hashedMirrors rewriteURL;
         curl = buildPackages.curlMinimal.override (old: rec {

pkgs/top-level/release.nix

@@ -138,6 +138,7 @@ let
             jobs.stdenv.aarch64-darwin
             jobs.vim.aarch64-darwin
             jobs.cachix.aarch64-darwin
+            jobs.darwin.linux-builder.aarch64-darwin
 
             # UI apps
             # jobs.firefox-unwrapped.aarch64-darwin
@@ -220,6 +221,7 @@ let
         jobs.vim.aarch64-darwin
         jobs.inkscape.aarch64-darwin
         jobs.qt5.qtmultimedia.aarch64-darwin
+        jobs.darwin.linux-builder.aarch64-darwin
         /*
           jobs.tests.cc-wrapper.default.aarch64-darwin
           jobs.tests.cc-wrapper.llvmPackages.clang.aarch64-darwin