python3Packages.werkzeug: 3.1.8 -> 3.1.9 (#581304)

Changelog: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-9

doc/languages-frameworks/ocaml.section.md

@@ -31,7 +31,7 @@ pkgs.mkShell {
 
 ## Packaging guide {#sec-language-ocaml-packaging}
 
-OCaml libraries should be installed in `$(out)/lib/ocaml/${ocaml.version}/site-lib/`. Such directories are automatically added to the `$OCAMLPATH` environment variable when building another package that depends on them or when opening a `nix-shell`.
+OCaml libraries are installed in `$out/lib/ocaml/${ocaml.version}/site-lib/`, or in the same directory of the `dev` output (see `buildDunePackage` below). Such directories are automatically added to the `$OCAMLPATH` environment variable when building another package that depends on them or when opening a `nix-shell`.
 
 Given that most of the OCaml ecosystem is now built with dune, nixpkgs includes a convenience build support function called `buildDunePackage` that will build an OCaml package using dune, OCaml and findlib and any additional dependencies provided as `buildInputs` or `propagatedBuildInputs`.
 
@@ -139,6 +139,29 @@ buildDunePackage (finalAttrs: {
 })
 ```
 
+Unless the package sets `outputs`, `buildDunePackage` builds separate outputs,
+and points `$OCAMLFIND_DESTDIR` to `dev`:
+
+- `out` contains what the package produces for use at runtime, such as
+  executables.
+- `dev` contains the OCaml libraries and the propagated dependencies needed to
+  build other packages against them. It is selected automatically when the
+  package is used as a build input.
+- `man` contains the man pages. Like `out`, it is installed by default.
+- `doc` contains the documentation, such as the README and license files.
+
+This keeps build-time only OCaml dependencies out of the runtime closure of
+executables. Code that refers to the library directory of such a package must
+use its `dev` output, for example `${lib.getDev menhirLib}/lib/ocaml` or
+`lib.makeSearchPathOutput "dev" "lib/ocaml/${ocaml.version}/site-lib"`.
+Likewise, installing the library into a profile or environment requires its
+`dev` output, e.g. `ocamlPackages.menhirLib.dev`.
+
+Toplevels and programs that load plugins need their own OCaml library at
+runtime, and the two outputs would refer to each other. Set
+`outputs = [ "out" ];` for such packages, and for packages whose custom
+`installPhase` installs everything into `$out`.
+
 The build will automatically fail if two distinct versions of the same library
 are added to `buildInputs` (which usually happens transitively because of
 `propagatedBuildInputs`). Set `dontDetectOcamlConflicts` to true to disable this

doc/languages-frameworks/swift.section.md

@@ -246,6 +246,46 @@ To disable the SwiftPM install phase, include the following in your derivation:
 { dontUseSwiftpmInstall = true; }
 ```
 
+## Swift Macros {#ssec-swift-macros}
+
+Nixpkgs includes the stdlib macros (ObservationMacros and SwiftMacros) and FoundationMacros in the toolchain.
+Packages that need macros for Apple frameworks on Darwin have two options:
+- `open-apple-macros` provides open-source implementations of FoundationModelsMacros and SwiftUIMacros; or
+- `darwin.xcode-macros` provides macro libraries from Xcode not otherwise included in the toolchain, but they are unfree.
+
+Add the appropriate package to `depsBuildBuild` (because they are compiler plugins that run on the build platform).
+If you need to manually specify the path for a package because it or its build system invokes `swiftc` directly:
+
+### `open-apple-macros` {#ssec-swift-macros-open-apple-macros}
+```nix
+{
+  buildPhase = ''
+    runHook preBuild
+    swiftc \
+      -external-plugin-path ${open-apple-macros}/lib/swift/host/plugins#${open-apple-macros}/libexec/swift/plugins/OpenAppleMacrosServer \
+      -disable-sandbox \
+      *.swift \
+      -o the_binary
+    runHook postBuild
+  '';
+}
+```
+
+### `darwin.xcode-macros` {#ssec-swift-macros-xcode-macros}
+```nix
+{
+  # For `darwin.xcode-macros`
+  buildPhase = ''
+    runHook preBuild
+    swiftc \
+      -plugin-path ${darwin.xcode-macros}/lib/swift/host/plugins \
+      *.swift \
+      -o the_binary
+    runHook postBuild
+  '';
+}
+```
+
 ## Hooks {#ssec-swift-hooks}
 
 Swift provides the following hooks to automate builds and unpack dependencies:

doc/redirects.json

@@ -4636,6 +4636,15 @@
   "ssec-swiftpm-install-phase": [
     "index.html#ssec-swiftpm-install-phase"
   ],
+  "ssec-swift-macros": [
+    "index.html#ssec-swift-macros"
+  ],
+  "ssec-swift-macros-open-apple-macros": [
+    "index.html#ssec-swift-macros-open-apple-macros"
+  ],
+  "ssec-swift-macros-xcode-macros": [
+    "index.html#ssec-swift-macros-xcode-macros"
+  ],
   "ssec-swift-hooks": [
     "index.html#ssec-swift-hooks"
   ],

doc/release-notes/rl-2611.section.md

@@ -54,6 +54,11 @@
 
 - `paperless-manage` now uses `runuser` instead of automatically calling `sudo` to set user/group before running. Invoke the script with `sudo paperless-manage` or an equivalent elevation tool of your choice
 
+- OpenSSL now prefers the system CA bundle at `/etc/ssl/certs/ca-certificates.crt` on both Linux and Darwin, falling back to `/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt` only when the system bundle is absent.
+  Previously, Darwin used the default Nix profile bundle directly.
+  An existing but unreadable or invalid system bundle does not trigger the fallback.
+  Explicit `NIX_SSL_CERT_FILE` and `SSL_CERT_FILE` overrides still take precedence.
+
 - `hyperfine` has been updated from 1.21.0 to 2.0.0, which contains several breaking changes:
   - Benchmarked commands are now executed directly instead of through an intermediate shell. Pass `-S`/`--shell=default` to restore the previous behavior.
   - The `--export-json` format has changed (schema version 2); tools consuming the exported JSON must be updated.
@@ -96,6 +101,13 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
+- `ocamlPackages.buildDunePackage` now builds packages with `out`, `dev`, `man` and `doc` outputs by default, unless they set `outputs`.
+  The OCaml libraries are installed into `dev`, man pages into `man`, documentation into `doc`, and `out` only contains what is needed at runtime, such as executables. This removes build-time only OCaml dependencies from the closure of tools like `patdiff`.
+  Code that refers to `${ocamlPackages.foo}/lib/ocaml` must use `${lib.getDev ocamlPackages.foo}/lib/ocaml` instead.
+  Installing such a library into a profile or environment (for example with `home.packages`, `environment.systemPackages` or `nix profile add`) no longer provides its `lib/ocaml` directory; install `ocamlPackages.foo.dev` instead.
+
+- The `bin` and `lib` outputs of `ocamlPackages.odoc`, `ocamlPackages.crunch`, `ocamlPackages.mdx` and `ocamlPackages.tw` were removed. Use the package itself for the executables, and its `dev` output for the OCaml library.
+
 - `bundlerApp` now sets `__structuredAttrs = true` for its result package.
   Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
 
@@ -194,6 +206,10 @@
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
+- `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now warn in the presence of `unittestFlagsArray`.
+  Please use [`unittestFlags`](#using-unittestcheckhook) instead.
+  If modifying the Nix expression is not feasible, users can remediate the warning by overriding `unittestFlagsArray` with `null` or `[ ]`.
+
 - `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
@@ -253,6 +269,8 @@
 
 - `tcl.mkTclDerivation` now enables `strictDeps` and `__structuredAttrs`.
 
+- `rustPlatform.cargoSetupHook` now forces several common C libraries to be linked to the Nixpkgs library rather than the vendored library. These include: aws-lc, openssl, libz, libsqlite3, zstd, libgit2, sodium, rustonig, libssh2, nginx, duckdb, and jemalloc. Set `dontCargoUseSystemLibs = true;` to opt out.
+
 - `rssguard` 5.x uses a new database layer. Regenerate your database after upgrading, following the [RSS Guard migration notes](https://rssguard.readthedocs.io/en/stable/contrib/migrate.html).
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
@@ -463,7 +481,7 @@
 
 - Firefox wrapper now accepts an optional `appDataDir` argument, which sets `MOZ_APP_DATA` to relocate Firefox application data. This is especially useful on macOS 27 and later, where wrapped Firefox applications may be denied access to profiles in traditional application data directory.
 
-- Swift has been upgraded to Swift 6.3.3 from Swift 5.10.1.
+- Swift has been upgraded to Swift 6.4.0 from Swift 5.10.1.
   The Swift packaging has been rewritten.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}

doc/stdenv/stdenv.chapter.md

@@ -1198,6 +1198,9 @@ They cannot be overridden without rebuilding the package.
 
 If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.
 
+`makeBinaryWrapper` refuses a `--prefix` or `--suffix` value that would introduce an empty segment (an empty value, or a leading, trailing or doubled separator), because many `PATH`-like variables interpret an empty segment as the current directory.
+For variables where an empty segment is useful and safe, such as `LUA_PATH` where `;;` stands for the default search path, use `--prefix-unchecked` or `--suffix-unchecked` instead.
+
 There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
 
 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.

maintainers/maintainer-list.nix

@@ -7950,7 +7950,7 @@
     name = "jan Lemata";
     github = "DuskyElf";
     githubId = 91879372;
-    email = "duskyelf.dev+nixpkgs@gmail.com";
+    email = "nixpkgs@duskyelf.me";
   };
   dustyhorizon = {
     name = "Kenneth Tan";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -18,6 +18,8 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
+- GNOME has been updated to version 51. Refer to the [GNOME release notes](https://release.gnome.org/51/) for more details.
+
 - `sing-box` now supports NaïveProxy outbounds.
 
 ## New Modules {#sec-release-26.11-new-modules}

nixos/lib/make-system-tarball.sh

@@ -41,7 +41,8 @@ mkdir -p $out/tarball
 
 rm env-vars
 
-time tar --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner -c * $extraArgs | $compressCommand > $out/tarball/$fileName.tar${extension}
+# Store optimization can change hardlink topology without changing input NARs.
+time tar --hard-dereference --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner -c * $extraArgs | $compressCommand > $out/tarball/$fileName.tar${extension}
 
 mkdir -p $out/nix-support
 echo $system > $out/nix-support/system

nixos/modules/services/admin/oxidized.nix

@@ -6,20 +6,6 @@
 }:
 let
   cfg = config.services.oxidized;
-
-  yaml = pkgs.formats.yaml { };
-  toYamlFile =
-    fn: attrs:
-    pkgs.runCommand fn
-      {
-        preferLocalBuild = true;
-      }
-      ''
-        cp ${yaml.generate fn attrs} $out
-
-        # unquote Ruby YAML tags into YAML scalars
-        sed -i -E "s/'(!ruby\/[^']*)'/\1/g" "$out"
-      '';
 in
 {
   options.services.oxidized = {
@@ -49,92 +35,39 @@ in
       description = "State directory for the oxidized service.";
     };
 
-    settings = lib.mkOption {
-      type = lib.types.nullOr yaml.type;
-      default = null;
-      example = {
-        debug = true;
-        use_syslog = true;
-        input = {
-          default = "ssh";
-          ssh.secure = true;
-        };
-        interval = 3600;
-        retries = 3;
-        model_map = {
-          cisco = "ios";
-          juniper = "junos";
-          dell = "powerconnect";
-          hp = "procurve";
-        };
-        source = {
-          default = "csv";
-          csv = {
-            delimiter = "!ruby/regexp /:/";
-            file = "/var/lib/oxidized/.config/oxidized/router.db";
-            map = {
-              name = 0;
-              model = 1;
-              username = 2;
-              password = 3;
-            };
-          };
-        };
-        pid = "/var/lib/oxidized/.config/oxidized/pid";
-        extensions = {
-          oxidized-web = {
-            load = true;
-            listen = "127.0.0.1";
-            port = 8888;
-            vhosts = [
-              "localhost"
-              "127.0.0.1"
-              "oxidized.example.com"
-            ];
-          };
-        };
-      };
-      description = ''
-        [Oxidized configuration] as a Nix attribute set installed at
-        {file}`/etc/oxidized/config`.
-
-        The resulting configuration file resides in the {file}`/nix/store`. Pass
-        secret values via {option}`services.oxidized.userConfigFile` instead.
-
-        This option is mutually exclusive with {option}`services.oxidied.configFile`.
-
-        ::: {.note}
-        Ruby-specific YAML tags can be passed as a quoted string. The config
-        renderer will unquote tags starting with `!ruby/` in both keys and values.
-        :::
-
-        [Oxidized configuration]: https://github.com/ytti/oxidized/blob/master/docs/Configuration.md
-      '';
-    };
-
     configFile = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
-      default = null;
-      description = ''
-        Path to the system-wide oxidized configuration file.
-
-        This file will be symlinked to {file}`/etc/oxidized/config`.
-
-        This option is mutually exclusive with {option}`services.oxidized.settings`.
+      example = lib.literalExpression ''
+        pkgs.writeText "oxidized-config.yml" '''
+          ---
+          debug: true
+          use_syslog: true
+          input:
+            default: ssh
+            ssh:
+              secure: true
+          interval: 3600
+          model_map:
+            dell: powerconnect
+            hp: procurve
+          source:
+            default: csv
+            csv:
+              delimiter: !ruby/regexp /:/
+              file: "/var/lib/oxidized/.config/oxidized/router.db"
+              map:
+                name: 0
+                model: 1
+                username: 2
+                password: 3
+          pid: "/var/lib/oxidized/.config/oxidized/pid"
+          rest: 127.0.0.1:8888
+          retries: 3
+          # ... additional config
+        ''';
       '';
-    };
-
-    userConfigFile = lib.mkOption {
-      type = lib.types.nullOr (lib.types.pathWith { inStore = false; });
-      default = null;
-      example = "/run/keys/oxidized";
       description = ''
-        Path to the per-user oxidized configuration file.
-
-        This file will be symlinked to {file}`/var/lib/oxidized/.config/oxidized/config`.
-
-        This config file is merged on top of the system-wide configuration file.
-        which makes it suitable for passing secrets.
+        Path to the oxidized configuration file.
       '';
     };
 
@@ -155,13 +88,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = (cfg.settings != null) != (cfg.configFile != null);
-        message = "Oxidized must be configured via exactly one of `settings` or `configFile`.";
-      }
-    ];
-
     users.groups.${cfg.group} = { };
     users.users.${cfg.user} = {
       description = "Oxidized service user";
@@ -171,9 +97,6 @@ in
       isSystemUser = true;
     };
 
-    environment.etc."oxidized/config".source =
-      if cfg.settings != null then toYamlFile "oxidized.yaml" cfg.settings else cfg.configFile;
-
     systemd.tmpfiles.settings."10-oxidized" = {
       "${cfg.dataDir}" = {
         d = {
@@ -200,10 +123,10 @@ in
       };
 
     }
-    // lib.optionalAttrs (cfg.userConfigFile != null) {
+    // lib.optionalAttrs (cfg.configFile != null) {
       "${cfg.dataDir}/.config/oxidized/config" = {
         "L+" = {
-          argument = "${cfg.userConfigFile}";
+          argument = "${cfg.configFile}";
           user = cfg.user;
           group = cfg.group;
         };

nixos/modules/services/desktop-managers/gnome.nix

@@ -461,35 +461,38 @@ in
             pkgs.gtk3.out # for gtk-launch program
             pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
             pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks
+            pkgs.gnome-extensions-app
+            pkgs.gnome-tecla
           ];
         in
         mandatoryPackages ++ removeExcluded optionalPackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-51/elements/core/meta-gnome-core-apps.bst
     (lib.mkIf serviceCfg.core-apps.enable {
       environment.systemPackages = removeExcluded [
         pkgs.baobab
         pkgs.decibels
         pkgs.epiphany
-        pkgs.gnome-text-editor
         pkgs.gnome-calculator
         pkgs.gnome-calendar
         pkgs.gnome-characters
         pkgs.gnome-clocks
+        pkgs.gnome-connections
         pkgs.gnome-console
         pkgs.gnome-contacts
+        # gnome-disk-utility is controlled below via `programs.gnome-disks`
         pkgs.gnome-font-viewer
         pkgs.gnome-logs
         pkgs.gnome-maps
         pkgs.gnome-music
+        # gnome-software is controlled below via `services.gnome.gnome-software`
         pkgs.gnome-system-monitor
-        pkgs.gnome-tecla
+        pkgs.gnome-text-editor
         pkgs.gnome-weather
         pkgs.loupe
         pkgs.nautilus
         pkgs.papers
-        pkgs.gnome-connections
         pkgs.showtime
         pkgs.simple-scan
         pkgs.snapshot
@@ -526,6 +529,7 @@ in
       ];
     })
 
+    # Note: This is an arbitrary list of packages, there is no "official" list of GNOME games.
     (lib.mkIf serviceCfg.games.enable {
       environment.systemPackages = removeExcluded [
         pkgs.aisleriot
@@ -551,18 +555,13 @@ in
       ];
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-developer-tools.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-51/elements/core/meta-gnome-core-developer-tools.bst
     (lib.mkIf serviceCfg.core-developer-tools.enable {
       environment.systemPackages = removeExcluded [
         pkgs.dconf-editor
         pkgs.devhelp
         pkgs.d-spy
         pkgs.gnome-builder
-        # boxes would make sense in this option, however
-        # it doesn't function well enough to be included
-        # in default configurations.
-        # https://github.com/NixOS/nixpkgs/issues/60908
-        # pkgs.gnome-boxes
         pkgs.sysprof
       ];
 

nixos/modules/services/display-managers/gdm.nix

@@ -353,8 +353,26 @@ in
           };
         }
       ]
+      ++ lib.optionals (!config.security.pam.p11.enable) [
+        {
+          settings."org/gnome/login-screen" = {
+            enable-smartcard-authentication = false;
+          };
+        }
+      ]
       ++ [ "${gdm}/share/gdm/greeter-dconf-defaults" ];
 
+    programs.dconf.profiles.user.databases = [
+      {
+        settings."org/gnome/login-screen" = {
+          enable-smartcard-authentication = config.security.pam.p11.enable;
+
+          # We currently don't provide a `gdm-switchable-auth` PAM service.
+          enable-switchable-authentication = false;
+        };
+      }
+    ];
+
     # Use AutomaticLogin if delay is zero, because it's immediate.
     # Otherwise with TimedLogin with zero seconds the prompt is still
     # presented and there's a little delay.
@@ -671,6 +689,85 @@ in
           ];
         };
       };
+
+      # Do not attempt to authenticate via smartcard when the login option
+      # "Password" is selected (gdm-password).
+      login.p11Auth = lib.mkIf config.security.pam.p11.enable false;
+
+      gdm-smartcard = lib.mkIf config.security.pam.p11.enable {
+        useDefaultRules = false;
+        rules = {
+          auth = utils.pam.autoOrderRules [
+            {
+              name = "nologin";
+              control = "requisite";
+              modulePath = "${config.security.pam.package}/lib/security/pam_nologin.so";
+            }
+            {
+              name = "faillock";
+              control = "requisite";
+              modulePath = "${config.security.pam.package}/lib/security/pam_faillock.so";
+              settings.preauth = true;
+            }
+            {
+              name = "p11";
+              control = "required";
+              modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so";
+              args = [
+                "${pkgs.opensc}/lib/opensc-pkcs11.so"
+              ];
+            }
+            {
+              name = "shells";
+              control = "required";
+              modulePath = "${config.security.pam.package}/lib/security/pam_shells.so";
+            }
+            {
+              name = "env";
+              control = "required";
+              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
+              settings.conffile = "/etc/pam/environment";
+              settings.readenv = 0;
+            }
+            {
+              name = "gdm";
+              enable = pamLogin.enable && pamLogin.enableGnomeKeyring;
+              control = "[success=ok default=1]";
+              modulePath = "${gdm}/lib/security/pam_gdm.so";
+            }
+            {
+              name = "gnome_keyring";
+              enable = pamLogin.enable && pamLogin.enableGnomeKeyring;
+              control = "optional";
+              modulePath = "${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so";
+            }
+          ];
+
+          account = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "include";
+              modulePath = "login";
+            }
+          ];
+
+          password = utils.pam.autoOrderRules [
+            {
+              name = "deny";
+              control = "required";
+              modulePath = "${config.security.pam.package}/lib/security/pam_deny.so";
+            }
+          ];
+
+          session = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "include";
+              modulePath = "login";
+            }
+          ];
+        };
+      };
     };
 
   };

nixos/modules/services/misc/aurral.nix

@@ -129,7 +129,8 @@ in
           "AF_INET"
           "AF_INET6"
         ];
-        # cloudflared's QUIC transport requires binding dynamically allocated UDP ports.
+        SocketBindDeny = "any";
+        SocketBindAllow = toString cfg.port;
         SystemCallErrorNumber = "EPERM";
         SystemCallFilter = [
           "@system-service"

nixos/modules/services/misc/spoolman.nix

@@ -22,7 +22,7 @@ in
         SPOOLMAN_AUTOMATIC_BACKUP = "TRUE";
         SPOOLMAN_BASE_PATH = "/spoolman";
         SPOOLMAN_METRICS_ENABLED = "TRUE";
-        SPOOLMAN_CORS_ORIGIN = "https://source1.domain.com,http://source2.domain.com:8080";
+        SPOOLMAN_CORS_ORIGIN = "source1.domain.com:p1, source2.domain.com:p2";
       };
       description = ''
         Environment variables to be passed to the spoolman service.

nixos/modules/services/misc/tabby.nix

@@ -98,7 +98,7 @@ in
 
           - nixpkgs.config.cudaSupport
           - nixpkgs.config.rocmSupport
-          - if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
+          - if stdenv.hostPlatform.isDarwin
 
           IFF multiple acceleration methods are found to be enabled or if you
           haven't set either `cudaSupport or rocmSupport` you will have to

nixos/tests/oxidized.nix

@@ -28,54 +28,46 @@ makeTest {
           routerDB = pkgs.writeText "oxidized-router.db" ''
             localhost:linuxgeneric:root
           '';
-          settings = {
-            interval = 3600;
-            retries = 3;
-            model = "linuxgeneric";
-            username = "root";
-            source = {
-              default = "csv";
-              csv = {
-                file = "/var/lib/oxidized/.config/oxidized/router.db";
-                delimiter = "!ruby/regexp /:/";
-                map = {
-                  name = 0;
-                  model = 1;
-                  username = 2;
-                  password = 3;
-                };
-                vars_map = {
-                  enable = 4;
-                };
-              };
-            };
-            input = {
-              default = "ssh";
-              utf8_encoded = true;
-            };
-            output = {
-              default = "git";
-              git = {
-                single_repo = true;
-                user = "oxidized";
-                email = "oxidized@example.com";
-                repo = "/var/lib/oxidized/git";
-              };
-            };
-            extensions = {
-              oxidized-web = {
-                load = true;
-                listen = "127.0.0.1";
-                port = 8888;
-                vhosts = [
-                  "localhost"
-                  "127.0.0.1"
-                  "oxidized"
-                  "oxidized.example.com"
-                ];
-              };
-            };
-          };
+          configFile = pkgs.writeText "oxidized-config.yml" ''
+            # vi: ft=yaml
+            ---
+            extensions:
+              oxidized-web:
+                load: true
+                listen: 127.0.0.1
+                port: 8888
+                vhosts:
+                  - localhost
+                  - 127.0.0.1
+                  - oxidized
+                  - oxidized.example.com
+            interval: 3600
+            retries: 3
+            model: linuxgeneric
+            username: root
+            source:
+              default: csv
+              csv:
+                file: "/var/lib/oxidized/.config/oxidized/router.db"
+                delimiter: !ruby/regexp /:/
+                map:
+                  name: 0
+                  model: 1
+                  username: 2
+                  password: 3
+                vars_map:
+                  enable: 4
+            input:
+              default: ssh
+              utf8_encoded: true
+            output:
+              default: git
+              git:
+                single_repo:  true
+                user: oxidized
+                email: oxidized@example.com
+                repo: /var/lib/oxidized/git
+          '';
         };
       };
       systemd.services.oxidized = {
@@ -92,6 +84,7 @@ makeTest {
 
         path = [ config.programs.ssh.package ];
       };
+
     };
 
   testScript =

nixos/tests/terminal-emulators.nix

@@ -41,6 +41,11 @@ let
     ghostty.pkg = p: p.ghostty;
     ghostty.cmd = "ghostty -e $command";
 
+    gnome-console.pkg = p: p.gnome-console;
+    gnome-console.executable = "kgx";
+    gnome-console.cmd = "kgx -e $command";
+    gnome-console.kill = true;
+
     gnome-terminal.pkg = p: p.gnome-terminal;
 
     guake.pkg = p: p.guake;
@@ -51,10 +56,6 @@ let
 
     kermit.pkg = p: p.kermit-terminal;
 
-    kgx.pkg = p: p.kgx;
-    kgx.cmd = "kgx -e $command";
-    kgx.kill = true;
-
     kitty.pkg = p: p.kitty;
     kitty.cmd = "kitty $command";
 

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.1164";
+  version = "9.2.1252";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-Ymtq7+egq8OydTdzHP/q14MK6p+crKlQwduJ27oDbNU=";
+    hash = "sha256-k5Na69KYXb7kxajpJFv9+vBymApaio7TwHrETudAGrk=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vscode/extensions/ms-azuretools.vscode-containers/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-azuretools";
     name = "vscode-containers";
-    version = "2.5.3";
-    hash = "sha256-QP74EdzkPqGjH1c9h8eESMubpvMDyLmC9eW4HcA9CBc=";
+    version = "2.5.2";
+    hash = "sha256-ERpwIOxLZxelWPRFYwsaEcbnOxW3cC3vGOKIkg92ztw=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -13,22 +13,22 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-wEpbJ/QxmoRoaet3B552n4at6QGfNmFdS/1SW94BEHw=";
+          hash = "sha256-YS/fX1utdHoPR2OgtQpvLA/gSePlfPieOGqgVrLiqQs=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-ATERu5GRmKDJgBSA48wIBiGf88smKmGduXVVjHosrNE=";
+          hash = "sha256-Z4sbBQ/wB/FlBh1K65AA2z9IWce11o2CSO12IJqTyZg=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-G4x5uSDU3yFthBi87pHezBBgrQFptMUpGfQDjQH3y4o=";
+          hash = "sha256-ovVwNVSHP0LNHOY8oGsV3JZ3N6wS0ZSpJfd6aPHpoS4=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.36.2";
+      version = "0.36.1";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -688,13 +688,13 @@
     "vendorHash": "sha256-J6zLLrX7/kKrkf00W2hDUYKpNmbrRzrziqb6aFRcO38="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-NjFrMXhPP0fbnB5he9dSn97PGq7yDw2YY6npvLzGtDs=",
+    "hash": "sha256-bCuQzBhuigU0Vi8cVOL6nZrHsjnsXh5AbSnVyoLWM1Q=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.83.0",
+    "rev": "v0.82.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XNFJSQAJKieL4rutVfRJCYFh9Ibse4i7aUJYUtwjtLI="
+    "vendorHash": "sha256-WKp01z2cNMbX/+HjhvNKcstQVbpNg75AwmLOOlbOPb8="
   },
   "hashicorp_time": {
     "hash": "sha256-7els7FaCojWzXp+0YP9YYJTAKS2PqpR1SMC1WxsfVb0=",

pkgs/applications/science/logic/coq/with-packages.nix

@@ -24,9 +24,9 @@ let
 
   coqPath = lib.makeSearchPath "/lib/coq/${rocq-version}/user-contrib" allPackages;
 
-  ocamlPath = lib.makeSearchPath "/lib/ocaml/${coq.ocamlPackages.ocaml.version}/site-lib" (
-    [ coq.ocamlPackages.findlib ] ++ allPackages
-  );
+  ocamlPath =
+    lib.makeSearchPathOutput "dev" "/lib/ocaml/${coq.ocamlPackages.ocaml.version}/site-lib"
+      ([ coq.ocamlPackages.findlib ] ++ allPackages);
 
   pathEnvVar = if isRocq then "ROCQPATH" else "COQPATH";
 in

pkgs/applications/virtualization/docker/default.nix

@@ -64,8 +64,6 @@ let
       versionCheckHook,
     }:
     let
-      systemdLibs' = systemdLibs.override { withCompression = true; };
-
       docker-meta = {
         license = lib.licenses.asl20;
         maintainers = with lib.maintainers; [
@@ -192,7 +190,7 @@ let
           ++ lib.optionals (lib.versionAtLeast version "29.0.0") [ nftables ]
           ++ lib.optionals withLvm [ lvm2 ]
           ++ lib.optionals withBtrfs [ btrfs-progs ]
-          ++ lib.optionals withSystemd [ systemdLibs' ]
+          ++ lib.optionals withSystemd [ systemdLibs ]
           ++ lib.optionals withSeccomp [ libseccomp ];
 
           postPatch = ''

pkgs/build-support/bintools-wrapper/ld-wrapper.sh

@@ -200,37 +200,30 @@ if [[ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 && "$linkType" != static-pie ]]; t
     # so, add the directory to the rpath.
     # It's important to add the rpath in the order of -L..., so
     # the link time chosen objects will be those of runtime linking.
-    declare -A rpaths
+    declare -A rpaths seenLibDirs
     for dir in ${libDirs+"${libDirs[@]}"}; do
-        # If the path is in the store, do not resolve any symlinks and add it to the rpath.
-        # Resolving symlinks in the store breaks bootstrapping, see issue #454199.
-        # If it is outside the store, resolve symlinks step by step until it falls
-        # into the store or it becomes not a symlink.
-        # Always canonicalize the path before checking it is in the store or not.
-        if dir2=$(realpath -s "$dir"); then
-            dir="$dir2"
-        else
+        # The same directory is often passed many times, such as from
+        # NIX_LDFLAGS; it would give the same result each time.
+        if [ -n "${seenLibDirs[$dir]:-}" ]; then
             continue
         fi
-        while [ -z "${rpaths[$dir]:-}" ] && [[ "$dir" != "${NIX_STORE:-}"/* ]] && [ -L "$dir" ]; do
-            if dir2=$(readlink "$dir"); then
-                dir="dir2"
-            else
-                break
-            fi
-            if dir2=$(realpath -s "$dir"); then
-                dir="dir2"
-            else
-                break
-            fi
-        done
+        seenLibDirs["$dir"]=1
+        # Find where the directory is, following symlinks outside the store,
+        # and in it only where needed; see resolveLibDir.  Skip directories
+        # that do not exist, in which the linker cannot find libraries either.
+        if ! [ -d "$dir" ] || ! resolveLibDir "$dir"; then
+            continue
+        fi
+        dir="$resolvedPath"
         # If the path turns out to be outside the store, we do not add it to rpath.
         # This typically happens for libraries in /tmp that are later
         # copied to $out/lib. If not, we're screwed.
         if [ -n "${rpaths[$dir]:-}" ] || [[ "$dir" != "${NIX_STORE:-}"/* ]]; then
             continue
         fi
-        for path in "$dir"/*; do
+        # Every name in libs is that of a shared library, ending in .so or
+        # containing .so., so the rest of the directory can be skipped.
+        for path in "$dir"/*.so*; do
             file="${path##*/}"
             if [ "${libs[$file]:-}" ]; then
                 # This library may have been provided by a previous directory,

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -129,6 +129,8 @@ lib.makeOverridable (
               "pki"
               # Custom dconf profiles
               "dconf"
+              # EGL platform definitions (required by nvidia-x11)
+              "egl"
             ];
           in
           map (path: "/etc/${path}") files;

pkgs/build-support/go/module.nix

@@ -302,7 +302,7 @@ lib.extendMkDerivation {
 
                 if [ "$cmd" = "test" ]; then
                   flags+=(-vet=off)
-                  flags+=($checkFlags)
+                  concatTo flags checkFlags
                 fi
 
                 local OUT

pkgs/build-support/node/prefetch-npm-deps/default.nix

@@ -20,6 +20,8 @@
     pname = "prefetch-npm-deps";
     version = (lib.importTOML ./Cargo.toml).package.version;
 
+    __structuredAttrs = true;
+
     src = lib.cleanSourceWith {
       src = ./.;
       filter =

pkgs/build-support/ocaml/dune.nix

@@ -45,6 +45,26 @@ lib.extendMkDerivation {
 
         strictDeps = true;
 
+        # OCaml libraries, and the dependencies they propagate, are only needed
+        # to build other packages. Unless the package chooses its outputs,
+        # those are installed into "dev", rather than "out", to minimize the
+        # "out" runtime closure. Man pages and documentation go to "man" and
+        # "doc".
+        outputs =
+          args.outputs or [
+            "out"
+            "dev"
+            "man"
+            "doc"
+          ];
+
+        # The findlib setup hook always points OCAMLFIND_DESTDIR at $out, so
+        # override it after all setup hooks have run.
+        postHook = ''
+          export OCAMLFIND_DESTDIR="''${!outputDev}/lib/ocaml/${ocaml.version}/site-lib/"
+        ''
+        + args.postHook or "";
+
         inherit enableParallelBuilding;
         dontAddStaticConfigureFlags = true;
         configurePlatforms = [ ];
@@ -67,12 +87,15 @@ lib.extendMkDerivation {
           args.installPhase or ''
             runHook preInstall
             dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${lib.concatStringsSep " " dunePackages} \
-             ${
-               if lib.versionAtLeast Dune.version "2.9" then
-                 "--docdir $out/share/doc --mandir $out/share/man"
-               else
-                 ""
-             }
+             ${lib.optionalString (lib.versionAtLeast Dune.version "2.9") ''
+               --docdir "''${!outputDoc}/share/doc" --mandir "''${!outputMan}/share/man" --etcdir "$out/etc" \
+             ''} ${lib.optionalString (lib.versionAtLeast Dune.version "3.0") ''
+               --bindir "''${!outputBin}/bin" --datadir "$out/share"
+             ''}
+            # Not every package installs something into each output.
+            for output in $(getAllOutputNames); do
+              mkdir -p "''${!output}"
+            done
             runHook postInstall
           '';
 
@@ -83,8 +106,22 @@ lib.extendMkDerivation {
             runHook postCheck
           '';
 
-        meta = (args.meta or { }) // {
-          platforms = args.meta.platforms or ocaml.meta.platforms;
-        };
+        # With several outputs, multiple-outputs.sh passes autoconf-style
+        # --bindir/--libdir/--mandir/... flags to ./configure. The configure
+        # scripts shipped by dune packages are hand-written and reject them.
+        setOutputFlags = args.setOutputFlags or false;
+
+        meta =
+          let
+            meta = args.meta or { };
+            # meta is often copied from another package, which may have other
+            # outputs. Keep the default if none of them are left.
+            outputsToInstall = lib.intersectLists finalAttrs.outputs (meta.outputsToInstall or [ ]);
+          in
+          removeAttrs meta [ "outputsToInstall" ]
+          // {
+            platforms = meta.platforms or ocaml.meta.platforms;
+          }
+          // lib.optionalAttrs (outputsToInstall != [ ]) { inherit outputsToInstall; };
       };
 }

pkgs/build-support/rust/fetch-cargo-vendor-util.py

@@ -1,57 +1,223 @@
 import functools
 import hashlib
 import json
-import multiprocessing as mp
+import os
 import re
 import shutil
 import subprocess
 import sys
+import tempfile
+import threading
 import tomllib
+from concurrent.futures import FIRST_EXCEPTION, Future, ThreadPoolExecutor, wait
+from dataclasses import dataclass, field
 from os.path import islink, realpath
 from pathlib import Path
-from typing import Any, TypedDict, cast
+from typing import Any, cast
 from urllib.parse import unquote
 
-import requests
 import tomli_w
+from requests import Session
 from requests.adapters import HTTPAdapter, Retry
 
+# Constants for controlling how the crates are downloaded from the registries via `requests`
+# These do not affect the fetching of git dependencies
+MAX_WORKERS = min(5, os.cpu_count() or 1)  # number of workers in the ThreadPoolExecutor
+CONNECT_TIMEOUT = 2  # max seconds for establishing initial connection
+READ_TIMEOUT = 10  # max seconds between receiving data packets
+TIMEOUT = (CONNECT_TIMEOUT, READ_TIMEOUT)
+RETRY_COUNT = 3  # number of retries for fetching an url
+BACKOFF_FACTOR = 0.5  # seconds to wait between retries (gets multiplied by 2 after every retry)
+
+# If for some reason our custom User-Agent value starts getting rejected, we could
+# set the User-Agent to the value that cargo uses, e.g.: "cargo/1.95.0 (f2d3ce0bd 2026-03-21)"
+USER_AGENT = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
+
 eprint = functools.partial(print, file=sys.stderr)
 
 
-def load_toml(path: Path) -> dict[str, Any]:
-    with open(path, "rb") as f:
-        return tomllib.load(f)
+@dataclass
+class RegistrySource:
+    raw: str
+    url: str
+    is_sparse: bool
+    ind: int = field(init=False)
 
 
-def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
-    # lockfile v1 and v2 don't have the `version` key, so assume v2
-    version = cargo_lock_toml.get("version", 2)
-
-    # TODO: add logic for differentiating between v1 and v2
-
-    return version
+@dataclass
+class RegistryPackage:
+    name: str
+    version: str
+    source: RegistrySource
+    checksum: str
 
 
-def create_http_session() -> requests.Session:
+GIT_SOURCE_REGEX = re.compile(r"git\+(?P<url>[^?]+)(\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
+
+
+@dataclass
+class GitSource:
+    raw: str
+    url: str
+    type: str | None
+    value: str | None
+    git_sha_rev: str
+    ind: int = field(init=False)
+
+
+@dataclass
+class GitPackage:
+    name: str
+    version: str
+    source: GitSource
+
+
+Source = RegistrySource | GitSource
+Package = RegistryPackage | GitPackage
+
+
+@dataclass
+class Lockfile:
+    version: int
+    sources: list[Source]
+    packages: list[Package]
+
+
+def parse_git_source(raw_source: str, lockfile_version: int) -> GitSource:
+    match = GIT_SOURCE_REGEX.match(raw_source)
+    if match is None:
+        raise Exception(f"Unable to process git source: {raw_source}.")
+
+    parsed_dict = match.groupdict(default=None)
+    url = cast(str, parsed_dict["url"])
+    git_sha_rev = cast(str, parsed_dict["git_sha_rev"])
+
+    source = GitSource(raw_source, url, parsed_dict["type"], parsed_dict["value"], git_sha_rev)
+
+    # the source URL is URL-encoded in lockfile_version >=4
+    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
+    if lockfile_version >= 4 and source.value is not None:
+        source.value = unquote(source.value)
+
+    return source
+
+
+def parse_source(raw_source: str, lockfile_version: int) -> Source:
+    if raw_source.startswith("git+"):
+        return parse_git_source(raw_source, lockfile_version)
+    elif raw_source.startswith("registry+"):
+        return RegistrySource(raw=raw_source, url=raw_source[9:], is_sparse=False)
+    elif raw_source.startswith("sparse+"):
+        return RegistrySource(raw=raw_source, url=raw_source[7:].rstrip("/"), is_sparse=True)
+    raise Exception(f"Cannot process source: {raw_source}")
+
+
+def load_lockfile(path: Path) -> Lockfile:
+    with path.open("rb") as f:
+        cargo_lock_toml = tomllib.load(f)
+
+    # The `version` key missing means either lockfile v1 or v2. We assume v2 for now.
+    lockfile_version = cargo_lock_toml.get("version", 2)
+
+    raw_packages: list[dict[str, str]] = cargo_lock_toml["package"]
+
+    sources: list[Source] = []
+    raw_source_to_source: dict[str, Source] = {}
+
+    # we'll mark every source with an index in order of appearance
+    # both git and registry sources have a different incrementing index
+    # we reserve registry index 0 for both of the default crates-io registries
+
+    for raw_source in ["registry+https://github.com/rust-lang/crates.io-index", "sparse+https://index.crates.io/"]:
+        source = parse_source(raw_source, lockfile_version)
+        source.ind = 0
+        sources.append(source)
+        raw_source_to_source[source.raw] = source
+
+    next_registry_ind = 1
+    next_git_ind = 0
+
+    git_selector_tuple_to_git_ind: dict[tuple[str, str | None, str | None], int] = {}
+
+    for raw_pkg in raw_packages:
+        raw_source = raw_pkg.get("source", None)
+        if raw_source is None:  # Skip local dependencies
+            continue
+        if raw_source in raw_source_to_source:
+            continue
+
+        source = parse_source(raw_source, lockfile_version)
+        match source:
+            case RegistrySource():
+                source.ind = next_registry_ind
+                next_registry_ind += 1
+            case GitSource():
+                # git sources may get the same `ind` value if their selectors match
+                tup = (source.url, source.type, source.value)
+                if tup not in git_selector_tuple_to_git_ind:
+                    git_selector_tuple_to_git_ind[tup] = next_git_ind
+                    next_git_ind += 1
+                source.ind = git_selector_tuple_to_git_ind[tup]
+
+        sources.append(source)
+        raw_source_to_source[source.raw] = source
+
+    packages: list[Package] = []
+
+    for raw_pkg in raw_packages:
+        name = raw_pkg["name"]
+        version = raw_pkg["version"]
+        raw_source = raw_pkg.get("source", None)
+        if raw_source is None:  # Skip local dependencies
+            continue
+        source = raw_source_to_source[raw_source]
+
+        match source:
+            case RegistrySource():
+                checksum = raw_pkg.get("checksum", None)
+
+                # lockfile v1 has the checksum values in a separate metadata table
+                if checksum is None:
+                    lockfile_version = 1
+                    checksum_key = f"checksum {name} {version} ({source.raw})"
+                    checksum = cargo_lock_toml["metadata"][checksum_key]
+
+                pkg = RegistryPackage(name, version, source, checksum)
+            case GitSource():
+                pkg = GitPackage(name, version, source)
+
+        packages.append(pkg)
+
+    return Lockfile(lockfile_version, sources, packages)
+
+
+_local = threading.local()
+
+
+def get_session() -> Session:
+    if hasattr(_local, "session"):
+        return _local.session
+
     retries = Retry(
-        total=5,
-        backoff_factor=0.5,
+        total=RETRY_COUNT,
+        backoff_factor=BACKOFF_FACTOR,
         status_forcelist=[500, 502, 503, 504]
     )
-    session = requests.Session()
-    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
+    session = Session()
+    session.headers["User-Agent"] = USER_AGENT
     session.mount('http://', HTTPAdapter(max_retries=retries))
     session.mount('https://', HTTPAdapter(max_retries=retries))
+
+    _local.session = session
     return session
 
 
-def download_file_with_checksum(session: requests.Session, url: str, destination_path: Path) -> str:
+def download_file_with_checksum(url: str, destination_path: Path) -> str:
+    session = get_session()
     sha256_hash = hashlib.sha256()
-    with session.get(url, stream=True) as response:
-        if not response.ok:
-            raise Exception(f"Failed to fetch file from {url}. Status code: {response.status_code}")
-        with open(destination_path, "wb") as file:
+    with session.get(url, stream=True, timeout=TIMEOUT) as response:
+        response.raise_for_status()
+        with destination_path.open("wb") as file:
             for chunk in response.iter_content(1024):  # Download in chunks
                 if chunk:  # Filter out keep-alive chunks
                     file.write(chunk)
@@ -62,117 +228,157 @@ def download_file_with_checksum(session: requests.Session, url: str, destination
     return checksum
 
 
-def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
-    # TODO: support other registries
-    #       maybe fetch config.json from the registry root and get the dl key
-    #       See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-    if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
-        raise Exception("Only the default crates.io registry is supported.")
+# Fetch the config.json file and get the .dl key from it
+# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
+def fetch_dl_for_registry_source(source: RegistrySource) -> str:
+    # We hardcode the .dl value for crates-io registries to avoid having to clone the git repo, saving a few seconds
+    if source.ind == 0:
+        return "https://static.crates.io/crates"
 
-    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
-    # rate limit on the API servers.
-    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
+    eprint(f'Fetching .dl value for registry "{source.url}"')
+    if source.is_sparse:
+        url = source.url + "/config.json"
+
+        # https://doc.rust-lang.org/cargo/reference/registry-web-api.html#web-api
+        headers = {
+            "Content-Type": "application/json",
+            "Accept": "application/json",
+        }
+
+        session = get_session()
+        with session.get(url, headers=headers, timeout=TIMEOUT) as response:
+            response.raise_for_status()
+            registry_config: dict[str, str] = response.json()
+    else:
+        tmp_dir = Path(tempfile.mkdtemp())
+        # use spare-checkout to only get the config.json file from the registry's git repo
+        # --quiet is deliberately not used to be able to debug if something goes wrong
+        cmd = ["nix-prefetch-git", "--builder", "--url", source.url, "--rev", "HEAD", "--sparse-checkout", "config.json", "--out", str(tmp_dir)]
+        subprocess.check_output(cmd)
+        with (tmp_dir / "config.json").open("rb") as f:
+            registry_config: dict[str, str] = json.load(f)
+
+    dl = registry_config["dl"]
+
+    auth_required = registry_config.get("auth-required", False)
+    if auth_required:
+        raise Exception(f'Registry "{source.url}" requires authentication, but it is not yet implemented!')
+
+    return dl
 
 
-def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
+# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-files
+def name_to_prefix(name: str) -> str:
+    nl = len(name)
+    if nl <= 2:
+        return str(nl)
+    if nl == 3:
+        return "3/" + name[0]
+    return name[0:2] + "/" + name[2:4]
 
-    url = get_download_url_for_tarball(pkg)
-    filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
 
-    # TODO: allow legacy checksum specification, see importCargoLock for example
-    #       also, don't forget about the other usage of the checksum
-    expected_checksum = pkg["checksum"]
+# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
+def make_download_url_for_tarball(pkg: RegistryPackage, dl: str) -> str:
+    # Assume default substitutions if no substitutions are specified
+    url = dl if "}" in dl else dl + "/{crate}/{version}/download"
 
-    tarball_out_dir = out_dir / "tarballs" / filename
-    eprint(f"Fetching {url} -> tarballs/{filename}")
+    prefix = name_to_prefix(pkg.name)
+    url = url.replace("{crate}", pkg.name)
+    url = url.replace("{version}", pkg.version)
+    url = url.replace("{prefix}", prefix)
+    url = url.replace("{lowerprefix}", prefix.lower())
+    url = url.replace("{sha256-checksum}", pkg.checksum)
+    return url
 
-    calculated_checksum = download_file_with_checksum(session, url, tarball_out_dir)
+
+def download_crate_tarball(url: str, out_path: Path, expected_checksum: str) -> None:
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+
+    eprint(f"Fetching {url} -> {out_path}")
+    calculated_checksum = download_file_with_checksum(url, out_path)
 
     if calculated_checksum != expected_checksum:
         raise Exception(f"Hash mismatch! File fetched from {url} had checksum {calculated_checksum}, expected {expected_checksum}.")
 
 
 def download_git_tree(url: str, git_sha_rev: str, out_dir: Path) -> None:
-
     tree_out_dir = out_dir / "git" / git_sha_rev
+
+    # This could happen if different selectors point to the same git_sha_rev
+    if tree_out_dir.exists():
+        eprint(f"Skipping fetching {url}#{git_sha_rev} as it has already been downloaded")
+        return
+
+    tree_out_dir.mkdir(parents=True)
+
     eprint(f"Fetching {url}#{git_sha_rev} -> git/{git_sha_rev}")
 
     cmd = ["nix-prefetch-git", "--builder", "--quiet", "--fetch-submodules", "--url", url, "--rev", git_sha_rev, "--out", str(tree_out_dir)]
     subprocess.check_output(cmd)
 
 
-GIT_SOURCE_REGEX = re.compile("git\\+(?P<url>[^?]+)(\\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
+def make_tarball_relpath(pkg: RegistryPackage) -> Path:
+    # Instead of .tar.gz we could have used the .crate extension
+    # But we keep using .tar.gz for backwards compat
+    filename = f'{pkg.name}-{pkg.version}.tar.gz'
 
+    # For backwards compat, all crates.io crates (where source.ind == 0)
+    # are stored directly in tarballs/
+    # Crates from other registries are stored in tarballs/registry-{ind}/
+    if pkg.source.ind == 0:
+        reldir = Path("tarballs")
+    else:
+        reldir = Path("tarballs") / f"registry-{pkg.source.ind}"
 
-class GitSourceInfo(TypedDict):
-    url: str
-    type: str | None
-    value: str | None
-    git_sha_rev: str
-
-
-def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
-    match = GIT_SOURCE_REGEX.match(source)
-    if match is None:
-        raise Exception(f"Unable to process git source: {source}.")
-
-    source_info = cast(GitSourceInfo, match.groupdict(default=None))
-
-    # the source URL is URL-encoded in lockfile_version >=4
-    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
-    if lockfile_version >= 4 and source_info["value"] is not None:
-        source_info["value"] = unquote(source_info["value"])
-
-    return source_info
+    return reldir / filename
 
 
 def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    git_packages: list[dict[str, Any]] = []
-    registry_packages: list[dict[str, Any]] = []
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            eprint(f"Skipping local dependency: {pkg["name"]}")
-            continue
-        source = pkg["source"]
-
-        if source.startswith("git+"):
-            git_packages.append(pkg)
-        elif source.startswith("registry+"):
-            registry_packages.append(pkg)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-    git_sha_rev_to_url: dict[str, str] = {}
-    for pkg in git_packages:
-        source_info = parse_git_source(pkg["source"], lockfile_version)
-        git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
+    lockfile = load_lockfile(lockfile_path)
 
     out_dir.mkdir(exist_ok=True)
     shutil.copy(lockfile_path, out_dir / "Cargo.lock")
 
-    # fetch git trees sequentially, since fetching concurrently leads to flaky behaviour
-    if len(git_packages) != 0:
-        (out_dir / "git").mkdir()
-        for git_sha_rev, url in git_sha_rev_to_url.items():
-            download_git_tree(url, git_sha_rev, out_dir)
+    git_sources = [source for source in lockfile.sources if isinstance(source, GitSource)]
+    registry_sources = [source for source in lockfile.sources if isinstance(source, RegistrySource)]
+    registry_packages = [pkg for pkg in lockfile.packages if isinstance(pkg, RegistryPackage)]
 
-    # run tarball download jobs in parallel, with at most 5 concurrent download jobs
-    with mp.Pool(min(5, mp.cpu_count())) as pool:
-        if len(registry_packages) != 0:
-            (out_dir / "tarballs").mkdir()
-            session = create_http_session()
-            tarball_args_gen = ((session, pkg, out_dir) for pkg in registry_packages)
-            pool.starmap(download_tarball, tarball_args_gen)
+    # We fetch git trees sequentially because fetching concurrently seemed to cause flaky behaviour
+    for source in git_sources:
+        download_git_tree(source.url, source.git_sha_rev, out_dir)
+
+    raw_registry_source_to_dl: dict[str, str] = {}
+    for source in registry_sources:
+        dl = fetch_dl_for_registry_source(source)
+        eprint(f'Using .dl value of "{dl}" for registry "{source.raw}"')
+        raw_registry_source_to_dl[source.raw] = dl
+
+    eprint(f"Downloading crate tarballs with {MAX_WORKERS} workers...")
+    with ThreadPoolExecutor(max_workers=MAX_WORKERS) as executor:
+        futures: list[Future[None]] = []
+
+        for pkg in registry_packages:
+            dl = raw_registry_source_to_dl[pkg.source.raw]
+            url = make_download_url_for_tarball(pkg, dl)
+
+            out_path = out_dir / make_tarball_relpath(pkg)
+
+            future = executor.submit(download_crate_tarball, url, out_path, pkg.checksum)
+            futures.append(future)
+
+        # fail early if a worker raises an exception
+        done, _ = wait(futures, return_when=FIRST_EXCEPTION)
+        for f in done:
+            e = f.exception()
+            if e is None:
+                continue
+            executor.shutdown(cancel_futures=True)
+            raise Exception(f"Failed to download tarball: {e}")
 
 
 def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
     cmd = ["cargo", "metadata", "--format-version", "1", "--no-deps", "--manifest-path", str(manifest_path)]
-    output = subprocess.check_output(cmd)
+    output = subprocess.check_output(cmd, cwd=manifest_path.parent)
     return json.loads(output)
 
 
@@ -244,8 +450,7 @@ def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_
     shutil.copytree(crate_tree, crate_out_dir, ignore=ignore_func)
     crate_out_dir.chmod(0o755)
 
-    with open(crate_manifest_path, "r") as f:
-        manifest_data = f.read()
+    manifest_data = crate_manifest_path.read_text()
 
     if "workspace" in manifest_data:
         crate_manifest_metadata = get_manifest_metadata(crate_manifest_path)
@@ -268,16 +473,16 @@ def extract_crate_tarball_contents(tarball_path: Path, crate_out_dir: Path) -> N
     subprocess.check_output(cmd)
 
 
-def make_git_source_selector(source_info: GitSourceInfo) -> dict[str, str]:
+def make_git_source_selector(source: GitSource) -> dict[str, str]:
     selector = {}
-    selector["git"] = source_info["url"]
-    if source_info["type"] is not None:
-        selector[source_info["type"]] = source_info["value"]
+    selector["git"] = source.url
+    if source.type is not None:
+        selector[source.type] = source.value
     return selector
 
 
-def make_registry_source_selector(source: str) -> dict[str, str]:
-    registry = source[9:] if source.startswith("registry+") else source
+def make_registry_source_selector(source: RegistrySource) -> dict[str, str]:
+    registry = source.raw if source.is_sparse else source.url
     selector = {}
     selector["registry"] = registry
     return selector
@@ -288,14 +493,9 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
     out_dir.mkdir(exist_ok=True)
     shutil.copy(lockfile_path, out_dir / "Cargo.lock")
 
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
+    lockfile = load_lockfile(lockfile_path)
 
-    source_to_ind: dict[str, str] = {}
-    selector_to_ind: dict[tuple, str] = {}
     source_config = {}
-    next_registry_ind = 0
-    next_git_ind = 0
 
     def add_source_replacement(
         orig_key: str,
@@ -308,112 +508,96 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
         source_config[orig_key] = orig_selector
         source_config[orig_key]["replace-with"] = vendored_key
 
-    # we reserve registry index 0 for crates-io
-    source_to_ind["registry+https://github.com/rust-lang/crates.io-index"] = "registry-0"
-    source_to_ind["sparse+https://index.crates.io/"] = "registry-0"
     add_source_replacement(
         orig_key="crates-io",
         orig_selector={},  # there is an internal selector defined for the `crates-io` source
         vendored_key="vendored-source-registry-0",
         vendored_dir="@vendor@/source-registry-0"
     )
-    next_registry_ind += 1
 
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependencies
-        if "source" not in pkg.keys():
-            continue
-        source: str = pkg["source"]
-        if source in source_to_ind:
-            continue
+    processed_git_inds = set()
 
-        if source.startswith("git+"):
-            source_info = parse_git_source(source, lockfile_version)
-            selector = make_git_source_selector(source_info)
-            selector_key = (source_info["url"], source_info["type"], source_info["value"])
-            if selector_key in selector_to_ind:
-                ind = selector_to_ind[selector_key]
-            else:
-                ind = f"git-{next_git_ind}"
-                next_git_ind += 1
-                selector_to_ind[selector_key] = ind
+    for source in lockfile.sources:
+        match source:
+            case RegistrySource():
+                if source.ind == 0:  # crates-io already handled separately above
+                    continue
                 add_source_replacement(
-                    orig_key=f"original-source-{ind}",
-                    orig_selector=selector,
-                    vendored_key=f"vendored-source-{ind}",
-                    vendored_dir=f"@vendor@/source-{ind}"
+                    orig_key=f"original-source-registry-{source.ind}",
+                    orig_selector=make_registry_source_selector(source),
+                    vendored_key=f"vendored-source-registry-{source.ind}",
+                    vendored_dir=f"@vendor@/source-registry-{source.ind}"
                 )
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            ind = f"registry-{next_registry_ind}"
-            next_registry_ind += 1
-            selector = make_registry_source_selector(source)
-            add_source_replacement(
-                orig_key=f"original-source-{ind}",
-                orig_selector=selector,
-                vendored_key=f"vendored-source-{ind}",
-                vendored_dir=f"@vendor@/source-{ind}"
-            )
-        else:
-            raise Exception(f"Can't process source: {source}.")
+            case GitSource():
+                # In some cases multiple git sources can have the same selector, thus the same git ind
+                # but source replacements can't be made for the same selector multiple times
+                if source.ind in processed_git_inds:
+                    continue
+                processed_git_inds.add(source.ind)
 
-        source_to_ind[source] = ind
+                add_source_replacement(
+                    orig_key=f"original-source-git-{source.ind}",
+                    orig_selector=make_git_source_selector(source),
+                    vendored_key=f"vendored-source-git-{source.ind}",
+                    vendored_dir=f"@vendor@/source-git-{source.ind}"
+                )
 
     config_path = out_dir / ".cargo" / "config.toml"
     config_path.parent.mkdir()
 
-    with open(config_path, "wb") as config_file:
+    with config_path.open("wb") as config_file:
         tomli_w.dump({"source": source_config}, config_file)
 
-    for pkg in cargo_lock_toml["package"]:
+    for pkg in lockfile.packages:
+        match pkg:
+            case RegistryPackage():
+                crate_out_dir = out_dir / f"source-registry-{pkg.source.ind}" / f"{pkg.name}-{pkg.version}"
+                crate_out_dir.parent.mkdir(exist_ok=True)
 
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            continue
+                tarball_path = vendor_staging_dir / make_tarball_relpath(pkg)
 
-        source: str = pkg["source"]
-        source_ind = source_to_ind[source]
-        crate_dir_name = f"{pkg["name"]}-{pkg["version"]}"
-        source_dir_name = f"source-{source_ind}"
-        crate_out_dir = out_dir / source_dir_name / crate_dir_name
-        crate_out_dir.parent.mkdir(exist_ok=True)
+                extract_crate_tarball_contents(tarball_path, crate_out_dir)
 
-        if source.startswith("git+"):
+                # non-git based crates need the package checksum at minimum
+                with (crate_out_dir / ".cargo-checksum.json").open("w") as f:
+                    json.dump({"files": {}, "package": pkg.checksum}, f)
 
-            source_info = parse_git_source(source, lockfile_version)
+            case GitPackage():
+                crate_out_dir = out_dir / f"source-git-{pkg.source.ind}" / f"{pkg.name}-{pkg.version}"
+                crate_out_dir.parent.mkdir(exist_ok=True)
 
-            git_sha_rev = source_info["git_sha_rev"]
-            git_tree = vendor_staging_dir / "git" / git_sha_rev
+                if crate_out_dir.exists():
+                    raise Exception(
+                        f"{crate_out_dir} already exists!\n"
+                        "This likely due to multiple packages having the same name, version and git selector, but not the same locked git revision\n"
+                        "As a workaround, change all conflicting packages to have different git selectors\n"
+                        "e.g. specifying an exact rev=<hash> selector for each affected package in both Cargo.toml and Cargo.lock\n"
+                        "If it is not possible or difficult to do so (e.g. it's a transient dependency), as a hack, you could also consider keeping\n"
+                        "the package with the most up-to-date revision and removing all other duplicated entries from Cargo.lock"
+                    )
 
-            copy_and_patch_git_crate_subtree(git_tree, pkg["name"], crate_out_dir)
+                git_sha_rev = pkg.source.git_sha_rev
+                git_tree = vendor_staging_dir / "git" / git_sha_rev
 
-            # git based crates allow having no checksum information
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}}, f)
+                copy_and_patch_git_crate_subtree(git_tree, pkg.name, crate_out_dir)
 
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-            # TODO: change this when non-crates-io registries are supported
-            dir_name = "tarballs"
-
-            tarball_path = vendor_staging_dir / dir_name / filename
-
-            extract_crate_tarball_contents(tarball_path, crate_out_dir)
-
-            # non-git based crates need the package checksum at minimum
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}, "package": pkg["checksum"]}, f)
-
-        else:
-            raise Exception(f"Can't process source: {source}.")
+                # git based crates allow having no checksum information
+                with (crate_out_dir / ".cargo-checksum.json").open("w") as f:
+                    json.dump({"files": {}}, f)
 
 
 def main() -> None:
     subcommand = sys.argv[1]
 
     subcommand_func_dict = {
-        "create-vendor-staging": lambda: create_vendor_staging(lockfile_path=Path(sys.argv[2]), out_dir=Path(sys.argv[3])),
-        "create-vendor": lambda: create_vendor(vendor_staging_dir=Path(sys.argv[2]), out_dir=Path(sys.argv[3]))
+        "create-vendor-staging": lambda: create_vendor_staging(
+            lockfile_path=Path(sys.argv[2]),
+            out_dir=Path(sys.argv[3])
+        ),
+        "create-vendor": lambda: create_vendor(
+            vendor_staging_dir=Path(sys.argv[2]),
+            out_dir=Path(sys.argv[3])
+        )
     }
 
     subcommand_func = subcommand_func_dict.get(subcommand)

pkgs/build-support/rust/hooks/cargo-setup-hook.sh

@@ -8,6 +8,11 @@ cargoSetupPostUnpackHook() {
     # it writable. If we're using a tarball, the unpackFile hook already handles
     # this for us automatically.
     if [ -z $cargoVendorDir ]; then
+        if [ -z "$cargoDeps" ]; then
+            echo "ERROR: Missing cargoDeps"
+            exit 1
+        fi
+
         if [ -d "$cargoDeps" ]; then
             local dest=$(stripHash "$cargoDeps")
             cp -Lr --reflink=auto -- "$cargoDeps" "$dest"
@@ -86,6 +91,77 @@ cargoSetupPostPatchHook() {
     echo "Finished cargoSetupPostPatchHook"
 }
 
+cargoUseSystemLibs() {
+  # Sentinel directory that doesn't exist. For packages
+  # Where you tell it directories, but can't force it to only
+  # use system libraries
+  #
+  # Note that this isn't perfect, as some have fallbacks if their probing fails.
+  local -r sentinel_dir="$(mktemp -du nixpkgs.XXXX)/use/system/library"
+
+  # https://docs.rs/system-deps/8.0.0/system_deps/#internally-build-system-libraries
+  export SYSTEM_DEPS_BUILD_INTERNAL="never"
+
+  # https://github.com/aws/aws-lc-rs/blob/741dbf573a64b6a1e1e6b7c1131a0f8153a28441/aws-lc-sys/README.md#automatic-detection
+  export AWS_LC_SYS_USE_SYSTEM="1"
+
+  # https://github.com/rust-openssl/rust-openssl/blob/b46d5ec06144795e8f9e118c44bebd392956917a/openssl-sys/build/main.rs#L53
+  export OPENSSL_NO_VENDOR="1"
+
+  # 1 = Links statically to the vendored one
+  # 0 = Use pkg-config
+  # https://github.com/rust-lang/libz-sys/blob/2ce3271849d85329b668e0bac9f21427ecf8aef9/build.rs#L256
+  export LIBZ_SYS_STATIC="0"
+
+  # https://github.com/rusqlite/rusqlite/blob/db83b9b08d9cab73f912501eefb8df7b100acd7d/libsqlite3-sys/build.rs#L53
+  export LIBSQLITE3_SYS_USE_PKG_CONFIG="1"
+
+  # https://github.com/gyscos/zstd-rs/blob/ad18ca4e275aed9acc3087d7c1c65d03ab67ad6e/zstd-safe/zstd-sys/build.rs#L279
+  export ZSTD_SYS_USE_PKG_CONFIG="1"
+
+  # https://github.com/rust-lang/git2-rs/blob/a00922bcdf0f78419aa5dd0d3643e73ce01672a8/libgit2-sys/build.rs#L95
+  export LIBGIT2_NO_VENDOR="1"
+
+  # https://github.com/sodiumoxide/sodiumoxide/blob/3057acb1a030ad86ed8892a223d64036ab5e8523/libsodium-sys/build.rs#L34
+  export SODIUM_USE_PKG_CONFIG="1"
+
+  # https://github.com/rust-onig/rust-onig/blob/73e63eb3eea6d93d24a4aadf7fea580287750c7d/onig_sys/build.rs#L250
+  export RUSTONIG_SYSTEM_LIBONIG="1"
+
+  # https://github.com/rust-lang/ssh2-rs/blob/0a11bdd4eecf4525e540c30f14b15ab1c07194b7/libssh2-sys/build.rs#L23
+  export LIBSSH2_SYS_USE_PKG_CONFIG="1"
+
+  # We can only supply the src dir.
+  # https://github.com/nginx/ngx-rust/tree/main/nginx-sys#input-variables
+  # Since we don't want to pull it in for every build, we set it to a dummy value
+  # in all builds, but lets the user set it via `env.NGINX_SOURCE_DIR = nginx.src`
+  export NGINX_SOURCE_DIR="${NGINX_SOURCE_DIR:-"$sentinel_dir/nginx/src"}"
+
+  # We can only supply the lib and include dirs
+  # https://github.com/duckdb/duckdb-rs/blob/ea700a79534c8e8c22a9ac685135f15c31de91d3/crates/libduckdb-sys/build.rs#L203
+  # Set to sentinel by default again
+  # There is also a DUCKDB_LIB_DIR var, but I think only one needs to be set.
+  export DUCKDB_DOWNLOAD_LIB="0"
+  export DUCKDB_INCLUDE_DIR="${DUCKDB_INCLUDE_DIR:-"$sentinel_dir/duckdb/include"}"
+
+  # https://github.com/tikv/jemallocator/blob/a181911517adff5331e43dfd9804086f7c392a25/jemalloc-sys/build.rs#L132
+  export JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE:-"$sentinel_dir/lib/libjemalloc"}"
+}
+
+# Cargo defaults to one job per host CPU. Limit builds that invoke Cargo
+# directly (e.g. through Meson or Make) to NIX_BUILD_CORES, like cargoBuildHook.
+# This runs in a phase because stdenv normalizes NIX_BUILD_CORES after
+# sourcing setup hooks.
+cargoSetupBuildJobs() {
+  export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-$NIX_BUILD_CORES}"
+}
+
+postUnpackHooks+=(cargoSetupBuildJobs)
+
+if [[ -z "${dontCargoUseSystemLibs-}" ]]; then
+  preConfigureHooks+=(cargoUseSystemLibs)
+fi
+
 if [ -z "${dontCargoSetupPostUnpack-}" ]; then
   postUnpackHooks+=(cargoSetupPostUnpackHook)
 fi

pkgs/build-support/rust/import-cargo-lock.nix

@@ -187,13 +187,18 @@ let
       let
         crateTarball = fetchCrate pkg registries.${registryIndexUrl};
       in
-      runCommand "${pkg.name}-${pkg.version}" { } ''
-        mkdir $out
-        tar xf "${crateTarball}" -C $out --strip-components=1
+      runCommand "${pkg.name}-${pkg.version}"
+        {
+          strictDeps = true;
+          __structuredAttrs = true;
+        }
+        ''
+          mkdir $out
+          tar xf "${crateTarball}" -C $out --strip-components=1
 
-        # Cargo is happy with largely empty metadata.
-        printf '{"files":{},"package":"${crateTarball.outputHash}"}' > "$out/.cargo-checksum.json"
-      ''
+          # Cargo is happy with largely empty metadata.
+          printf '{"files":{},"package":"${crateTarball.outputHash}"}' > "$out/.cargo-checksum.json"
+        ''
     else if gitParts != null then
       let
         missingHash = throw ''
@@ -224,66 +229,71 @@ let
           else
             missingHash;
       in
-      runCommand "${pkg.name}-${pkg.version}" { } ''
-        tree=${tree}
+      runCommand "${pkg.name}-${pkg.version}"
+        {
+          strictDeps = true;
+          __structuredAttrs = true;
+        }
+        ''
+          tree=${tree}
 
-        # If the target package is in a workspace, or if it's the top-level
-        # crate, we should find the crate path using `cargo metadata`.
-        # Some packages do not have a Cargo.toml at the top-level,
-        # but only in nested directories.
-        # Only check the top-level Cargo.toml, if it actually exists
-        if [[ -f $tree/Cargo.toml ]]; then
-          crateCargoTOML=$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $tree/Cargo.toml | \
-          ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path')
-        fi
-
-        # If the repository is not a workspace the package might be in a subdirectory.
-        if [[ -z $crateCargoTOML ]]; then
-          for manifest in $(find $tree -name "Cargo.toml"); do
-            echo Looking at $manifest
-            crateCargoTOML=$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path "$manifest" | ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path' || :)
-            if [[ ! -z $crateCargoTOML ]]; then
-              break
-            fi
-          done
-
-          if [[ -z $crateCargoTOML ]]; then
-            >&2 echo "Cannot find path for crate '${pkg.name}-${pkg.version}' in the tree in: $tree"
-            exit 1
+          # If the target package is in a workspace, or if it's the top-level
+          # crate, we should find the crate path using `cargo metadata`.
+          # Some packages do not have a Cargo.toml at the top-level,
+          # but only in nested directories.
+          # Only check the top-level Cargo.toml, if it actually exists
+          if [[ -f $tree/Cargo.toml ]]; then
+            crateCargoTOML=$(cd "$tree" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $tree/Cargo.toml | \
+            ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path')
           fi
-        fi
 
-        echo Found crate ${pkg.name} at $crateCargoTOML
-        tree=$(dirname $crateCargoTOML)
+          # If the repository is not a workspace the package might be in a subdirectory.
+          if [[ -z $crateCargoTOML ]]; then
+            for manifest in $(find $tree -name "Cargo.toml"); do
+              echo Looking at $manifest
+              crateCargoTOML=$(cd "$(dirname "$manifest")" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path "$manifest" | ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path' || :)
+              if [[ ! -z $crateCargoTOML ]]; then
+                break
+              fi
+            done
 
-        cp -prvL "$tree" "$out" || echo "Warning: certain files couldn't be copied!" >&2
-        chmod u+w $out
+            if [[ -z $crateCargoTOML ]]; then
+              >&2 echo "Cannot find path for crate '${pkg.name}-${pkg.version}' in the tree in: $tree"
+              exit 1
+            fi
+          fi
 
-        if grep -q workspace "$out/Cargo.toml"; then
-          chmod u+w "$out/Cargo.toml"
-          ${replaceWorkspaceValues} "$out/Cargo.toml" "$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $crateCargoTOML | ${jq}/bin/jq -r .workspace_root)/Cargo.toml"
-        fi
+          echo Found crate ${pkg.name} at $crateCargoTOML
+          tree=$(dirname $crateCargoTOML)
 
-        # Cargo is happy with empty metadata.
-        printf '{"files":{},"package":null}' > "$out/.cargo-checksum.json"
+          cp -prvL "$tree" "$out" || echo "Warning: certain files couldn't be copied!" >&2
+          chmod u+w $out
 
-        ${optionalString (gitParts ? type) ''
-          gitPartsValue=${escapeShellArg gitParts.value}
-          # starting with lockfile version v4 the git source url contains encoded query parameters
-          # our regex parser does not know how to unescape them to get the actual value, so we do it here
-          ${optionalString (lockFileVersion >= 4) ''
-            gitPartsValue=$(${getExe python3Packages.python} -c "import sys, urllib.parse; print(urllib.parse.unquote(sys.argv[1]))" "$gitPartsValue")
+          if grep -q workspace "$out/Cargo.toml"; then
+            chmod u+w "$out/Cargo.toml"
+            ${replaceWorkspaceValues} "$out/Cargo.toml" "$(cd "$tree" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $crateCargoTOML | ${jq}/bin/jq -r .workspace_root)/Cargo.toml"
+          fi
+
+          # Cargo is happy with empty metadata.
+          printf '{"files":{},"package":null}' > "$out/.cargo-checksum.json"
+
+          ${optionalString (gitParts ? type) ''
+            gitPartsValue=${escapeShellArg gitParts.value}
+            # starting with lockfile version v4 the git source url contains encoded query parameters
+            # our regex parser does not know how to unescape them to get the actual value, so we do it here
+            ${optionalString (lockFileVersion >= 4) ''
+              gitPartsValue=$(${getExe python3Packages.python} -c "import sys, urllib.parse; print(urllib.parse.unquote(sys.argv[1]))" "$gitPartsValue")
+            ''}
           ''}
-        ''}
 
-        # Set up configuration for the vendor directory.
-        cat > $out/.cargo-config <<EOF
-        [source."${pkg.source}"]
-        git = "${gitParts.url}"
-        ${optionalString (gitParts ? type) "${gitParts.type} = \"$gitPartsValue\""}
-        replace-with = "vendored-sources"
-        EOF
-      ''
+          # Set up configuration for the vendor directory.
+          cat > $out/.cargo-config <<EOF
+          [source."${pkg.source}"]
+          git = "${gitParts.url}"
+          ${optionalString (gitParts ? type) "${gitParts.type} = \"$gitPartsValue\""}
+          replace-with = "vendored-sources"
+          EOF
+        ''
     else
       throw "Cannot handle crate source: ${pkg.source}";
 
@@ -291,6 +301,7 @@ let
     runCommand "cargo-vendor-dir"
       (
         {
+          strictDeps = true;
           __structuredAttrs = true;
         }
         // (

pkgs/build-support/rust/test/fetch-cargo-vendor/default.nix

@@ -0,0 +1,4 @@
+{ callPackage }:
+{
+  gitDependencyCargoConfig = callPackage ./git-dependency-cargo-config { };
+}

pkgs/build-support/rust/test/fetch-cargo-vendor/git-dependency-cargo-config/default.nix

@@ -0,0 +1,6 @@
+{ rustPlatform }:
+rustPlatform.fetchCargoVendor {
+  name = "git-dependency-cargo-config";
+  src = ../../import-cargo-lock/git-dependency-cargo-config;
+  hash = "sha256-rUQQ4Xrk+rW5Vgm7GK8xrK9zcwazsmBO6Q6qTCUniWc=";
+}

pkgs/build-support/rust/test/import-cargo-lock/default.nix

@@ -17,6 +17,7 @@
       { };
   gitDependencyTag = callPackage ./git-dependency-tag { };
   gitDependencyBranch = callPackage ./git-dependency-branch { };
+  gitDependencyCargoConfig = callPackage ./git-dependency-cargo-config { };
   maturin = maturin.tests.pyo3;
   v1 = callPackage ./v1 { };
   gitDependencyWorkspaceInheritance = callPackage ./git-dependency-workspace-inheritance {

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-cargo-config/Cargo.lock

@@ -0,0 +1,13 @@
+version = 3
+
+[[package]]
+name = "fixture"
+version = "0.1.0"
+dependencies = [
+ "bootloader",
+]
+
+[[package]]
+name = "bootloader"
+version = "0.11.17"
+source = "git+https://github.com/rust-osdev/bootloader.git?rev=3d7f72e36d4101ecf78b70cef2475d700bb01721#3d7f72e36d4101ecf78b70cef2475d700bb01721"

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-cargo-config/default.nix

@@ -0,0 +1,8 @@
+{ rustPlatform }:
+rustPlatform.importCargoLock {
+  lockFile = ./Cargo.lock;
+  outputHashes = {
+    # Bootloader's .cargo/config.toml enables bindeps, which are required to parse its manifest.
+    "bootloader-0.11.17" = "sha256-mLm5M1HLipN1EzS1zbDgMxMOqNySivGsK8+i0uOmoFM=";
+  };
+}

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -33,6 +33,8 @@ assertExecutable() {
 
 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
+# --prefix-unchecked ENV SEP VAL  : same as --prefix/--suffix, accepted for compatibility
+# --suffix-unchecked                with makeBinaryWrapper
 # --prefix-each     ENV SEP VALS  : like --prefix, but VALS is a list
 # --suffix-each     ENV SEP VALS  : like --suffix, but VALS is a list
 # --prefix-contents ENV SEP FILES : like --suffix-each, but contents of FILES
@@ -145,7 +147,7 @@ makeShellWrapper() {
             command="${params[$((n + 1))]}"
             n=$((n + 1))
             echo "$command" >> "$wrapper"
-        elif [[ ("$p" == "--suffix") || ("$p" == "--prefix") ]]; then
+        elif [[ ("$p" == "--suffix") || ("$p" == "--prefix") || ("$p" == "--suffix-unchecked") || ("$p" == "--prefix-unchecked") ]]; then
             varName="${params[$((n + 1))]}"
             separator="${params[$((n + 2))]}"
             value="${params[$((n + 3))]}"

pkgs/build-support/wrapper-common/utils.bash

@@ -150,6 +150,67 @@ expandResponseParams() {
     done
 }
 
+# Resolve the path $1 of a library directory, which like the linker
+# takes a relative path from the working directory, to the directory the
+# linker searches, as far as needed to tell whether it is in the store,
+# and where.  Like the kernel, follow each symlink before going on to the
+# next component, so that symlinks in ancestor directories count, and `..`
+# applies to the target of a symlink rather than removing it.  But in the
+# store, keep symlinks that are not followed by `..` as they are, since
+# resolving symlinks between store paths would refer to their targets
+# instead (see issue #454199).  The result is stored in resolvedPath.
+# Fails if there are too many symlinks.
+resolveLibDir() {
+    local rest="$1/" component link target links=0
+    # The common case: a path in the store with no `.`, `..` or empty
+    # components is already resolved, since it has no symlink to follow.
+    if [[ "$1" == "${NIX_STORE:-}"/* && "$1/" != */./* && "$1/" != */../* && "$1/" != *//* ]]; then
+        resolvedPath="$1"
+        return
+    fi
+    if [[ "$rest" != /* ]]; then
+        rest="$PWD/$rest"
+    fi
+    resolvedPath=
+    while [[ -n "$rest" ]]; do
+        component="${rest%%/*}"
+        rest="${rest#*/}"
+        case "$component" in
+            "" | .) continue ;;
+            ..)
+                if [[ -L "$resolvedPath" ]]; then
+                    # Follow it, then apply this `..` to its target.
+                    link="$resolvedPath"
+                    resolvedPath="${resolvedPath%/*}"
+                    rest="../$rest"
+                else
+                    resolvedPath="${resolvedPath%/*}"
+                    continue
+                fi
+                ;;
+            *)
+                link="$resolvedPath/$component"
+                # Keep a symlink in the store unless `..` follows it, and
+                # never resolve the store or its ancestors, which may be
+                # symlinks (NIX_IGNORE_SYMLINK_STORE).
+                if [[ "$link" == "${NIX_STORE:-}"/* || "${NIX_STORE:-}/" == "$link"/* || ! -L "$link" ]]; then
+                    resolvedPath="$link"
+                    continue
+                fi
+                ;;
+        esac
+        (( ++links <= 40 )) || return 1
+        target=$(readlink "$link") || return 1
+        # A relative target is relative to the directory containing the
+        # link, which is now resolvedPath.
+        if [[ "$target" == /* ]]; then
+            resolvedPath=
+        fi
+        rest="$target/$rest"
+    done
+    resolvedPath="${resolvedPath:-/}"
+}
+
 checkLinkType() {
     local arg
     type="dynamic"

pkgs/by-name/_7/_7kaa/package.nix

@@ -66,7 +66,7 @@ gccStdenv.mkDerivation (finalAttrs: {
     autoupdate
   '';
 
-  hardeningDisable = lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin) [
+  hardeningDisable = lib.optionals stdenv.hostPlatform.isDarwin [
     "stackprotector"
   ];
 

pkgs/by-name/_9/_9base/package.nix

@@ -92,6 +92,6 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     # needs additional work to support aarch64-darwin
     # due to usage of _DARWIN_NO_64_BIT_INODE
-    broken = stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/by-name/ab/abseil-cpp_202608/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  fixDarwinDylibNames,
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
@@ -22,6 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
+    # Test helper libraries linking against GoogleTest
+    "testing"
   ];
 
   cmakeFlags = [
@@ -35,10 +38,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
 
   buildInputs = [ gtest ];
 
+  postInstall = ''
+    for lib in scoped_mock_log status_matchers; do
+      moveToOutput "lib/libabsl_$lib.*" "$testing"
+      substituteInPlace $out/lib/cmake/absl/abslTargets-*.cmake \
+        --replace-fail "$out/lib/libabsl_$lib." "$testing/lib/libabsl_$lib."
+      substituteInPlace "$out/lib/pkgconfig/absl_$lib.pc" \
+        --replace-fail "libdir=$out/lib" "libdir=$testing/lib"
+    done
+  '';
+
+  outputChecks.out.disallowedRequisites = [ gtest ];
+
   __structuredAttrs = true;
 
   meta = {

pkgs/by-name/ac/aclpubcheck/package.nix

@@ -17,8 +17,6 @@ python3Packages.buildPythonApplication {
     hash = "sha256-s9kegTZOZEgGx0Yj8jOfzAyjyy1EuabOybMDBoodRvo=";
   };
 
-  __structuredAttrs = true;
-
   build-system = with python3Packages; [
     setuptools
   ];

pkgs/by-name/ac/acpica-tools/package.nix

@@ -45,9 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
     # ACPICA emits packed structs that produce unaligned pointers. Apple's
     # arm64 linker rejects these under chained fixups; opt back into the
     # legacy fixup format so the link succeeds.
-    NIX_LDFLAGS = lib.optionalString (
-      stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
-    ) "-no_fixup_chains";
+    NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-no_fixup_chains";
 
     # i686 builds fail with hardening enabled (due to -Wformat-overflow). Disable
     # -Werror altogether to make this derivation less fragile to toolchain

pkgs/by-name/ad/adguardian/package.nix

@@ -2,6 +2,8 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  pkg-config,
+  aws-lc,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -18,6 +20,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-uch2JKnskO5W8EPK877qL0aQQ+iInHJoCrrhZbmoVRs=";
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    aws-lc
+  ];
+
   meta = {
     description = "Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance";
     mainProgram = "adguardian";

pkgs/by-name/ad/adpathfinder/package.nix

@@ -10,8 +10,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.2.0";
   pyproject = true;
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "NetSPI";
     repo = "AD-PathFinder";

pkgs/by-name/ad/adscan/package.nix

@@ -10,8 +10,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "13.2.0";
   pyproject = true;
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "ADScanPro";
     repo = "adscan";

pkgs/by-name/ad/advi/package.nix

@@ -16,9 +16,9 @@ let
     case "$1 $2" in
       "config var")
         case "$3" in
-          man) echo "$out/share/man";;
+          man) echo "''${man:-$out}/share/man";;
           etc) echo "$out/etc";;
-          doc) echo "$out/share/doc";;
+          doc) echo "''${doc:-$out}/share/doc";;
           share) echo "$out/share";;
           prefix) echo "$out";;
           *) echo "fake-opam does not understand arguments: $@" ; exit 1 ;;
@@ -46,7 +46,7 @@ ocamlPackages.buildDunePackage rec {
   postPatch = ''
     substituteInPlace ./Makefile \
       --replace "\$(DUNE) install \$(DUNEROOT) --display=short" \
-      "\$(DUNE) install \$(DUNEROOT) --prefix $out --docdir $out/share/doc --mandir $out/share/man"
+      "\$(DUNE) install \$(DUNEROOT) --prefix $out --docdir ''${!outputDoc}/share/doc --mandir ''${!outputMan}/share/man"
     substituteInPlace ./src/discover.sh \
       --replace 'gs_path=$(which gs)' 'gs_path=${ghostscriptX}/bin/gs'
   '';

pkgs/by-name/ad/adwaita-fonts/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adwaita-fonts";
-  version = "50.0";
+  version = "51.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-fonts/${lib.versions.major finalAttrs.version}/adwaita-fonts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-TJJ/v+7BxQOAG6UQwslOAFTILFIs97oNO+XU1B/PXIY=";
+    hash = "sha256-+hBK4sG5ZYDTIvVj/+iy38pSlrDspJce/S2AEUBRI9I=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adwaita-icon-theme/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "adwaita-icon-theme";
-  version = "50.0";
+  version = "51.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major finalAttrs.version}/adwaita-icon-theme-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+sbgQB/KcUeAVhoIG49+J8O8HbNOvaTaF1CB8msk1GA=";
+    hash = "sha256-ulYc88ljBaRxefpWBYVq1pXJI46gf3CTrr2bqAxOMjs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ag/agentsploit/package.nix

@@ -11,8 +11,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.7.0";
   pyproject = true;
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "agentsploit";
     repo = "agentsploit";
@@ -52,6 +50,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   disabledTestPaths = [
     # Tests need network access
+    "tests/unit/test_openai_adapter.py"
     "tests/integration/"
   ];
 

pkgs/by-name/ap/apache-airflow/python-package.nix

@@ -397,8 +397,6 @@ buildPythonPackage (
     pname = "apache-airflow";
     version = "3.3.2";
 
-    __structuredAttrs = true;
-
     src = fetchFromGitHub {
       owner = "apache";
       repo = "airflow";

pkgs/by-name/ap/apm-cli/package.nix

@@ -10,8 +10,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "0.35.0";
   pyproject = true;
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "apm";

pkgs/by-name/ap/apt-swarm/package.nix

@@ -2,12 +2,16 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
+  pkg-config,
+  aws-lc,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "apt-swarm";
   version = "0.6.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = "apt-swarm";
@@ -17,6 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-Fo/+UbdfDhbAsoWjoko4tAmyDZK6tPn/0d2CjPKyaaQ=";
 
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ aws-lc ];
+
   meta = {
     description = "Experimental p2p gossip network for OpenPGP signature transparency";
     homepage = "https://github.com/kpcyrd/apt-swarm";

pkgs/by-name/ap/apt/package.nix

@@ -32,14 +32,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "3.3.5";
+  version = "3.3.3";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "apt-team";
     repo = "apt";
     rev = finalAttrs.version;
-    hash = "sha256-LUU9U6ahbsL3P8KqatgUQGfO9xVkoXzyE9Qn+Ny3JyA=";
+    hash = "sha256-pYDd6l9SZR6YXU4/V5cgC36ggvuoHqlKNkHyL++8dp8=";
   };
 
   # cycle detection; lib can't be split

pkgs/by-name/aq/aqtinstall/package.nix

@@ -9,7 +9,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "aqtinstall";
   version = "3.3.0";
   pyproject = true;
-  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "miurahr";

pkgs/by-name/ar/arrow-cpp/package.nix

@@ -172,10 +172,6 @@ stdenv.mkDerivation (finalAttrs: {
               "TestS3FS.*"
               "TestS3FSGeneric.*"
               "TestS3FSHTTPS.*" # Needs Minio
-            ]
-            ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-              # https://github.com/apache/arrow/issues/41505
-              "TestAzuriteGeneric.Empty"
             ];
         in
         "-${lib.concatStringsSep ":" filteredTests}";
@@ -352,8 +348,6 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
-    # https://hydra.nixos.org/job/nixpkgs/unstable/arrow-cpp.x86_64-darwin/all
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64;
     description = "Cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/docs/cpp/";
     changelog = "https://arrow.apache.org/release/${finalAttrs.version}.html";

pkgs/by-name/ar/arti/package.nix

@@ -6,6 +6,7 @@
   pkg-config,
   sqlite,
   openssl,
+  zstd,
   versionCheckHook,
   nix-update-script,
   nixosTests,
@@ -36,9 +37,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildAndTestSubdir = "crates/arti";
   cargoHash = "sha256-g+t5X1t0koUzqoHpY8+lncqRobdDuZggXtD3HRk9ryE=";
 
-  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ sqlite ] ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
+  buildInputs = [
+    sqlite
+    zstd
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   # `full` includes all stable and non-conflicting feature flags. the primary
   # downsides are increased binary size and memory usage for building, but

pkgs/by-name/as/asciidoc/package.nix

@@ -7,7 +7,7 @@
   autoreconfHook,
   installShellFiles,
   enableStandardFeatures ? false,
-  sourceHighlight,
+  source-highlight,
   highlight,
   graphviz,
   texliveMinimal,
@@ -246,7 +246,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
             -e "s|run('convert|run('${lib.getExe' imagemagick "convert"}|g" \
             -i "asciidoc/resources/filters/music/music2png.py"
 
-        sed -e 's|filter="source-highlight|filter="${sourceHighlight}/bin/source-highlight|' \
+        sed -e 's|filter="source-highlight|filter="${source-highlight}/bin/source-highlight|' \
             -e 's|filter="highlight|filter="${highlight}/bin/highlight|' \
             -e 's|filter="pygmentize|filter="${pygments}/bin/pygmentize|' \
             -i "asciidoc/resources/filters/source/source-highlight-filter.conf"
@@ -283,10 +283,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   )
   + ''
     # Fix tests
-    for f in $(grep -R --files-with-matches "2002-11-25") ; do
-      substituteInPlace $f --replace "2002-11-25" "1980-01-02"
-      substituteInPlace $f --replace "00:37:42" "00:00:00"
-    done
+    substituteInPlace $(grep -R --files-with-matches "2002-11-25" tests/data) \
+      --replace-fail "2002-11-25" "1980-01-02"
+    substituteInPlace $(grep -R --files-with-matches "00:37:42" tests/data) \
+      --replace-fail "00:37:42" "00:00:00"
   ''
   + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     # We want to use asciidoc from the build platform to build the documentation.
@@ -317,8 +317,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     runHook postCheck
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Text-based document generation system";
     longDescription = ''

pkgs/by-name/as/asciimol/package.nix

@@ -10,8 +10,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.2.7";
   pyproject = true;
 
-  __structuredAttrs = true;
-
   src = fetchPypi {
     inherit (finalAttrs) pname version;
     hash = "sha256-SqwViOnVx1TcpY8Kd5VQCg1A8KQnBhL8aq9Gsrwer3k=";

pkgs/by-name/as/asl/package.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionalString (!buildDocs) ''
       substituteInPlace Makefile --replace "all: binaries docs" "all: binaries"
     ''
-    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
       substituteInPlace sysdefs.h --replace "x86_64" "aarch64"
     '';
 

pkgs/by-name/at/at-spi2-core/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.60.6";
+  version = "2.62.0";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-qJtkqLIXqAQr3w41y/q2Kc7uNWQNunXfV4r96ap4nVc=";
+    hash = "sha256-A6lPe/NfMA2vKEOjfN82R5qRvFP1mo6kN8eeJdldHeM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/aurral/package.json.patch

@@ -0,0 +1,15 @@
+diff --git a/package.json b/package.json
+index 5e1328e5..0f289597 100644
+--- a/package.json
++++ b/package.json
+@@ -4,9 +4,7 @@
+   "description": "Aurral artist request manager",
+   "private": true,
+   "type": "module",
+-  "engines": {
+-    "node": "26.8.x"
+-  },
++  "files": ["backend/*", "frontend/dist/*", "lib/*"],
+   "workspaces": [
+     "backend",
+     "frontend"

pkgs/by-name/au/aurral/package.nix

@@ -1,15 +1,11 @@
 {
   lib,
-  stdenv,
-  fetchPnpmDeps,
-  pnpm_12,
-  pnpmConfigHook,
-  cloudflared,
-  procps,
+  buildNpmPackage,
   fetchFromGitHub,
   gitMinimal,
   nix-update-script,
   nodejs_26,
+  python3,
   sqlite,
   ffmpeg,
   yt-dlp,
@@ -22,56 +18,46 @@
 }:
 
 let
-  pnpm = pnpm_12.override { nodejs-slim = nodejs_26; };
-  # Upstream pins a Node minor release, but Nixpkgs tracks the latest Node 26.
-  relaxNodeVersion = ''
-    substituteInPlace package.json \
-      --replace-fail '"node": "26.12.x"' '"node": "26.x"'
-  '';
+  matcherPython = python3.withPackages (ps: [ ps.beets ]);
 in
-stdenv.mkDerivation (finalAttrs: {
+buildNpmPackage (finalAttrs: {
   pname = "aurral";
-  version = "2.12.0";
+  version = "2.10.0";
 
   __structuredAttrs = true;
-  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "lklynet";
     repo = "aurral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-slnwPhWqQDEbtkV+gTiSHHMvOxJ4de3kR85YVdP5pO0=";
+    hash = "sha256-PNTcFtP9ajEBi3X7oofdsm5K0bN9T4MlMYA0+srFqgs=";
   };
 
-  # Test fixtures create executable scripts; /usr/bin/env is unavailable in the sandbox.
-  postPatch = relaxNodeVersion + ''
-    substituteInPlace .tests/share/share-links.test.ts \
-      .tests/download/ytdlp-song-search.test.ts \
-      .tests/download/ytdlp-runtime.test.ts \
-      --replace-fail '#!/usr/bin/env node' '#!${lib.getExe nodejs_26}'
-  '';
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    inherit pnpm;
-    postPatch = relaxNodeVersion;
-    fetcherVersion = 5;
-    hash = "sha256-juz5YV5Vc0N24OfSjb7iltS+iLYEKUKVOML1mPS5s+0=";
-  };
-
-  nativeBuildInputs = [
-    nodejs_26
-    pnpm
-    pnpmConfigHook
+  # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
+  patches = [
+    ./package.json.patch
   ];
 
-  buildPhase = ''
-    runHook preBuild
-    pnpm rebuild
-    pnpm --filter aurral-frontend run build
-    runHook postBuild
+  # patch needed for upstream test issues and pinned Beets version that is being deprecated see https://github.com/lklynet/aurral/pull/937
+  # TODO: remove recovery test patch after merging https://github.com/lklynet/aurral/pull/951
+  postPatch = ''
+    substituteInPlace backend/services/trackMatching/beetsClient.js \
+      --replace-fail 'const PINNED_BEETS_VERSION = "2.14.0";' \
+      'const PINNED_BEETS_VERSION = "${python3.pkgs.beets.version}";'
+    substituteInPlace .tests/track-matching/beets-client.test.js \
+      --replace-fail 'assert.equal(status.error.required, "2.14.0");' \
+      'assert.equal(status.error.required, "${python3.pkgs.beets.version}");'
+    substituteInPlace .tests/honker/background-worker-recovery.test.js \
+      --replace-fail '  assert.equal(registry?.inFlightActive, undefined);' \
+      '  assert.equal(registry?.inFlightActive, undefined); queue.cancel(jobId);'
   '';
 
+  npmDepsFetcherVersion = 2;
+  npmDepsHash = "sha256-8GmWzjja+SYIkJa+VqkA0nmY10B/bjq7i2RR8qZBofo=";
+
+  nodejs = nodejs_26;
+
+  env.AURRAL_MATCHER_PYTHON = "${matcherPython}/bin/python";
   env.VITE_APP_VERSION = finalAttrs.version;
   env.LD_LIBRARY_PATH = lib.makeLibraryPath [ sqlite ];
   env.FONTCONFIG_FILE = makeFontsConf {
@@ -81,33 +67,34 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
+  npmInstallFlags = [
+    "--include=optional"
+    "--include-workspace-root=false"
+  ];
+
+  npmBuildFlags = [ "--workspace=frontend" ];
+
   doCheck = true;
+
   nativeCheckInputs = [
     ffmpeg
     gitMinimal
-    procps
   ];
+
   checkPhase = ''
     runHook preCheck
-    pnpm test
-    pnpm run test:integration
+
+    npm test
+    npm run test:integration
+
     runHook postCheck
   '';
 
-  installPhase = ''
-    runHook preInstall
-
-    # pnpm prune does not support this workspace with the packaged pnpm version.
-    # Reinstall only the root and backend production dependencies from the offline store.
-    rm -rf node_modules backend/node_modules frontend/node_modules docs/node_modules
-    pnpm install --offline --ignore-scripts --frozen-lockfile --prod \
-      --filter=aurral --filter=aurral-backend
-
-    mkdir -p $out/lib/aurral/frontend
-    cp -r package.json backend lib node_modules $out/lib/aurral/
-    cp -r frontend/dist $out/lib/aurral/frontend/
-    runHook postInstall
-  '';
+  npmPruneFlags = [
+    "--workspace=backend"
+    "--include=optional"
+    "--include-workspace-root=false"
+  ];
 
   postInstall = ''
     mkdir $out/bin
@@ -121,21 +108,21 @@ stdenv.mkDerivation (finalAttrs: {
     }
     export PATH=${
       lib.makeBinPath [
-        nodejs_26
+        finalAttrs.nodejs
         ffmpeg
         yt-dlp
-        cloudflared
       ]
     }\''${PATH:+:}\$PATH
     export FONTCONFIG_FILE=${finalAttrs.env.FONTCONFIG_FILE}
+    export AURRAL_MATCHER_PYTHON=${matcherPython}/bin/python
     export APP_VERSION=${finalAttrs.version}
     export NODE_ENV=production
     case "\$1" in
         resetAdminPassword)
-        exec node $out/lib/aurral/backend/scripts/resetAdminPassword.ts "\$@"
+        exec node $out/lib/node_modules/aurral/backend/scripts/resetAdminPassword.js "\$@"
         ;;
         server|"")
-        exec node $out/lib/aurral/backend/server.ts
+        exec node $out/lib/node_modules/aurral/backend/server.js
         ;;
         -h|--help|*)
         echo "Usage: (server|resetAdminPassword)"

pkgs/by-name/au/autogen/package.nix

@@ -8,7 +8,7 @@
   which,
   pkg-config,
   perl,
-  guile_2_2,
+  guile,
   libxml2,
 }:
 
@@ -101,7 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildPackages.texinfo
   ];
   buildInputs = [
-    guile_2_2
+    guile
     libxml2
   ];
 

pkgs/by-name/au/automake/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "automake";
-  version = "1.18.1";
+  version = "1.19";
 
   src = fetchurl {
     url = "mirror://gnu/automake/automake-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FoqjYyeDUbia9WaERI9SWlvOUHnQtoQr2RD90/FkaIc=";
+    hash = "sha256-4+LC46vzeJgTjbW2wdHcNckWDFl4vnlH0sdBcFJR1EU=";
   };
 
   strictDeps = true;
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
-    branch = "1.18";
+    branch = "1.19";
     homepage = "https://www.gnu.org/software/automake/";
     description = "GNU standard-compliant makefile generator";
     license = lib.licenses.gpl2Plus;

pkgs/by-name/au/automake116x/package.nix

@@ -4,6 +4,7 @@
   fetchurl,
   perl,
   autoconf,
+  automake,
   updateAutotoolsGnuConfigScriptsHook,
 }:
 
@@ -24,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ autoconf ];
 
-  setupHook = ./setup-hook.sh;
+  inherit (automake) setupHook;
 
   doCheck = false; # takes _a lot_ of time, fails 3 out of 2698 tests, all seem to be related to paths
   doInstallCheck = false; # runs the same thing, fails the same tests

pkgs/by-name/au/autopush-rs/package.nix

@@ -24,8 +24,6 @@ let
       pname = "fernet_key";
       inherit version src;
 
-      __structuredAttrs = true;
-
       format = "other";
 
       # this would run the upstream docker makefile

pkgs/by-name/av/avalonia-ilspy/package.nix

@@ -51,7 +51,7 @@ buildDotnetModule rec {
     bintools
     fixDarwinDylibNames
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     autoSignDarwinBinariesHook
   ];
 

pkgs/by-name/aw/aw-watcher-steam/package.nix

@@ -9,7 +9,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "aw-watcher-steam";
   version = "0-unstable-2025-06-16";
   pyproject = true;
-  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Edwardsoen";

pkgs/by-name/aw/awscurl/package.nix

@@ -8,7 +8,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "awscurl";
   version = "0.44";
   pyproject = true;
-  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "okigan";

pkgs/by-name/az/azurefox/package.nix

@@ -10,8 +10,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.5.0";
   pyproject = true;
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "TacoRocket";
     repo = "AzureFox";

pkgs/by-name/az/azurite/package.nix

@@ -32,6 +32,10 @@ buildNpmPackage (finalAttrs: {
     libsecret
   ];
 
+  # @vscode/vsce-sign's postinstall script fails on exotic architectures.
+  # We ignore the scripts, and this does not change the output.
+  npmFlags = [ "--ignore-scripts" ];
+
   meta = {
     description = "Lightweight server clone of Azure Storage that simulates most of the commands supported by it with minimal dependencies";
     homepage = "https://github.com/Azure/Azurite";

pkgs/by-name/ba/babeldoc/package.nix

@@ -12,7 +12,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "babeldoc";
   version = "0.6.4";
   pyproject = true;
-  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "funstory-ai";

pkgs/by-name/ba/bandcampsync/package.nix

@@ -9,8 +9,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   version = "0.8.0";
   pyproject = true;
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "meeb";
     repo = "bandcampsync";

pkgs/by-name/ba/basex/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "basex";
-  version = "13.0";
+  version = "12.4";
 
   src = fetchurl {
     url = "http://files.basex.org/releases/${finalAttrs.version}/BaseX${
       builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version
     }.zip";
-    hash = "sha256-WUzF5MO7i25p2j/ru4w53nJREut/3/4JygNLdPyZTnI=";
+    hash = "sha256-qIaAy05V5JUZ+YuuesFecCvdpCYoZm0/dWFnInpHvKE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/bat/package.nix

@@ -6,6 +6,7 @@
   less,
   installShellFiles,
   makeWrapper,
+  oniguruma,
   libgit2,
   zlib,
   versionCheckHook,
@@ -35,6 +36,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   buildInputs = [
+    oniguruma
     libgit2
     zlib
   ];

pkgs/by-name/ba/batmon/package.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     mainProgram = "batmon";
     platforms = with lib.platforms; unix ++ windows;
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [ _6543 ];
   };
 })

pkgs/by-name/ba/bazaar/package.nix

@@ -1,13 +1,15 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
+  fetchFromGitLab,
   blueprint-compiler,
   desktop-file-utils,
+  dbus,
   meson,
   python3,
   ninja,
   pkg-config,
+  vala,
   wrapGAppsHook4,
   appstream,
   flatpak,
@@ -29,12 +31,13 @@
   md4c,
   webkitgtk_6_0,
   libsecret,
+  systemdLibs,
   nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.9.1";
+  version = "0.9.9";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -46,11 +49,12 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  src = fetchFromGitHub {
-    owner = "bazaar-org";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9J+XI5JnV8Yfk3xRI/VM5RSG4eMafbw2rBRpPMIu5yA=";
+    hash = "sha256-qmMwlvB8DXNP0SHip1mQoktYFeH/DwfvVtVIny16Ryo=";
   };
 
   nativeBuildInputs = [
@@ -60,6 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
+    vala
     wrapGAppsHook4
     (python3.withPackages (p: [
       p.babel
@@ -69,6 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     appstream
+    dbus
     flatpak
     glib-networking
     gtk4
@@ -87,6 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     md4c
     webkitgtk_6_0
     libsecret
+    systemdLibs
   ];
 
   postInstall = ''
@@ -112,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "FlatHub-first app store for GNOME";
-    homepage = "https://github.com/kolunmi/bazaar";
+    homepage = "https://gitlab.gnome.org/World/bazaar";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       dtomvan

pkgs/by-name/ba/bazarr/package.nix

@@ -31,7 +31,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     webrtcvad
   ];
 
-  __structuredAttrs = true;
   dontBuild = true;
   dontWrapPythonPrograms = true;
   pyproject = false;

pkgs/by-name/ba/bazel_7/package.nix

@@ -118,11 +118,6 @@ let
           url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-arm64";
           hash = "sha256-wfuZLSHa77wr0A4ZLF5DqH7qyOljYNXM2a5imoS+nGQ";
         }
-      else if stdenv.hostPlatform.system == "x86_64-darwin" then
-        fetchurl {
-          url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-darwin-x86_64";
-          hash = "sha256-qAb9s6R5+EbqVfWHUT7sk1sOrbDEPv4EhgXH7nC46Zw=";
-        }
       else
         fetchurl {
           # stdenv.hostPlatform.system == "aarch64-darwin"
@@ -284,12 +279,12 @@ let
 
   platforms = lib.platforms.linux ++ lib.platforms.darwin;
 
-  inherit (stdenv.hostPlatform) isDarwin isAarch64;
+  inherit (stdenv.hostPlatform) isDarwin;
 
   system = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  arch = with stdenv.hostPlatform; if isDarwin && isAarch64 then "arm64" else parsed.cpu.name;
+  arch = if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
 
   bazelRC = writeTextFile {
     name = "bazel-rc";

pkgs/by-name/ba/bazel_8/package.nix

@@ -36,12 +36,13 @@
 
 let
   inherit (callPackage ./build-support/patching.nix { }) addFilePatch;
-  inherit (stdenv.hostPlatform) isDarwin isAarch64;
+  inherit (stdenv.hostPlatform) isDarwin;
 
   bazelSystem = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  bazelArch = if isDarwin && isAarch64 then "arm64" else stdenv.hostPlatform.parsed.cpu.name;
+  bazelArch =
+    if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";

pkgs/by-name/ba/bazel_9/package.nix

@@ -34,7 +34,7 @@
 
 let
   inherit (callPackage ./build-support/patching.nix { }) addFilePatch;
-  inherit (stdenv.hostPlatform) isDarwin isAarch64;
+  inherit (stdenv.hostPlatform) isDarwin;
 
   defaultShellUtils =
     # Keep this list conservative. For more exotic tools, prefer to use
@@ -85,7 +85,8 @@ let
   bazelSystem = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  bazelArch = if isDarwin && isAarch64 then "arm64" else stdenv.hostPlatform.parsed.cpu.name;
+  bazelArch =
+    if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";

pkgs/by-name/bi/bic/package.nix

@@ -59,6 +59,6 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ hexagonal-sun ];
     # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/by-name/bi/bicep-lsp/package.nix

@@ -43,7 +43,7 @@ buildDotnetModule rec {
     stdenv.cc.cc.lib
   ];
 
-  doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64); # mono is not available on aarch64-darwin
+  doCheck = !stdenv.hostPlatform.isDarwin; # mono is not available on aarch64-darwin
 
   meta = {
     description = "Domain Specific Language (DSL) for deploying Azure resources declaratively";

pkgs/by-name/bi/bichon/package.nix

@@ -16,17 +16,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bichon";
-  version = "2.2.0";
+  version = "2.1.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "rustmailer";
     repo = "bichon";
     tag = finalAttrs.version;
-    hash = "sha256-NwEv7BUmBviK6ZjLWhUcaldQxQHLsJm7URNOkzbrTUE=";
+    hash = "sha256-e0fuRpO4Pc2fZFab5p4Nj0Wgq/db2gj56CgwWcpBi9c=";
   };
 
-  cargoHash = "sha256-cGRPZd3V+6T/JWWm0giV19EvXuoPZBNUtf37xCud7Ow=";
+  cargoHash = "sha256-f+n38ffIIebd0puhyWaDsWfreMs3sWAi1osqEz9BHYg=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;

pkgs/by-name/bi/bigloo/package.nix

@@ -71,7 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ thoughtpolice ];
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64; # segfault during build
 
     longDescription = ''
       Bigloo is a Scheme implementation devoted to one goal: enabling

pkgs/by-name/bi/bitbake-setup/package.nix

@@ -13,8 +13,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "2.19.0";
   format = "wheel";
 
-  __structuredAttrs = true;
-
   src = fetchPypi {
     pname = "bitbake_setup";
     inherit (finalAttrs) version;

pkgs/by-name/bi/bitcoin-knots/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     installShellFiles
     gnupg
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.autoSignDarwinBinariesHook
   ]
   ++ lib.optionals withGui [

pkgs/by-name/bi/bitcoin/package.nix

@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     installShellFiles
     gnupg
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     autoSignDarwinBinariesHook
   ]
   ++ lib.optionals withGui [ qt6.wrapQtAppsHook ];

pkgs/by-name/bl/blueprint-compiler/package.nix

@@ -6,24 +6,26 @@
   libadwaita,
   meson,
   ninja,
-  python3,
   runCommand,
   stdenv,
   testers,
   wrapGAppsNoGuiHook,
   xvfb-run,
   gnome,
+  python3Packages,
 }:
-stdenv.mkDerivation (finalAttrs: {
+
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "blueprint-compiler";
-  version = "0.20.4";
+  version = "0.22.2";
+  pyproject = false;
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "blueprint-compiler";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dA+FQTRmTz6rl5ToZJ8CXY1Zd7Em7VwvF3U3Qoyvu80=";
+    hash = "sha256-DRpPUfiufwK2c2RW01IYIX6tgVyxfFl5hnv5F8+9aD4=";
   };
 
   postPatch = ''
@@ -34,17 +36,11 @@ stdenv.mkDerivation (finalAttrs: {
     gobject-introspection
     meson
     ninja
-    python3
     wrapGAppsNoGuiHook
   ];
 
   buildInputs = [
     libadwaita
-    (python3.withPackages (
-      ps: with ps; [
-        pygobject3
-      ]
-    ))
   ];
 
   propagatedBuildInputs = [
@@ -52,6 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
     gobject-introspection
   ];
 
+  dependencies = [ python3Packages.pygobject3 ];
+
   nativeCheckInputs = [
     dbus
     xvfb-run
@@ -70,6 +68,13 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postCheck
   '';
 
+  # Prevent double wrapping, let the Python wrapper use the args in preFixup.
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   passthru = {
     tests = {
       version = testers.testVersion {

pkgs/by-name/bo/boehmgc/package.nix

@@ -74,13 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
     export NIX_LDFLAGS="$NIX_LDFLAGS -T $TMP/openbsd.ldscript"
   '';
 
-  # `gctest` fails under x86_64 emulation on aarch64-darwin
-  # and also on aarch64-linux (qemu-user)
-  doCheck =
-    !(
-      (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64)
-      || (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64)
-    );
+  # `gctest` fails on aarch64-linux under qemu-user.
+  doCheck = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
 
   enableParallelBuilding = true;
 

pkgs/by-name/bo/borgbackup/package.nix

@@ -33,6 +33,13 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   };
 
   postPatch = ''
+    # Upstream is very sensible about msgpack versions, but the updates to here did not change any relevant code,
+    # so basically backport the essential changes from the bump commits, instead of relaxing the version freely.
+    substituteInPlace src/borg/helpers/msgpack.py \
+      --replace-fail "(1, 2, 1)" "(1, 2, 4)"
+    substituteInPlace pyproject.toml \
+      --replace-fail "<=1.2.1" "<=1.2.4"
+
     # sandbox does not support setuid/setgid/sticky bits
     substituteInPlace src/borg/testsuite/archiver.py \
       --replace-fail "0o4755" "0o0755"
@@ -55,11 +62,8 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   sphinxBuilders = [
-    # HACK: sphinxBuilders is currently broken with __structuredAttrs = true,
-    # and ignores all but the first array item. for now, pass them as a single
-    # space-separated entry. fixed on staging, but requires a mass-rebuild.
-    # TODO: revert to [ "singlehtml" "man" ] on staging.
-    "singlehtml man"
+    "singlehtml"
+    "man"
   ];
 
   buildInputs = [

pkgs/by-name/bo/borgmatic/package.nix

@@ -18,8 +18,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "2.1.7";
   pyproject = true;
 
-  __structuredAttrs = true;
-
   src = fetchPypi {
     inherit (finalAttrs) pname version;
     hash = "sha256-qsB8564wCWBemsxn7vIBmntdabzK1j7agP8ZK2nzdc8=";

pkgs/by-name/bp/bpftools/add-128-bit-integer-types-for-aarch64.patch

@@ -0,0 +1,17 @@
+diff --git a/tools/include/uapi/linux/types.h b/tools/include/uapi/linux/types.h
+index 85aa327..adc3543 100644
+--- a/tools/include/uapi/linux/types.h
++++ b/tools/include/uapi/linux/types.h
+@@ -7,6 +7,12 @@
+ #ifndef __ASSEMBLER__
+ 
+ /* copied from linux:include/uapi/linux/types.h */
++
++#ifdef __SIZEOF_INT128__
++typedef __signed__ __int128 __s128 __attribute__((aligned(16)));
++typedef unsigned __int128 __u128 __attribute__((aligned(16)));
++#endif
++
+ #define __bitwise
+ typedef __u16 __bitwise __le16;
+ typedef __u16 __bitwise __be16;

pkgs/by-name/bp/bpftools/package.nix

@@ -27,6 +27,11 @@ stdenv.mkDerivation (finalAttrs: {
     # fix unknown type name '__vector128' on powerpc64*
     # https://www.spinics.net/lists/bpf/msg28613.html
     ./include-asm-types-for-powerpc64.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+    # Fix unknown type name `__u128` on aarch64, analogous to
+    # https://github.com/libbpf/libbpf/commit/f90a9c487d7542d91fa584b83b6a624a4fbeb341
+    ./add-128-bit-integer-types-for-aarch64.patch
   ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];

pkgs/by-name/br/brotli/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brotli";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brotli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kl8ZHt71v17QR2bDP+ad/5uixf+GStEPLQ5ooFoC5i8=";
+    hash = "sha256-llY72cYffDv0ugsH0p89xIPEbElV4L8u7U/Fe8hT3gI=";
   };
 
   patches = [

pkgs/by-name/bu/bubblewrap/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bubblewrap";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "bubblewrap";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-VnhJ5bej3/GTHcU8+AkyR7f3J0KKDuoc94SFxo4grhk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sgIATYiBYbHaftA+ShIqfxS3OScz7VurjPciL2WB1oQ=";
   };
 
   outputs = [
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = false;
 
   meta = {
-    changelog = "https://github.com/containers/bubblewrap/releases/tag/${finalAttrs.src.rev}";
+    changelog = "https://github.com/containers/bubblewrap/releases/tag/${finalAttrs.src.tag}";
     description = "Unprivileged sandboxing tool";
     homepage = "https://github.com/containers/bubblewrap";
     license = lib.licenses.lgpl21Plus;

pkgs/by-name/bu/buf/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.75.0";
+  version = "1.73.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G7la7dj1xrzVUZJUmnVtYacP3K1jCCVnUxBN+yadMoo=";
+    hash = "sha256-L4d37MQL2pVpt8nV8lxWlUYqxCAkl9KRz2hmJNuOu+o=";
   };
 
-  vendorHash = "sha256-kXtxVyyNt+uNS4hZHWYRrHalK2gAp3N67YRrL9Er+tE=";
+  vendorHash = "sha256-3ijHv25dS62wzqw+yPxlsZ34GALNIf3Azdjm9hVenW8=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

pkgs/by-name/bu/buildah-unwrapped/package.nix

@@ -20,8 +20,6 @@ buildGoModule (finalAttrs: {
   pname = "buildah";
   version = "1.46.0";
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "podman-container-tools";
     repo = "buildah";

pkgs/by-name/bu/buildkite-cli/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
   gitMinimal,
@@ -42,11 +41,6 @@ buildGoModule (finalAttrs: {
         "TestResolvePipelinesFromPath"
         "TestPreflightCmd_Run"
         "TestSnapshotContext_CancelsPush"
-      ]
-      ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-        # Expected timeout error but got none
-        "TestPollJobStatus"
-        "TestPollJobStatusTimeout"
       ];
     in
     [