javaPackages.compiler.openjdk21: 21.0.12+2 -> 21.0.12+8 (#539108)

Release notes: https://github.com/linux-audit/audit-userspace/releases/tag/v4.2
Diff: https://github.com/linux-audit/audit-userspace/compare/v4.1.4...v4.2

doc/build-helpers/testers.chapter.md

@@ -741,7 +741,7 @@ Notable attributes:
 
 Compliance suite for [modular service](https://nixos.org/manual/nixos/unstable/#modular-services) integrations.
 
-Tests that a service manager integration correctly handles the portable modular services contract: `process.argv`, sub-services, assertions, and warnings.
+Tests that a service manager integration correctly handles the portable modular services contract: `process.argv`, `process.environment` (including `null` values that unset a variable), sub-services, assertions, and warnings.
 
 ### Return value {#tester-modularServiceCompliance-return}
 

lib/services/service.nix

@@ -70,6 +70,26 @@ in
           Command used for reloading in the underlying service manager to reload.
         '';
       };
+
+      environment = lib.mkOption {
+        type = types.lazyAttrsOf (
+          types.nullOr (types.coercedTo (types.either types.path types.package) (x: "${x}") types.str)
+        );
+        default = { };
+        example = lib.literalExpression ''{ FOO = "bar"; PATH = null; }'';
+        description = ''
+          Environment variables passed verbatim to the service process by the
+          service manager. Entries set to `null` actively unset the variable
+          before the process starts -- backends without native unset support use
+          a wrapper (e.g. `execline`'s `unexport`) so the variable is absent
+          even when the service manager or a backend-specific override would
+          otherwise supply it.
+
+          Values appear in the rendered unit and may be world-readable. For
+          secrets, use a backend-specific mechanism such as
+          `systemd.service.serviceConfig.EnvironmentFile`.
+        '';
+      };
     };
 
     notificationProtocol = mkOption {

lib/services/test.nix

@@ -48,6 +48,10 @@ let
             (dummyPkg "cowsay.sh")
             "world"
           ];
+          environment = {
+            FOO = "bar";
+            DROPPED = null;
+          };
         };
       };
       service3 = {
@@ -110,6 +114,7 @@ let
                 "/usr/bin/echo"
                 "hello"
               ];
+              environment = { };
             };
             services = { };
             assertions = [
@@ -128,6 +133,10 @@ let
                 "${dummyPkg "cowsay.sh"}"
                 "world"
               ];
+              environment = {
+                FOO = "bar";
+                DROPPED = null;
+              };
             };
             services = { };
             assertions = [ ];
@@ -136,6 +145,7 @@ let
           service3 = {
             process = {
               argv = [ "/bin/false" ];
+              environment = { };
             };
             services.exclacow = {
               process = {
@@ -143,6 +153,7 @@ let
                   "${dummyPkg "cowsay-ng"}/bin/cowsay"
                   "!"
                 ];
+                environment = { };
               };
               services = { };
               assertions = [

nixos/doc/manual/default.nix

@@ -152,7 +152,16 @@ let
   };
 
   systemdServiceOptions = buildPackages.nixosOptionsDoc {
-    inherit (evalModules { modules = [ ../../modules/system/service/systemd/service.nix ]; }) options;
+    inherit
+      (evalModules {
+        modules = [
+          (modules.importApply ../../modules/system/service/systemd/service.nix {
+            pkgs = throw "nixos docs / systemdServiceOptions: Do not reference pkgs in docs";
+          })
+        ];
+      })
+      options
+      ;
     # TODO: filter out options that are not systemd-specific, maybe also change option prefix to just `service-opt-`?
     inherit revision warningsAreErrors;
     transformOptions =

nixos/modules/system/service/systemd/service.nix

@@ -1,3 +1,9 @@
+# Non-module arguments
+# These are separate from the module arguments to avoid implicit dependencies.
+# This makes service modules self-contained, allowing mixing of Nixpkgs versions.
+{ pkgs }:
+
+# The module
 {
   lib,
   config,
@@ -92,6 +98,11 @@ in
         to prevent systemd substitution. Set this option explicitly to enable
         systemd's substitution features.
 
+        When {option}`process.environment` contains keys set to `null`, the default
+        is automatically prefixed with `unexport KEY` invocations (from
+        `pkgs.execline`) so those variables are unset before the process starts,
+        regardless of what `Environment=` or inherited environment supplies.
+
         To extend {option}`process.argv` with systemd specifiers, you can append
         to the escaped arguments:
 
@@ -109,8 +120,19 @@ in
         for available specifiers like `%n`, `%i`, `%t`.
       '';
       type = types.str;
-      default = config.systemd.lib.escapeSystemdExecArgs config.process.argv;
-      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.argv";
+      default =
+        let
+          nullEnvKeys = lib.attrNames (lib.filterAttrs (_: v: v == null) config.process.environment);
+        in
+        if nullEnvKeys == [ ] then
+          config.systemd.lib.escapeSystemdExecArgs config.process.argv
+        else
+          lib.concatMapStringsSep " " (
+            k: "${escapeSystemdExecArg "${pkgs.execline}/bin/unexport"} ${escapeSystemdExecArg k}"
+          ) nullEnvKeys
+          + " "
+          + config.systemd.lib.escapeSystemdExecArgs config.process.argv;
+      defaultText = lib.literalMD "The escaped `process.argv`, prefixed with `\"unexport\" \"KEY\"` (from `pkgs.execline`) for each key in `process.environment` set to `null`.";
     };
 
     systemd.mainExecReload = mkOption {
@@ -187,7 +209,7 @@ in
         types.submoduleWith {
           class = "service";
           modules = [
-            ./service.nix
+            (lib.modules.importApply ./service.nix { inherit pkgs; })
           ];
           specialArgs = {
             inherit systemdPackage;
@@ -207,6 +229,9 @@ in
     systemd.services."" = {
       # TODO description;
       wantedBy = lib.mkDefault [ "multi-user.target" ];
+      environment = lib.mapAttrs (_: lib.mkDefault) (
+        lib.filterAttrs (_: v: v != null) config.process.environment
+      );
       serviceConfig = {
         ExecReload = config.systemd.mainExecReload;
         Type = lib.mkDefault (if config.notificationProtocol.systemd then "notify" else "simple");

nixos/modules/system/service/systemd/system.nix

@@ -63,7 +63,7 @@ let
   modularServiceConfiguration = portable-lib.configure {
     serviceManagerPkgs = pkgs;
     extraRootModules = [
-      ./service.nix
+      (lib.modules.importApply ./service.nix { inherit pkgs; })
       ./config-data-path.nix
     ];
     extraRootSpecialArgs = {

nixos/modules/system/service/systemd/test.nix

@@ -76,6 +76,40 @@ let
         };
       };
 
+      # Test that `process.environment` becomes `Environment=` entries on the unit,
+      # that null values are dropped from `Environment=` and wrapped with unexport
+      # in `ExecStart`.
+      system.services.envvars = {
+        process = {
+          argv = [ hello' ];
+          environment = {
+            FOO = "bar";
+            BAZ = "qux";
+            DROPPED = null;
+          };
+        };
+      };
+
+      # Test that an explicit `systemd.service.environment` override wins over
+      # the portable default produced by `process.environment`.
+      system.services.envvars-override = {
+        process = {
+          argv = [ hello' ];
+          environment.FOO = "from-process";
+        };
+        systemd.service.environment.FOO = "from-systemd";
+      };
+
+      # Test that `process.environment` `null` unsets via wrapper even when the
+      # systemd layer sets the same key (true unset, not just "skip setting").
+      system.services.envvars-unset = {
+        process = {
+          argv = [ hello' ];
+          environment.FOO = null;
+        };
+        systemd.service.environment.FOO = "leaked";
+      };
+
       # Test extending process.argv with systemd specifiers
       system.services.argv-extended =
         { config, ... }:
@@ -137,6 +171,22 @@ runCommand "test-modular-service-systemd-units"
       # The base command should be escaped ($1 -> $$1, m%n -> m%%n), but the appended --systemd-unit %n should not be
       grep -F 'ExecStart="${hello}/bin/hello" "--greeting" "Fun $$1 fact, remainder is often expressed as m%%n" --systemd-unit %n' ${toplevel}/etc/systemd/system/argv-extended.service >/dev/null
 
+      # process.environment becomes Environment= entries; null values are dropped
+      # from Environment= and wrapped with unexport in ExecStart.
+      grep -F 'Environment="FOO=bar"' ${toplevel}/etc/systemd/system/envvars.service >/dev/null
+      grep -F 'Environment="BAZ=qux"' ${toplevel}/etc/systemd/system/envvars.service >/dev/null
+      ! grep -F 'Environment=.*DROPPED' ${toplevel}/etc/systemd/system/envvars.service
+      grep 'ExecStart=.*unexport.*DROPPED' ${toplevel}/etc/systemd/system/envvars.service >/dev/null
+
+      # systemd.service.environment override wins over process.environment.
+      grep -F 'Environment="FOO=from-systemd"' ${toplevel}/etc/systemd/system/envvars-override.service >/dev/null
+      ! grep -F 'FOO=from-process' ${toplevel}/etc/systemd/system/envvars-override.service
+
+      # process.environment null uses unexport wrapper for true unset, even when
+      # the systemd layer has an Environment= entry for the same key.
+      grep -F 'Environment="FOO=leaked"' ${toplevel}/etc/systemd/system/envvars-unset.service >/dev/null
+      grep 'ExecStart=.*unexport.*FOO' ${toplevel}/etc/systemd/system/envvars-unset.service >/dev/null
+
       [[ ! -e ${toplevel}/etc/systemd/system/foo.socket ]]
       [[ ! -e ${toplevel}/etc/systemd/system/bar.socket ]]
       [[ ! -e ${toplevel}/etc/systemd/system/bar-db.socket ]]

nixos/tests/geoclue2.nix

@@ -31,6 +31,6 @@
       assert ("Latitude:    12.345000°" in whereAmI), f"Incorrect latitude in:\n{whereAmI}"
       assert ("Longitude:   -67.890000°" in whereAmI), f"Incorrect longitude in:\n{whereAmI}"
       assert ("Altitude:    123.450000 meters" in whereAmI), f"Incorrect altitude in:\n{whereAmI}"
-      assert ("Accuracy:    1000.000000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
+      assert ("Accuracy:    1000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
     '';
 }

nixos/tests/systemd-boot.nix

@@ -460,19 +460,17 @@ in
       nodes.machine = common;
 
       testScript =
-        let
-          oldVersion = "222";
-        in
         # python
         ''
           machine.succeed("mount -o remount,rw /boot")
 
           def switch():
-              # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
+              # Replace version inside sd-boot with something older. See SD_MAGIC in systemd src/boot/boot.c
+              # Note: the sed replacement has to be length-preserving, because section length matters.
               machine.succeed(
-                """
+                r"""
                 find /boot -iname '*boot*.efi' -print0 | \
-                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot ${oldVersion} ####/' '{}'
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot [0-9]\(.*\) ####/#### LoaderInfo: systemd-boot 0\1 ####/' '{}'
                 """
               )
               return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")

pkgs/applications/editors/emacs/elisp-packages/manual-packages/b4-review-mode/package.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  b4,
-  melpaBuild,
-}:
-melpaBuild {
-  pname = "b4-review-mode";
-  inherit (b4) version;
-
-  src = b4.src-misc;
-  sourceRoot = "${b4.src-misc.name}/misc/emacs";
-
-  meta = {
-    description = "Emacs major mode with highlighting for the b4 review reply editor";
-    homepage = "https://git.kernel.org/pub/scm/utils/b4/b4.git/about";
-    license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [ fzakaria ];
-  };
-}

pkgs/applications/editors/vim/plugins/non-generated/b4-review-vim/default.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  vimUtils,
-  b4,
-}:
-vimUtils.buildVimPlugin {
-  pname = "b4-review-vim";
-  inherit (b4) version;
-
-  src = b4.src-misc;
-  sourceRoot = "${b4.src-misc.name}/misc/vim";
-
-  meta = {
-    description = "Vim syntax highlighting for the b4 review reply editor";
-    homepage = "https://git.kernel.org/pub/scm/utils/b4/b4.git/about";
-    license = lib.licenses.gpl2Only;
-    maintainers = with lib.maintainers; [ fzakaria ];
-  };
-}

pkgs/build-support/testers/modular-service-compliance.nix

@@ -29,6 +29,10 @@ let
     services = {
       svc = {
         process.argv = [ "${coreutils}/bin/true" ];
+        process.environment = {
+          FOO = "bar";
+          DROPPED = null;
+        };
         assertions = [
           {
             assertion = true;
@@ -70,6 +74,19 @@ let
         expected = [ "${coreutils}/bin/true" ];
       };
 
+      # A set environment variable round-trips through process.environment.
+      testProcessEnvironment = {
+        expr = c.process.environment.FOO;
+        expected = "bar";
+      };
+
+      # A null environment variable is preserved as null (unset request),
+      # rather than coerced to a string or dropped from the attrset.
+      testProcessEnvironmentNull = {
+        expr = c.process.environment.DROPPED;
+        expected = null;
+      };
+
       testAssertions = {
         expr = lib.elem {
           assertion = true;
@@ -186,6 +203,9 @@ let
     mkdir -p "$dir"
     echo "$$" > "$dir/pid"
     printf '%s\n' "$@" > "$dir/args"
+    # Record the process's own environment as received from the service
+    # manager (NUL-delimited, as the kernel stores it).
+    "${coreutils}/bin/cat" "/proc/$$/environ" > "$dir/environ"
     exec "${coreutils}/bin/sleep" infinity
   '';
 
@@ -238,6 +258,31 @@ let
         || { echo "${id}: expected arg ${lib.escapeShellArg arg} not found"; cat "${sharedDir}/${id}/args"; exit 1; }
     '') expectedArgs;
 
+  /**
+    Shell snippet: assert that the service's recorded environment contains
+    each `present` entry (an exact `KEY=value` string) and contains no
+    variable named in `absent`.
+  */
+  checkEnv =
+    id:
+    {
+      present ? [ ],
+      absent ? [ ],
+    }:
+    ''
+      # The recorded environ is NUL-delimited; render one entry per line.
+      tr '\0' '\n' < "${sharedDir}/${id}/environ" > "${sharedDir}/${id}/environ.lines"
+    ''
+    + lib.concatMapStrings (entry: ''
+      grep -qxF -- ${lib.escapeShellArg entry} "${sharedDir}/${id}/environ.lines" \
+        || { echo "${id}: expected env ${lib.escapeShellArg entry} not found"; cat "${sharedDir}/${id}/environ.lines"; exit 1; }
+    '') present
+    + lib.concatMapStrings (key: ''
+      if grep -qE ${lib.escapeShellArg "^${key}="} "${sharedDir}/${id}/environ.lines"; then
+        echo "${id}: env variable ${lib.escapeShellArg key} should be unset"; exit 1
+      fi
+    '') absent;
+
   mkTestScript =
     name: text:
     lib.getExe (writeShellApplication {
@@ -330,6 +375,24 @@ in
     );
   };
 
+  environment = mkTest {
+    name = "${namePrefix}-environment";
+    services.test = {
+      process.argv = mkArgv "env" [ ];
+      process.environment = {
+        FOO = "bar";
+        DROPPED = null;
+      };
+    };
+    testExe = mkTestScript "environment" (
+      waitAndCheck "env" [ ]
+      + checkEnv "env" {
+        present = [ "FOO=bar" ];
+        absent = [ "DROPPED" ];
+      }
+    );
+  };
+
   sub-services = mkTest {
     name = "${namePrefix}-sub-services";
     services.a = {

pkgs/by-name/as/assimp/package.nix

@@ -42,6 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "ASSIMP_BUILD_ASSIMP_TOOLS" true)
     (lib.cmakeBool "ASSIMP_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "ASSIMP_WARNINGS_AS_ERRORS" false)
   ];
 
   # Some matrix tests fail on non-86_64-linux:

pkgs/by-name/au/audit/package.nix

@@ -30,13 +30,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "4.1.4";
+  version = "4.2";
 
   src = fetchFromGitHub {
     owner = "linux-audit";
     repo = "audit-userspace";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GdJ9nzlDAdOazOHH/YWuEoELrJh+G5ZJUKwIqAKAzpo=";
+    hash = "sha256-poldhsF+ccutCxK7KE/gYpxa1x3wUQJWoCwU6pGFj6A=";
   };
 
   postPatch = ''
@@ -165,7 +165,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://people.redhat.com/sgrubb/audit/";
     description = "Audit Library";
-    changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.2";
+    changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ grimmauld ];
     teams = [ lib.teams.security-review ];

pkgs/by-name/b4/b4/package.nix

@@ -2,7 +2,6 @@
   lib,
   python3Packages,
   fetchPypi,
-  fetchgit,
   patatt,
 }:
 
@@ -32,15 +31,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
     textual
   ];
 
-  passthru = {
-    src-misc = fetchgit {
-      url = "https://git.kernel.org/pub/scm/utils/b4/b4.git";
-      rev = "v${finalAttrs.version}";
-      hash = "sha256-NjYL3RKQpjDkU98qbXyl/cvLTJYVAfIowm8E2Rg8AgI=";
-      fetchSubmodules = false;
-    };
-  };
-
   meta = {
     homepage = "https://git.kernel.org/pub/scm/utils/b4/b4.git/about";
     license = lib.licenses.gpl2Only;

pkgs/by-name/ca/cacert/package.nix

@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.125";
+  version = "3.126";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
+    hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg=";
   };
 
   unpackPhase = ''

pkgs/by-name/da/dash/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.13.4";
+  version = "0.5.13.5";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-0Q39Qc2lkWVWDbOcqRXCxKdjb/8EKB2NLfd62Sx1Pis=";
+    hash = "sha256-QAkBAaKkkfE+kB09SOkEFPJmNGKLm//zX/VANjwien0=";
   };
 
   strictDeps = true;

pkgs/by-name/do/doctest/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doctest";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4jW6xPFCFxk1l47EkSUVojhycrtluPhOc5Adf/25R7M=";
+    hash = "sha256-+/IEISqN9HdaCJ0udLVUitOUziLvF/D3POecZMoXuho=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/et/ethtool/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ethtool";
-  version = "7.0";
+  version = "7.1";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/ethtool-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Zgv5clp4cTQ6DSMgaKdjT7z7abbC+O/0VYJ/rvsM0WI=";
+    hash = "sha256-TXjCbtwCVbyS9LmVtf1mEI11/5Zu1GlPYCWm03C8JJY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fl/fluidsynth/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.5";
+  version = "2.5.6";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WEzOYHtPIUkPZu3v4dWcCh3dOJUyG1xRxDuoSXqiGbk=";
+    hash = "sha256-q4NdfemCprYEYCrKlHumeRM8TyNz8eJcFM18EsB0p0c=";
     fetchSubmodules = true;
   };
 
@@ -52,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    changelog = "https://github.com/FluidSynth/fluidsynth/blob/${finalAttrs.src.tag}/doc/wiki/ChangeLog.md";
     description = "Real-time software synthesizer based on the SoundFont 2 specifications";
     homepage = "https://www.fluidsynth.org";
     license = lib.licenses.lgpl21Plus;

pkgs/by-name/ge/geoclue2/fix-sysusers_dir.patch

@@ -0,0 +1,13 @@
+diff --git a/data/meson.build b/data/meson.build
+index 2591e6a..dc1bd8d 100644
+--- a/data/meson.build
++++ b/data/meson.build
+@@ -69,7 +69,7 @@ if get_option('enable-backend')
+         if systemd.found()
+             sysusers_dir = systemd.get_variable(pkgconfig: 'sysusersdir')
+         else
+-            sysusers_dir = '/usr/lib/sysusers.d'
++            sysusers_dir = join_paths(get_option('prefix'), 'usr/lib/sysusers.d')
+         endif
+         configure_file(output: 'geoclue-sysusers.conf',
+                        input: 'geoclue-sysusers.conf.in',

pkgs/by-name/ge/geoclue2/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geoclue";
-  version = "2.7.2";
+  version = "2.8.1";
 
   outputs = [
     "out"
@@ -42,11 +42,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "geoclue";
     repo = "geoclue";
     tag = finalAttrs.version;
-    hash = "sha256-LwL1WtCdHb/NwPr3/OLISwaAwplhJwiZT9vUdX29Bbs=";
+    hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg=";
   };
 
   patches = [
     ./add-option-for-installation-sysconfdir.patch
+    ./fix-sysusers_dir.patch
   ];
 
   separateDebugInfo = true;

pkgs/by-name/gl/glog/package.nix

@@ -71,18 +71,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   checkPhase =
     let
-      excludedTests =
-        lib.optionals stdenv.hostPlatform.isDarwin [
-          "mock-log"
-        ]
-        ++ [
-          "logging" # works around segfaults for now
-        ]
-        ++ lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) [
-          # CHECK_STREQ failed: symbol == "non_inline_func" ((/build/source/build/symbolize_unittest+0x1000b840) vs. non_inline_func)
-          # TestWithPCInsideNonInlineFunction doesn't use TEST(), so can't exclude via GTEST_FILTER
-          "symbolize"
-        ];
+      excludedTests = [
+        "logging" # works around segfaults for now
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isGnu [
+        # Test appears to make strong assumptions about compiler optimizations
+        # that appear to be broken under GCC 16.
+        "stacktrace"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        "mock-log"
+      ]
+      ++ lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) [
+        # CHECK_STREQ failed: symbol == "non_inline_func" ((/build/source/build/symbolize_unittest+0x1000b840) vs. non_inline_func)
+        # TestWithPCInsideNonInlineFunction doesn't use TEST(), so can't exclude via GTEST_FILTER
+        "symbolize"
+      ];
       excludedTestsRegex = lib.optionalString (
         excludedTests != [ ]
       ) "(${lib.concatStringsSep "|" excludedTests})";

pkgs/by-name/gn/gn/package.nix

@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2026-04-01";
+      _version = "0-unstable-2026-05-27";
     in
     _version,
-  rev ? "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
-  hash ? "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ=",
+  rev ? "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
+  hash ? "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8=",
 }:
 
 stdenv.mkDerivation {

pkgs/by-name/gr/graphviz/package.nix

@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphviz";
-  version = "14.1.2";
+  version = "15.1.0";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     tag = finalAttrs.version;
-    hash = "sha256-LkyiKl0ulS9ujEdVLfyeoc4CtjITd6CAc35IUtlHSfw=";
+    hash = "sha256-5v/ib8hwqHrJLs+jvDGvg0aJiKIt8ipXEd1EUzew7XU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gr/gridtracker2/package.nix

@@ -11,13 +11,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "gridtracker2";
-  version = "2.260723.0";
+  version = "2.260714.0";
 
   src = fetchFromGitLab {
     owner = "gridtracker.org";
     repo = "gridtracker2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BfUJhkw242Gu8gxCeDiIzpTiuToBSlKlI5+Z5Ae1kdE=";
+    hash = "sha256-ZY+p86wgjzVNALBt6+Gn68sZ6tNcsq5wo1QykZccPT0=";
   };
 
   npmDepsHash = "sha256-5h3bswjVf/8JHhwHRFTUfydN7XXtWbxNHTZ0mLL7RT8=";

pkgs/by-name/hd/hdrhistogram_c/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Fix build on i686 by not trying to build AVX2 code
   # Submitted upstream: https://github.com/HdrHistogram/HdrHistogram_c/pull/143
-  ${if stdenv.hostPlatform.isi686 then "patches" else null} = [
+  patches = [
     ./no-avx2-i386.patch
   ];
 

pkgs/by-name/im/imagemagick/package.nix

@@ -67,26 +67,6 @@
 assert libXtSupport -> libX11Support;
 assert libraqmSupport -> freetypeSupport;
 
-let
-  arch =
-    if stdenv.hostPlatform.system == "i686-linux" then
-      "i686"
-    else if
-      stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin"
-    then
-      "x86-64"
-    else if stdenv.hostPlatform.system == "armv7l-linux" then
-      "armv7l"
-    else if
-      stdenv.hostPlatform.system == "aarch64-linux" || stdenv.hostPlatform.system == "aarch64-darwin"
-    then
-      "aarch64"
-    else if stdenv.hostPlatform.system == "powerpc64le-linux" then
-      "ppc64le"
-    else
-      null;
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
   version = "7.1.2-27";
@@ -113,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     "MVDelegate=${lib.getExe' coreutils "mv"}"
     "RMDelegate=${lib.getExe' coreutils "rm"}"
     "--with-frozenpaths"
-    (lib.withFeatureAs (arch != null) "gcc-arch" arch)
+    "--with-gcc-arch=generic"
     (lib.withFeature librsvgSupport "rsvg")
     (lib.withFeature librsvgSupport "pango")
     (lib.withFeature liblqr1Support "lqr")

pkgs/by-name/li/libapparmor/package.nix

@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y5r8X7Cpwp7TSsKYXNoAeyy0MbgxLSW8gNtLsIvKP8c=";
+    hash = "sha256-Kuc5Nrz4iq5MC5AOcJL9Sb54DWNKlEk3b3DW0vpgSZg=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

pkgs/by-name/li/libffiReal/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.7.0";
+  version = "3.7.1";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY=";
+    hash = "sha256-1emmY43b0lE921RRjrZ+S75vpwe8wBwQ9iEvCgiNgZ0=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -32,9 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./freebsd-tsan-pthread.patch
   ];
 
-  # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file:
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c";
-
   strictDeps = true;
   outputs = [
     "out"
@@ -94,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "http://sourceware.org/libffi/";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ aduh95 ];
     platforms = lib.platforms.all;
     pkgConfigModules = [ "libffi" ];
   };

pkgs/by-name/li/libmysofa/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmysofa";
-  version = "1.3.3";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "hoene";
     repo = "libmysofa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc=";
+    hash = "sha256-gP/RjKzMx8JIYcyiivBGvy3kIdwHMEKY6abssyVUKNQ=";
   };
 
   outputs = [

pkgs/by-name/li/libressl/default.nix

@@ -100,6 +100,17 @@ let
         moveToOutput "share/man/man1/nc.1.gz" "$nc"
       '';
 
+      doInstallCheck = true;
+      installCheckPhase = ''
+        runHook preInstallCheck
+
+        # Check whether the build target actually contains our cacert.
+        # A simple binary match for the path is enough.
+        grep "${cacert}/etc/ssl/certs/ca-bundle.crt" $out/lib/*libtls*
+
+        runHook postInstallCheck
+      '';
+
       meta = {
         description = "Free TLS/SSL implementation";
         homepage = "https://www.libressl.org";
@@ -139,6 +150,13 @@ let
     url = "https://github.com/libressl/portable/commit/a15ea0710398eaeed3be53cf643e80a1e80c981d.patch";
     hash = "sha256-Mlf4SrGCCqALQicbGtmVGdkdfcE8DEGYkOuVyG2CozM=";
   };
+
+  # https://github.com/libressl/portable/issues/1295
+  # https://github.com/libressl/portable/pull/1303
+  tls-default-ca-patch = fetchpatch {
+    url = "https://github.com/libressl/portable/commit/c85e07d0d68129fc1b1c9039b266099c8d735c3d.patch";
+    hash = "sha256-oNL3v8Ef1HrayXn+/3T4UhHLJos8eVMlqebVyaxnWVo=";
+  };
 in
 {
   # 4.2 was released October 2025 and will become unsupported on October 22,
@@ -148,6 +166,7 @@ in
     hash = "sha256-bVwvWFg1iOp5H0yGRQBAcdAN+lVKW/eIoAbKHrWr1ws=";
     patches = [
       common-cmake-install-full-dirs-patch
+      tls-default-ca-patch
     ];
   };
 
@@ -156,5 +175,8 @@ in
   libressl_4_3 = generic {
     version = "4.3.2";
     hash = "sha256-7fAa7iTGXWnmqe/LnUS82mgv+dTzu72V55Th36kIR7U=";
+    patches = [
+      tls-default-ca-patch
+    ];
   };
 }

pkgs/by-name/li/libsodium/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-04-16";
+  version = "1.0.22-unstable-2026-07-08";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "33cc75ab1565d9dcbe808354191bd572ad6b64d0";
-    hash = "sha256-8kS9FBoaFaJOjH7XZc8IG3GaQaUiYD/awQOhs7j0n1Y=";
+    rev = "77a422c85a3b8b487de50c811b38d18394831ba6";
+    hash = "sha256-Ahka2PnrmYvTLjZMzik5mFsxhDpMLRMKT/I5ftUb0Xc=";
   };
 
   outputs = [

pkgs/by-name/li/libssh/package.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libssh";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor finalAttrs.version}/libssh-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Gmr0JNgyfl7t705f5/W5JCJt1hesnz3oDyF9gqNqcSE=";
+    hash = "sha256-05Qa8KLXjV2C7Xo2mI6RM5lDEvA1uWWabkP42zloeEw=";
   };
 
   outputs = [

pkgs/by-name/li/libtiff/package.nix

@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtiff";
-  version = "4.7.1";
+  version = "4.7.2";
 
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UiC6s86i7UavW86EKm74oPVlEacvoKmwW7KETjpnNaI=";
+    hash = "sha256-60Lpg5WRfWMzlOoOUA+C6KLlYIZ+3BjXidOVqv4M2GA=";
   };
 
   patches = [

pkgs/by-name/mb/mbedtls/4.nix

@@ -5,8 +5,8 @@
 }:
 
 callPackage ./generic.nix {
-  version = "4.1.0";
-  hash = "sha256-TA1uka13So8URttw+JJVdKIL+IonkhIQSc0IfraXpIM=";
+  version = "4.2.0";
+  hash = "sha256-Xz5W5zYPNlASPyc1/Sz2O1LONdxpUkg1hgzKdax/3ag=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

pkgs/by-name/mb/mbedtls/package.nix

@@ -6,8 +6,8 @@
 }:
 
 callPackage ./generic.nix {
-  version = "3.6.6";
-  hash = "sha256-+PW41/c8M/Yz0EVWM4Gt4HTNBMUTU5MayaKVZ+upLIo=";
+  version = "3.6.7";
+  hash = "sha256-t1ZPeFA3ftKaEIaXQ7RXZEsiOAYK4KSSm55SFr9g17A=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

pkgs/by-name/mi/minikube/package.nix

@@ -9,7 +9,6 @@
   libvirt,
   withQemu ? false,
   qemu,
-  socket-vmnet,
   withVfkit ? false,
   vfkit,
   makeWrapper,
@@ -78,16 +77,10 @@ buildGoModule (finalAttrs: {
       --prefix PATH : ${
         lib.makeBinPath (
           lib.optionals withQemu [ qemu ]
-          ++ lib.optionals (withQemu && stdenv.hostPlatform.isDarwin) [ socket-vmnet ]
-          ++ lib.optionals (withVfkit && stdenv.hostPlatform.isDarwin) [ vfkit ]
           ++ lib.optionals stdenv.hostPlatform.isLinux [ libvirt ]
+          ++ lib.optionals (withVfkit && stdenv.hostPlatform.isDarwin) [ vfkit ]
         )
       } \
-      ${
-        lib.optionalString (
-          withQemu && stdenv.hostPlatform.isDarwin
-        ) ''--set MINIKUBE_SOCKET_VMNET_CLIENT_PATH "${lib.getExe' socket-vmnet "socket_vmnet_client"}"''
-      } \
       ${lib.optionalString stdenv.hostPlatform.isLinux "--prefix LD_LIBRARY_PATH : ${
         lib.makeLibraryPath [ libvirt ]
       }"}

pkgs/by-name/my/mymake/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mymake";
-  version = "2.4.5";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "fstromback";
     repo = "mymake";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R9JWTHmnRwEusl7IT+vZ+nFoJB+7o50S1KgzBx+X1t8=";
+    hash = "sha256-H7uoTnFtRf0jaqQ+N2IK4I+edx+cK/5wXDG1Orc2XcY=";
   };
 
   buildPhase = ''

pkgs/by-name/ne/netpbm/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
   pname = "netpbm";
-  version = "11.15.1";
+  version = "11.15.3";
 
   outputs = [
     "bin"
@@ -31,8 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "5227";
-    sha256 = "sha256-Lr02cu7OAPv+wjKjPkA0wyZ0VvurUuCf5IJXjmCAE0I=";
+    rev = "5264";
+    sha256 = "sha256-5G2OitW25ZNsdBcVkKfLpFJWjTm9VcB3ca0QllOSugI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/on/onetbb/package.nix

@@ -76,6 +76,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeBool "TBB_DISABLE_HWLOC_AUTOMATIC_SEARCH" false)
+    # Treating compiler errors as warnings creates churn each compiler update,
+    # and provides little utility to us downstream.
+    (lib.cmakeBool "TBB_STRICT" false)
     (lib.cmakeBool "TBB_TEST" finalAttrs.finalPackage.doCheck)
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -83,10 +86,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   env = {
-    # Fix build with modern gcc
-    # In member function 'void std::__atomic_base<_IntTp>::store(__int_type, std::memory_order) [with _ITp = bool]',
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=stringop-overflow";
-
     # Fix undefined reference errors with version script under LLVM.
     NIX_LDFLAGS = lib.optionalString (
       stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17"

pkgs/by-name/pa/paperless-ngx/package.nix

@@ -124,6 +124,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     "scikit-learn"
     "tika-client"
     "tqdm"
+    "zxing-cpp"
     # requested by maintainer
     "imap-tools"
     "ocrmypdf"

pkgs/by-name/pd/pdns-recursor/package.nix

@@ -21,17 +21,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns-recursor";
-  version = "5.4.4";
+  version = "5.4.3";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-recursor-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Tut86kxxvTuABQWitPyFSd1vRnW36eFkC/8bNDpJwzo=";
+    hash = "sha256-opICnFQ6xFOMpXYouBQsntypsoOjqAyzk+2UfgWE8A8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     sourceRoot = "pdns-recursor-${finalAttrs.version}/rec-rust-lib/rust";
-    hash = "sha256-0/HLB9wMVQALga7ZJcPSDczjcBinMwQz2vTPep+x8p8=";
+    hash = "sha256-eAiXdsHWZca0wx5FONGfa7JDcpDHyCABJOUROhwAsZo=";
   };
 
   cargoRoot = "rec-rust-lib/rust";

pkgs/by-name/pr/prek/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.4.4";
+  version = "0.4.10";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PAEmRQ5Vro83fkegOWsdY59U7WAQxBPSEalzxZV6K4o=";
+    hash = "sha256-tTr/Aob6jP1YL+n5vGkUkByew73WdP3mqLW5Lci1gNM=";
   };
 
-  cargoHash = "sha256-EmlR6Lmt5XR0uS/y3FqY5yGNeVBSdtLtEGH9jZLcP2o=";
+  cargoHash = "sha256-He55uH7t7NI5sYgowujqCMK5yjhC2F+8ZLxKG6TLjYY=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/so/socket-vmnet/package.nix

@@ -1,67 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "socket-vmnet";
-  version = "1.2.2";
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  src = fetchFromGitHub {
-    owner = "lima-vm";
-    repo = "socket_vmnet";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-D5Z4aml82h397ho48HFeXwR6y2XkopFIKjO09jUgFdo=";
-  };
-
-  postPatch = ''
-    # NOTA BENE:
-    # Since socket_vmnet is macOS only the upstream Makefile assumes
-    # standard system utilities such as date from /bin/ and logger
-    # from /usr/bin are available through $PATH.
-    # This is not the case for the nixpkgs build environment.
-    # To maintain compatability with nixpkgs build env nixpkgs dependency
-    # purity and the following replacements are made:
-    substituteInPlace Makefile \
-       --replace-fail "logger" "echo" \
-       --replace-fail "-r $(SOURCE_DATE_EPOCH)" "-d @$(SOURCE_DATE_EPOCH)"
-    substituteInPlace launchd/io.github.lima-vm.socket_vmnet{,.bridged.en0}.plist \
-      --replace-fail "/opt/socket_vmnet/bin/socket_vmnet" "${placeholder "out"}/bin/socket_vmnet"
-  '';
-
-  dontConfigure = true;
-
-  makeFlags = [
-    "VERSION=${finalAttrs.version}"
-    "SOURCE_DATE_EPOCH=0"
-  ];
-
-  makeTargets = [
-    "socket_vmnet"
-    "socket_vmnet_client"
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    make PREFIX=$out $makeFlags install.{bin,doc}
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Vmnet.framework support for unmodified rootless QEMU";
-    homepage = "https://github.com/lima-vm/socket_vmnet";
-    changelog = "https://github.com/lima-vm/socket_vmnet/releases/tag/${finalAttrs.src.tag}";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ afh ];
-    mainProgram = "socket_vmnet";
-    platforms = lib.platforms.darwin;
-  };
-})

pkgs/by-name/so/sourceHighlight/gcc16-disambiguate-regex-ranges-test.patch

@@ -0,0 +1,57 @@
+diff --git a/lib/tests/test_regexranges_main.cpp b/lib/tests/test_regexranges_main.cpp
+index 567d79230c..e28bba47e5 100644
+--- a/lib/tests/test_regexranges_main.cpp
++++ b/lib/tests/test_regexranges_main.cpp
+@@ -12,26 +12,26 @@
+ using namespace std;
+ using namespace srchilite;
+ 
+-RegexRanges ranges;
++RegexRanges regexRanges;
+ 
+ void check_range_regex(const string &s, bool expectedTrue = true) {
+     cout << "checking " << s << endl;
+     if (expectedTrue)
+-        assertTrue(ranges.addRegexRange(s));
++        assertTrue(regexRanges.addRegexRange(s));
+     else
+-        assertFalse(ranges.addRegexRange(s));
++        assertFalse(regexRanges.addRegexRange(s));
+ }
+ 
+ void check_match(const string &line, const string &expected = "") {
+     cout << "searching inside " << line;
+     const boost::regex *matched = 0;
+     if (expected != "") {
+-        matched = ranges.matches(line);
++        matched = regexRanges.matches(line);
+         assertTrue(matched != 0);
+         assertEquals(expected, matched->str());
+         cout << " found " << *matched << endl;
+     } else {
+-        assertTrue(ranges.matches(line) == 0);
++        assertTrue(regexRanges.matches(line) == 0);
+         cout << " not found" << endl;
+     }
+ }
+@@ -39,9 +39,9 @@
+ void check_in_range(const string &s, bool expectedTrue = true) {
+     cout << "checking " << s << "... ";
+     if (expectedTrue) {
+-        assertTrue(ranges.isInRange(s));
++        assertTrue(regexRanges.isInRange(s));
+     } else {
+-        assertFalse(ranges.isInRange(s));
++        assertFalse(regexRanges.isInRange(s));
+     }
+     cout << expectedTrue << endl;
+ }
+@@ -57,7 +57,7 @@
+     check_range_regex("{notclosed");
+ 
+     // reset regular expressions
+-    ranges.clear();
++    regexRanges.clear();
+ 
+     check_range_regex("/// foo");
+     check_range_regex("/// bar");

pkgs/by-name/so/sourceHighlight/package.nix

@@ -37,6 +37,11 @@ stdenv.mkDerivation rec {
       url = "https://git.savannah.gnu.org/cgit/src-highlite.git/patch/?id=ab9fe5cb9b85c5afab94f2a7f4b6d7d473c14ee9";
       hash = "sha256-wmSLgLnLuFE+IC6AjxzZp/HEnaOCS1VfY2cac0T7Y+w=";
     })
+
+    # GCC 16 detects ambiguity in the `ranges` name in a test (conflicts with
+    # `namespace std::range { }` from GCC), so we rename the variable to
+    # disambiguate.
+    ./gcc16-disambiguate-regex-ranges-test.patch
   ]
   ++ lib.optionals stdenv.cc.isClang [
     # Adds compatibility with C++17 by removing the `register` storage class specifier.

pkgs/by-name/sp/spirv-tools/package.nix

@@ -29,6 +29,11 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/2ec8457ab33d539b6f1fecc998360c0b8b05ed4f.diff";
       hash = "sha256-YHbYBwXMm4rTKpmMW6I3LUafhA4RuNUdXqUBUAXwXpE=";
     })
+
+    (fetchpatch {
+      url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/0db9162641d9709c63c92a13e66fd88905180e89.diff";
+      hash = "sha256-eoS35Zxb+frQTTTNCaZ4TV/QZjaK45mW1OzzIlXQ1C0=";
+    })
   ]
   # The cmake options are sufficient for turning on static building, but not
   # for disabling shared building, just trim the shared lib from the CMake

pkgs/by-name/sr/srt/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "srt";
-  version = "1.5.5";
+  version = "1.5.6";
 
   src = fetchFromGitHub {
     owner = "Haivision";
     repo = "srt";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-hOkLlmtF9dKqXZTjAeBntkkg5WsmsZN6DKhyakoIF1k=";
+    sha256 = "sha256-fdgj6URuMaem+ZVy7D8Hnf2Ev1HindevdvX0xyxCL4M=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/sy/systemtap-unwrapped/package.nix

@@ -8,12 +8,16 @@
   cpio,
   elfutils,
   python3,
+  bashNonInteractive,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "systemtap";
   version = "5.4";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchgit {
     url = "git://sourceware.org/git/systemtap.git";
     rev = "release-${finalAttrs.version}";
@@ -30,14 +34,15 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     cpio
+    gettext
     python3
     python3.pkgs.setuptools
   ];
   buildInputs = [
     boost
     elfutils
-    gettext
     python3
+    bashNonInteractive
   ];
   enableParallelBuilding = true;
 

pkgs/by-name/th/thrift/package.nix

@@ -12,6 +12,7 @@
   bison,
   flex,
   ctestCheckHook,
+  buildPackages,
   static ? stdenv.hostPlatform.isStatic,
 }:
 
@@ -26,6 +27,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-gGAO+D0A/hEoHMm6OvRBc1Mks9y52kfd0q/Sg96pdW4=";
   };
 
+  postPatch = lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
+    # Compiling the tests doesn't work for cross builds.
+    substituteInPlace lib/py/CMakeLists.txt \
+      --replace-fail 'COMMAND ''${THRIFT_COMPILER} --gen py test/test_thrift_file/TestServer.thrift' ""
+  '';
+
   # Workaround to make the Python wrapper not drop this package:
   # pythonFull.buildEnv.override { extraLibs = [ thrift ]; }
   pythonPath = [ ];
@@ -35,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     flex
     pkg-config
-    (python3.withPackages (
+    (buildPackages.python3.withPackages (
       ps:
       with ps;
       [
@@ -74,7 +81,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     # FIXME: Fails to link in static mode with undefined reference to
     # `boost::unit_test::unit_test_main(bool (*)(), int, char**)'
-    (lib.cmakeBool "BUILD_TESTING" (!static))
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
+    # Building tutorials requires running thrift.
+    (lib.cmakeBool "BUILD_TUTORIALS" (stdenv.buildPlatform.canExecute stdenv.hostPlatform))
   ];
 
   disabledTests = [
@@ -111,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Library for scalable cross-language services";
     mainProgram = "thrift";
     homepage = "https://thrift.apache.org/";
+    downloadPage = "https://github.com/apache/thrift";
     license = lib.licenses.asl20;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [ bjornfor ];

pkgs/by-name/ti/tideways-daemon/package.nix

@@ -10,7 +10,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-daemon";
-  version = "1.18.2";
+  version = "1.18.0";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -28,15 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-34SvkbUTm8ngMqqzeDd7waHg1w6eJlNpTqHGEnWsc/s=";
+        hash = "sha256-sm5xITxGSbcWiI4hhxkHKFleTQBeZZBTH823KQz3M5U=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_aarch64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-tz+VtJ3G5X63mp2gy8zGSvxzY9aN07goGyToyIZkUXk=";
+        hash = "sha256-WxaJx/vkg139zm0xOzT+9FZRAk4v/YJcVHTXwDVcALE=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-MYHDrZtHuKGi3QGsxW8ZWZDZaUEuqcfRVBZV4jjGk44=";
+        hash = "sha256-RcNG7jPt+bYiP4hzV6vaxVgSstDM2oWjOmo9TmpKcWM=";
       };
     };
     updateScript = "${

pkgs/by-name/tr/traefik/package.nix

@@ -1,23 +1,23 @@
 {
   lib,
   fetchzip,
-  buildGo126Module,
+  buildGo125Module,
   nixosTests,
   nix-update-script,
 }:
 
-buildGo126Module (finalAttrs: {
+buildGo125Module (finalAttrs: {
   pname = "traefik";
-  version = "3.7.8";
+  version = "3.7.6";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-nFc3Mcy0kbeEvyrKfrF9AR60RZOEIMMwsUmefUAi84Y=";
+    hash = "sha256-7osOcFQIqsMQ0ZiGQMy6Joet/Tlou9BYlzmtyytaMh8=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-z+Ku6GOecoiZ8eJVHUiD/GxV2blSIfLOs+Yr4B8coI8=";
+  vendorHash = "sha256-lMGuyp3GdcMUdzxu/e3c3ZV1/XWnsqVho2uj230GXzw=";
 
   proxyVendor = true;
 

pkgs/by-name/tz/tzdata/package.nix

@@ -8,16 +8,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tzdata";
-  version = "2026b";
+  version = "2026c";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
-      hash = "sha256-EUVD2fGaa/61vKQ2hq6hc9OHVaPbHy7sESZHrpLG9UQ=";
+      hash = "sha256-5KF4pEd/PQ6nfMMYKP9yqjj+/41hqhPn6Z4ULp2QK+Q=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
-      hash = "sha256-N+nthCf101IcIvxY4pPL+wQ9cO7fEAOHCzPzY/Yco0Q=";
+      hash = "sha256-sc/8Os5MTHzQ77ovet2G7D0LedpIvPA1gmcf08j+rOg=";
     })
   ];
 

pkgs/by-name/un/unbound/package.nix

@@ -63,13 +63,13 @@ assert lib.assertMsg (
 ) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)";
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.25.1";
+  version = "1.25.2";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-1PXnxCPxoB5IrVBQIsrxiWAq+IoH7Ma9T1TTJsoTJc4=";
+    hash = "sha256-zt0JpVmct7w6ay+p8CdH6SGt/rL/v//e7K3MT8KZfOY=";
   };
 
   outputs = [

pkgs/by-name/uv/uv/package.nix

@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.11.32";
+  version = "0.11.28";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-Vkh4GWcKpaAVrok7K/620jfaFayKZRCO32icfZ6+mSU=";
+    hash = "sha256-/mTH2hojC+l0yxn+LEAIj8FTA/nWKIPZ7uLMVJxebw4=";
   };
 
-  cargoHash = "sha256-w8O655Ad9bz79KeWF00hniNX+fssY9ZE+LUKaWBQM7c=";
+  cargoHash = "sha256-FvLl32JfIq5a1NnLtnFJyy5T+vkcOD+qfQLDy6NYhHg=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/by-name/va/valkey/package.nix

@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "valkey";
-  version = "9.1.0";
+  version = "9.1.1";
 
   src = fetchFromGitHub {
     owner = "valkey-io";
     repo = "valkey";
     rev = finalAttrs.version;
-    hash = "sha256-RMZz83fycpOTPWB1dIXU0/hdh4ZGC+6JhCws8htAQ5E=";
+    hash = "sha256-wGHlPQ2JPxGTaJRJ9Siz3Q3eKdlo5z1tQpSFs9xZMbI=";
   };
 
   patches = lib.optional useSystemJemalloc ./use_system_jemalloc.patch;

pkgs/by-name/xs/xsimd/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xsimd";
-  version = "14.2.0";
+  version = "14.3.0";
 
   src = fetchFromGitHub {
     owner = "xtensor-stack";
     repo = "xsimd";
     tag = finalAttrs.version;
-    hash = "sha256-BTiN4B3//wlB3nmOoluM/7bL7J7YIBp5afih9zUP1yw=";
+    hash = "sha256-0m9gUDCgGh58lf9uPp1Obw4rsqWEL1RffWYB6s315p0=";
   };
 
   # strictDeps raises the chance that xsimd will be able to be cross compiled

pkgs/by-name/xv/xvfb/package.nix

@@ -38,14 +38,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  # TODO: commented out for rebuild avoidance after xorg-server update. revert
-  # on staging.
-  # inherit (xorg-server) src version;
-  version = "21.1.23";
-  src = fetchurl {
-    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
-  };
+  inherit (xorg-server) src version;
 
   strictDeps = true;
 

pkgs/by-name/ya/yara/package.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yara";
-  version = "4.5.6";
+  version = "4.5.7";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vzYH56BC0Stb2I4U5VzxA0xG46xZkWmbTIC6BtzeNQ8=";
+    hash = "sha256-4PK/GU02mcgMSkFllqGZ7zmswQb8b6bkfEWLoCGHo3E=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/zx/zxing-cpp/package.nix

@@ -6,25 +6,31 @@
   python3,
   stdenv,
   libzint,
+  pkg-config,
+  stb,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zxing-cpp";
-  version = "2.3.0";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "zxing-cpp";
     repo = "zxing-cpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e3nSxjg8p+1DEUbZOh4C2zfnA6iGhNJMPiIe2oJEbRo=";
+    hash = "sha256-ZtjvHBnuPJkc9kU998jH7IPlX3jF/RGtLNWDzsb0v4A=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
+    pkg-config
   ];
 
   buildInputs = [
     libzint
+    stb
   ];
 
   cmakeFlags = [
@@ -57,7 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
       formats.
     '';
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ lukegb ];
+    maintainers = with lib.maintainers; [
+      lukegb
+      qweered
+    ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/development/compilers/ghc/9.8.4-binary.nix

@@ -324,6 +324,15 @@ stdenv.mkDerivation {
   # calls install-strip ...
   dontBuild = true;
 
+  # GHC tries to remove xattrs when installing to work around Gatekeeper
+  # (see https://gitlab.haskell.org/ghc/ghc/-/issues/17418). This step normally
+  # succeeds in nixpkgs because xattrs are not allowed in the store, but it
+  # can fail when a file has the `com.apple.provenance` xattr, and it can’t be
+  # modified (such as target of the symlink to `libiconv.dylib`).
+  # The `com.apple.provenance` xattr is a new feature of macOS as of macOS 13.
+  # See: https://eclecticlight.co/2023/03/13/ventura-has-changed-app-quarantine-with-a-new-xattr/
+  makeFlags = lib.optionals stdenv.buildPlatform.isDarwin [ "XATTR=/does-not-exist" ];
+
   # Patch scripts to include runtime dependencies in $PATH.
   postInstall = ''
     for i in "$out/bin/"*; do

pkgs/development/compilers/openjdk/21/source.json

@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-5QWicPXWUyP1VkmTDIOjIgu9NXkB27nvtgUbrL+mSxg=",
+  "hash": "sha256-XxD5Tn5dMwirOoESCsza1dPvcgMF795Uh8YgaGUli1g=",
   "owner": "openjdk",
   "repo": "jdk21u",
-  "rev": "refs/tags/jdk-21.0.12+2"
+  "rev": "refs/tags/jdk-21.0.12+8"
 }

pkgs/development/compilers/rust/1_97.nix

@@ -50,8 +50,8 @@ let
 in
 import ./default.nix
   {
-    rustcVersion = "1.97.0";
-    rustcSha256 = "sha256-HAhV2JgqD7HQMhtgVLVbcy07HRfIRoQet/0Ks3vydvg=";
+    rustcVersion = "1.97.1";
+    rustcSha256 = "sha256-YiwrQpxTy/3A3TpR0DVU6RzWPr7BkSwfVwlkDN/vGp0=";
 
     llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
     llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -65,27 +65,27 @@ import ./default.nix
     # Note: the version MUST be the same version that we are building. Upstream
     # ensures that each released compiler can compile itself:
     # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.97.0";
+    bootstrapVersion = "1.97.1";
 
     # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
     bootstrapHashes = {
-      i686-unknown-linux-gnu = "d066e5dd59c15fc1c793173d53b41719162de4470b5c34041a8bc664542df375";
-      x86_64-unknown-linux-gnu = "eb89b20287153391c49ebcdb7fd91b683a12438d129bfb92eadcc495545af3a7";
-      x86_64-unknown-linux-musl = "675bb2d574efc64da0563a9cb70cc017560394c5938e04c92987cad383299e8d";
-      arm-unknown-linux-gnueabihf = "180e487a1f7abaeda374b942d369dd7faa4364b1267629d48552d9a17a5bc4ab";
-      armv7-unknown-linux-gnueabihf = "2f9dfd76694efcf391f6d4947e97be17d1f469c9e989ed194660ddd85877ca60";
-      aarch64-unknown-linux-gnu = "70fb01b4894d56fad34c260ce63aee647589be57a26ab33730110d8228cbcf02";
-      aarch64-unknown-linux-musl = "28efcf4ee31235eb5f7820dadba46400ab9dbbb030719e7a2ab284b02c8cbf82";
-      x86_64-apple-darwin = "3dc9ad8ec35a9f0acd2c5ae2c80c36baf5c7010423bf339ca55709fc995885d4";
-      aarch64-apple-darwin = "c2e6a5ef480f5715ae9874188c1fa749b6a6f90d8d911f5a3a5d768f0ac70427";
-      powerpc64-unknown-linux-gnu = "62c9f9b7887505fc4dcda40784469f23909657d245e53025a7a8124b016d6631";
-      powerpc64le-unknown-linux-gnu = "a8d3f487d07cebc48ce03ad66a970a5f5138a5c1e7c7cec12fb9b6e47a24bf1a";
-      powerpc64le-unknown-linux-musl = "09fee3b9ede1e94ff6c3bad3918dc231be909c74bb182e0acd583c03a9f1df5f";
-      riscv64gc-unknown-linux-gnu = "be239392f7112f6a81f20c9e715d5743319a8b773592e027ad800d73527d8fae";
-      s390x-unknown-linux-gnu = "fee699e31d0a0034f46669c473e61a88af6734f8c5902d77329ac236fcd9b538";
-      loongarch64-unknown-linux-gnu = "37ad9d55b98cc680a2d75c7184e6457b632ce82690a56be7a2044e32c91176ce";
-      loongarch64-unknown-linux-musl = "bfba202bae252ac372026171d9bc98e5eb80578d576546f56e8aee2e9d64ecf0";
-      x86_64-unknown-freebsd = "77101232e3769395e99c0e663d2c8beb3d4127857945cf7c812c1886ba823b8f";
+      i686-unknown-linux-gnu = "914c2702deada0b9cf1d64bb3495d76e55cb3eba07d508472dde8b55a93e3759";
+      x86_64-unknown-linux-gnu = "b4cdbc7cc6b0ee0a2666b1872769fdb2ad8393b28b63952f6493b4b400e4832b";
+      x86_64-unknown-linux-musl = "40dbea28193cf2b488cf3e4a89274ccfb60efa50883f19917a382f84fd05bdc4";
+      arm-unknown-linux-gnueabihf = "ba62fe07ad85b507907705a14adc1e8bc258de5f6177ba41d77bbff9f469a4ce";
+      armv7-unknown-linux-gnueabihf = "e89c5e33aaddc6ef56857000c9117875c2997e9a1a500bd7b16277c9874b002f";
+      aarch64-unknown-linux-gnu = "2f2496c70bd336a66a4c8baf2d303ba161f3552f192444c3639ba903c7c1e2c5";
+      aarch64-unknown-linux-musl = "c5f45b5c6eb7f8fdb277c54c08402b7c931516740fbd4eccc26ba148f7cd5d57";
+      x86_64-apple-darwin = "5f4c84d2bcce7983468642855a45fc4978fba1324cfdd1ea0b182face3ab4ffa";
+      aarch64-apple-darwin = "cbd14c36f039f6f11f38148a6295d8234d18ddf20bea53031c86f119423a8b26";
+      powerpc64-unknown-linux-gnu = "2b507d5eb9b5c4c041b50e93e069db56d094f02e6df103dc74c016155141bfae";
+      powerpc64le-unknown-linux-gnu = "ff524eef5a59d801df09ccad5cdaf9ea1f0a07d75cbed2a7e9f013a9eb76a3c1";
+      powerpc64le-unknown-linux-musl = "15630f33fbea2dd9661f8482b6c612da271549aba40401444aaa53650e646b9b";
+      riscv64gc-unknown-linux-gnu = "59bec35d8febb2ab918fa41cffbaa5b07146a63bdc33f029ff756d70a3151ece";
+      s390x-unknown-linux-gnu = "808268af9e880d41b8cb32b242e38c9bd3ea7aba6409b02fbffa0fbc5370c538";
+      loongarch64-unknown-linux-gnu = "d5a925962854730ae7641420d8337af93988ea4ff47b503a856ec53776c87841";
+      loongarch64-unknown-linux-musl = "3fb653299d228e3e0726afb179b07dd10a51a2ecc3cdfcd740011b1d8420ca97";
+      x86_64-unknown-freebsd = "77866a4c449bcccb40e9d6712bf3eb899d29018ed8e841fd9d8d59370751f152";
     };
 
     selectRustPackage = pkgs: pkgs.rust_1_97;

pkgs/development/interpreters/spidermonkey/140.nix

@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "140.11.0";
-  hash = "sha512-0GrbPvTeEyTj1hhy1w3jGrCKwBPzOQNUm+0oxuvMW03ulLs2OIKCwZNdd9GlZAefOtvwjWu4AoSomcuz2GEwDA==";
+  version = "140.13.0";
+  hash = "sha512-k3pBA9ccXh5L8FGCFyn26nC1wY1ESTCkh2lcwj10cSoBNARySPasAjBeAb7LcFQmpVudiXOfAqAe2gHs9bwn8Q==";
 }

pkgs/development/libraries/fontconfig/default.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fontconfig";
-  version = "2.18.1";
+  version = "2.18.2";
 
   outputs = [
     "bin"
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   # ref: https://github.com/NixOS/nixpkgs/pull/401037#discussion_r2055430206
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/api/v4/projects/890/packages/generic/fontconfig/${finalAttrs.version}/fontconfig-${finalAttrs.version}.tar.xz";
-    hash = "sha256-IwDz2/pyU7OkT0/uzbyN+kXd5dws+3H86vMfOUy0EDE=";
+    hash = "sha256-z45ldu8EhMFQeb2vd82cUcRk31NlgUraTT7nMx6jHrU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gmp/6.x.nix

@@ -69,8 +69,7 @@ let
     ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.is64bit) "ABI=64"
     # to build a .dll on windows, we need --disable-static + --enable-shared
     # see https://gmplib.org/manual/Notes-for-Particular-Systems.html
-    ++ optional (!withStatic && stdenv.hostPlatform.isPE) "--disable-static --enable-shared"
-    ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) "--disable-assembly";
+    ++ optional (!withStatic && stdenv.hostPlatform.isPE) "--disable-static --enable-shared";
 
     doCheck = true; # not cross;
 

pkgs/development/libraries/libmicrohttpd/1.0.nix

@@ -1,10 +1,10 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix rec {
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/libmicrohttpd-${version}.tar.gz";
-    hash = "sha256-tG0A9Y76b0l7l9LngsTuZjAdQS3dhV3TBoUYs6LNPqI=";
+    hash = "sha256-u1z8rfxS29XrUS1uKZXgNhNRwz6XqHq6Qm06Snumz3A=";
   };
 }

pkgs/development/python-modules/aiohttp/default.nix

@@ -48,14 +48,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiohttp";
-  version = "3.14.1";
+  version = "3.14.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "aiohttp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OJSLv/NfVrKESZqNr51FJUzLRz7wLMRdGoNjKC5EhlI=";
+    hash = "sha256-n8LH34N9V2Smqc23q/49gqRbP0U1glJAYiyPEGFtEmM=";
   };
 
   postPatch = ''

pkgs/development/python-modules/faust-cchardet/default.nix

@@ -3,16 +3,16 @@
   buildPythonPackage,
   fetchFromGitHub,
   cython,
+  packaging,
   pkgconfig,
   setuptools,
-  wheel,
   pytestCheckHook,
   python,
 }:
 
 buildPythonPackage rec {
   pname = "faust-cchardet";
-  version = "2.1.19";
+  version = "2.1.20";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -20,14 +20,19 @@ buildPythonPackage rec {
     repo = "cChardet";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-yY6YEhXC4S47rxnkKAta4m16IVGn7gkHSt056bYOYJ4=";
+    hash = "sha256-MeRX/g38c+q2jiTtEhUpaGYf+5tkhexRGuIG0PdUGvI=";
   };
 
-  nativeBuildInputs = [
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "packaging<26" packaging
+  '';
+
+  build-system = [
     cython
+    packaging
     pkgconfig
     setuptools
-    wheel
   ];
 
   postFixup = ''
@@ -41,7 +46,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
-    changelog = "https://github.com/faust-streaming/cChardet/blob/${src.rev}/CHANGES.rst";
+    changelog = "https://github.com/faust-streaming/cChardet/blob/${src.tag}/CHANGES.rst";
     description = "High-speed universal character encoding detector";
     mainProgram = "cchardetect";
     homepage = "https://github.com/faust-streaming/cChardet";

pkgs/development/python-modules/feedgen/default.nix

@@ -2,27 +2,30 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   python-dateutil,
   lxml,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "feedgen";
   version = "1.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-2b1Rw7XpVqKlKZjDcIxNLHKfL8wxEYjh5dO5cmOTVGo=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     python-dateutil
     lxml
   ];
 
-  # No tests in archive
-  doCheck = false;
+  nativeCheckInputs = [ pytestCheckHook ];
 
   meta = {
     description = "Python module to generate ATOM feeds, RSS feeds and Podcasts";
@@ -34,4 +37,4 @@ buildPythonPackage rec {
     ];
     maintainers = with lib.maintainers; [ casey ];
   };
-}
+})

pkgs/development/python-modules/fields/default.nix

@@ -2,24 +2,29 @@
   buildPythonPackage,
   lib,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fields";
   version = "5.0.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-MdSqA9jUTjXfE8Qx3jUTaZfwR6kkpZfYT3vCCeG+Vyc=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "fields" ];
 
+  doCheck = false; # Argument(s) {'path'} are declared in the hookimpl but can not be found in the hookspec
+
   meta = {
     description = "Container class boilerplate killer";
     homepage = "https://github.com/ionelmc/python-fields";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.sheepforce ];
   };
-}
+})

pkgs/development/python-modules/filelock/default.nix

@@ -41,6 +41,7 @@ buildPythonPackage (finalAttrs: {
     "tests/test_virtualenv.py"
     # Very prone to timeouts on busy machines
     "tests/test_filelock.py"
+    "tests/test_read_write.py"
   ];
 
   meta = {

pkgs/development/python-modules/httpcore2/default.nix

@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "httpcore2";
-  version = "2.5.0";
+  version = "2.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "httpx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vIWAUjHPyafbeeUc2OvGpkiOoTj1fTniRnQiKSdkm6s=";
+    hash = "sha256-3kghDQMYksF9a4sFGajzNfGPOjdX1OiMwv7rH/fbmM0=";
   };
 
   postPatch = ''

pkgs/development/python-modules/httpx2/default.nix

@@ -24,14 +24,17 @@
   pygments,
   rich,
   socksio,
+  wsproto,
   zstandard,
 
   # tests
   chardet,
   pytestCheckHook,
   pytest-trio,
+  starlette,
   trustme,
   uvicorn,
+  websockets,
 
   # reverse deps
   httpx2,
@@ -39,14 +42,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "httpx2";
-  version = "2.5.0";
+  version = "2.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "httpx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vIWAUjHPyafbeeUc2OvGpkiOoTj1fTniRnQiKSdkm6s=";
+    hash = "sha256-3kghDQMYksF9a4sFGajzNfGPOjdX1OiMwv7rH/fbmM0=";
   };
 
   postPatch = ''
@@ -75,6 +78,7 @@ buildPythonPackage (finalAttrs: {
     ];
     http2 = [ h2 ];
     socks = [ socksio ];
+    ws = [ wsproto ];
     zstd = lib.optionals (pythonOlder "3.14") [ zstandard ];
   };
 
@@ -89,10 +93,11 @@ buildPythonPackage (finalAttrs: {
   nativeCheckInputs = [
     chardet
     pytestCheckHook
-    # pytest-httpbin
     pytest-trio
+    (starlette.overridePythonAttrs { doCheck = false; })
     trustme
     uvicorn
+    websockets
   ]
   ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 

pkgs/development/python-modules/lark-oapi/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lark-oapi";
-  version = "1.7.1";
+  version = "1.6.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "larksuite";
     repo = "oapi-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6EYLE+RiDd9ZNjwQ4gWW6jsipFjJCE7CZsSsxIenE6w=";
+    hash = "sha256-W4eFhB9+XdqA/fX26XwULjvSlflL0ar/FDXWFqXsP8g=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/matplotlib/default.nix

@@ -69,13 +69,13 @@ let
 in
 
 buildPythonPackage (finalAttrs: {
-  version = "3.11.0";
+  version = "3.11.1";
   pname = "matplotlib";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-aMDHvgGzDcyjY4k09/WR33NAEjXL2/DRqxxx59t/i1c=";
+    hash = "sha256-aWR9tXRpQceT1uRFpM00kyP/uH2cyVjCrYSmWbSDLTA=";
   };
 
   env.XDG_RUNTIME_DIR = "/tmp";

pkgs/development/python-modules/mistune/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mistune";
-  version = "3.3.3";
+  version = "3.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "mistune";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AAOpQ3GMEifMVM1SaT5zVltIshAQt5SYqCtIvdjy20M=";
+    hash = "sha256-7N1Kz2lN6GyDVKUhuGrEkbinV8Vpc4aahal/7KhnIXo=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/multipart/default.nix

@@ -6,16 +6,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "multipart";
-  version = "1.3.1";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "defnull";
     repo = "multipart";
-    tag = "v${version}";
-    hash = "sha256-kLiOK6ovW3ki1CONXVQZCJw/U3K1AoR6rrmJUstwZOw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1/G8qUnY7i5OvxkTSebC2pae9lzzfvnozJSVVylqB7w=";
   };
 
   build-system = [ flit-core ];
@@ -25,10 +25,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "multipart" ];
 
   meta = {
-    changelog = "https://github.com/defnull/multipart/blob/${src.tag}/CHANGELOG.rst";
+    changelog = "https://github.com/defnull/multipart/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     description = "Parser for multipart/form-data";
     homepage = "https://github.com/defnull/multipart";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

pkgs/development/python-modules/numpy/2.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   python,
   pythonAtLeast,
   buildPythonPackage,
@@ -52,6 +53,16 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-IriSrnGAZHvJ7m97s12BydNQZDZunCVtRgj/iSgw5Vc=";
   };
 
+  patches = [
+    # Fix for test failure on i686. Remove with next release.
+    # Upstream report: https://github.com/numpy/numpy/issues/32060
+    # Upstream PR: https://github.com/numpy/numpy/pull/32064
+    (fetchpatch {
+      url = "https://github.com/numpy/numpy/commit/0e1dce62e27f79be9d6552487787a19b7f95cfbf.patch";
+      hash = "sha256-mQjf6y/mLSgx9+G70/r9U3VJg5zIrl/6ANQhpP2LGmg=";
+    })
+  ];
+
   postPatch = ''
     # remove needless reference to full Python path stored in built wheel
     substituteInPlace numpy/meson.build \

pkgs/development/python-modules/psycopg/default.nix

@@ -4,6 +4,8 @@
   buildPythonPackage,
   fetchFromGitHub,
   fetchurl,
+  nukeReferences,
+  python,
   replaceVars,
 
   # build
@@ -78,12 +80,17 @@ let
 
     nativeBuildInputs = [
       libpq.pg_config
+      nukeReferences
     ];
 
     buildInputs = [
       libpq
     ];
 
+    postInstall = ''
+      nuke-refs $out/${python.sitePackages}/psycopg_c/{pq.c,_psycopg.c}
+    '';
+
     # tested in psycopg
     doCheck = false;
 

pkgs/development/python-modules/rf-protocols/default.nix

@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  prek,
   pyprojectVersionPatchHook,
   pytest-asyncio,
   pytestCheckHook,
@@ -33,7 +32,6 @@ buildPythonPackage (finalAttrs: {
   ];
 
   nativeCheckInputs = [
-    prek
     pytest-asyncio
     pytestCheckHook
   ];

pkgs/development/python-modules/sh/default.nix

@@ -38,7 +38,9 @@ buildPythonPackage rec {
     "test_unicode_path"
     # fails to import itself after modifying the environment
     "test_environment"
-    # timing sensitive through usage of sleep(1) and signal handling
+    # timing sensitive due to strict timeouts
+    "test_done_callback_no_deadlock"
+    "test_timeout_overstep"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # Disable tests that fail on Darwin sandbox

pkgs/development/python-modules/yarl/default.nix

@@ -16,16 +16,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "yarl";
-  version = "1.24.2";
+  version = "1.24.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aio-libs";
     repo = "yarl";
-    tag = "v${version}";
-    hash = "sha256-GEe2GDXmqsQgWB0UxPZVMdSco3j2JYHg9BU9M6oqynw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2Uqn1TwfH375CBIveEpsco4dDNrhxHwX8wIP8dKhh/M=";
   };
 
   build-system = [
@@ -61,10 +61,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "yarl" ];
 
   meta = {
-    changelog = "https://github.com/aio-libs/yarl/blob/${src.tag}/CHANGES.rst";
+    changelog = "https://github.com/aio-libs/yarl/blob/${finalAttrs.src.tag}/CHANGES.rst";
     description = "Yet another URL library";
     homepage = "https://github.com/aio-libs/yarl";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
-}
+})

pkgs/development/python-modules/zxing-cpp/default.nix

@@ -6,16 +6,17 @@
   pillow,
   pybind11,
   libzxing-cpp,
+  pyprojectVersionPatchHook,
   pytestCheckHook,
   libzint,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage {
   pname = "zxing-cpp";
-  inherit (libzxing-cpp) src version meta;
+  inherit (libzxing-cpp) src version;
   pyproject = true;
 
-  sourceRoot = "${src.name}/wrappers/python";
+  sourceRoot = "${libzxing-cpp.src.name}/wrappers/python";
 
   # we don't need pybind11 in the root environment
   # https://pybind11.readthedocs.io/en/stable/installing.html#include-with-pypi
@@ -25,7 +26,7 @@ buildPythonPackage rec {
 
     substituteInPlace setup.py \
       --replace-fail "cfg = 'Debug' if self.debug else 'Release'" "cfg = 'Release'" \
-      --replace-fail " '-DVERSION_INFO=' + self.distribution.get_version()]" " '-DVERSION_INFO=' + self.distribution.get_version(), '-DZXING_DEPENDENCIES=LOCAL', '-DZXING_USE_BUNDLED_ZINT=OFF']"
+      --replace-fail "f'-DPython_EXECUTABLE={sys.executable}'," "f'-DPython_EXECUTABLE={sys.executable}', '-DZXING_DEPENDENCIES=LOCAL', '-DZXING_USE_BUNDLED_ZINT=OFF',"
   '';
 
   dontUseCmakeConfigure = true;
@@ -39,6 +40,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     cmake
+    pyprojectVersionPatchHook
   ];
 
   buildInputs = [ libzint ];
@@ -51,4 +53,16 @@ buildPythonPackage rec {
   enabledTestPaths = [ "test.py" ];
 
   pythonImportsCheck = [ "zxingcpp" ];
+
+  meta = {
+    inherit (libzxing-cpp.meta)
+      homepage
+      changelog
+      description
+      longDescription
+      license
+      maintainers
+      platforms
+      ;
+  };
 }

pkgs/development/tools/misc/libtool/libtool2.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libtool";
-  version = "2.5.4";
+  version = "2.6.2";
 
   src = fetchurl {
     url = "mirror://gnu/libtool/${pname}-${version}.tar.gz";
-    sha256 = "sha256-2o67LOTc9GuQCY2vliz/po9LT2LqYPeY0O8Skp7eat8=";
+    hash = "sha256-JK2zqprgNccPq6NEr1fXMhXriSgQRa9sfM0wd1H4sL8=";
   };
 
   outputs = [

pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix

@@ -8,7 +8,6 @@ in
   ln-boot,
   mes,
   buildPlatform,
-  fetchurl,
 }:
 let
   pname = "mes-libc";
@@ -24,18 +23,16 @@ let
   sources = sourcesJson."${arch}.linux.gcc";
   inherit (sources) libtcc1_SOURCES libc_gnu1_SOURCES libc_gnu2_SOURCES;
 
-  ldexpl = fetchurl {
-    url = "https://gitlab.com/janneke/mes/-/raw/c837abed8edb341d4e56913729fbe9803b4de47c/lib/math/ldexpl.c";
-    hash = "sha256-3QoFZZIqVmlMUosEqOdYIMEHzYgQ7GJ7Hz0Bf/1iIig=";
-  };
-
   # Concatenate all source files into a convenient bundle
   # "gcc" variants of source files (eg. "lib/linux/x86-mes-gcc") can also be
   # compiled by tinycc
   #
   # Passing this many arguments is too much for kaem so we need to split
   # the operation in two
-  firstLibc = libc_gnu1_SOURCES + " ${ldexpl}";
+  #
+  # We also vendor a copy of ldexpl. We do not `fetchurl` it as the mes GitLab
+  # often has force pushes and links are thus unstable.
+  firstLibc = libc_gnu1_SOURCES + " " + ./ldexpl.c;
   lastLibc = libc_gnu2_SOURCES;
 in
 kaem.runCommand "${pname}-${version}"

pkgs/os-specific/linux/systemd/default.nix

@@ -203,13 +203,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "261";
+  version = "261.1";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6IB1ZEQqQ0impwBhCaLZAEgMVkVFU61JDVlGotxNzGQ=";
+    hash = "sha256-4iOitWGdRmGgJjEXGWtq2lEhPtGguma+qrjTShrps2g=";
   };
 
   # PATCH POLICY

pkgs/tools/misc/findutils/default.nix

@@ -13,24 +13,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "findutils";
-  version = "4.10.0";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "mirror://gnu/findutils/findutils-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-E4fgtn/yR9Kr3pmPkN+/cMFJE5Glnd/suK5ph4nwpPU=";
+    sha256 = "sha256-v9GcsGzHHzNS1WfpAoTYzawCrIl3S76t8LUzsMEUMv0=";
   };
 
   postPatch = ''
-    substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${coreutils}/bin/echo";'
+    substituteInPlace xargs/xargs.c --replace 'char default_cmd[] = "echo";' 'char default_cmd[] = "${lib.getExe' coreutils "echo"}";'
   '';
 
   patches = [
     ./no-install-statedir.patch
-
-    # Fixes test-float failure on ppc64 with C23
-    # https://lists.gnu.org/archive/html/bug-gnulib/2025-07/msg00021.html
-    # Multiple upstream commits squashed with adjustments, see header
-    ./gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch
   ];
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
@@ -53,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   configureFlags = [
     # "sort" need not be on the PATH as a run-time dep, so we need to tell
     # configure where it is. Covers the cross and native case alike.
-    "SORT=${coreutils}/bin/sort"
+    "SORT=${lib.getExe' coreutils "sort"}"
     "--localstatedir=/var/cache"
   ];
 
@@ -86,6 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.gnu.org/software/findutils/";
+    changelog = "https://cgit.git.savannah.gnu.org/cgit/findutils.git/tree/NEWS?h=v${finalAttrs.version}";
     description = "GNU Find Utilities, the basic directory searching utilities of the GNU operating system";
     longDescription = ''
       The GNU Find Utilities are the basic directory searching

pkgs/tools/misc/findutils/gnulib-float-h-tests-port-to-C23-PowerPC-GCC.patch

@@ -1,225 +0,0 @@
-Applied the following incremental gnulib commits:
-
-- 55a366a06fbd98bf13adc531579e3513cee97a32
-- 65ed9d3b24ad09fd61d326c83e7f1b05f6e9d65f
-- ce8e9de0bf34bc63dffc67ab384334c509175f64
-- 6164b4cb0887b5331a4e64449107decd37d32735
-
-With adjustments specific to the structure & differences in findutils:
-
-- gnulib code is split across gl/lib and gnulib-tests
-- float.in.h seems old, lacking blocks for standards C11 and up. Relevant code for LDBL_NORM_MAX was added.
-- A Makefile.in is used for the test flags instead of the fancy automake modules
-  in the upstream gnulib project, so we add -lm to the float test there.
-  Surrounding texts in this file are slightly different in every project.
----
-diff '--color=auto' -ruN a/gl/lib/float.c b/gl/lib/float.c
---- a/gl/lib/float.c	2024-01-01 21:35:38.000000000 +0100
-+++ b/gl/lib/float.c	2026-01-02 16:11:07.508755119 +0100
-@@ -22,7 +22,7 @@
- 
- #if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
- const union gl_long_double_union gl_LDBL_MAX =
--  { { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL } };
-+  { { DBL_MAX, DBL_MAX / 0x1p53 } };
- #elif defined __i386__
- const union gl_long_double_union gl_LDBL_MAX =
-   { { 0xFFFFFFFF, 0xFFFFFFFF, 32766 } };
-diff '--color=auto' -ruN a/gl/lib/float.in.h b/gl/lib/float.in.h
---- a/gl/lib/float.in.h	2024-01-01 21:35:38.000000000 +0100
-+++ b/gl/lib/float.in.h	2026-01-02 16:13:56.571684867 +0100
-@@ -111,44 +111,38 @@
- # define LDBL_MAX_10_EXP 4932
- #endif
- 
--/* On AIX 7.1 with gcc 4.2, the values of LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX are
--   wrong.
--   On Linux/PowerPC with gcc 4.4, the value of LDBL_MAX is wrong.  */
--#if (defined _ARCH_PPC || defined _POWER) && defined _AIX && (LDBL_MANT_DIG == 106) && defined __GNUC__
-+/* On PowerPC with gcc 15 when using __ibm128 long double, the value of
-+   LDBL_MIN_EXP, LDBL_MIN, LDBL_MAX, and LDBL_NORM_MAX are wrong.  */
-+#if ((defined _ARCH_PPC || defined _POWER) && LDBL_MANT_DIG == 106 \
-+     && defined __GNUC__)
- # undef LDBL_MIN_EXP
- # define LDBL_MIN_EXP DBL_MIN_EXP
- # undef LDBL_MIN_10_EXP
- # define LDBL_MIN_10_EXP DBL_MIN_10_EXP
- # undef LDBL_MIN
- # define LDBL_MIN 2.22507385850720138309023271733240406422e-308L /* DBL_MIN = 2^-1022 */
--#endif
--#if (defined _ARCH_PPC || defined _POWER) && (defined _AIX || defined __linux__) && (LDBL_MANT_DIG == 106) && defined __GNUC__
- # undef LDBL_MAX
--/* LDBL_MAX is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xFFFFFFFF }.
--   It is not easy to define:
--     #define LDBL_MAX 1.79769313486231580793728971405302307166e308L
--   is too small, whereas
--     #define LDBL_MAX 1.79769313486231580793728971405302307167e308L
--   is too large.  Apparently a bug in GCC decimal-to-binary conversion.
--   Also, I can't get values larger than
--     #define LDBL63 ((long double) (1ULL << 63))
--     #define LDBL882 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL945 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL1008 (LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63 * LDBL63)
--     #define LDBL_MAX (LDBL1008 * 65535.0L + LDBL945 * (long double) 9223372036821221375ULL + LDBL882 * (long double) 4611686018427387904ULL)
--   which is represented as { 0x7FEFFFFF, 0xFFFFFFFF, 0x7C8FFFFF, 0xF8000000 }.
--   So, define it like this through a reference to an external variable
-+/* LDBL_MAX is 2**1024 - 2**918, represented as: { 0x7FEFFFFF, 0xFFFFFFFF,
-+                                                   0x7C9FFFFF, 0xFFFFFFFF }.
-+
-+   Do not write it as a constant expression, as GCC would likely treat
-+   that as infinity due to the vagaries of this platform's funky arithmetic.
-+   Instead, define it through a reference to an external variable.
-+   Like the following, but using a union to avoid type mismatches:
- 
--     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL };
-+     const double LDBL_MAX[2] = { DBL_MAX, DBL_MAX / 0x1p53 };
-      extern const long double LDBL_MAX;
- 
--   or through a pointer cast
-+   The following alternative would not work as well when GCC is optimizing:
-+
-+     #define LDBL_MAX (*(long double const *) (double[])
-+                       { DBL_MAX, DBL_MAX / 0x1p53 })
- 
--     #define LDBL_MAX \
--       (*(const long double *) (double[]) { DBL_MAX, DBL_MAX / (double)134217728UL / (double)134217728UL })
-+   The following alternative would require GCC 6 or later:
- 
--   Unfortunately, this is not a constant expression, and the latter expression
--   does not work well when GCC is optimizing..  */
-+     #define LDBL_MAX __builtin_pack_longdouble (DBL_MAX, DBL_MAX / 0x1p53)
-+
-+   Unfortunately none of the alternatives are constant expressions.  */
- # if !GNULIB_defined_long_double_union
- union gl_long_double_union
-   {
-@@ -159,6 +153,8 @@
- # endif
- extern const union gl_long_double_union gl_LDBL_MAX;
- # define LDBL_MAX (gl_LDBL_MAX.ld)
-+# undef LDBL_NORM_MAX
-+# define LDBL_NORM_MAX LDBL_MAX
- #endif
- 
- /* On IRIX 6.5, with cc, the value of LDBL_MANT_DIG is wrong.
-@@ -179,6 +175,35 @@
- # endif
- #endif
- 
-+/* On PowerPC platforms, 'long double' has a double-double representation.
-+   Up to ISO C 17, this was outside the scope of ISO C because it can represent
-+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits>, such as
-+   1.0L + 4.94065645841246544176568792868221e-324L = 1 + 2^-1074; see
-+   ISO C 17 § 5.2.4.2.2.(3).
-+   In ISO C 23, wording has been included that makes this 'long double'
-+   representation compliant; see ISO C 23 § 5.2.5.3.3.(8)-(9).  In this setting,
-+   numbers with mantissas of the form 1.<52 bits><many zeroes><52 bits> are
-+   called "unnormalized".  And since LDBL_EPSILON must be normalized (per
-+   ISO C 23 § 5.2.5.3.3.(33)), it must be 2^-105.  */
-+#if defined __powerpc__ && LDBL_MANT_DIG == 106
-+# undef LDBL_EPSILON
-+# define LDBL_EPSILON 2.46519032881566189191165176650870696773e-32L /* 2^-105 */
-+#endif
-+
-+/* ============================ ISO C23 support ============================ */
-+
-+/* 'long double' properties */
-+
-+#ifndef LDBL_NORM_MAX
-+# ifdef __LDBL_NORM_MAX__
-+#  define LDBL_NORM_MAX __LDBL_NORM_MAX__
-+# else
-+#  define LDBL_NORM_MAX LDBL_MAX
-+# endif
-+#endif
-+
-+/* ================================= Other ================================= */
-+
- #if @REPLACE_ITOLD@
- /* Pull in a function that fixes the 'int' to 'long double' conversion
-    of glibc 2.7.  */
-diff '--color=auto' -ruN a/gnulib-tests/Makefile.in b/gnulib-tests/Makefile.in
---- a/gnulib-tests/Makefile.in	2024-06-01 18:18:09.000000000 +0200
-+++ b/gnulib-tests/Makefile.in	2026-01-02 15:56:12.645625323 +0100
-@@ -1172,7 +1172,7 @@
- 	../gl/lib/libgnulib.a libtests.a $(am__DEPENDENCIES_1)
- test_float_SOURCES = test-float.c
- test_float_OBJECTS = test-float.$(OBJEXT)
--test_float_LDADD = $(LDADD)
-+test_float_LDADD = $(LDADD) -lm
- test_float_DEPENDENCIES = libtests.a ../gl/lib/libgnulib.a libtests.a \
- 	../gl/lib/libgnulib.a libtests.a $(am__DEPENDENCIES_1)
- test_fnmatch_SOURCES = test-fnmatch.c
-diff '--color=auto' -ruN a/gnulib-tests/test-float.c b/gnulib-tests/test-float.c
---- a/gnulib-tests/test-float.c	2024-05-27 21:48:37.000000000 +0200
-+++ b/gnulib-tests/test-float.c	2026-01-02 16:15:21.261123584 +0100
-@@ -59,6 +59,8 @@
- 
- /* ------------------------------------------------------------------------- */
- 
-+#include <math.h>
-+
- #include "fpucw.h"
- #include "macros.h"
- 
-@@ -295,6 +297,44 @@
- 
- /* -------------------- Check macros for 'long double' -------------------- */
- 
-+static int
-+test_isfinitel (long double volatile x)
-+{
-+  if (x != x)
-+    return 0;
-+  long double volatile zero = x * 0;
-+  return zero == 0;
-+}
-+
-+/* Return X after normalization.  This makes a difference on platforms
-+   where long double can represent unnormalized values.  For example,
-+   suppose x = 1 + 2**-106 on PowerPC with IBM long double where
-+   FLT_RADIX = 2, LDBL_MANT_DIG = 106, and LDBL_EPSILON = 2**-105.
-+   Then 1 < x < 1 + LDBL_EPSILON, and normalize_long_double (x) returns 1.  */
-+static long double
-+normalize_long_double (long double volatile x)
-+{
-+  if (FLT_RADIX == 2 && test_isfinitel (x))
-+    {
-+      int xexp;
-+      long double volatile
-+        frac = frexpl (x, &xexp),
-+        significand = frac * pow2l (LDBL_MANT_DIG),
-+        normalized_significand = truncl (significand),
-+        normalized_x = normalized_significand * pow2l (xexp - LDBL_MANT_DIG);
-+
-+      /* The test_isfinitel defends against PowerPC with IBM long double,
-+         which fritzes out near LDBL_MAX.  */
-+      if (test_isfinitel (normalized_x))
-+        x = normalized_x;
-+    }
-+  else
-+    {
-+      /* Hope that X is already normalized.  */
-+    }
-+  return x;
-+}
-+
- static void
- test_long_double (void)
- {
-@@ -354,11 +394,14 @@
-     for (n = 0; n <= 2 * LDBL_MANT_DIG; n++)
-       {
-         volatile long double half_n = pow2l (- n); /* 2^-n */
--        volatile long double x = me - half_n;
-+        volatile long double x = normalize_long_double (me - half_n);
-         if (x < me)
-           ASSERT (x <= 1.0L);
-       }
-   }
-+
-+  /* Check the value of LDBL_NORM_MAX.  */
-+  ASSERT (LDBL_NORM_MAX == normalize_long_double (LDBL_MAX));
- }
- 
- int