Merge staging-next into staging

https://github.com/NLnetLabs/unbound/releases/tag/release-1.25.2

Fixes:
CVE-2026-14586, CVE-2026-32665, CVE-2026-40691, CVE-2026-41637,
CVE-2026-42955, CVE-2026-44621, CVE-2026-44687, CVE-2026-44690,
CVE-2026-46582, CVE-2026-50045, CVE-2026-50046, CVE-2026-50243,
CVE-2026-50248, CVE-2026-50251, CVE-2026-50252, CVE-2026-52863,
CVE-2026-54478, CVE-2026-55708, CVE-2026-55717, CVE-2026-55973,
CVE-2026-55990, CVE-2026-55991, CVE-2026-56416, CVE-2026-56444

maintainers/maintainer-list.nix

@@ -15629,12 +15629,6 @@
     githubId = 632767;
     name = "Guillaume Maudoux";
   };
-  layzyoldman = {
-    email = "ricardopaivacampos@gmail.com";
-    github = "layzyoldman";
-    githubId = 193278607;
-    name = "Ricardo Campos";
-  };
   LazilyStableProton = {
     email = "LazilyStable@proton.me";
     github = "LazyStability";
@@ -19316,12 +19310,6 @@
     githubId = 220262;
     name = "Ion Mudreac";
   };
-  mugaizzo = {
-    email = "mugahedman@hotmail.com";
-    github = "mugaizzo";
-    githubId = 15838537;
-    name = "Mugahed Izzeldin";
-  };
   mulatta = {
     email = "seungwon@mulatta.io";
     github = "mulatta";

nixos/tests/geoclue2.nix

@@ -31,6 +31,6 @@
       assert ("Latitude:    12.345000°" in whereAmI), f"Incorrect latitude in:\n{whereAmI}"
       assert ("Longitude:   -67.890000°" in whereAmI), f"Incorrect longitude in:\n{whereAmI}"
       assert ("Altitude:    123.450000 meters" in whereAmI), f"Incorrect altitude in:\n{whereAmI}"
-      assert ("Accuracy:    1000.000000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
+      assert ("Accuracy:    1000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
     '';
 }

nixos/tests/systemd-boot.nix

@@ -460,19 +460,17 @@ in
       nodes.machine = common;
 
       testScript =
-        let
-          oldVersion = "222";
-        in
         # python
         ''
           machine.succeed("mount -o remount,rw /boot")
 
           def switch():
-              # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
+              # Replace version inside sd-boot with something older. See SD_MAGIC in systemd src/boot/boot.c
+              # Note: the sed replacement has to be length-preserving, because section length matters.
               machine.succeed(
-                """
+                r"""
                 find /boot -iname '*boot*.efi' -print0 | \
-                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot ${oldVersion} ####/' '{}'
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot [0-9]\(.*\) ####/#### LoaderInfo: systemd-boot 0\1 ####/' '{}'
                 """
               )
               return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1508,12 +1508,12 @@
     "vendorHash": "sha256-8p6dJwGyTK+qtgplSLtIRKxnNAQAgHfs4z/EsBcg/iY="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-0155GXJMfoCnyqaJiF5SJIA1Qz1q2AYe/BB0AYODG/0=",
+    "hash": "sha256-YiUARVEsGfD4IUuTFSrkAIAD6kOyFUoLebSaZtW9FcE=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.218.0",
+    "rev": "v0.215.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-FfZvuC/XXhKS03E+l4/9KCLSwx+uTP1LzywckZqX6pA="
+    "vendorHash": "sha256-YNCd1i2HDa0aToZ0vEr6tRugXnBXE+zymhLM+rmRNPI="
   }
 }

pkgs/by-name/ca/cacert/package.nix

@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.125";
+  version = "3.126";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
+    hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg=";
   };
 
   unpackPhase = ''

pkgs/by-name/ca/caesura/package.nix

@@ -1,10 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   rustPlatform,
-  cacert,
-  writableTmpDirAsHomeHook,
   flac,
   lame,
   makeBinaryWrapper,
@@ -19,37 +16,24 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "caesura";
-  version = "0.31.0";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "RogueOneEcho";
     repo = "caesura";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+REt+MKImO7fnYWJ32P6mKzulGJTnxc+9ednVF5aCJU=";
+    hash = "sha256-ifaZ+rmMmWhn8HM25sRPXJKuXvWE5VG+5hFMi9hqxA0=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "normalize-sox-dependent-full-spectrogram-widths.patch";
-      url = "https://github.com/RogueOneEcho/caesura/commit/3af818ae35a3e18f444c889d9d3b88294f4f110f.patch?full_index=1";
-      hash = "sha256-znAbk6hFVj198BUUwwDo76SWei0cKINeXzlYEFvTwHA=";
-    })
-  ];
-
-  cargoHash = "sha256-0+vZma8AC44XqVHzmJT/roV7sy8w6DYhujRK9N91J5c=";
+  cargoHash = "sha256-g8Duhl5nZ6umIrAafW7s4vtDS+f06CWnFLoLSw0wa4o=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
   ];
-  nativeCheckInputs = [
-    cacert
-    writableTmpDirAsHomeHook
-  ]
-  ++ runtimeDeps;
+  nativeCheckInputs = runtimeDeps;
 
   env = {
     CAESURA_NIX = "1";
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
   };
 
   postPatch = ''

pkgs/by-name/do/doctest/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doctest";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4jW6xPFCFxk1l47EkSUVojhycrtluPhOc5Adf/25R7M=";
+    hash = "sha256-+/IEISqN9HdaCJ0udLVUitOUziLvF/D3POecZMoXuho=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/et/ethtool/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ethtool";
-  version = "7.0";
+  version = "7.1";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/ethtool-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Zgv5clp4cTQ6DSMgaKdjT7z7abbC+O/0VYJ/rvsM0WI=";
+    hash = "sha256-TXjCbtwCVbyS9LmVtf1mEI11/5Zu1GlPYCWm03C8JJY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fl/fluidsynth/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WEzOYHtPIUkPZu3v4dWcCh3dOJUyG1xRxDuoSXqiGbk=";
+    hash = "sha256-q4NdfemCprYEYCrKlHumeRM8TyNz8eJcFM18EsB0p0c=";
     fetchSubmodules = true;
   };
 
@@ -52,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    changelog = "https://github.com/FluidSynth/fluidsynth/blob/${finalAttrs.src.tag}/doc/wiki/ChangeLog.md";
     description = "Real-time software synthesizer based on the SoundFont 2 specifications";
     homepage = "https://www.fluidsynth.org";
     license = lib.licenses.lgpl21Plus;

pkgs/by-name/ge/gecode/package.nix

@@ -2,8 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   bison,
-  cmake,
   flex,
   perl,
   gmp,
@@ -12,22 +12,30 @@
   enableGist ? true,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "gecode";
-  version = "6.4.0";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "Gecode";
     repo = "gecode";
-    tag = "release-${finalAttrs.version}";
-    hash = "sha256-WhMN7QC+VQfvHUV1LLaW7I7fG++/fznh1ZDUY/Q8zD8=";
+    rev = "release-${version}";
+    sha256 = "0b1cq0c810j1xr2x9y9996p894571sdxng5h74py17c6nr8c6dmk";
   };
 
+  patches = [
+    # https://github.com/Gecode/gecode/pull/74
+    (fetchpatch {
+      name = "fix-const-weights-clang.patch";
+      url = "https://github.com/Gecode/gecode/commit/c810c96b1ce5d3692e93439f76c4fa7d3daf9fbb.patch";
+      sha256 = "0270msm22q5g5sqbdh8kmrihlxnnxqrxszk9a49hdxd72736p4fc";
+    })
+  ];
+
   enableParallelBuilding = true;
   dontWrapQtApps = true;
   nativeBuildInputs = [
     bison
-    cmake
     flex
   ];
   buildInputs = [
@@ -44,4 +52,4 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.all;
     maintainers = [ ];
   };
-})
+}

pkgs/by-name/ge/geoclue2/fix-sysusers_dir.patch

@@ -0,0 +1,13 @@
+diff --git a/data/meson.build b/data/meson.build
+index 2591e6a..dc1bd8d 100644
+--- a/data/meson.build
++++ b/data/meson.build
+@@ -69,7 +69,7 @@ if get_option('enable-backend')
+         if systemd.found()
+             sysusers_dir = systemd.get_variable(pkgconfig: 'sysusersdir')
+         else
+-            sysusers_dir = '/usr/lib/sysusers.d'
++            sysusers_dir = join_paths(get_option('prefix'), 'usr/lib/sysusers.d')
+         endif
+         configure_file(output: 'geoclue-sysusers.conf',
+                        input: 'geoclue-sysusers.conf.in',

pkgs/by-name/ge/geoclue2/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geoclue";
-  version = "2.7.2";
+  version = "2.8.1";
 
   outputs = [
     "out"
@@ -42,11 +42,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "geoclue";
     repo = "geoclue";
     tag = finalAttrs.version;
-    hash = "sha256-LwL1WtCdHb/NwPr3/OLISwaAwplhJwiZT9vUdX29Bbs=";
+    hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg=";
   };
 
   patches = [
     ./add-option-for-installation-sysconfdir.patch
+    ./fix-sysusers_dir.patch
   ];
 
   separateDebugInfo = true;

pkgs/by-name/gn/gn/package.nix

@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2026-04-01";
+      _version = "0-unstable-2026-05-27";
     in
     _version,
-  rev ? "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
-  hash ? "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ=",
+  rev ? "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
+  hash ? "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8=",
 }:
 
 stdenv.mkDerivation {

pkgs/by-name/gr/graphviz/package.nix

@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphviz";
-  version = "14.1.2";
+  version = "15.1.0";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     tag = finalAttrs.version;
-    hash = "sha256-LkyiKl0ulS9ujEdVLfyeoc4CtjITd6CAc35IUtlHSfw=";
+    hash = "sha256-5v/ib8hwqHrJLs+jvDGvg0aJiKIt8ipXEd1EUzew7XU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/hd/hdrhistogram_c/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Fix build on i686 by not trying to build AVX2 code
   # Submitted upstream: https://github.com/HdrHistogram/HdrHistogram_c/pull/143
-  ${if stdenv.hostPlatform.isi686 then "patches" else null} = [
+  patches = [
     ./no-avx2-i386.patch
   ];
 

pkgs/by-name/im/imagemagick/package.nix

@@ -67,26 +67,6 @@
 assert libXtSupport -> libX11Support;
 assert libraqmSupport -> freetypeSupport;
 
-let
-  arch =
-    if stdenv.hostPlatform.system == "i686-linux" then
-      "i686"
-    else if
-      stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin"
-    then
-      "x86-64"
-    else if stdenv.hostPlatform.system == "armv7l-linux" then
-      "armv7l"
-    else if
-      stdenv.hostPlatform.system == "aarch64-linux" || stdenv.hostPlatform.system == "aarch64-darwin"
-    then
-      "aarch64"
-    else if stdenv.hostPlatform.system == "powerpc64le-linux" then
-      "ppc64le"
-    else
-      null;
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
   version = "7.1.2-27";
@@ -113,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     "MVDelegate=${lib.getExe' coreutils "mv"}"
     "RMDelegate=${lib.getExe' coreutils "rm"}"
     "--with-frozenpaths"
-    (lib.withFeatureAs (arch != null) "gcc-arch" arch)
+    "--with-gcc-arch=generic"
     (lib.withFeature librsvgSupport "rsvg")
     (lib.withFeature librsvgSupport "pango")
     (lib.withFeature liblqr1Support "lqr")

pkgs/by-name/ki/kiro-cli/package.nix

@@ -3,17 +3,10 @@
   stdenv,
   fetchurl,
   autoPatchelfHook,
-  makeBinaryWrapper,
   undmg,
   versionCheckHook,
   xz,
   bzip2,
-  wl-clipboard,
-  # On Wayland, kiro-cli shells out to wl-clipboard (wl-copy/wl-paste) for
-  # clipboard access. Enabling this puts wl-clipboard on the runtime PATH so
-  # clipboard support works out of the box under Wayland sessions. Has no
-  # effect on Darwin.
-  waylandSupport ? stdenv.hostPlatform.isLinux,
 }:
 
 let
@@ -48,9 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionals stdenv.hostPlatform.isLinux [
       autoPatchelfHook
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isLinux && waylandSupport) [
-      makeBinaryWrapper
-    ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       undmg
     ];
@@ -75,12 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm755 bin/kiro-cli-chat $out/bin/kiro-cli-chat
     install -Dm755 bin/kiro-cli-term $out/bin/kiro-cli-term
   ''
-  + lib.optionalString (stdenv.hostPlatform.isLinux && waylandSupport) ''
-    for bin in kiro-cli kiro-cli-chat kiro-cli-term; do
-      wrapProgram $out/bin/$bin \
-        --suffix PATH : ${lib.makeBinPath [ wl-clipboard ]}
-    done
-  ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/bin $out/Applications
     cp -r "../Kiro CLI.app" "$out/Applications/"

pkgs/by-name/ku/ku/package.nix

@@ -8,14 +8,14 @@
 
 buildGo126Module (finalAttrs: {
   pname = "ku";
-  version = "0.9.0";
+  version = "0.8.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "ku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4z4lPvmkEqC7YBEaAa8cUyB42hkFkTFRkHGaA58/Vpg=";
+    hash = "sha256-vUv4eKTCucJ/ol76z0Q3jOigYBSwM823ZxjvBFqv1yY=";
   };
 
   vendorHash = "sha256-x7O2/uKnIIFDr8WK0ej3FJiIGxN5Fq5Czqrv4OJ5A44=";

pkgs/by-name/li/libapparmor/package.nix

@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y5r8X7Cpwp7TSsKYXNoAeyy0MbgxLSW8gNtLsIvKP8c=";
+    hash = "sha256-Kuc5Nrz4iq5MC5AOcJL9Sb54DWNKlEk3b3DW0vpgSZg=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

pkgs/by-name/li/libffiReal/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.7.0";
+  version = "3.7.1";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY=";
+    hash = "sha256-1emmY43b0lE921RRjrZ+S75vpwe8wBwQ9iEvCgiNgZ0=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -32,9 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./freebsd-tsan-pthread.patch
   ];
 
-  # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file:
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c";
-
   strictDeps = true;
   outputs = [
     "out"
@@ -94,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "http://sourceware.org/libffi/";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ aduh95 ];
     platforms = lib.platforms.all;
     pkgConfigModules = [ "libffi" ];
   };

pkgs/by-name/li/libmysofa/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmysofa";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "hoene";
     repo = "libmysofa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc=";
+    hash = "sha256-gP/RjKzMx8JIYcyiivBGvy3kIdwHMEKY6abssyVUKNQ=";
   };
 
   outputs = [

pkgs/by-name/li/libressl/default.nix

@@ -100,6 +100,17 @@ let
         moveToOutput "share/man/man1/nc.1.gz" "$nc"
       '';
 
+      doInstallCheck = true;
+      installCheckPhase = ''
+        runHook preInstallCheck
+
+        # Check whether the build target actually contains our cacert.
+        # A simple binary match for the path is enough.
+        grep "${cacert}/etc/ssl/certs/ca-bundle.crt" $out/lib/*libtls*
+
+        runHook postInstallCheck
+      '';
+
       meta = {
         description = "Free TLS/SSL implementation";
         homepage = "https://www.libressl.org";
@@ -139,6 +150,13 @@ let
     url = "https://github.com/libressl/portable/commit/a15ea0710398eaeed3be53cf643e80a1e80c981d.patch";
     hash = "sha256-Mlf4SrGCCqALQicbGtmVGdkdfcE8DEGYkOuVyG2CozM=";
   };
+
+  # https://github.com/libressl/portable/issues/1295
+  # https://github.com/libressl/portable/pull/1303
+  tls-default-ca-patch = fetchpatch {
+    url = "https://github.com/libressl/portable/commit/c85e07d0d68129fc1b1c9039b266099c8d735c3d.patch";
+    hash = "sha256-oNL3v8Ef1HrayXn+/3T4UhHLJos8eVMlqebVyaxnWVo=";
+  };
 in
 {
   # 4.2 was released October 2025 and will become unsupported on October 22,
@@ -148,6 +166,7 @@ in
     hash = "sha256-bVwvWFg1iOp5H0yGRQBAcdAN+lVKW/eIoAbKHrWr1ws=";
     patches = [
       common-cmake-install-full-dirs-patch
+      tls-default-ca-patch
     ];
   };
 
@@ -156,5 +175,8 @@ in
   libressl_4_3 = generic {
     version = "4.3.2";
     hash = "sha256-7fAa7iTGXWnmqe/LnUS82mgv+dTzu72V55Th36kIR7U=";
+    patches = [
+      tls-default-ca-patch
+    ];
   };
 }

pkgs/by-name/li/libsodium/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-04-16";
+  version = "1.0.22-unstable-2026-07-08";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "33cc75ab1565d9dcbe808354191bd572ad6b64d0";
-    hash = "sha256-8kS9FBoaFaJOjH7XZc8IG3GaQaUiYD/awQOhs7j0n1Y=";
+    rev = "77a422c85a3b8b487de50c811b38d18394831ba6";
+    hash = "sha256-Ahka2PnrmYvTLjZMzik5mFsxhDpMLRMKT/I5ftUb0Xc=";
   };
 
   outputs = [

pkgs/by-name/li/libssh/package.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libssh";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor finalAttrs.version}/libssh-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Gmr0JNgyfl7t705f5/W5JCJt1hesnz3oDyF9gqNqcSE=";
+    hash = "sha256-05Qa8KLXjV2C7Xo2mI6RM5lDEvA1uWWabkP42zloeEw=";
   };
 
   outputs = [

pkgs/by-name/li/libtiff/package.nix

@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtiff";
-  version = "4.7.1";
+  version = "4.7.2";
 
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UiC6s86i7UavW86EKm74oPVlEacvoKmwW7KETjpnNaI=";
+    hash = "sha256-60Lpg5WRfWMzlOoOUA+C6KLlYIZ+3BjXidOVqv4M2GA=";
   };
 
   patches = [

pkgs/by-name/mb/mbedtls/4.nix

@@ -5,8 +5,8 @@
 }:
 
 callPackage ./generic.nix {
-  version = "4.1.0";
-  hash = "sha256-TA1uka13So8URttw+JJVdKIL+IonkhIQSc0IfraXpIM=";
+  version = "4.2.0";
+  hash = "sha256-Xz5W5zYPNlASPyc1/Sz2O1LONdxpUkg1hgzKdax/3ag=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

pkgs/by-name/mb/mbedtls/package.nix

@@ -6,8 +6,8 @@
 }:
 
 callPackage ./generic.nix {
-  version = "3.6.6";
-  hash = "sha256-+PW41/c8M/Yz0EVWM4Gt4HTNBMUTU5MayaKVZ+upLIo=";
+  version = "3.6.7";
+  hash = "sha256-t1ZPeFA3ftKaEIaXQ7RXZEsiOAYK4KSSm55SFr9g17A=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

pkgs/by-name/mi/minizinc/package.nix

@@ -13,6 +13,22 @@
   zlib,
 }:
 
+let
+  gecode_6_3_0 = gecode.overrideAttrs (_: {
+    version = "6.3.0";
+    src = fetchFromGitHub {
+      owner = "gecode";
+      repo = "gecode";
+      rev = "f7f0d7c273d6844698f01cec8229ebe0b66a016a";
+      hash = "sha256-skf2JEtNkRqEwfHb44WjDGedSygxVuqUixskTozi/5k=";
+    };
+    patches = [ ];
+  });
+in
+let
+  gecode = gecode_6_3_0;
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "minizinc";
   version = "2.9.7";

pkgs/by-name/ph/phpantom-lsp/package.nix

@@ -6,17 +6,19 @@
   _experimental-update-script-combinators,
   nix-update-script,
 }:
+
 let
   stubsSrc = fetchFromGitHub {
     owner = "JetBrains";
     repo = "phpstorm-stubs";
-    rev = "f6dd2dd35d99fb774251a83555fe07bf2109d57e";
-    hash = "sha256-H9Td/yi9Um0Z9ifxZdh74bvGCMVSC+MA1OHrtbGD8vE=";
+    rev = "517b9ad1adaf2c5453c00ec2fbb02d192a4a9b6c";
+    hash = "sha256-IDWAuy301avfTF/E7Mby2JQQtIr/gnN5flZ3uctUpus=";
   };
 in
+
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "phpantom-lsp";
-  version = "0.9.0";
+  version = "0.8.0";
 
   __structuredAttrs = true;
 
@@ -24,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "AJenbo";
     repo = "phpantom_lsp";
     tag = finalAttrs.version;
-    hash = "sha256-euWaFH40VHefZewUcKvsLwwHZP+GwfTN8kfuAkaABB8=";
+    hash = "sha256-00NAiPm3qqxyS1u1GPpJlgnBlUjDx9VmjK6oOwH8kcU=";
   };
 
   postPatch = ''
@@ -36,7 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       > stubs/jetbrains/phpstorm-stubs/.commit
   '';
 
-  cargoHash = "sha256-2MIJxVRqyCv5HzCwY1s+rCp1A4vFRsyAEEuyIEegZMA=";
+  cargoHash = "sha256-FyMI8Kb3QUD8Jui9k7vayMcQC+KWL8sZi3A05NPbXsg=";
 
   checkFlags = [
     "--test"

pkgs/by-name/po/pomo/package.nix

@@ -1,39 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  iana-etc,
-  libredirect,
-  stdenvNoCC,
-}:
-buildGoModule (finalAttrs: {
-  pname = "pomo";
-  version = "1.2.1";
-
-  __structuredAttrs = true;
-
-  src = fetchFromGitHub {
-    owner = "Bahaaio";
-    repo = "pomo";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-gQ7bHQGaQPujpOwVdcwKgiYQjUECi/Pjt5LKwa1v1J8=";
-  };
-
-  vendorHash = "sha256-kbTYq4Xc86bcmNMhInq1rwYTbGRmu2TEXT2e7bqT5YY=";
-
-  nativeCheckInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [ libredirect.hook ];
-
-  preCheck = lib.optionalString stdenvNoCC.hostPlatform.isDarwin ''
-    export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/services=${iana-etc}/etc/services
-  '';
-
-  meta = {
-    description = "Customizable TUI Pomodoro timer with ASCII art, progress bar, notifications, and stats";
-    homepage = "https://github.com/Bahaaio/pomo";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [
-      mugaizzo
-    ];
-    mainProgram = "pomo";
-  };
-})

pkgs/by-name/pr/prek/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.4.4";
+  version = "0.4.10";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PAEmRQ5Vro83fkegOWsdY59U7WAQxBPSEalzxZV6K4o=";
+    hash = "sha256-tTr/Aob6jP1YL+n5vGkUkByew73WdP3mqLW5Lci1gNM=";
   };
 
-  cargoHash = "sha256-EmlR6Lmt5XR0uS/y3FqY5yGNeVBSdtLtEGH9jZLcP2o=";
+  cargoHash = "sha256-He55uH7t7NI5sYgowujqCMK5yjhC2F+8ZLxKG6TLjYY=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/pv/pvetui/package.nix

@@ -7,7 +7,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "pvetui";
-  version = "1.4.3";
+  version = "1.4.2";
 
   __structuredAttrs = true;
 
@@ -15,10 +15,10 @@ buildGoModule (finalAttrs: {
     owner = "devnullvoid";
     repo = "pvetui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8mfp5bfROqT6DcxByaHZRTkDHJpfclCpeaJaINLKmlk=";
+    hash = "sha256-yYYGXb+CriDRZcV8e/7MN4Pq8GKP35JdMrcxozWVBpE=";
   };
 
-  vendorHash = "sha256-7Tuh9T3uTlNxdSlSL7gQIYXpfpNbCkQrRWj/FoU8fbU=";
+  vendorHash = "sha256-JOo/7/3J9LqefIYuRl9efSlSfzLvQ/B8Jpy2e5cdEio=";
 
   subPackages = [ "cmd/pvetui" ];
 

pkgs/by-name/sc/schemat/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "schemat";
-  version = "0.5.3";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "raviqqe";
     repo = "schemat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vA5J76wU2FlKz1fxTgv8jVuV4RIOML+tI5Y/dXyc9f0=";
+    hash = "sha256-Ij7JigbXhE2o0Z61uZ3W/pK7zcQyrX+SMpF0iKsVx30=";
   };
 
-  cargoHash = "sha256-LGZE3r9n+KtnCiCxc/3K981wq4fN6ZR/KD8b638DmeM=";
+  cargoHash = "sha256-oaET2IGU78TUC98HKsiQnbg7R262ugrn8oiLeKC767s=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/sp/spirv-tools/package.nix

@@ -29,6 +29,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/2ec8457ab33d539b6f1fecc998360c0b8b05ed4f.diff";
       hash = "sha256-YHbYBwXMm4rTKpmMW6I3LUafhA4RuNUdXqUBUAXwXpE=";
     })
+
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/0db9162641d9709c63c92a13e66fd88905180e89.diff";
+      hash = "sha256-eoS35Zxb+frQTTTNCaZ4TV/QZjaK45mW1OzzIlXQ1C0=";
+    })
   ]
   # The cmake options are sufficient for turning on static building, but not
   # for disabling shared building, just trim the shared lib from the CMake

pkgs/by-name/sr/srt/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "srt";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-hOkLlmtF9dKqXZTjAeBntkkg5WsmsZN6DKhyakoIF1k=";
+    sha256 = "sha256-fdgj6URuMaem+ZVy7D8Hnf2Ev1HindevdvX0xyxCL4M=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/tz/tzdata/package.nix

@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2026b";
+  version = "2026c";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
-      hash = "sha256-EUVD2fGaa/61vKQ2hq6hc9OHVaPbHy7sESZHrpLG9UQ=";
+      hash = "sha256-5KF4pEd/PQ6nfMMYKP9yqjj+/41hqhPn6Z4ULp2QK+Q=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
-      hash = "sha256-N+nthCf101IcIvxY4pPL+wQ9cO7fEAOHCzPzY/Yco0Q=";
+      hash = "sha256-sc/8Os5MTHzQ77ovet2G7D0LedpIvPA1gmcf08j+rOg=";
     })
   ];
 

pkgs/by-name/un/unbound/package.nix

@@ -63,13 +63,13 @@ assert lib.assertMsg (
 ) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)";
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.25.1";
+  version = "1.25.2";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-1PXnxCPxoB5IrVBQIsrxiWAq+IoH7Ma9T1TTJsoTJc4=";
+    hash = "sha256-zt0JpVmct7w6ay+p8CdH6SGt/rL/v//e7K3MT8KZfOY=";
   };
 
   outputs = [

pkgs/by-name/va/valkey/package.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "valkey";
-  version = "9.1.0";
+  version = "9.1.1";
 
   src = fetchFromGitHub {
     owner = "valkey-io";
     repo = "valkey";
     rev = finalAttrs.version;
-    hash = "sha256-RMZz83fycpOTPWB1dIXU0/hdh4ZGC+6JhCws8htAQ5E=";
+    hash = "sha256-wGHlPQ2JPxGTaJRJ9Siz3Q3eKdlo5z1tQpSFs9xZMbI=";
   };
 
   patches = lib.optional useSystemJemalloc ./use_system_jemalloc.patch;

pkgs/by-name/ve/vesta-viewer/package.nix

@@ -6,11 +6,9 @@
   makeDesktopItem,
   copyDesktopItems,
   autoPatchelfHook,
-  wrapGAppsHook3,
-  makeWrapper,
   _7zz,
+
   glib,
-  gsettings-desktop-schemas,
   libGL,
   libGLU,
   libgcc,
@@ -33,10 +31,7 @@ let
     platforms = [
       "x86_64-linux"
     ];
-    maintainers = with lib.maintainers; [
-      ulysseszhan
-      layzyoldman
-    ];
+    maintainers = with lib.maintainers; [ ulysseszhan ];
     mainProgram = "VESTA";
   };
 
@@ -44,12 +39,9 @@ let
     nativeBuildInputs = [
       copyDesktopItems
       autoPatchelfHook
-      wrapGAppsHook3
-      makeWrapper
     ];
     buildInputs = [
       glib
-      gsettings-desktop-schemas
       libGL
       libGLU
       libgcc
@@ -60,9 +52,6 @@ let
       libxtst
     ];
 
-    # Prevent wrapGAppsHook3 from auto-wrapping binaries.
-    dontWrapGApps = true;
-
     src = fetchzip {
       url = "https://jp-minerals.org/vesta/archives/${version}/VESTA-gtk3.tar.bz2";
       hash = "sha256-Dm4exMUgNZ6Sh8dVhsvLZGS38UXxe9t+9s3ttBQajGg=";
@@ -75,7 +64,7 @@ let
       cp -r * $out/lib/VESTA
 
       mkdir -p $out/bin
-      ln -s $out/lib/VESTA/VESTA{-core,-gui} -t $out/bin
+      ln -s $out/lib/VESTA/VESTA{,-core,-gui} -t $out/bin
 
       mkdir -p $out/share/icons/hicolor/{128x128,256x256}/apps
       ln -s $out/lib/VESTA/img/logo.png $out/share/icons/hicolor/128x128/apps/VESTA.png
@@ -84,11 +73,6 @@ let
       runHook postInstall
     '';
 
-    # Wrap GSettings/XDG_DATA_DIRS into a single wrapper.
-    postFixup = ''
-      makeWrapper $out/lib/VESTA/VESTA $out/bin/VESTA "''${gappsWrapperArgs[@]}"
-    '';
-
     desktopItems = [
       (makeDesktopItem {
         name = "vesta";
@@ -98,18 +82,14 @@ let
         exec = "VESTA %u";
         icon = "VESTA";
         categories = [ "Science" ];
-        mimeTypes = [
-          "chemical/x-cif"
-          "chemical/x-pdb"
-          "chemical/x-xyz"
-        ];
+        mimeTypes = [ "application/x-vesta" ];
       })
     ];
   };
 
   darwinArgs = {
     nativeBuildInputs = [
-      _7zz
+      _7zz # instead of undmg because of APFS
     ];
     src = fetchurl {
       url = "https://jp-minerals.org/vesta/archives/${version}/VESTA.dmg";

pkgs/by-name/vi/vivliostyle/0001-allow-specifying-browser-path-via-env-var.patch

@@ -1,20 +0,0 @@
----
- src/browser.ts | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/browser.ts b/src/browser.ts
-index 8e653e2..ae57d2f 100644
---- a/src/browser.ts
-+++ b/src/browser.ts
-@@ -355,6 +355,8 @@ export async function getExecutableBrowserPath({
-   type,
-   tag,
- }: ResolvedTaskConfig['browser']): Promise<string> {
-+  const envPath = process.env.VIVLIOSTYLE_BROWSER_PATH;
-+  if (envPath && fs.existsSync(envPath)) return envPath;
-   const browsers = await importNodeModule('@puppeteer/browsers');
-   const buildId = await resolveBuildId({ type, tag, browsers });
-   return browsers.computeExecutablePath({
--- 
-2.54.0
-

pkgs/by-name/vi/vivliostyle/package.nix

@@ -1,99 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchPnpmDeps,
-  nix-update-script,
-
-  # build-time
-  makeBinaryWrapper,
-  nodejs,
-  pnpmBuildHook,
-  pnpmConfigHook,
-  pnpm_10,
-
-  chromium,
-  defaultBrowser ? chromium,
-}:
-
-let
-  pnpm = pnpm_10;
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "vivliostyle";
-  version = "11.1.0";
-
-  src = fetchFromGitHub {
-    owner = "vivliostyle";
-    repo = "vivliostyle-cli";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-rbb/av3amlLit7OjTc+S/pf1SrxEnsENQOArgnc7k3s=";
-  };
-
-  patches = [
-    ./0001-allow-specifying-browser-path-via-env-var.patch
-  ];
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    fetcherVersion = 4;
-    hash = "sha256-WPTCLAEWmD1TY84281TJCzp+mcjMFM5Xwf02s7U+M4U=";
-  };
-
-  nativeBuildInputs = [
-    makeBinaryWrapper
-    nodejs
-    pnpm
-    pnpmBuildHook
-    pnpmConfigHook
-  ];
-
-  pnpmBuildFlags = [
-    "--mode"
-    "production"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,lib}
-    mv {node_modules,dist,examples,packages,package.json} $out/lib
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    chmod +x $out/lib/dist/cli.js
-    patchShebangs $out/usr/lib/dist/cli.js
-
-    makeWrapper $out/lib/dist/cli.js $out/bin/vivliostyle \
-      --prefix PATH : ${lib.makeBinPath [ nodejs ]} \
-      --set VIVLIOSTYLE_BROWSER_PATH ${lib.getExe defaultBrowser}
-
-    ln -s $out/bin/vivliostyle $out/bin/vs
-  '';
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "CLI tool for typesetting HTML and Markdown documents";
-    longDescription = ''
-      Vivliostyle is a CSS typesetting ecosystem for creating beautifully
-      formatted documents using web technologies.
-    '';
-    homepage = "https://github.com/vivliostyle/vivliostyle-cli";
-    changelog = "https://github.com/vivliostyle/vivliostyle-cli/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    mainProgram = "vivliostyle";
-    license = lib.licenses.agpl3Only;
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ eljamm ];
-    teams = with lib.teams; [ ngi ];
-  };
-})

pkgs/by-name/xs/xsimd/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xsimd";
-  version = "14.2.0";
+  version = "14.3.0";
 
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     tag = finalAttrs.version;
-    hash = "sha256-BTiN4B3//wlB3nmOoluM/7bL7J7YIBp5afih9zUP1yw=";
+    hash = "sha256-0m9gUDCgGh58lf9uPp1Obw4rsqWEL1RffWYB6s315p0=";
   };
 
   # strictDeps raises the chance that xsimd will be able to be cross compiled

pkgs/by-name/xv/xvfb/package.nix

@@ -38,14 +38,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  # TODO: commented out for rebuild avoidance after xorg-server update. revert
-  # on staging.
-  # inherit (xorg-server) src version;
-  version = "21.1.23";
-  src = fetchurl {
-    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
-  };
+  inherit (xorg-server) src version;
 
   strictDeps = true;
 

pkgs/development/compilers/rust/1_97.nix

@@ -50,8 +50,8 @@ let
 in
 import ./default.nix
   {
-    rustcVersion = "1.97.0";
-    rustcSha256 = "sha256-HAhV2JgqD7HQMhtgVLVbcy07HRfIRoQet/0Ks3vydvg=";
+    rustcVersion = "1.97.1";
+    rustcSha256 = "sha256-YiwrQpxTy/3A3TpR0DVU6RzWPr7BkSwfVwlkDN/vGp0=";
 
     llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
     llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -65,27 +65,27 @@ import ./default.nix
     # Note: the version MUST be the same version that we are building. Upstream
     # ensures that each released compiler can compile itself:
     # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.97.0";
+    bootstrapVersion = "1.97.1";
 
     # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
     bootstrapHashes = {
-      i686-unknown-linux-gnu = "d066e5dd59c15fc1c793173d53b41719162de4470b5c34041a8bc664542df375";
-      x86_64-unknown-linux-gnu = "eb89b20287153391c49ebcdb7fd91b683a12438d129bfb92eadcc495545af3a7";
-      x86_64-unknown-linux-musl = "675bb2d574efc64da0563a9cb70cc017560394c5938e04c92987cad383299e8d";
-      arm-unknown-linux-gnueabihf = "180e487a1f7abaeda374b942d369dd7faa4364b1267629d48552d9a17a5bc4ab";
-      armv7-unknown-linux-gnueabihf = "2f9dfd76694efcf391f6d4947e97be17d1f469c9e989ed194660ddd85877ca60";
-      aarch64-unknown-linux-gnu = "70fb01b4894d56fad34c260ce63aee647589be57a26ab33730110d8228cbcf02";
-      aarch64-unknown-linux-musl = "28efcf4ee31235eb5f7820dadba46400ab9dbbb030719e7a2ab284b02c8cbf82";
-      x86_64-apple-darwin = "3dc9ad8ec35a9f0acd2c5ae2c80c36baf5c7010423bf339ca55709fc995885d4";
-      aarch64-apple-darwin = "c2e6a5ef480f5715ae9874188c1fa749b6a6f90d8d911f5a3a5d768f0ac70427";
-      powerpc64-unknown-linux-gnu = "62c9f9b7887505fc4dcda40784469f23909657d245e53025a7a8124b016d6631";
-      powerpc64le-unknown-linux-gnu = "a8d3f487d07cebc48ce03ad66a970a5f5138a5c1e7c7cec12fb9b6e47a24bf1a";
-      powerpc64le-unknown-linux-musl = "09fee3b9ede1e94ff6c3bad3918dc231be909c74bb182e0acd583c03a9f1df5f";
-      riscv64gc-unknown-linux-gnu = "be239392f7112f6a81f20c9e715d5743319a8b773592e027ad800d73527d8fae";
-      s390x-unknown-linux-gnu = "fee699e31d0a0034f46669c473e61a88af6734f8c5902d77329ac236fcd9b538";
-      loongarch64-unknown-linux-gnu = "37ad9d55b98cc680a2d75c7184e6457b632ce82690a56be7a2044e32c91176ce";
-      loongarch64-unknown-linux-musl = "bfba202bae252ac372026171d9bc98e5eb80578d576546f56e8aee2e9d64ecf0";
-      x86_64-unknown-freebsd = "77101232e3769395e99c0e663d2c8beb3d4127857945cf7c812c1886ba823b8f";
+      i686-unknown-linux-gnu = "914c2702deada0b9cf1d64bb3495d76e55cb3eba07d508472dde8b55a93e3759";
+      x86_64-unknown-linux-gnu = "b4cdbc7cc6b0ee0a2666b1872769fdb2ad8393b28b63952f6493b4b400e4832b";
+      x86_64-unknown-linux-musl = "40dbea28193cf2b488cf3e4a89274ccfb60efa50883f19917a382f84fd05bdc4";
+      arm-unknown-linux-gnueabihf = "ba62fe07ad85b507907705a14adc1e8bc258de5f6177ba41d77bbff9f469a4ce";
+      armv7-unknown-linux-gnueabihf = "e89c5e33aaddc6ef56857000c9117875c2997e9a1a500bd7b16277c9874b002f";
+      aarch64-unknown-linux-gnu = "2f2496c70bd336a66a4c8baf2d303ba161f3552f192444c3639ba903c7c1e2c5";
+      aarch64-unknown-linux-musl = "c5f45b5c6eb7f8fdb277c54c08402b7c931516740fbd4eccc26ba148f7cd5d57";
+      x86_64-apple-darwin = "5f4c84d2bcce7983468642855a45fc4978fba1324cfdd1ea0b182face3ab4ffa";
+      aarch64-apple-darwin = "cbd14c36f039f6f11f38148a6295d8234d18ddf20bea53031c86f119423a8b26";
+      powerpc64-unknown-linux-gnu = "2b507d5eb9b5c4c041b50e93e069db56d094f02e6df103dc74c016155141bfae";
+      powerpc64le-unknown-linux-gnu = "ff524eef5a59d801df09ccad5cdaf9ea1f0a07d75cbed2a7e9f013a9eb76a3c1";
+      powerpc64le-unknown-linux-musl = "15630f33fbea2dd9661f8482b6c612da271549aba40401444aaa53650e646b9b";
+      riscv64gc-unknown-linux-gnu = "59bec35d8febb2ab918fa41cffbaa5b07146a63bdc33f029ff756d70a3151ece";
+      s390x-unknown-linux-gnu = "808268af9e880d41b8cb32b242e38c9bd3ea7aba6409b02fbffa0fbc5370c538";
+      loongarch64-unknown-linux-gnu = "d5a925962854730ae7641420d8337af93988ea4ff47b503a856ec53776c87841";
+      loongarch64-unknown-linux-musl = "3fb653299d228e3e0726afb179b07dd10a51a2ecc3cdfcd740011b1d8420ca97";
+      x86_64-unknown-freebsd = "77866a4c449bcccb40e9d6712bf3eb899d29018ed8e841fd9d8d59370751f152";
     };
 
     selectRustPackage = pkgs: pkgs.rust_1_97;

pkgs/development/libraries/fontconfig/default.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fontconfig";
-  version = "2.18.1";
+  version = "2.18.2";
 
   outputs = [
     "bin"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   # ref: https://github.com/NixOS/nixpkgs/pull/401037#discussion_r2055430206
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/api/v4/projects/890/packages/generic/fontconfig/${finalAttrs.version}/fontconfig-${finalAttrs.version}.tar.xz";
-    hash = "sha256-IwDz2/pyU7OkT0/uzbyN+kXd5dws+3H86vMfOUy0EDE=";
+    hash = "sha256-z45ldu8EhMFQeb2vd82cUcRk31NlgUraTT7nMx6jHrU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gmp/6.x.nix

@@ -69,8 +69,7 @@ let
     ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) "ABI=64"
     # to build a .dll on windows, we need --disable-static + --enable-shared
     # see https://gmplib.org/manual/Notes-for-Particular-Systems.html
-    ++ optional (!withStatic && stdenv.hostPlatform.isPE) "--disable-static --enable-shared"
-    ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) "--disable-assembly";
+    ++ optional (!withStatic && stdenv.hostPlatform.isPE) "--disable-static --enable-shared";
 
     doCheck = true; # not cross;
 

pkgs/development/python-modules/aiohttp/default.nix

@@ -48,14 +48,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiohttp";
-  version = "3.14.1";
+  version = "3.14.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OJSLv/NfVrKESZqNr51FJUzLRz7wLMRdGoNjKC5EhlI=";
+    hash = "sha256-gpAYbANSlUZoB0lATEP2N288GxlF8/GzD7bEW1AkHZw=";
   };
 
   postPatch = ''

pkgs/development/python-modules/faust-cchardet/default.nix

@@ -3,16 +3,16 @@
   buildPythonPackage,
   fetchFromGitHub,
   cython,
+  packaging,
   pkgconfig,
   setuptools,
-  wheel,
   pytestCheckHook,
   python,
 }:
 
 buildPythonPackage rec {
   pname = "faust-cchardet";
-  version = "2.1.19";
+  version = "2.1.20";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -20,14 +20,19 @@ buildPythonPackage rec {
     repo = "cChardet";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-yY6YEhXC4S47rxnkKAta4m16IVGn7gkHSt056bYOYJ4=";
+    hash = "sha256-MeRX/g38c+q2jiTtEhUpaGYf+5tkhexRGuIG0PdUGvI=";
   };
 
-  nativeBuildInputs = [
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "packaging<26" packaging
+  '';
+
+  build-system = [
     cython
+    packaging
     pkgconfig
     setuptools
-    wheel
   ];
 
   postFixup = ''
@@ -41,7 +46,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
-    changelog = "https://github.com/faust-streaming/cChardet/blob/${src.rev}/CHANGES.rst";
+    changelog = "https://github.com/faust-streaming/cChardet/blob/${src.tag}/CHANGES.rst";
     description = "High-speed universal character encoding detector";
     mainProgram = "cchardetect";
     homepage = "https://github.com/faust-streaming/cChardet";

pkgs/development/python-modules/feedgen/default.nix

@@ -2,27 +2,30 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   python-dateutil,
   lxml,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "feedgen";
   version = "1.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-2b1Rw7XpVqKlKZjDcIxNLHKfL8wxEYjh5dO5cmOTVGo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     python-dateutil
     lxml
   ];
 
-  # No tests in archive
-  doCheck = false;
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
     description = "Python module to generate ATOM feeds, RSS feeds and Podcasts";
@@ -34,4 +37,4 @@ buildPythonPackage rec {
     ];
     maintainers = with lib.maintainers; [ casey ];
   };
-}
+})

pkgs/development/python-modules/fields/default.nix

@@ -2,24 +2,29 @@
   buildPythonPackage,
   lib,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fields";
   version = "5.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-MdSqA9jUTjXfE8Qx3jUTaZfwR6kkpZfYT3vCCeG+Vyc=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "fields" ];
 
+  doCheck = false; # Argument(s) {'path'} are declared in the hookimpl but can not be found in the hookspec
+
   meta = {
     description = "Container class boilerplate killer";
     homepage = "https://github.com/ionelmc/python-fields";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.sheepforce ];
   };
-}
+})

pkgs/development/python-modules/filelock/default.nix

@@ -41,6 +41,7 @@ buildPythonPackage (finalAttrs: {
     "tests/test_virtualenv.py"
     # Very prone to timeouts on busy machines
     "tests/test_filelock.py"
+    "tests/test_read_write.py"
   ];
 
   meta = {

pkgs/development/python-modules/matplotlib/default.nix

@@ -69,13 +69,13 @@ let
 in
 
 buildPythonPackage (finalAttrs: {
-  version = "3.11.0";
+  version = "3.11.1";
   pname = "matplotlib";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-aMDHvgGzDcyjY4k09/WR33NAEjXL2/DRqxxx59t/i1c=";
+    hash = "sha256-aWR9tXRpQceT1uRFpM00kyP/uH2cyVjCrYSmWbSDLTA=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";

pkgs/development/python-modules/mkdocs-awesome-nav/default.nix

@@ -3,7 +3,6 @@
   gitMinimal,
   buildPythonPackage,
   fetchFromGitHub,
-  pyprojectVersionPatchHook,
   flit-core,
   mkdocs,
   mkdocs-exclude,
@@ -26,10 +25,6 @@ buildPythonPackage rec {
     hash = "sha256-guv+c4QwaATYEZ6XcWVZaOcZ7U9oLsW+RdWBtB1Xrnc=";
   };
 
-  nativeBuildInputs = [
-    pyprojectVersionPatchHook
-  ];
-
   build-system = [ flit-core ];
 
   dependencies = [

pkgs/development/python-modules/multipart/default.nix

@@ -6,16 +6,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "multipart";
-  version = "1.3.1";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "defnull";
     repo = "multipart";
-    tag = "v${version}";
-    hash = "sha256-kLiOK6ovW3ki1CONXVQZCJw/U3K1AoR6rrmJUstwZOw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1/G8qUnY7i5OvxkTSebC2pae9lzzfvnozJSVVylqB7w=";
   };
 
   build-system = [ flit-core ];
@@ -25,10 +25,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "multipart" ];
 
   meta = {
-    changelog = "https://github.com/defnull/multipart/blob/${src.tag}/CHANGELOG.rst";
+    changelog = "https://github.com/defnull/multipart/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     description = "Parser for multipart/form-data";
     homepage = "https://github.com/defnull/multipart";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

pkgs/development/python-modules/osmnx/default.nix

@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "osmnx";
-  version = "2.1.1";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gboeing";
     repo = "osmnx";
     tag = "v${version}";
-    hash = "sha256-PX4Vhf3R9UGKMYp636+tJ5NV/oURd3Zzxfvj7LLCaPM=";
+    hash = "sha256-3uLgc6zptmXlPg93qtsWbqNxXiBD/SEnXBL/IM/1m2c=";
   };
 
   build-system = [ uv-build ];

pkgs/development/python-modules/rf-protocols/default.nix

@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  prek,
   pyprojectVersionPatchHook,
   pytest-asyncio,
   pytestCheckHook,
@@ -33,7 +32,6 @@ buildPythonPackage (finalAttrs: {
   ];
 
   nativeCheckInputs = [
-    prek
     pytest-asyncio
     pytestCheckHook
   ];

pkgs/development/python-modules/sh/default.nix

@@ -38,7 +38,9 @@ buildPythonPackage rec {
     "test_unicode_path"
     # fails to import itself after modifying the environment
     "test_environment"
-    # timing sensitive through usage of sleep(1) and signal handling
+    # timing sensitive due to strict timeouts
+    "test_done_callback_no_deadlock"
+    "test_timeout_overstep"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # Disable tests that fail on Darwin sandbox

pkgs/os-specific/linux/systemd/default.nix

@@ -203,13 +203,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "261";
+  version = "261.1";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6IB1ZEQqQ0impwBhCaLZAEgMVkVFU61JDVlGotxNzGQ=";
+    hash = "sha256-4iOitWGdRmGgJjEXGWtq2lEhPtGguma+qrjTShrps2g=";
   };
 
   # PATCH POLICY

pkgs/tools/misc/findutils/default.nix

@@ -13,24 +13,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "findutils";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/findutils-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+    sha256 = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0=";
   };
 
   postPatch = ''
-    substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${coreutils}/bin/echo";'
+    substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";'
   '';
 
   patches = [
     ./no-install-statedir.patch
-
-    # Fixes test-float failure on ppc64 with C23
-    # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
-    # Multiple upstream commits squashed with adjustments, see header
-    ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
   ];
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
@@ -53,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     # "sort" need not be on the PATH as a run-time dep, so we need to tell
     # configure where it is. Covers the cross and native case alike.
-    "SORT=${coreutils}/bin/sort"
+    "SORT=${lib.getExe' coreutils "sort"}"
     "--localstatedir=/var/cache"
   ];
 
@@ -86,6 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.gnu.org/software/findutils/";
+    changelog = "https://cgit.git.savannah.gnu.org/cgit/findutils.git/tree/NEWS?h=v${finalAttrs.version}";
     description = "GNU Find Utilities, the basic directory searching utilities of the GNU operating system";
     longDescription = ''
       The GNU Find Utilities are the basic directory searching

pkgs/tools/misc/findutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch

@@ -1,225 +0,0 @@
-Applied the following incremental gnulib commits:
-
-- 55a366a06fbd98bf13adc531579e3513cee97a32
-- 65ed9d3b24ad09fd61d326c83e7f1b05f6e9d65f
-- ce8e9de0bf34bc63dffc67ab384334c509175f64
-- 6164b4cb0887b5331a4e64449107decd37d32735
-
-With adjustments specific to the structure & differences in findutils:
-
-- gnulib code is split across gl/lib and gnulib-tests
-- float.in.h seems old, lacking blocks for standards C11 and up. Relevant code for LDBL_NORM_MAX was added.
-- A Makefile.in is used for the test flags instead of the fancy automake modules
-  in the upstream gnulib project, so we add -lm to the float test there.
-  Surrounding texts in this file are slightly different in every project.
----
-diff '--color=auto' -ruN a/gl/lib/float.c b/gl/lib/float.c
---- a/gl/lib/float.c	2024-01-01 21:35:38.000000000 +0100
-+++ b/gl/lib/float.c	2026-01-02 16:11:07.508755119 +0100
-@@ -22,7 +22,7 @@
- 
- #if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
- const union gl_long_double_union gl_LDBL_MAX =
--  { { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL } };
-+  { { DBL_MAX, DBL_MAX / 0x1p53 } };
- #elif defined __i386__
- const union gl_long_double_union gl_LDBL_MAX =
-   { { 0xFFFFFFFF, 0xFFFFFFFF, 32766 } };
-diff '--color=auto' -ruN a/gl/lib/float.in.h b/gl/lib/float.in.h
---- a/gl/lib/float.in.h	2024-01-01 21:35:38.000000000 +0100
-+++ b/gl/lib/float.in.h	2026-01-02 16:13:56.571684867 +0100
-@@ -111,44 +111,38 @@
- # define LDBL_MAX_10_EXP 4932
- #endif
- 
--/* On AIX 7.1 with gcc 4.2, the values of LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX are
--   wrong.
--   On Linux/PowerPC with gcc 4.4, the value of LDBL_MAX is wrong.  */
--#if (defined _ARCH_PPC || defined _POWER) && defined _AIX && (LDBL_MANT_DIG == 106) && defined __GNUC__
-+/* On PowerPC with gcc 15 when using __ibm128 long double, the value of
-+   LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX, and LDBL_NORM_MAX are wrong.  */
-+#if ((defined _ARCH_PPC || defined _POWER) && LDBL_MANT_DIG == 106 \
-+     && defined __GNUC__)
- # undef LDBL_MIN_EXP
- # define LDBL_MIN_EXP DBL_MIN_EXP
- # undef LDBL_MIN_10_EXP
- # define LDBL_MIN_10_EXP DBL_MIN_10_EXP
- # undef LDBL_MIN
- # define LDBL_MIN 2.22507385850720138309023271733240406422e-308L /* DBL_MIN = 2^-1022 */
--#endif
--#if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
- # undef LDBL_MAX
--/* LDBL_MAX is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xFFFFFFFF }.
--   It is not easy to define:
--     #define LDBL_MAX 1.79769313486231580793728971405302307166e308L
--   is too small, whereas
--     #define LDBL_MAX 1.79769313486231580793728971405302307167e308L
--   is too large.  Apparently a bug in GCC decimal-to-binary conversion.
--   Also, I can't get values larger than
--     #define LDBL63 ((long double) (1ULL << 63))
--     #define LDBL882 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL945 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL1008 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL_MAX (LDBL1008 * 65535.0L + LDBL945 * (long double) 9223372036821221375ULL + LDBL882 * (long double) 4611686018427387904ULL)
--   which is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xF8000000 }.
--   So, define it like this through a reference to an external variable
-+/* LDBL_MAX is 2**1024 - 2**918, represented as: { 0x7FEFFFFF, 0xFFFFFFFF,
-+                                                   0x7C9FFFFF, 0xFFFFFFFF }.
-+
-+   Do not write it as a constant expression, as GCC would likely treat
-+   that as infinity due to the vagaries of this platform's funky arithmetic.
-+   Instead, define it through a reference to an external variable.
-+   Like the following, but using a union to avoid type mismatches:
- 
--     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL };
-+     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / 0x1p53 };
-      extern const long double LDBL_MAX;
- 
--   or through a pointer cast
-+   The following alternative would not work as well when GCC is optimizing:
-+
-+     #define LDBL_MAX (*(long double const *) (double[])
-+                       { DBL_MAX, DBL_MAX / 0x1p53 })
- 
--     #define LDBL_MAX \
--       (*(const long double *) (double[]) { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL })
-+   The following alternative would require GCC 6 or later:
- 
--   Unfortunately, this is not a constant expression, and the latter expression
--   does not work well when GCC is optimizing..  */
-+     #define LDBL_MAX __builtin_pack_longdouble (DBL_MAX, DBL_MAX / 0x1p53)
-+
-+   Unfortunately none of the alternatives are constant expressions.  */
- # if !GNULIB_defined_long_double_union
- union gl_long_double_union
-   {
-@@ -159,6 +153,8 @@
- # endif
- extern const union gl_long_double_union gl_LDBL_MAX;
- # define LDBL_MAX (gl_LDBL_MAX.ld)
-+# undef LDBL_NORM_MAX
-+# define LDBL_NORM_MAX LDBL_MAX
- #endif
- 
- /* On IRIX 6.5, with cc, the value of LDBL_MANT_DIG is wrong.
-@@ -179,6 +175,35 @@
- # endif
- #endif
- 
-+/* On PowerPC platforms, 'long double' has a double-double representation.
-+   Up to ISO C 17, this was outside the scope of ISO C because it can represent
-+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits>, such as
-+   1.0L + 4.94065645841246544176568792868221e-324L = 1 + 2^-1074; see
-+   ISO C 17 § 5.2.4.2.2.(3).
-+   In ISO C 23, wording has been included that makes this 'long double'
-+   representation compliant; see ISO C 23 § 5.2.5.3.3.(8)-(9).  In this setting,
-+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits> are
-+   called "unnormalized".  And since LDBL_EPSILON must be normalized (per
-+   ISO C 23 § 5.2.5.3.3.(33)), it must be 2^-105.  */
-+#if defined __powerpc__ && LDBL_MANT_DIG == 106
-+# undef LDBL_EPSILON
-+# define LDBL_EPSILON 2.46519032881566189191165176650870696773e-32L /* 2^-105 */
-+#endif
-+
-+/* ============================ ISO C23 support ============================ */
-+
-+/* 'long double' properties */
-+
-+#ifndef LDBL_NORM_MAX
-+# ifdef __LDBL_NORM_MAX__
-+#  define LDBL_NORM_MAX __LDBL_NORM_MAX__
-+# else
-+#  define LDBL_NORM_MAX LDBL_MAX
-+# endif
-+#endif
-+
-+/* ================================= Other ================================= */
-+
- #if @REPLACE_ITOLD@
- /* Pull in a function that fixes the 'int' to 'long double' conversion
-    of glibc 2.7.  */
-diff '--color=auto' -ruN a/gnulib-tests/Makefile.in b/gnulib-tests/Makefile.in
---- a/gnulib-tests/Makefile.in	2024-06-01 18:18:09.000000000 +0200
-+++ b/gnulib-tests/Makefile.in	2026-01-02 15:56:12.645625323 +0100
-@@ -1172,7 +1172,7 @@
- 	../gl/lib/libgnulib.a libtests.a $(am__DEPENDENCIES_1)
- test_float_SOURCES = test-float.c
- test_float_OBJECTS = test-float.$(OBJEXT)
--test_float_LDADD = $(LDADD)
-+test_float_LDADD = $(LDADD) -lm
- test_float_DEPENDENCIES = libtests.a ../gl/lib/libgnulib.a libtests.a \
- 	../gl/lib/libgnulib.a libtests.a $(am__DEPENDENCIES_1)
- test_fnmatch_SOURCES = test-fnmatch.c
-diff '--color=auto' -ruN a/gnulib-tests/test-float.c b/gnulib-tests/test-float.c
---- a/gnulib-tests/test-float.c	2024-05-27 21:48:37.000000000 +0200
-+++ b/gnulib-tests/test-float.c	2026-01-02 16:15:21.261123584 +0100
-@@ -59,6 +59,8 @@
- 
- /* ------------------------------------------------------------------------- */
- 
-+#include <math.h>
-+
- #include "fpucw.h"
- #include "macros.h"
- 
-@@ -295,6 +297,44 @@
- 
- /* -------------------- Check macros for 'long double' -------------------- */
- 
-+static int
-+test_isfinitel (long double volatile x)
-+{
-+  if (x != x)
-+    return 0;
-+  long double volatile zero = x * 0;
-+  return zero == 0;
-+}
-+
-+/* Return X after normalization.  This makes a difference on platforms
-+   where long double can represent unnormalized values.  For example,
-+   suppose x = 1 + 2**-106 on PowerPC with IBM long double where
-+   FLT_RADIX = 2, LDBL_MANT_DIG = 106, and LDBL_EPSILON = 2**-105.
-+   Then 1 < x < 1 + LDBL_EPSILON, and normalize_long_double (x) returns 1.  */
-+static long double
-+normalize_long_double (long double volatile x)
-+{
-+  if (FLT_RADIX == 2 && test_isfinitel (x))
-+    {
-+      int xexp;
-+      long double volatile
-+        frac = frexpl (x, &xexp),
-+        significand = frac * pow2l (LDBL_MANT_DIG),
-+        normalized_significand = truncl (significand),
-+        normalized_x = normalized_significand * pow2l (xexp - LDBL_MANT_DIG);
-+
-+      /* The test_isfinitel defends against PowerPC with IBM long double,
-+         which fritzes out near LDBL_MAX.  */
-+      if (test_isfinitel (normalized_x))
-+        x = normalized_x;
-+    }
-+  else
-+    {
-+      /* Hope that X is already normalized.  */
-+    }
-+  return x;
-+}
-+
- static void
- test_long_double (void)
- {
-@@ -354,11 +394,14 @@
-     for (n = 0; n <= 2 * LDBL_MANT_DIG; n++)
-       {
-         volatile long double half_n = pow2l (- n); /* 2^-n */
--        volatile long double x = me - half_n;
-+        volatile long double x = normalize_long_double (me - half_n);
-         if (x < me)
-           ASSERT (x <= 1.0L);
-       }
-   }
-+
-+  /* Check the value of LDBL_NORM_MAX.  */
-+  ASSERT (LDBL_NORM_MAX == normalize_long_double (LDBL_MAX));
- }
- 
- int