Merge master into staging-nixos

https://github.com/NotAShelf/direnv.nvim

nixos/modules/security/wrappers/default.nix

@@ -361,16 +361,19 @@ in
 
     ###### wrappers consistency checks
     system.checks = lib.singleton (
-      pkgs.runCommandLocal "ensure-all-wrappers-paths-exist"
+      pkgs.runCommandLocal "ensure-wrapper-integrity"
         {
-          nativeBuildInputs = [ pkgs.libcap-text-verifier ];
+          nativeBuildInputs = [
+            pkgs.libcap-text-verifier
+            pkgs.file
+          ];
           preferLocalBuild = true;
         }
         ''
           # make sure we produce output
           mkdir -p $out
 
-          echo -n "Checking that Nix store paths of all wrapped programs exist... "
+          echo -n "Checking that Nix store paths of all wrapped programs exist and are ELF executables... "
           ${lib.toShellVar "wrappers" (lib.mapAttrs (n: v: v.source) wrappers)}
           for name in "''${!wrappers[@]}"; do
             path="''${wrappers[$name]}"
@@ -382,6 +385,15 @@ in
               test -t 1 && echo -ne '\033[0m'
               exit 1
             fi
+            magic=$(file --mime --brief --dereference "$path")
+            if ! [[ "$magic" =~ application/x-executable || "$magic" =~ application/x-pie-executable ]]; then
+              test -t 1 && echo -ne '\033[1;31m'
+              echo "FAIL"
+              echo "The target executable $path is not an ELF! This is a security risk."
+              echo "Script wrappers (e.g. bash or python) are commonly susceptible to dangerous env var injections."
+              test -t 1 && echo -ne '\033[0m'
+              exit 1
+            fi
           done
           echo "OK"
 

nixos/modules/services/networking/rpcbind.nix

@@ -5,8 +5,6 @@
   ...
 }:
 
-with lib;
-
 {
 
   ###### interface
@@ -15,8 +13,8 @@ with lib;
 
     services.rpcbind = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable `rpcbind`, an ONC RPC directory service
@@ -32,29 +30,34 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.services.rpcbind.enable {
-    environment.systemPackages = [ pkgs.rpcbind ];
+  config = lib.mkMerge [
+    (lib.mkIf config.services.rpcbind.enable {
+      environment.systemPackages = [ pkgs.rpcbind ];
 
-    systemd.packages = [ pkgs.rpcbind ];
+      systemd.packages = [ pkgs.rpcbind ];
 
-    systemd.services.rpcbind = {
-      wantedBy = [ "multi-user.target" ];
-      # rpcbind performs a check for /var/run/rpcbind.lock at startup
-      # and will crash if /var/run isn't present. In the stock NixOS
-      # var.conf tmpfiles configuration file, /var/run is symlinked to
-      # /run, so rpcbind can enter a race condition in which /var/run
-      # isn't symlinked yet but tries to interact with the path, so
-      # controlling the order explicitly here ensures that rpcbind can
-      # start successfully. The `wants` instead of `requires` should
-      # avoid creating a strict/brittle dependency.
-      wants = [ "systemd-tmpfiles-setup.service" ];
-      after = [ "systemd-tmpfiles-setup.service" ];
-    };
+      systemd.services.rpcbind = {
+        wantedBy = [ "multi-user.target" ];
+        # rpcbind performs a check for /var/run/rpcbind.lock at startup
+        # and will crash if /var/run isn't present. In the stock NixOS
+        # var.conf tmpfiles configuration file, /var/run is symlinked to
+        # /run, so rpcbind can enter a race condition in which /var/run
+        # isn't symlinked yet but tries to interact with the path, so
+        # controlling the order explicitly here ensures that rpcbind can
+        # start successfully. The `wants` instead of `requires` should
+        # avoid creating a strict/brittle dependency.
+        wants = [ "systemd-tmpfiles-setup.service" ];
+        after = [ "systemd-tmpfiles-setup.service" ];
+      };
+    })
 
-    users.users.rpc = {
-      group = "nogroup";
-      uid = config.ids.uids.rpc;
-    };
-  };
+    {
+      users.users.rpc = {
+        enable = config.services.rpcbind.enable;
+        group = "nogroup";
+        uid = config.ids.uids.rpc;
+      };
+    }
+  ];
 
 }

pkgs/applications/editors/vim/plugins/generated.nix

@@ -5334,6 +5334,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  direnv-nvim = buildVimPlugin {
+    pname = "direnv.nvim";
+    version = "0-unstable-2026-06-28";
+    src = fetchFromGitHub {
+      owner = "NotAShelf";
+      repo = "direnv.nvim";
+      rev = "9258f9f10c4c729d8296fce0e3ecb12543daad06";
+      hash = "sha256-b5PpmkYWaDGLNcu+36tRR5ycATHYBjs9WrV8/jfmooQ=";
+    };
+    meta.homepage = "https://github.com/NotAShelf/direnv.nvim/";
+    meta.license = getLicenseFromSpdxId "MPL-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
   direnv-vim = buildVimPlugin {
     pname = "direnv.vim";
     version = "0-unstable-2023-12-02";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -379,6 +379,7 @@ https://github.com/barrettruth/diffs.nvim/,,
 https://github.com/dlyongemallo/diffview-plus.nvim/,,
 https://github.com/sindrets/diffview.nvim/,,
 https://github.com/elihunter173/dirbuf.nvim/,,
+https://github.com/NotAShelf/direnv.nvim/,,
 https://github.com/direnv/direnv.vim/,,
 https://github.com/chipsenkbeil/distant.nvim/,,
 https://github.com/doki-theme/doki-theme-vim/,,

pkgs/by-name/de/deno/package.nix

@@ -36,7 +36,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.9.6";
+  version = "2.9.7";
 
   __structuredAttrs = true;
 
@@ -51,10 +51,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-4X7IfQk9NJizhZKqH2EuDnSfk8axkKFyiZEv1FOfWTM=";
+    hash = "sha256-GOhud8uXlsDdyAN84WscakxK2qCFTEYSUwR5Wt2QPAs=";
   };
 
-  cargoHash = "sha256-EKRC+wqIos9O0GHaxjmb/ghyzV6oCi1qwhO2tjszWR4=";
+  cargoHash = "sha256-VSWkdTJiSX8O3+Kpu7RKnydxB3OcbwG9+NJCvLdFl68=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch

pkgs/by-name/im/immich/package.nix

@@ -110,7 +110,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "3.2.2";
+  version = "3.2.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
+    hash = "sha256-/wWep6A/ryocuGMOElcD1lOEwT6tJDdwa5HAcCZUXSs=";
   };
 
   pnpmDeps = fetchPnpmDeps {

pkgs/by-name/li/libslirp/package.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libslirp";
-  version = "4.9.3";
+  version = "4.9.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "slirp";
     repo = "libslirp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY=";
+    hash = "sha256-iWu3/Klsm8e9MH147BJhn9Vqyneq5ROqPvll1cnieL0=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/ni/nix-fast-build/package.nix

@@ -9,7 +9,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nix-fast-build";
-  version = "2.0.3";
+  version = "2.0.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Mic92";
     repo = "nix-fast-build";
     tag = finalAttrs.version;
-    hash = "sha256-L4HfADUq4Imq1LnvmjBPFBEAZAIKD9Pnj6ExRkVqHC4=";
+    hash = "sha256-sc/NZIHkRhgyAzK8Xn6G++vGrl/Uf7QHh+J5fnZ/o4s=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/ru/ruff/package.nix

@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.16.8";
+  version = "0.16.9";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-vfyEulokZqx5VyQA3jlKhQhgr/flLIGHcgC7CeegGl0=";
+    hash = "sha256-gxQXIlle9LGs1HcPiJn7KW0p21xsr62/FGypyqEfnSI=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-aX9Vu1egtvloe9dspXHR0Amc0mEuWG67EAOQU2b3oM0=";
+  cargoHash = "sha256-5ZolzeBEj6dolhObhWS/jMyB7KJPRSIbN0+zcG+0AGY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/we/wesnoth/package.nix

@@ -10,6 +10,9 @@
   SDL2_net,
   makeBinaryWrapper,
   SDL2_ttf,
+  sdl3,
+  sdl3-image,
+  sdl3-mixer,
   pango,
   gettext,
   boost186,
@@ -22,12 +25,30 @@
   lua5_4,
   curl,
   nix-update-script,
+  versionCheckHook,
   enableDevel ? false,
 }:
 
 let
   boost = boost186;
   suffix = lib.optionalString enableDevel "-devel";
+
+  sdl =
+    if enableDevel then
+      [
+        sdl3
+        sdl3-image
+        sdl3-mixer
+      ]
+    else
+      [
+        SDL2
+        SDL2_image
+        SDL2_mixer
+        SDL2_net
+        SDL2_ttf
+      ];
+
   # wesnoth requires lua built with c++, see https://github.com/wesnoth/wesnoth/pull/8234
   lua = lua5_4.override {
     postConfigure = ''
@@ -38,7 +59,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wesnoth${suffix}";
-  version = if enableDevel then "1.19.24" else "1.18.8";
+  version = if enableDevel then "1.19.28" else "1.18.8";
 
   src = fetchFromGitHub {
     owner = "wesnoth";
@@ -46,11 +67,17 @@ stdenv.mkDerivation (finalAttrs: {
     tag = finalAttrs.version;
     hash =
       if enableDevel then
-        "sha256-q6gdzHDPkG/RqpJxIHqWsxD0n8dzKajDhAT49bjmq78="
+        "sha256-5S2kgqn+HZIPguQP+FYaK79Cvx0IRnmcGSeWPQflt/g="
       else
         "sha256-Tgp3y120j5nqoBrDo7D9C0FcVO3TH5lf+/SoCjR+ikc=";
   };
 
+  strictDeps = true;
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/wesnothd${suffix}";
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -58,11 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ makeBinaryWrapper ];
 
   buildInputs = [
-    SDL2
-    SDL2_image
-    SDL2_mixer
-    SDL2_net
-    SDL2_ttf
     pango
     gettext
     boost
@@ -74,7 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     icu
     lua
     curl
-  ];
+  ]
+  ++ sdl;
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_SYSTEM_LUA" true)

pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash

@@ -24,9 +24,6 @@ buildRedistHookRegistration() {
   postInstallCheckHooks+=(checkCudaNonEmptyOutputs)
   nixLog "added checkCudaNonEmptyOutputs to postInstallCheckHooks"
 
-  preFixupHooks+=(fixupPropagatedBuildOutputsForMultipleOutputs)
-  nixLog "added fixupPropagatedBuildOutputsForMultipleOutputs to preFixupHooks"
-
   postFixupHooks+=(fixupCudaPropagatedBuildOutputsToOut)
   nixLog "added fixupCudaPropagatedBuildOutputsToOut to postFixupHooks"
 
@@ -193,16 +190,6 @@ checkCudaHasStubsIffIncludeRemoveStubsFromRunpathHook() {
   return 0
 }
 
-# TODO(@connorbaker): https://github.com/NixOS/nixpkgs/issues/323126.
-# _multioutPropagateDev() currently expects a space-separated string rather than an array.
-# NOTE: Because _multioutPropagateDev is a postFixup hook, we correct it in preFixup.
-fixupPropagatedBuildOutputsForMultipleOutputs() {
-  nixLog "converting propagatedBuildOutputs to a space-separated string"
-  # shellcheck disable=SC2124
-  export propagatedBuildOutputs="${propagatedBuildOutputs[@]}"
-  return 0
-}
-
 # The multiple outputs setup hook only propagates build outputs to dev.
 # We want to propagate them to out as well, in case the user interpolates
 # the package into a string -- in such a case, the dev output is not selected
@@ -217,7 +204,7 @@ fixupCudaPropagatedBuildOutputsToOut() {
   mkdir -p "${out:?}/nix-support"
 
   # NOTE: We must use printWords to ensure the output is a single line.
-  for output in $propagatedBuildOutputs; do
+  for output in "${propagatedBuildOutputs[@]}"; do
     # Propagate the other components to the out output
     nixLog "adding ${!output:?} to propagatedBuildInputs of ${out:?}"
     printWords "${!output:?}" >>"${out:?}/nix-support/propagated-build-inputs"

pkgs/development/interpreters/lua-5/default.nix

@@ -4,6 +4,8 @@
   lib,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
   makeBinaryWrapper,
 }:
 
@@ -199,6 +201,13 @@ rec {
 
   luajit_openresty = import ../luajit/openresty.nix {
     self = luajit_openresty;
-    inherit callPackage fetchFromGitHub passthruFun;
+    inherit
+      callPackage
+      fetchFromGitHub
+      fetchpatch2
+      applyPatches
+      stdenv
+      passthruFun
+      ;
   };
 }

pkgs/development/interpreters/luajit/openresty.nix

@@ -2,23 +2,45 @@
   self,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
+  stdenv,
   passthruFun,
 }:
 
-callPackage ./default.nix rec {
-  version = "2.1-20260724";
+let
+  version = "2.1-20260824";
 
   src = fetchFromGitHub {
     owner = "openresty";
     repo = "luajit2";
-    rev = "v${version}";
-    hash = "sha256-cvy9FgHWFuacCFl7/conLwNuMgaol1LnIUiqcnXy9H8=";
+    tag = "v${version}";
+    hash = "sha256-IynlDQOyjCr1C3qibLg3OJ9Qd/Rb5jzjy30ETKdKvFM=";
   };
 
+  # upstream LuaJIT has no riscv64.
+  # port submitted at https://github.com/openresty/luajit2/pull/236 same as Debian
+  srcWithRiscv64Port = applyPatches {
+    inherit src;
+    patches = [
+      (fetchpatch2 {
+        url = "https://github.com/openresty/luajit2/compare/v2.1-20260824...ce14aff834d8d62220fc730a16042c52451f41cc.diff";
+        hash = "sha256-VHDTUr7PWpthmhO3BokCbdL1cricAnX6BjZGTi1wr3Q=";
+      })
+    ];
+  };
+in
+callPackage ./default.nix {
+  inherit version;
+
+  # default luaAttr would be luajit_2_1, the wrong interpreter for the lua package set
+  luaAttr = "luajit_openresty";
+
+  src = if stdenv.hostPlatform.isRiscV64 then srcWithRiscv64Port else src;
+
   extraMeta = {
     badPlatforms = [
       "loongarch64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/1278
-      "riscv64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/628
       # 64-bit POWER (LE and BE, either ELF ABI version on the latter) *is* supported, but ELFv1 powerpc64-linux has an
       # issue with memory allocation
       # https://github.com/openresty/luajit2/issues/258

pkgs/development/python-modules/argos-translate-files/default.nix

@@ -62,7 +62,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Translate files using Argos Translate";
     homepage = "https://www.argosopentech.com";
-    license = lib.licenses.mit;
+    license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ misuzu ];
   };
 })

pkgs/top-level/all-packages.nix

@@ -4395,7 +4395,7 @@ with pkgs;
 
   luaPackages = lua52Packages;
 
-  luajit = luajit_2_1;
+  luajit = if stdenv.hostPlatform.isRiscV64 then luajit_openresty else luajit_2_1;
 
   luarocks = luaPackages.luarocks;
   luarocks-nix = luaPackages.luarocks-nix;