Merge master into staging-next

Changelog: https://github.com/markqvist/Reticulum/blob/1.4.0/Changelog.md

doc/channels.chapter.md

@@ -0,0 +1,26 @@
+# How channels work {#how-channels-work}
+
+nixpkgs uses the [channels feature](https://nixos.org/nix/manual/#sec-channels) of nix.
+
+nixpkgs is distributed for users of Nix on non-NixOS distributions through the channel
+`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
+e.g. `nixos-22.11`, which includes all packages and modules for the stable NixOS
+22.11. Stable NixOS releases are generally only given
+security updates. More up to date packages and modules are available via the
+`nixos-unstable` channel.
+
+Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
+nixpkgs repository, although both do lag the `master` branch by generally
+[a couple of days](https://status.nixos.org/). Updates to a channel are
+distributed as soon as all tests for that channel pass, e.g.
+[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
+shows the status of tests for the `nixpkgs-unstable` channel.
+
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
+which also builds binary packages from the Nix expressions in Nixpkgs for
+`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
+The binaries are made available via a [binary cache](https://cache.nixos.org).
+
+The current Nix expressions of the channels are available in the
+[nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
+that correspond to the channel names (e.g. `nixos-22.11-small`).

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -0,0 +1,24 @@
+# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
+
+This hook defaults a variety of environment variables known
+to control thread counts to 1. Many of these otherwise default
+to `$(nproc)`, which causes massive overloads on build machines
+if nix build jobs and build cores are already tuned to fully utilize
+compute capacity of a builder without additional parallelism.
+
+Currently sets the following environment variables:
+- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
+- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
+- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
+- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
+- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
+- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
+- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
+
+The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
+can be used to override the default thread count limit.
+`dontLimitCheckPhaseThreads = true;` can be used to disable
+thread limiting on an individual package.
+
+This hook will not attempt to override already existing
+definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,6 +13,7 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
+check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -34,7 +35,6 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
-openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -1,10 +0,0 @@
-# openmpCheckPhaseHook {#setup-hook-omp-check}
-
-
-This hook can be used to setup a check phase that
-requires running a OpenMP application. It mostly
-serves to limit `OMP_NUM_THREADS` to avoid overloading
-build machines.
-
-This hook will not attempt to override an already existing
-definition of `OMP_NUM_THREADS` in the environment.

doc/preface.chapter.md

@@ -1,50 +1,14 @@
-# Preface {#preface}
+# Overview {#preface}
 
-The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
-[Nix package manager](https://nixos.org/nix/), released under a
-[permissive MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
-Packages are available for several platforms, and can be used with the Nix
-package manager on most GNU/Linux distributions as well as [NixOS](https://nixos.org/nixos).
+Nixpkgs is a set of packages for the [Nix package manager](https://nixos.org/nix/), released under the [MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
 
-This document is the user [_reference_](https://nix.dev/contributing/documentation/diataxis#reference) manual for Nixpkgs.
-It describes the entire public interface of Nixpkgs in a concise and orderly manner, and all relevant behaviors, with examples and cross-references.
+Further documentation:
 
-To discover other kinds of documentation:
 - [nix.dev](https://nix.dev/): Tutorials and guides for getting things done with Nix
-- [NixOS **Option Search**](https://search.nixos.org/options) and reference documentation
-- [Nixpkgs **Package Search**](https://search.nixos.org/packages)
-- [**NixOS** manual](https://nixos.org/manual/nixos/stable/): Reference documentation for the NixOS Linux distribution
-- [`CONTRIBUTING.md`](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): Contributing to Nixpkgs, including this manual
-
-## Overview of Nixpkgs {#overview-of-nixpkgs}
+- [NixOS Search](https://search.nixos.org)
+- [Contributing](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): to Nixpkgs
 
 Nix expressions describe how to build packages from source and are collected in
-the [Nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
-collection are Nix expressions for
-[NixOS modules](https://nixos.org/nixos/manual/index.html#sec-writing-modules).
-With these expressions the Nix package manager can build binary packages.
+the [nixpkgs repository](https://github.com/NixOS/nixpkgs).
 
-Packages, including the Nix packages collection, are distributed through
-[channels](https://nixos.org/nix/manual/#sec-channels). The collection is
-distributed for users of Nix on non-NixOS distributions through the channel
-`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
-e.g., `nixos-22.11`, which includes all packages and modules for the stable NixOS
-22.11. Stable NixOS releases are generally only given
-security updates. More up-to-date packages and modules are available via the
-`nixos-unstable` channel.
-
-Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
-Nixpkgs repository, although both do lag the `master` branch by generally
-[a couple of days](https://status.nixos.org/). Updates to a channel are
-distributed as soon as all tests for that channel pass, e.g.,
-[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
-shows the status of tests for the `nixpkgs-unstable` channel.
-
-The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
-which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, and `aarch64-darwin`.
-The binaries are made available via a [binary cache](https://cache.nixos.org).
-
-The current Nix expressions of the channels are available in the
-[Nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
-that correspond to the channel names (e.g., `nixos-22.11-small`).
+Packages are distributed through [channels](#how-channels-work).

doc/redirects.json

@@ -152,6 +152,9 @@
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
+  "how-channels-work": [
+    "index.html#how-channels-work"
+  ],
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
@@ -395,9 +398,7 @@
     "index.html#pnpm-build-hook-honored-variables"
   ],
   "preface": [
-    "index.html#preface"
-  ],
-  "overview-of-nixpkgs": [
+    "index.html#preface",
     "index.html#overview-of-nixpkgs"
   ],
   "part-using": [
@@ -2920,7 +2921,8 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-omp-check": [
+  "setup-hook-check-phase-thread-limit": [
+    "index.html#setup-hook-check-phase-thread-limit",
     "index.html#setup-hook-omp-check"
   ],
   "ninja": [

doc/release-notes/rl-2611.section.md

@@ -31,6 +31,9 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
+- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
+  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
+
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.

doc/using-nixpkgs.md

@@ -1,6 +1,7 @@
 # Using Nixpkgs {#part-using}
 
 ```{=include=} chapters
+channels.chapter.md
 using/platform-support.chapter.md
 using/configuration.chapter.md
 using/overlays.chapter.md

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -154,3 +154,5 @@
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
   - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
+
+- `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).

nixos/modules/hardware/opentabletdriver.nix

@@ -61,16 +61,27 @@ in
       wantedBy = [ "graphical-session.target" ];
       partOf = [ "graphical-session.target" ];
 
+      unitConfig = {
+        After = "graphical-session.target";
+        ConditionEnvironment = [
+          "|WAYLAND_DISPLAY"
+          "|DISPLAY"
+        ];
+      };
+
       serviceConfig = {
         Type = "simple";
-        # workaround for https://github.com/NixOS/nixpkgs/issues/469340
-        ExecStartPre = pkgs.writeShellScript "disable-for-gdm-greeter" ''
-          if [[ "$USER" = "gdm-greeter"* ]]; then
+        # workaround for https://github.com/NixOS/nixpkgs/issues/469340 and
+        # https://github.com/OpenTabletDriver/OpenTabletDriver/issues/4885
+        ExecStartPre = pkgs.writeShellScript "poll-for-non-gdm-greeter-display" ''
+          if [[ "$USER" = "gdm-greeter"* \
+              || ( "$${XDG_SESSION_TYPE}" = wayland && -z "$${WAYLAND_DISPLAY}" ) ]]; then
             exit 1
           fi
         '';
         ExecStart = lib.getExe' cfg.package "otd-daemon";
         Restart = "on-failure";
+        RestartSec = 3;
       };
     };
   };

nixos/modules/services/misc/errbot.nix

@@ -91,6 +91,20 @@ in
     };
     users.groups.errbot = { };
 
+    systemd.tmpfiles.settings = {
+      "10-errbot" = lib.mapAttrs' (
+        name: instanceCfg:
+        let
+          dataDir = if instanceCfg.dataDir != null then instanceCfg.dataDir else "/var/lib/errbot/${name}";
+        in
+        lib.nameValuePair "${dataDir}".d {
+          group = "errbot";
+          user = "errbot";
+          mode = "0755";
+        }
+      ) cfg.instances;
+    };
+
     systemd.services = lib.mapAttrs' (
       name: instanceCfg:
       lib.nameValuePair "errbot-${name}" (
@@ -103,12 +117,7 @@ in
           serviceConfig = {
             User = "errbot";
             Restart = "on-failure";
-            ExecStartPre = [
-              "${lib.getExe' pkgs.coreutils "mkdir"} -p ${dataDir}"
-              "${lib.getExe' pkgs.coreutils "chown"} -R errbot:errbot ${dataDir}"
-            ];
             ExecStart = "${pkgs.errbot}/bin/errbot -c ${mkConfigDir instanceCfg dataDir}/config.py";
-            PermissionsStartOnly = true;
           };
         }
       )

nixos/modules/services/networking/anubis.nix

@@ -374,6 +374,10 @@ in
       anubis = { };
     };
 
+    systemd.slices.system-anubis = {
+      description = "Anubis AI Firewall System Slice";
+      documentation = [ "https://anubis.techaro.lol" ];
+    };
     systemd.services = lib.mapAttrs' (
       name: instance:
       lib.nameValuePair "${instanceName name}" {
@@ -396,6 +400,7 @@ in
         );
 
         serviceConfig = {
+          Slice = "system-anubis.slice";
           User = instance.user;
           Group = instance.group;
           DynamicUser = true;

nixos/modules/services/security/vaultwarden/default.nix

@@ -173,6 +173,7 @@ in
     domain = lib.mkOption {
       type = with lib.types; nullOr str;
       default = null;
+      example = "bitwarden.example.com";
       description = "The domain under which VaultWarden will be reachable.";
     };
 

nixos/tests/all-tests.nix

@@ -604,6 +604,10 @@ in
     imports = [ ./firefox.nix ];
     _module.args.firefoxPackage = pkgs.firefox-esr-140;
   };
+  firefox-esr-153 = runTest {
+    imports = [ ./firefox.nix ];
+    _module.args.firefoxPackage = pkgs.firefox-esr-153;
+  };
   firefox-syncserver = runTest ./firefox-syncserver.nix;
   firefox_decrypt = runTest ./firefox_decrypt.nix;
   firefoxpwa = runTest ./firefoxpwa.nix;

pkgs/applications/editors/android-studio/default.nix

@@ -16,9 +16,9 @@ let
       inherit tiling_wm;
     };
   stableVersion = {
-    version = "2026.1.1.10"; # "Android Studio Quail 1 | 2026.1.1 Patch 2"
-    sha256Hash = "sha256-+9PxFtEsrtck6o2g0s2ufnkRcPefKqESc+oPLSKiJNw=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.10/android-studio-quail1-patch2-linux.tar.gz";
+    version = "2026.1.2.10"; # "Android Studio Quail 2 | 2026.1.2"
+    sha256Hash = "sha256-ZERaVAkucFbG638aia0RbQ/uwu9flluOWU1iq9tYWQ8=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.10/android-studio-quail2-linux.tar.gz";
   };
   betaVersion = {
     version = "2026.1.3.5"; # "Android Studio Quail 3 | 2026.1.3 RC 1"

pkgs/applications/editors/emacs/make-emacs.nix

@@ -116,8 +116,6 @@
 
   # test
   callPackage,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 assert (withGTK3 && !withNS && variant != "macport") -> withX || withPgtk;
@@ -254,11 +252,7 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
   ]
   ++ lib.optionals (withPgtk || withX && (withGTK3 || withXwidgets)) [ wrapGAppsHook3 ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    sigtool
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
-  ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
 
   buildInputs = [
     gnutls
@@ -424,15 +418,10 @@ stdenv.mkDerivation (finalAttrs: {
       NATIVE_FULL_AOT = "1";
       LIBRARY_PATH = lib.concatStringsSep ":" libGccJitLibraryPaths;
     }
-    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-      # workaround for ld64 hardening issue
-      #
-      # TODO: Clean up on `staging`
-      NIX_CFLAGS_COMPILE =
-        "-fuse-ld=lld"
-        # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
-        # See https://github.com/NixOS/nixpkgs/issues/127902
-        + lib.optionalString (variant == "macport") " -isystem ${./macport-noescape-noop}";
+    // lib.optionalAttrs (variant == "macport") {
+      # Fixes intermittent segfaults when compiled with LLVM >= 7.0.
+      # See https://github.com/NixOS/nixpkgs/issues/127902
+      NIX_CFLAGS_COMPILE = "-isystem ${./macport-noescape-noop}";
     };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0541";
+  version = "9.2.0782";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-M2vdIAM3P2MZdcMvFX/3/fixliTosR06nvPIX7NXFNo=";
+    hash = "sha256-D4IyDgl1JdmumDzO0uMg2LhoSnFUeqhcMJ6ImC17wzs=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/default.nix

@@ -14,8 +14,6 @@
     url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/68f6d131750aa778807119e03eed70286a17b1cb/trunk/archlinux.vim";
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   },
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -39,10 +37,6 @@ stdenv.mkDerivation {
   nativeBuildInputs = [
     gettext
     pkg-config
-  ]
-  # TODO: Clean up on `staging`.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
   buildInputs = [
     ncurses
@@ -50,13 +44,6 @@ stdenv.mkDerivation {
     gawk
   ];
 
-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_COMPILE = "-fuse-ld=lld";
-  };
-
   strictDeps = true;
 
   configureFlags = [

pkgs/applications/editors/vim/full.nix

@@ -48,9 +48,6 @@
   darwinSupport ? config.vim.darwin or false, # Enable Darwin support
   ftNixSupport ? config.vim.ftNix or true, # Add nix indentation support from vim-nix (not needed for basic syntax highlighting)
   sodiumSupport ? config.vim.sodium or true, # Enable sodium based encryption
-
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 let
@@ -172,9 +169,7 @@ stdenv.mkDerivation {
   ++ lib.optional nlsSupport gettext
   ++ lib.optional perlSupport perl
   ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook3
-  ++ lib.optional waylandSupport wayland-scanner
-  # TODO: Clean up on `staging`
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
+  ++ lib.optional waylandSupport wayland-scanner;
 
   buildInputs = [
     ncurses
@@ -201,10 +196,7 @@ stdenv.mkDerivation {
   ++ lib.optional sodiumSupport libsodium;
 
   # error: '__declspec' attributes are not enabled; use '-fdeclspec' or '-fms-extensions' to enable support for __declspec attributes
-  # workaround for ld64 hardening issue
-  #
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec -fuse-ld=lld";
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-fdeclspec";
 
   preConfigure = lib.optionalString ftNixSupport ''
     cp ${vimPlugins.vim-nix.src}/ftplugin/nix.vim runtime/ftplugin/nix.vim

pkgs/applications/editors/vim/macvim.nix

@@ -17,8 +17,6 @@
   # This can be set to one of the `darwin.xcode_*` packages as well.
   # If set, this should be a path to Xcode.app, e.g. `"/Applications/Xcode.app"`.
   withXcodePath ? null,
-  # TODO: Clean up on `staging`
-  llvmPackages,
 }:
 
 # Try to match MacVim's documented script interface compatibility
@@ -50,8 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    # TODO: Clean up on `staging`
-    llvmPackages.lld
   ];
   buildInputs = [
     # MacVim references up to MAC_OS_VERSION_14_0 in its source
@@ -192,8 +188,7 @@ stdenv.mkDerivation (finalAttrs: {
   # macvim obj-c log macro triggers -Wformat-security (seems like a bug? it's a string literal!)
   hardeningDisable = common.hardeningDisable ++ [ "format" ];
   # os_log also enables -Werror,-Wformat by default
-  # TODO: Clean up on `staging`
-  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS -fuse-ld=lld";
+  env.NIX_CFLAGS_COMPILE = "-DOS_LOG_FORMAT_WARNINGS";
 
   # We rely on the user's Xcode install to build. It may be located in an arbitrary place, and
   # it's not clear what system-level components it may require, so for now we'll just allow full

pkgs/applications/editors/vim/plugins/generated.nix

@@ -12142,12 +12142,12 @@ final: prev: {
 
   none-ls-extras-nvim = buildVimPlugin {
     pname = "none-ls-extras.nvim";
-    version = "0-unstable-2026-06-06";
+    version = "0-unstable-2026-07-17";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls-extras.nvim";
-      rev = "27681d797a26f1b4d6119296df42f5204c88a2dc";
-      hash = "sha256-GZLT8X1eLeSkiV5EN1nOkCQg5nwNATURi/KMj90i40I=";
+      rev = "9a8b8a9aeb43382e5aaf49b00b7cfb5d42d32118";
+      hash = "sha256-YmDhDUqSJPOllXzkyrVUgnshrI5+Kt5Te8tEmnjOAVQ=";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls-extras.nvim/";
     meta.license = getLicenseFromSpdxId "Unlicense";
@@ -15076,6 +15076,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  present-nvim = buildVimPlugin {
+    pname = "present.nvim";
+    version = "0-unstable-2025-03-03";
+    src = fetchFromGitHub {
+      owner = "Chaitanyabsprip";
+      repo = "present.nvim";
+      rev = "c76e6996b346ff3ec6260c2461e56946c4a72d0d";
+      hash = "sha256-EPQlVv4zn3LNgYu58xpp3OlLrFOW+VuRgiP0YzO6REw=";
+    };
+    meta.homepage = "https://github.com/Chaitanyabsprip/present.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   presenting-vim = buildVimPlugin {
     pname = "presenting.vim";
     version = "0.1.0-unstable-2023-12-30";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3602,7 +3602,6 @@ assertNoAdditions {
       snacks-nvim
       telescope-nvim
     ];
-    dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
       # Issue reproduction file
       "minimal"

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1075,6 +1075,7 @@ https://github.com/RishabhRD/popfix/,,
 https://github.com/nvim-lua/popup.nvim/,,
 https://github.com/tris203/precognition.nvim/,,
 https://github.com/andweeb/presence.nvim/,,
+https://github.com/Chaitanyabsprip/present.nvim/,,
 https://github.com/sotte/presenting.vim/,,
 https://github.com/ewilazarus/preto/,,
 https://github.com/anuvyklack/pretty-fold.nvim/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-/RKpbsdp7MjakNvKWvq2OiwLJ7mftHKKrb5xwKlM76Y=";
+          hash = "sha256-JYg1P0t3YadTxmqeRSky8X9emLnP2cO3BYO9R7PgQfM=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-mdgzM0dymFjSYFm018wsuWzzUJJsA896YmRwoH1wLmM=";
+          hash = "sha256-miK4K8THmT+ebjcAl/3Cp9vtVWfMlpIWWIqyAm5+YeQ=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-0EFuSvcSLTfrR74Uxpwiq2K39cWqi33q80AhtlilCnQ=";
+          hash = "sha256-ao9yGH9xIBmNrp/sHpwpxKZnR8LjXl1Cegfgw7Nq+2M=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.214";
+      version = "2.1.215";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/default.nix

@@ -3512,8 +3512,8 @@ let
         mktplcRef = {
           name = "veriloghdl";
           publisher = "mshr-h";
-          version = "1.28.1";
-          hash = "sha256-+Pc9blI/n6JeokdUhWjLzicwBv90p4MjhK2rvpQ2xrA=";
+          version = "1.29.0";
+          hash = "sha256-/VIAT9nnDG52Jzh+j0E038NSjoLCXZSVRSvGWXOeuuY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/mshr-h.VerilogHDL/changelog";

pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix

@@ -68,11 +68,11 @@ vscode-utils.buildVscodeMarketplaceExtension {
 
   nativeBuildInputs = [
     autoPatchelfHook
+    jq
     makeWrapper
   ];
 
   buildInputs = [
-    jq
     libkrb5
     zlib
     (lib.getLib stdenv.cc.cc)

pkgs/applications/editors/vscode/extensions/vscode-utils.nix

@@ -73,6 +73,9 @@ let
         # This cannot be removed, it is used by some extensions.
         installPrefix = "share/vscode/extensions/${vscodeExtUniqueId}";
 
+        strictDeps = true;
+        __structuredAttrs = true;
+
         nativeBuildInputs = [ unpackVsixSetupHook ] ++ nativeBuildInputs;
 
         installPhase =

pkgs/applications/editors/vscode/generic.nix

@@ -419,7 +419,11 @@ stdenv.mkDerivation (
         let
           nodeModulesPath =
             if stdenv.hostPlatform.isDarwin then
-              if lib.versionAtLeast vscodeVersion "1.94.0" then
+              # 1.129 moved node_modules back into app.asar, shipping native
+              # binaries in the asar.unpacked directory like before 1.94
+              if lib.versionAtLeast vscodeVersion "1.129.0" then
+                "Contents/Resources/app/node_modules.asar.unpacked"
+              else if lib.versionAtLeast vscodeVersion "1.94.0" then
                 "Contents/Resources/app/node_modules"
               else
                 "Contents/Resources/app/node_modules.asar.unpacked"
@@ -475,6 +479,7 @@ stdenv.mkDerivation (
         patchelf \
           --add-needed ${lib.getLib openssl}/lib/libssl.so.3 \
           $out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign
+        chmod +x $out/lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign
       '')
     );
 

pkgs/applications/emulators/libretro/cores/atari800.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "atari800";
-  version = "0-unstable-2026-07-10";
+  version = "0-unstable-2026-07-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-atari800";
-    rev = "3f036fd69a0f0948d32a9a7cd97af3e0dd7ec434";
-    hash = "sha256-WnozEFNpW6qmSsQGTKzflitG6TVaozyOMcnAka+E1fE=";
+    rev = "9d3bcf283502512052e21c6f1453fbdf7aa3122b";
+    hash = "sha256-uLMQWi+Z21irwkFBArlHNXILintSWF7PfGy5bgKmAhQ=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/bluemsx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bluemsx";
-  version = "0-unstable-2026-07-04";
+  version = "0-unstable-2026-07-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bluemsx-libretro";
-    rev = "fe7173f801fd2d6c3564ebe816797a44524e4bbf";
-    hash = "sha256-NcDcFexU2jPWwQmWo9CK+jbYtEFiqZmzKLfrQrB9Cmg=";
+    rev = "2f31e9ca38785ad4c2bd9e1d91829eda14a92954";
+    hash = "sha256-J1LbOsUR+9HX/LRtkG9XQIiRdhfyHUYvqXYBKWdGxBI=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/bsnes.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bsnes";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-07-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bsnes-libretro";
-    rev = "d62d219ac22f1ed179738d107d8a4da2c4289845";
-    hash = "sha256-XYCzXAFkSFNMlRjzH4zR3lpRguOqvAJM4TBcL9Feog8=";
+    rev = "9c1285dda7dd6bb9a9951d37bcee8794ada640e6";
+    hash = "sha256-hu4Odi+6A8OrpsNbWZI5JrBkFI1brsqp08fyOySFyr8=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix

@@ -8,11 +8,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.12.0esr";
+  version = "140.13.0esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "3d598dd964bca074d11b71f84d586811b0a736bdd4d1e6cedb9286c56b1e11584e85ca1d0369c9b2f8d9e4d0eaf014d1b9232a96e71ac25f71fa9ed0807f642d";
+    sha512 = "937a4103d71c5e1e4bf051821729f6ea70b5c18d444930a487695cc23d74712a0134047248f6ac02305e01becb705426a55b9d89739f02a01eda01ecf5bc27f1";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox-esr-153.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  callPackage,
+  fetchurl,
+  nixosTests,
+  buildMozillaMach,
+}:
+
+buildMozillaMach rec {
+  pname = "firefox";
+  version = "153.0esr";
+  applicationName = "Firefox ESR";
+  src = fetchurl {
+    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
+    sha512 = "3ea7956ef2fdcaa86430ef922f04484cbb1a3faf447e035107159fcd5ecd8d0a0e4507a332fc3d7b66e4308c38733bd0624affd7629447b89c655a9ea0fb0936";
+  };
+
+  meta = {
+    changelog = "https://www.firefox.com/en-US/firefox/${lib.removeSuffix "esr" version}/releasenotes/";
+    description = "Web browser built from Firefox source tree";
+    homepage = "http://www.mozilla.com/en-US/firefox/";
+    maintainers = with lib.maintainers; [ hexa ];
+    platforms = lib.platforms.unix;
+    badPlatforms = [ lib.systems.inspect.patterns.is32bit ];
+    maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
+    license = lib.licenses.mpl20;
+    mainProgram = "firefox";
+  };
+  tests = {
+    inherit (nixosTests) firefox-esr-153;
+  };
+  updateScript = callPackage ../update.nix {
+    attrPath = "firefox-esr-153-unwrapped";
+    versionPrefix = "153";
+    versionSuffix = "esr";
+  };
+}

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "152.0.6";
+  version = "153.0";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "c4d877837d7007fb611c38d49d9b6dd3bc4c5c9ca900b54e722e140ce7ecd0924f69b5cedc7f8c1fe602e7efe1d7159b019de27999e29235cd631821bb13e6b0";
+    sha512 = "a1af5866e1c9a732818123f2f041bfd5993d093e96dd743b583312fb11d2b39d429df750f9ec22ded64b58a209bb1ecabc7aaf73057d7a64c7349e4da043d66d";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -435,7 +435,7 @@ let
                 ;;
               *)
                 # Copy if the symlink resolves to a Mach-O dylib
-                otool -l "$file" 2>/dev/null | grep -q 'LC_ID_DYLIB' || continue
+                otool -l "$file" 2>/dev/null | grep -F 'LC_ID_DYLIB' >/dev/null || continue
                 ;;
             esac
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -580,13 +580,13 @@
     "vendorHash": "sha256-sPQR+LDZRMXygLUd9xj6/bI+8DhAPKbkytlTzmrEOBU="
   },
   "hashicorp_google": {
-    "hash": "sha256-TQFMOZZbMabLfTDPON1OMd+DgyssfprzqMbc9/u7cbQ=",
+    "hash": "sha256-QgGEF8L4O6ON1VhEUFrLwc2WNUSt8qIjn5DWVOQAxB0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.39.0",
+    "rev": "v7.40.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ayt8FR4684ZV5kd6exMw0AEgkMJLW5huvTYZqcr3q/s="
+    "vendorHash": "sha256-moP2fqZnj8J6IFAhb0n6pikVYVg2Is22xd/xuuJ+zIQ="
   },
   "hashicorp_google-beta": {
     "hash": "sha256-pEdNv1MViCsCb3wFoDghCeQ5q2FErtGrQL9noL5B11g=",
@@ -842,13 +842,13 @@
     "vendorHash": "sha256-EAv8EeNn0PJ3BElmg6sKkd/LXNe0lFjEIjHuZRG3CoQ="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-PgAK0BUTSyW4CXssQkENohnhtd2O5GPuFVvSDcHWjQ8=",
+    "hash": "sha256-xQhWB5gUO10v7KXXHci3gvXlI/hg7JXsn9bYxHVGJwc=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.30.0",
+    "rev": "v2.30.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
+    "vendorHash": "sha256-9RisIZUblqqylMW6Bz6ehpwRUXyvTdicuhEGI+n5G3Y="
   },
   "linode_linode": {
     "hash": "sha256-N/SVZ1ajNRT53zxdYBT6Hd/wwAuKhEre0QSZUYbkwGA=",

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -34,7 +34,6 @@
   libjxl,
   libicns,
   apple-sdk_15,
-  llvmPackages,
   nix-update-script,
 }:
 
@@ -66,11 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     gobject-introspection
-  ]
-  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
-  # TODO: Remove once nixpkgs#536365 reaches this branch.
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -107,12 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontWrapQtApps = true;
 
-  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
-  # TODO: Remove once nixpkgs#536365 reaches this branch.
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   cmakeFlags = [
     # We're allowed to used the API ID of the Snap package:
     (lib.cmakeFeature "TDESKTOP_API_ID" "611335")

pkgs/applications/networking/irc/weechat/default.nix

@@ -105,11 +105,11 @@ assert lib.all (p: p.enabled -> !(builtins.elem null p.buildInputs)) plugins;
 
 stdenv.mkDerivation rec {
   pname = "weechat";
-  version = "4.9.3";
+  version = "4.9.4";
 
   src = fetchurl {
     url = "https://weechat.org/files/src/weechat-${version}.tar.xz";
-    hash = "sha256-XH2VOfqGyZ6nalUaiJqSusIeq3uyeQ29NGRS0AsQw3w=";
+    hash = "sha256-P8UDWfOjsljJ8DFIsC87nFkZRTXRtGXEgfuFp2wu0AU=";
   };
 
   # Why is this needed? https://github.com/weechat/weechat/issues/2031

pkgs/applications/science/math/R/default.nix

@@ -27,7 +27,6 @@
   pkg-config,
   bison,
   which,
-  llvmPackages,
   jdk,
   blas,
   lapack,
@@ -69,10 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     tzdata
     which
-  ]
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
-
+  ];
   buildInputs = [
     bzip2
     gfortran
@@ -130,11 +126,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontDisableStatic = static;
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   preConfigure = ''
     configureFlagsArray=(
       --disable-lto

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix

@@ -13,13 +13,13 @@ let
             mkHyprlandPlugin,
           }:
           let
-            version = "0.55.0";
+            version = "0.56.0";
 
             hyprland-plugins-src = fetchFromGitHub {
               owner = "hyprwm";
               repo = "hyprland-plugins";
               tag = "v${version}";
-              hash = "sha256-WMUJ7tyw/9QbKUyRzLndEQSqX05fQLmFlRdMAmPD7tI=";
+              hash = "sha256-piRpwar7VZI3YviYo0a/UMFz9+rLesfv3nRLGKxjVGg=";
             };
           in
           mkHyprlandPlugin {

pkgs/build-support/build-typst-package.nix

@@ -40,6 +40,9 @@ lib.extendMkDerivation {
     {
       name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       dontBuild = true;
 
       installPhase =

pkgs/build-support/fetchurl/mirrors.nix

@@ -53,10 +53,13 @@
   ];
 
   # GCC
+  # The commented out ones don't seem to be keeping up with the latest releases
+  # as of 2026-07-07 they don't have tarballs for 14.4 or 15.3
   gcc = [
-    "https://mirror.koddos.net/gcc/"
-    "https://bigsearcher.com/mirrors/gcc/"
-    "ftp://ftp.nluug.nl/mirror/languages/gcc/"
+    # "https://mirror.koddos.net/gcc/"
+    # "https://bigsearcher.com/mirrors/gcc/"
+    "https://mirrorservice.org/sites/sourceware.org/pub/gcc/"
+    # "ftp://ftp.nluug.nl/mirror/languages/gcc/"
     "ftp://ftp.fu-berlin.de/unix/languages/gcc/"
     "ftp://ftp.irisa.fr/pub/mirrors/gcc.gnu.org/gcc/"
     "ftp://gcc.gnu.org/pub/gcc/"

pkgs/build-support/go/module.nix

@@ -320,10 +320,15 @@ lib.extendMkDerivation {
               }
 
               getGoDirs() {
-                local type;
-                type="$1"
-                if [ -n "$subPackages" ]; then
-                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+                local -r type="$1"
+
+                # Support strucuredAttrs, they are not space seperated
+                local -a subPackagesArray
+                concatTo subPackagesArray subPackages
+
+                # Outputs each element prefixed with './' if the array is not empty
+                if [[ ''${#subPackagesArray[@]} -gt 0 ]]; then
+                  echo "''${subPackagesArray[*]/#/./}"
                 else
                   find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
                 fi

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -3,6 +3,8 @@
 # assertExecutable FILE
 assertExecutable() {
     local file="$1"
+    [[ -e "$file" ]] || \
+        die "Cannot wrap '$file' because it does not exist"
     [[ -f "$file" && -x "$file" ]] || \
         die "Cannot wrap '$file' because it is not an executable file"
 }

pkgs/by-name/_4/_4ti2/package.nix

@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://4ti2.github.io/";
     description = "Software package for algebraic, geometric and combinatorial problems on linear spaces";
     license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ coolcuber ];
     platforms = lib.platforms.all;
   };
 })

pkgs/by-name/ad/adrs/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "adrs";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "joshrotenberg";
     repo = "adrs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vs7EtIfyfBsXQQKPUKnJlAfUIuj+b17alDBT1WgH8xc=";
+    hash = "sha256-sYeJ+5gAZXjKiwHLcS2iiBM3OZUWXo6lS0OxiNLtBXM=";
   };
 
-  cargoHash = "sha256-8iDb6DNBCJkjKORIOLZQNPthMLSHC0Lfd6vo9+HIkS4=";
+  cargoHash = "sha256-jI0FAZ+QzqTTiRKcnfo1Uh0J1rFWNqNvSLQU/GIjLbc=";
 
   meta = {
     description = "Command-line tool for managing Architectural Decision Records";

pkgs/by-name/ae/aerion-creds/package.nix

@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+let
+  version = "0.3.2";
+
+  archMap = {
+    "x86_64-linux" = "x86_64";
+    "aarch64-linux" = "aarch64";
+  };
+  sysArch =
+    archMap.${stdenv.hostPlatform.system}
+      or (throw "Unsupported architecture: ${stdenv.hostPlatform.system}");
+
+  shimHashes = {
+    "x86_64" = "sha256-8WvuQgWTJNe4UpmS6uSYDYm46sIqxJbwVZ/J3CRz0OI=";
+    "aarch64" = "sha256-4RvFbxJGwM70huziY2ELoCouTrtMasgoqFUncBeBFvU=";
+  };
+in
+stdenv.mkDerivation {
+  pname = "aerion-creds";
+  inherit version;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/hkdb/aerion/releases/download/v${version}/flathub-build-env-v${version}-linux-${sysArch}";
+    hash = shimHashes.${sysArch};
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp $src $out/bin/aerion-creds
+    chmod +x $out/bin/aerion-creds
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "OAuth credentials shim for Aerion";
+    homepage = "https://github.com/hkdb/aerion";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ curious ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}

pkgs/by-name/ae/aerion/package.nix

@@ -0,0 +1,103 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  buildNpmPackage,
+  fetchFromGitHub,
+  pkg-config,
+  wrapGAppsHook3,
+  gtk3,
+  webkitgtk_4_1,
+  glib,
+
+  aerion-creds,
+  withOAuth ? false,
+}:
+
+let
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "hkdb";
+    repo = "aerion";
+    rev = "v${version}";
+    hash = "sha256-elmk4huz4mvc7t+5/ZM5AK2R4pSKrLsZM0HxWFmQldE=";
+  };
+
+  frontend = buildNpmPackage {
+    pname = "aerion-frontend";
+    inherit version src;
+
+    sourceRoot = "${src.name}/frontend";
+
+    npmDepsHash = "sha256-dC+xGwSqdzItIfDipAVIVnbUJHiFkmzanjV/5xFsbkc=";
+
+    buildPhase = ''
+      npm run build
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r dist/* $out/
+    '';
+  };
+
+in
+buildGoModule {
+  pname = "aerion";
+  inherit version src;
+
+  __structuredAttrs = true;
+
+  vendorHash = "sha256-ptsrOpJo3i+yRSCGuHynbzi+C+GD/mBmPuHqWSVV/+4=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    wrapGAppsHook3
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    gtk3
+    webkitgtk_4_1
+    glib
+  ];
+
+  tags = [
+    "production"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "desktop"
+    "webkit2_41"
+  ];
+
+  preBuild = ''
+    mkdir -p frontend/dist
+    cp -r ${frontend}/* frontend/dist/
+  '';
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux (
+    ''
+      install -Dm644 build/linux/aerion.png $out/share/pixmaps/io.github.hkdb.Aerion.png
+      install -Dm644 build/linux/aerion.desktop $out/share/applications/io.github.hkdb.Aerion.desktop
+    ''
+    + lib.optionalString withOAuth ''
+      rm -f $out/bin/aerion-creds
+      ln -s ${aerion-creds}/bin/aerion-creds $out/bin/aerion-creds
+    ''
+  );
+
+  passthru = {
+    inherit frontend;
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "An Open Source Lightweight E-Mail Client";
+    homepage = "https://github.com/hkdb/aerion";
+    license = lib.licenses.asl20;
+    mainProgram = "aerion";
+    maintainers = with lib.maintainers; [ curious ];
+  };
+}

pkgs/by-name/ae/aerion/update.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix nix-update nix-prefetch-scripts common-updater-scripts
+
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+aerion_creds_file="$nixpkgs/pkgs/by-name/ae/aerion-creds/package.nix"
+
+version=$(list-git-tags --url=https://github.com/hkdb/aerion \
+  | grep -oP '^v\d+\.\d+\.\d+$' \
+  | sed 's/^v//' \
+  | sort -V \
+  | tail -1)
+
+echo "Updating aerion and aerion-creds to v$version"
+
+# Update version in creds file
+sed -i "s/version = \".*\";/version = \"$version\";/" "$aerion_creds_file"
+
+# Update creds binary hashes
+for arch in x86_64 aarch64; do
+    url="https://github.com/hkdb/aerion/releases/download/v$version/flathub-build-env-v$version-linux-$arch"
+    echo "  Fetching creds hash for $arch..."
+    hash=$(nix-prefetch-url --type sha256 "$url")
+    sri_hash=$(nix-hash --to-sri --type sha256 "$hash")
+    sed -i "s|\"$arch\" = \"sha256-[^\"]*\";|\"$arch\" = \"$sri_hash\";|" "$aerion_creds_file"
+done
+
+# Update main package (handles version, source hash, npmDepsHash, vendorHash)
+cd "$nixpkgs"
+nix-update --version="$version" --subpackage frontend aerion
+
+echo "Done!"

pkgs/by-name/al/alsa-lib/package.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alsa-lib";
-  version = "1.2.16";
+  version = "1.2.16.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-lib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-EiseMWbVX+GbzeZWU116NvKrEOZscsatL0PyD/3tCpY=";
+    hash = "sha256-90Dbf0iCVZRP/UQoQW7jOQqWdChWkWQz30aMKBQ2SA4=";
   };
 
   patches = [
@@ -46,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-lib/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture libraries";
     mainProgram = "aserver";
 

pkgs/by-name/al/alsa-ucm-conf/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alsa-ucm-conf";
-  version = "1.2.16";
+  version = "1.2.16.1";
 
   src = fetchurl {
     url = "mirror://alsa/lib/alsa-ucm-conf-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-rLyXLW5x7fo0Xnav3xDDmf0PHzz5DYSv20z1G/xKZUg=";
+    hash = "sha256-zz0cB+CJqDxOziwg8F3WqKq3/NEIdow4gROGiAV1SSs=";
   };
 
   patches = [
@@ -47,6 +47,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-ucm-conf/releases/tag/v${finalAttrs.version}";
     description = "ALSA Use Case Manager configuration";
 
     longDescription = ''

pkgs/by-name/al/alsa-utils/package.nix

@@ -85,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "http://www.alsa-project.org/";
+    changelog = "https://github.com/alsa-project/alsa-utils/releases/tag/v${finalAttrs.version}";
     description = "ALSA, the Advanced Linux Sound Architecture utils";
     longDescription = ''
       The Advanced Linux Sound Architecture (ALSA) provides audio and

pkgs/by-name/am/amp-cli/package.nix

@@ -26,7 +26,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1783629102-g8185a2";
+  version = "0.0.1784391370-g49c6a1";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -77,9 +77,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-KNXCbNhY7njmGQlv3NxBmkIDciVVZlXl9JedBerdrZM=";
-            aarch64-linux = "sha256-HJf1Ikmai/h/Y2HybYcKxRhx5VhiyoPaubocCkoxF3s=";
-            aarch64-darwin = "sha256-agoKx8pXQf1HGUwsfqpgeZBubwhnPG+xqIfu3Y+AK2Y=";
+            x86_64-linux = "sha256-x7p8BIQbu/ylyCkE63NZQUYfOn5nzwvwqXRWYbW4Q8w=";
+            aarch64-linux = "sha256-X2xQzlu2VfucXii92mFWsp1Ab8blBORtT/BE0kcZi6g=";
+            aarch64-darwin = "sha256-8jj4+dtc54eaFHVlCYKdX9F3s/qrCVICgi5Dyi+n3cg=";
           }
           .${system'};
       }

pkgs/by-name/an/android-studio-tools/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "android-studio-tools";
-  version = "14742923";
+  version = "15859902";
 
   src = fetchzip {
     # The only difference between the Linux and Mac versions is a single comment at the top of all the scripts
     # Therefore, we will use the Linux version and just patch the comment
-    url = "https://dl.google.com/android/repository/commandlinetools-linux-14742923_latest.zip";
-    hash = "sha256-oimC4ToDFIa8Rlv+5RB+swl8M5PHdX4omlrMZMQEx8M=";
+    url = "https://dl.google.com/android/repository/commandlinetools-linux-15859902_latest.zip";
+    hash = "sha256-tCbccw7qa7ncHGyWPWjwQOpaisN3QMRYXRpK7WtyjWY=";
   };
 
   postPatch = ''

pkgs/by-name/ap/apparmor-parser/package.nix

@@ -30,15 +30,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
   '';
 
-  patches = [
-    (fetchpatch {
-      # https://gitlab.com/apparmor/apparmor/-/merge_requests/2133
-      # Patches generated yacc parser code to compile with format-security
-      url = "https://gitlab.com/apparmor/apparmor/-/commit/6bdec74d5e74660b97e00b4b8fafc014b05907b7.diff";
-      hash = "sha256-7c5EFByrGIDj2lc31bRttyeybwndDm4iS4qdPMVaG/I=";
-    })
-  ];
-
   nativeBuildInputs = [
     bison
     flex

pkgs/by-name/aq/aquamarine/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   cmake,
   fetchFromGitHub,
   hwdata,
@@ -21,7 +21,7 @@
   wayland-protocols,
   wayland-scanner,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
   version = "0.13.0";
 

pkgs/by-name/ar/arftracksat/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "arftracksat";
-  version = "1.0-unstable-2025-09-15";
+  version = "1.0-unstable-2026-02-19";
 
   src = fetchFromGitHub {
     owner = "arf20";
     repo = "arftracksat";
-    rev = "5c9b3866b6fcd95382ff56c68cdd38f3d08c1372";
-    hash = "sha256-inCgsxrJkBNGmdGPd28XnOJYCiatL35TxDcfvZjA2cY=";
+    rev = "a9b86878e2ee6f332dc1df07685b7d20970c2f7e";
+    hash = "sha256-guDgy4H0pnQCihYwG7HoKApOlEcDtcaRaj6fRuVdLlc=";
   };
 
   nativeBuildInputs = [
@@ -35,11 +35,13 @@ stdenv.mkDerivation {
   buildInputs = [
     curl
     nlohmann_json
+    curlpp
+    glm
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     freeglut
     libGL
     libGLU
-    curlpp
-    glm
   ];
 
   meta = {

pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 
 import argparse
+import errno
 import os
 import pprint
 import subprocess
@@ -195,6 +196,12 @@ def populate_cache(initial: list[Path], recursive: bool =False) -> None:
             except ELFError:
                 # Not an ELF file in the right format
                 pass
+            except OSError as e:
+                if e.errno == errno.EINVAL:
+                    # pyelftools can raise EINVAL for certain compressed sections.
+                    pass
+                else:
+                    raise
 
 
 def find_dependency(soname: str, soarch: str, soabi: str) -> Optional[Path]:
@@ -343,6 +350,10 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
 
     except ELFError:
         return []
+    except OSError as e:
+        if e.errno == errno.EINVAL:
+            return []
+        raise
 
     # these platforms are packaged in nixpkgs with ld.so in a separate derivation
     # than libc.so and friends. keep_libc is mandatory.

pkgs/by-name/au/autotiling/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "autotiling";
-  version = "1.9.3";
+  version = "1.9.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "autotiling";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k+UiAGMB/fJiE+C737yGdyTpER1ciZrMkZezkcn/4yk=";
+    hash = "sha256-iD5ids+tmb/QFbsGa3QhfxXVCEBQZTG3ZAweOwdGfeE=";
   };
 
   build-system = [

pkgs/by-name/ba/bash-completion/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bash-completion";
-  version = "2.17.0";
+  version = "2.18.0";
 
   # Using fetchurl because fetchGithub or fetchzip will have trouble on
   # e.g. APFS filesystems (macOS) because of non UTF-8 characters in some of the
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   # See discussion in https://github.com/NixOS/nixpkgs/issues/107768
   src = fetchurl {
     url = "https://github.com/scop/bash-completion/releases/download/${finalAttrs.version}/bash-completion-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3Z2CXklkNfs766Oue+qfd+gh6JRmfQdDHR1MjFcLnlg=";
+    hash = "sha256-iLz4UST3f3Ty8vi80WrEOC2AeoJ+3nQqZJQMcRauoz8=";
   };
 
   postPatch = ''

pkgs/by-name/bb/bbot/package.nix

@@ -6,20 +6,25 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "bbot";
-  version = "2.7.2";
+  version = "2.8.6";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-vpKezG1nJVxQE4Qijf8feeRFD4hjy98HznVDXL+MBkE=";
+    hash = "sha256-u8F995BD1l6nPWYckMIYSgErSO3fBcU2IyBFU1WZjF8=";
   };
 
   pythonRelaxDeps = [
     "dnspython"
+    "idna"
+    "lxml"
     "radixtarget"
     "regex"
     "tabulate"
     "websockets"
+    "yara-python"
+    "pyjwt"
+    "cloudcheck"
   ];
 
   build-system = with python3.pkgs; [
@@ -60,7 +65,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     xmltojson
     xxhash
     yara-python
-
+    starlette
+    tornado
   ];
 
   # Project has no tests

pkgs/by-name/be/bencher-cli/package.nix

@@ -9,7 +9,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bencher-cli";
-  version = "0.6.8";
+  version = "0.6.10";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "bencherdev";
     repo = "bencher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-MlRj56QXRrvfBxi6+B6vpEKlDWMFB+V1CzQYOiGFpHE=";
+    hash = "sha256-0RP1Q5tsN+2PMT+EfdgkDrOAqPZiHiKXR83VyjojyNU=";
   };
 
-  cargoHash = "sha256-biCHEePgVxrnGUj94bwWrp9GVhspiMjcMRdp3A7O2h0=";
+  cargoHash = "sha256-Hk6bnEoAXUDXts1tj6QgYvr7GVw3d6FleeLN4MWBRgw=";
 
   nativeBuildInputs = [ mold ];
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/by-name/bi/bichon/package.nix

@@ -0,0 +1,78 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  fetchPnpmDeps,
+  pnpm,
+  pnpmConfigHook,
+  nodejs,
+  openssl,
+  pkg-config,
+  versionCheckHook,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bichon";
+  version = "1.6.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "rustmailer";
+    repo = "bichon";
+    tag = finalAttrs.version;
+    hash = "sha256-a8BAO93eI2eiFwmvMqUsgL1KZ11X3qg/r/Iw6ckMSTs=";
+  };
+
+  cargoHash = "sha256-GC/2bswme76bAFRCsBHFi3lWnYx5x5H58emCmkiyKfE=";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    sourceRoot = "${finalAttrs.src.name}/web";
+    fetcherVersion = 4;
+    hash = "sha256-Ax8z1sjt8v6XOenhw7eRuEEo0huPv9fbcfzqc8RxJEc=";
+  };
+  pnpmRoot = "web";
+
+  nativeBuildInputs = [
+    nodejs
+    pnpmConfigHook
+    pnpm
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  env.GIT_HASH = finalAttrs.src.rev;
+
+  preBuild = ''
+    # Build web frontend before rust build
+    pushd web
+    pnpm run build
+    popd
+
+    # Just sets the GIT_HASH variable for builds, we set it above so we don't need git
+    rm crates/server/build.rs
+  '';
+
+  # The tests are flaky and some require the network
+  doCheck = false;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  # `bichon-server` doesn't have a `--version` option but `bichon-cli` does.
+  versionCheckProgram = "${placeholder "out"}/bin/bichon-cli";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/rustmailer/bichon/releases/tag/${finalAttrs.version}";
+    description = "Lightweight, high-performance Rust email archiver with WebUI";
+    homepage = "https://github.com/rustmailer/bichon";
+    license = with lib.licenses; [ agpl3Only ];
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    mainProgram = "bichon-server";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/bl/blas/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   lapack-reference,
   openblas,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
   isILP64 ? false,
   blasProvider ? openblas,
 }:
@@ -188,7 +188,7 @@ stdenv.mkDerivation {
   ];
 
   propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
   ];
 
   meta = (blasProvider'.meta or { }) // {

pkgs/by-name/bl/blis/package.nix

@@ -5,6 +5,12 @@
   perl,
   python3,
 
+  # sets BLIS_NUM_THREADS and OMP_NUM_THREADS for packages
+  # invoking blis during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading
+  checkPhaseThreadLimitHook,
+
   # Enable BLAS interface with 64-bit integer width.
   blas64 ? false,
 
@@ -36,6 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
+  propagatedNativeBuildInputs = [
+    checkPhaseThreadLimitHook
+  ];
+
   doCheck = true;
 
   enableParallelBuilding = true;

pkgs/by-name/bl/blueutil/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  llvmPackages,
   testers,
   nix-update-script,
 }:
@@ -18,12 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Qw5c9dp7wpuOcQSLsg1pfJ+NbrEtme2o6nKD3Ba3A3M=";
   };
 
-  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-  nativeBuildInputs = [ llvmPackages.lld ];
-
   env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Werror -mmacosx-version-min=10.9 -framework Foundation -framework IOBluetooth";
-  # TODO: Remove when NixOS/nixpkgs#536365 reaches master.
-  env.NIX_CFLAGS_LINK = "--ld-path=${lib.getExe' llvmPackages.lld "ld64.lld"}";
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/bo/borgbackup/package.nix

@@ -4,6 +4,7 @@
   acl,
   e2fsprogs,
   fetchFromGitHub,
+  fetchpatch,
   libb2,
   lz4,
   openssh,
@@ -32,6 +33,26 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     hash = "sha256-pMZr9cVr84b948b5Iuevpy6AtMeYo/Ma8uFLuagAYy4=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "msgspec-1.2.0-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/364438f58c86aebd157b55bd2202afaf5945e008.patch";
+      excludes = [ "docs/changes.rst" ];
+      hash = "sha256-YhZDD6i2cn7p00Dgmpqi8uGJzFZzixMZmHPcZroB1sE=";
+    })
+    (fetchpatch {
+      name = "msgspec-1.2.1-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/8abdd3b8bf065dceecd52d2b22d92b3c407a7c1d.patch";
+      excludes = [ "docs/changes.rst" ];
+      hash = "sha256-bvSRxEzNvejG6PQFkeNDuQB7Zd4/EYPEZkrgjpgQ9Ss=";
+    })
+    (fetchpatch {
+      name = "msgspec-1.2.1-unpacker-compat.patch";
+      url = "https://github.com/borgbackup/borg/commit/b09bbed3de095d6ac9d69a42a486ec18523046dc.patch";
+      hash = "sha256-F8CIqOcQOLdYn7srsev2op0pgkgt8zdkc5DQUH1c6xg=";
+    })
+  ];
+
   postPatch = ''
     # sandbox does not support setuid/setgid/sticky bits
     substituteInPlace src/borg/testsuite/archiver.py \
@@ -103,7 +124,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     py
     pytest-benchmark
     pytest-xdist
-    pytestCheckHook
+    pytest9_0CheckHook
     versionCheckHook
   ];
 

pkgs/by-name/bo/bosh-cli/package.nix

@@ -9,13 +9,13 @@
 buildGoModule (finalAttrs: {
   pname = "bosh-cli";
 
-  version = "7.9.18";
+  version = "7.10.7";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "bosh-cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-8bB1wOs4Ef6nR0d5Z6cmby6AiYSO90uBF6Hw6Q1UiWY=";
+    sha256 = "sha256-hWaJcB+H907QRw5A+xJzy4Dr22NufKNDEAJTtLNYqqg=";
   };
   vendorHash = null;
 

pkgs/by-name/bu/buf/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.71.0";
+  version = "1.72.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GrGtJzZoyyEoIyqc8iItH7/LhXNEuTKbDl+gdB/5bHw=";
+    hash = "sha256-cnCwaa9vzoaqUmrFWqmHPiO/7UjeIburisIiLJZUpl4=";
   };
 
-  vendorHash = "sha256-8FJtJ/mHldia6t5yIPUfCvOlsKJSzT/vVcF+WxRO1Mo=";
+  vendorHash = "sha256-8LTi/+ODA8Tyd5mp5OeTDECjp6+bmNFFHxxCi6RtzTs=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

pkgs/by-name/bu/bumblebee-status/plugins.nix

@@ -118,7 +118,7 @@ in
   };
   # NOTE: Yes, there is also a plugin named `layout-xkbswitch` with a dash.
   layout_xkbswitch.propagatedBuildInputs = [ pkgs.xkb-switch ];
-  libvirtvms.propagatedBuildInputs = [ py.libvirt ];
+  libvirtvms.propagatedBuildInputs = [ py.libvirt-python ];
   load.propagatedBuildInputs = [ pkgs.gnome-system-monitor ];
   memory.propagatedBuildInputs = [ pkgs.gnome-system-monitor ];
   messagereceiver = { };

pkgs/by-name/c-/c-ares/package.nix

@@ -18,7 +18,7 @@
 
 stdenv.mkDerivation rec {
   pname = "c-ares";
-  version = "1.34.6";
+  version = "1.34.8";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     # Note: tag name varies in some versions, e.g. v1.30.0, c-ares-1_17_0.
     url = "https://github.com/c-ares/c-ares/releases/download/v${version}/c-ares-${version}.tar.gz";
-    hash = "sha256-kS3XzDs+innFL9f7nA9Ozwqqc+Re/aiAJmotbia4TvU=";
+    hash = "sha256-wiK21oEJb5RE0sSGPSwRdAGeJ8rMoKSlwRTTbdfXv3g=";
   };
 
   outputs = [

pkgs/by-name/ca/caffeine/package.nix

@@ -5,7 +5,6 @@
   apple-sdk,
   darwin,
   xcbuildHook,
-  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -32,8 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     xcbuildHook
     darwin.autoSignDarwinBinariesHook
-    # TODO: Remove once #536365 reaches this branch
-    llvmPackages.lld
   ];
 
   buildInputs = [
@@ -45,9 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-configuration Release"
   ];
 
-  # TODO: Remove once #536365 reaches this branch
-  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
-
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/ca/cargo-auditable/builder.nix

@@ -42,20 +42,9 @@ lib.extendMkDerivation {
         # https://github.com/rust-secure-code/cargo-auditable/issues/235
         "--skip=test_proc_macro"
         "--skip=test_self_hosting"
-      ]
-      # TODO: Clean up on `staging`.
-      ++
-        lib.optionals
-          (
-            stdenv.hostPlatform.isMusl
-            || stdenv.hostPlatform.isAarch32
-            || stdenv.hostPlatform.isDarwin
-            || stdenv.hostPlatform.isMsvc
-          )
-          [
-            # Expects `linker = "rust-lld"` to work.
-            "--skip=test_bare_linker"
-          ];
+        # Expects `linker = "rust-lld"` to work.
+        "--skip=test_bare_linker"
+      ];
 
       postInstall = ''
         installManPage cargo-auditable/cargo-auditable.1

pkgs/by-name/ca/cargo-psp/package.nix

@@ -7,14 +7,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-psp";
-  version = "0.2.8";
+  version = "0.2.9";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-Jud89nYJq4xZn2HudmSA82hOYwItrrTblhIfeqqIqm8=";
+    hash = "sha256-zifaXT7Yzo1tG11PrwIIopOul83jBR2Nbdb02l6M0rk=";
   };
 
-  cargoHash = "sha256-oL2KbhpqvPhtN7hpAuR6a383pPKlW1XuXkoew0ZvPUo=";
+  cargoHash = "sha256-M7dBm5a+xAVORvX6sSTZ5JBSNsImi5OTXr+JPFq0DtU=";
 
   nativeBuildInputs = [
     makeBinaryWrapper

pkgs/by-name/ca/catch2_3/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "catch2";
-  version = "3.15.0";
+  version = "3.15.2";
 
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
     tag = "v${version}";
-    hash = "sha256-1GBzS8jgJXb82BMMRuHWqszB1Xwg6wohmCuINWE7QoU=";
+    hash = "sha256-Fb8dnuaKQwLxYmGDZy38ZsCKk6RwE4PSidD1xmnb1rU=";
   };
 
   patches = lib.optionals stdenv.cc.isClang [

pkgs/by-name/ch/changie/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "changie";
-  version = "1.25.0";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "miniscruff";
     repo = "changie";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-u32vA7rAuXMaxToDPeB/QpNf6Qo0PFf8hkTFQhY89TA=";
+    hash = "sha256-zLAUOxe/PdVGBeT7inwZJuf/vascir32ade5CWqyvrM=";
   };
 
-  vendorHash = "sha256-VoiGg0K89S98j2q68U0oYENgAYjynl3EeFC47l3Hq9Q=";
+  vendorHash = "sha256-+N/h5kNEiSFe1fnzuk/oqf8g0eND4SgHCN/HM9oOgoE=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ch/checkPhaseThreadLimitHook/hook.sh

@@ -0,0 +1,32 @@
+setupThreadLimit() {
+  # Limit number of threads used during checks. Default is "all cores".
+  # Using all cores causes high load on builders if checks are executed with NIX_BUILD_CORE parallelism.
+  # This gets even worse if multiple builds are scheduled on the same machine, potentially growing O(n^3) without explicit core limits.
+
+  # global value to override all of these at once
+  NIX_CHECK_PHASE_DEFAULT_NUM_THREADS="${NIX_CHECK_PHASE_DEFAULT_NUM_THREADS:-1}"
+
+  thread_vars=(
+    OMP_NUM_THREADS
+    OPENBLAS_NUM_THREADS
+    MKL_NUM_THREADS
+    BLIS_NUM_THREADS
+    VECLIB_MAXIMUM_THREADS
+    NUMBA_NUM_THREADS
+    NUMEXPR_NUM_THREADS
+  )
+
+  echo "setting known thread variables to default: $NIX_CHECK_PHASE_DEFAULT_NUM_THREADS"
+  for var in "${thread_vars[@]}"; do
+    export "$var=${!var:-$NIX_CHECK_PHASE_DEFAULT_NUM_THREADS}"
+    printf " %s=%s" "$var" "${!var}"
+  done
+  printf "\n"
+}
+
+
+if [[ -z "${dontLimitCheckPhaseThreads-}" ]]; then
+    echo "Using checkPhaseThreadLimitHook"
+    preCheckHooks+=('setupThreadLimit')
+    preInstallCheckHooks+=('setupThreadLimit')
+fi

pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix

@@ -0,0 +1,15 @@
+{
+  lib,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "check-phase-thread-limit-hook";
+
+  __structuredAttrs = true;
+
+  meta = {
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+} ./hook.sh

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,47 +1,47 @@
 {
-  "version": "2.1.214",
-  "commit": "e158e55a79995c80ed463a5d2de322bc0ac2f711",
-  "buildDate": "2026-07-17T23:32:51Z",
+  "version": "2.1.215",
+  "commit": "316ce99628e89900bf0b1328fed3b8fec0c0c92d",
+  "buildDate": "2026-07-19T00:11:19Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "59796dd18e9d77f1256f367db6d28ce4bd9cd5968e402ad3a327aac36abc6dec",
-      "size": 247091504
+      "checksum": "90608b5c5ab504e96e77365cea6203d046e291d59b2bb42cf28dcb2ccdf9dd58",
+      "size": 247124336
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "d979ba15662828969e5d0f39f1367798a07ef6e031b524efdad37fe7caf84010",
-      "size": 256507024
+      "checksum": "1ef5f5e56ede9f7765a9bef654ece6045dba58f48b7f5b699765375953d52b6b",
+      "size": 256540048
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "4c38f26a57a42619ee813f15dc39fc1fa4fe0bb403215c3cdc342b58fa689c3c",
-      "size": 261995424
+      "checksum": "2b43a3d5b0787217e5d7381fad42c7314292546fe9db9eb8b9b379de90509b30",
+      "size": 262060960
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "3c029136f7c81f54ed4a38e9d52e655aad536433dbbde50519c8c31bb646ad14",
-      "size": 265210864
+      "checksum": "c1efffaaf370aa187cb6a09dd93d4e511c646899b0078476f83791b664bde7fe",
+      "size": 265239536
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "bbcdec27500f1c7f04a8697fa1d55cdae183ba9054b984ac95d82ccdcccaec3e",
-      "size": 255243624
+      "checksum": "95f1bb89dd94ae099c7b5e53832f99624fdf82da8e0f11d81e1632b26e61973e",
+      "size": 255309160
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "1744afe6baa7d5321917bc6f807883daf4f0abda8e9e5d006c03356eb3df8945",
-      "size": 259838544
+      "checksum": "3a14b862d102d0b6b88650a00b8489b1dfec7f84b367f8192ee62c8bdaeb9220",
+      "size": 259863120
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "da26afacbc58d6f569d0921ff6825772220c734327f5f976c0c73bd0b7dd3cf8",
-      "size": 256220832
+      "checksum": "f14452d1e199273795f2920c00fd7a7f818178ddf1f3efb4d005a7e3d4ec4eff",
+      "size": 256247968
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "4c62218523c562991ef05985af3cffa1a69a588bbcfb3b3bf7b59e9bcb69e963",
-      "size": 250596512
+      "checksum": "0e976441467cb09e35b52c83e661ce8e148c5a8766e0899a4255d95c4b8110f6",
+      "size": 250623648
     }
   },
   "sdkCompat": {
@@ -58,6 +58,7 @@
       "0.3.196",
       "0.3.197",
       "0.3.198",
+      "0.3.199",
       "0.3.200",
       "0.3.201",
       "0.3.202",

pkgs/by-name/cl/clickhouse/lts.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.3.17.4-lts";
-  rev = "00f5ad7bc29d8bb65e1f7eb24208da15db3cf642";
-  hash = "sha256-RJSqcsn3ZOL145RTUs4QujPm6DHjDSYiL9jI1C1YCVE=";
+  version = "26.3.17.56-lts";
+  rev = "c57540de480d8a501b601163471d3843674378cf";
+  hash = "sha256-fcRxZbcp7t28bC9vlmgVAV9gB63cQwFWsc0gyKxGhvQ=";
   lts = true;
 }

pkgs/by-name/cm/cmake/darwin-binary-paths.patch

@@ -46,16 +46,3 @@ index 15a1e2c0c3..33bb304cf7 100644
          OUTPUT_VARIABLE OSX_VERSION
          OUTPUT_STRIP_TRAILING_WHITESPACE
          )
-diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index ddc975c202..8ff651fd90 100644
---- a/Utilities/cmcurl/CMakeLists.txt
-+++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -127,7 +127,7 @@
-     set(OSX_VERSION ${CMAKE_OSX_DEPLOYMENT_TARGET})
-   else()
-     execute_process(
--      COMMAND sw_vers -productVersion
-+      COMMAND @sw_vers@ -productVersion
-       OUTPUT_VARIABLE OSX_VERSION
-       OUTPUT_STRIP_TRAILING_WHITESPACE
-       )

pkgs/by-name/cm/cmake/darwin-bsd-binary-paths.patch

@@ -39,13 +39,13 @@ index 260b6631c0..ffb8fcd8d2 100644
      if(ProcessorCount_cmd_sysctl)
        execute_process(COMMAND ${ProcessorCount_cmd_sysctl} -n hw.ncpu
 diff --git a/Source/kwsys/ProcessUNIX.c b/Source/kwsys/ProcessUNIX.c
-index a918b8d9a7..36145707e1 100644
+index 8c22b4e43a..6d9ccef5e7 100644
 --- a/Source/kwsys/ProcessUNIX.c
 +++ b/Source/kwsys/ProcessUNIX.c
-@@ -2503,7 +2503,7 @@
-    have two integers to store: the pid and then the ppid.  */
+@@ -2503,7 +2503,7 @@ static pid_t kwsysProcessFork(kwsysProcess* cp,
  #if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__) ||       \
-   defined(__OpenBSD__) || defined(__GLIBC__) || defined(__GNU__)
+   defined(__NetBSD__) || defined(__OpenBSD__) || defined(__GLIBC__) ||        \
+   defined(__GNU__)
 -#  define KWSYSPE_PS_COMMAND "ps axo pid,ppid"
 +#  define KWSYSPE_PS_COMMAND "@ps@ axo pid,ppid"
  #  define KWSYSPE_PS_FORMAT "%d %d\n"

pkgs/by-name/cm/cmake/package.nix

@@ -50,11 +50,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "4.1.2";
+  version = "4.3.4";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ZD8EGCt7oyOrMfUm94UTT7ecujGIqFIgbvBHP+4oKhU=";
+    hash = "sha256-/e/4l7nrSddkU58rHtxut+FEDfMlZ4qXwZeEmekxrdo=";
   };
 
   patches = [

pkgs/by-name/cm/cmake/remove-impure-search-paths.patch

@@ -157,10 +157,10 @@ index 2a2f478fd7..f22281bdca 100644
  list(REMOVE_DUPLICATES _CPACK_IFW_PATHS)
  
 diff --git a/Modules/FindBLAS.cmake b/Modules/FindBLAS.cmake
-index b45a279b94..884ccc0e32 100644
+index 9f986a78e7..5a6a9758ea 100644
 --- a/Modules/FindBLAS.cmake
 +++ b/Modules/FindBLAS.cmake
-@@ -1098,16 +1098,8 @@
+@@ -1112,16 +1112,10 @@ if(BLA_VENDOR MATCHES "ACML" OR BLA_VENDOR STREQUAL "All")
      ((BLA_VENDOR STREQUAL "ACML_GPU") AND (NOT BLAS_ACML_GPU_LIB_DIRS))
      )
    # try to find acml in "standard" paths
@@ -176,9 +176,11 @@ index b45a279b94..884ccc0e32 100644
 -  endif()
 +  set(_ACML_ROOT)
 +  set(_ACML_GPU_ROOT)
-   list(GET _ACML_ROOT 0 _ACML_ROOT)
-   list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
++  list(GET _ACML_ROOT 0 _ACML_ROOT)
++  list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
    if(_ACML_ROOT)
+     list(GET _ACML_ROOT 0 _ACML_ROOT)
+     list(GET _ACML_GPU_ROOT 0 _ACML_GPU_ROOT)
 diff --git a/Modules/FindCUDA.cmake b/Modules/FindCUDA.cmake
 index bceb615ca0..2350b15655 100644
 --- a/Modules/FindCUDA.cmake
@@ -229,26 +231,13 @@ index bceb615ca0..2350b15655 100644
  
  # Example of how to find an include file from the CUDA_SDK_ROOT_DIR
 diff --git a/Modules/FindCUDAToolkit.cmake b/Modules/FindCUDAToolkit.cmake
-index b00cd26b7e..f5f74ebe1d 100644
+index df36f9a19b..825d1e7386 100644
 --- a/Modules/FindCUDAToolkit.cmake
 +++ b/Modules/FindCUDAToolkit.cmake
-@@ -776,12 +776,6 @@
-       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
-         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
-         break()
--      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
--        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
--        break()
--      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
--        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
--        break()
-       endif()
-     endforeach()
-   endfunction()
-@@ -864,18 +858,8 @@
-   # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
-   # directory is the desired location.
-   if(NOT CUDAToolkit_ROOT_DIR)
+@@ -830,18 +830,9 @@ else()
+     # We will also search the default symlink location /usr/local/cuda first since
+     # if CUDAToolkit_ROOT is not specified, it is assumed that the symlinked
+     # directory is the desired location.
 -    if(UNIX)
 -      if(NOT APPLE)
 -        set(platform_base "/usr/local/cuda-")
@@ -258,14 +247,14 @@ index b00cd26b7e..f5f74ebe1d 100644
 -    else()
 -      set(platform_base "C:\\Program Files\\NVIDIA GPU Computing Toolkit\\CUDA\\v")
 -    endif()
--
+ 
      # Build out a descending list of possible cuda installations, e.g.
 -    file(GLOB possible_paths "${platform_base}*")
 +    set(possible_paths)
      # Iterate the glob results and create a descending list.
      set(versions)
      foreach(p ${possible_paths})
-@@ -891,14 +875,6 @@
+@@ -857,14 +848,6 @@ else()
  
      # With a descending list of versions, populate possible paths to search.
      set(search_paths)
@@ -280,6 +269,19 @@ index b00cd26b7e..f5f74ebe1d 100644
  
      # Now search for the toolkit again using the platform default search paths.
      _CUDAToolkit_find_root_dir(SEARCH_PATHS "${search_paths}" FIND_FLAGS PATH_SUFFIXES bin)
+@@ -889,12 +872,6 @@ else()
+       elseif(CUDAToolkit_ROOT_DIR AND EXISTS "${CUDAToolkit_ROOT_DIR}/${vf}")
+         set(${result_variable} "${CUDAToolkit_ROOT_DIR}/${vf}" PARENT_SCOPE)
+         break()
+-      elseif(CMAKE_SYSROOT_LINK AND EXISTS "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT_LINK}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+-      elseif(EXISTS "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}")
+-        set(${result_variable} "${CMAKE_SYSROOT}/usr/lib/cuda/${vf}" PARENT_SCOPE)
+-        break()
+       endif()
+     endforeach()
+   endfunction()
 diff --git a/Modules/FindCoin3D.cmake b/Modules/FindCoin3D.cmake
 index 1d89c604e0..5b70e71a87 100644
 --- a/Modules/FindCoin3D.cmake
@@ -579,10 +581,10 @@ index 82156747d3..cc3f2a64af 100644
         "Ice-${Ice_VERSION_SLICE2CPP_FULL}/slice"
         "Ice-${Ice_VERSION_SLICE2CPP_SHORT}/slice"
 diff --git a/Modules/FindJNI.cmake b/Modules/FindJNI.cmake
-index 10dcc51776..e272bd9583 100644
+index a70b00f330..1962b55d4a 100644
 --- a/Modules/FindJNI.cmake
 +++ b/Modules/FindJNI.cmake
-@@ -363,51 +363,6 @@
+@@ -367,56 +367,6 @@ if (WIN32)
  endif()
  
  set(_JNI_JAVA_DIRECTORIES_BASE
@@ -604,6 +606,11 @@ index 10dcc51776..e272bd9583 100644
 -  # Arch Linux specific paths for default JVM
 -  /usr/lib/jvm/default
 -  # Ubuntu specific paths for default JVM
+-  /usr/lib/jvm/java-26-openjdk-{libarch}
+-  /usr/lib/jvm/java-25-openjdk-{libarch}    # Ubuntu 24.04 LTS
+-  /usr/lib/jvm/java-24-openjdk-{libarch}
+-  /usr/lib/jvm/java-23-openjdk-{libarch}
+-  /usr/lib/jvm/java-22-openjdk-{libarch}
 -  /usr/lib/jvm/java-21-openjdk-{libarch}    # Ubuntu 23.04
 -  /usr/lib/jvm/java-20-openjdk-{libarch}    # Ubuntu 22.10
 -  /usr/lib/jvm/java-19-openjdk-{libarch}    # Ubuntu 22.04 LTS
@@ -1093,28 +1100,28 @@ index edef791cb8..5515f44710 100644
  
  find_path(PHP4_FOUND_INCLUDE_PATH main/php.h
 diff --git a/Modules/FindPerlLibs.cmake b/Modules/FindPerlLibs.cmake
-index 330700e183..7fc89df6eb 100644
+index fbe1aade72..34562e7807 100644
 --- a/Modules/FindPerlLibs.cmake
 +++ b/Modules/FindPerlLibs.cmake
-@@ -141,10 +141,6 @@
+@@ -176,10 +176,6 @@ if (PERL_EXECUTABLE)
      PATHS
        "${PERL_UPDATE_ARCHLIB}/CORE"
        "${PERL_ARCHLIB}/CORE"
--      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/CORE
    )
  
    ### PERL_LIBRARY
-@@ -154,10 +150,6 @@
+@@ -189,10 +185,6 @@ if (PERL_EXECUTABLE)
      PATHS
        "${PERL_UPDATE_ARCHLIB}/CORE"
        "${PERL_ARCHLIB}/CORE"
--      /usr/lib/perl5/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/${PERL_ARCHNAME}/CORE
--      /usr/lib/perl5/${PERL_VERSION_STRING}/CORE
--      /usr/lib/perl/${PERL_VERSION_STRING}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/${PERL_ARCHNAME}/CORE
+-      /usr/lib/perl5/${PerlLibs_VERSION}/CORE
+-      /usr/lib/perl/${PerlLibs_VERSION}/CORE
    )
  
  endif ()
@@ -1343,17 +1350,21 @@ index 2c62a5f17f..772a8d88f6 100644
    PATH_SUFFIXES
      bin lib/qt lib/qt3 qt qt3 qt/bin qt3/bin lib/qt/bin lib/qt3/bin
 diff --git a/Modules/FindRuby.cmake b/Modules/FindRuby.cmake
-index 18b9e35855..dba9976565 100644
+index 863f70a7f2..17e3ac606a 100644
 --- a/Modules/FindRuby.cmake
 +++ b/Modules/FindRuby.cmake
-@@ -367,7 +367,6 @@
-           HINTS
-           ${Ruby_HDR_DIR}
-           ${Ruby_ARCH_DIR}
--          /usr/lib/ruby/${_Ruby_VERSION_SHORT}/i586-linux-gnu/
- )
+@@ -366,11 +366,6 @@ if (NOT Ruby_EXECUTABLE AND Ruby_FIND_VIRTUALENV MATCHES "^(FIRST|ONLY)$")
+   endif ()
+ endif ()
  
- set(Ruby_INCLUDE_DIRS ${Ruby_INCLUDE_DIR})
+-# Check for Homebrew Ruby (non-virtualenv, common on MacOS)
+-if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
+-  _RUBY_CHECK_BREW()
+-endif ()
+-
+ # Fallback to system installed Ruby
+ if (NOT Ruby_EXECUTABLE AND NOT Ruby_FIND_VIRTUALENV STREQUAL "ONLY")
+   _RUBY_CHECK_SYSTEM()
 diff --git a/Modules/FindSDL.cmake b/Modules/FindSDL.cmake
 index a720dcc3df..73e222a27c 100644
 --- a/Modules/FindSDL.cmake
@@ -1644,6 +1655,20 @@ index 7c4f123a1d..4cfd53de9f 100644
  
  if(NOT CMAKE_CROSSCOMPILING)
    execute_process(COMMAND @sw_vers@ -productVersion
+@@ -277,13 +277,6 @@ if(NOT CMAKE_OSX_SYSROOT)
+     RESULT_VARIABLE _result
+   )
+   unset(_sdk_macosx)
+-
+-  list(APPEND CMAKE_PLATFORM_IMPLICIT_LINK_DIRECTORIES_EXCLUDE
+-    # Without -isysroot, some compiler drivers implicitly pass -L/usr/local/lib
+-    # to the linker.  Since the macOS dynamic loader does not search it by
+-    # default, it is not a fully-implemented implicit link directory.
+-    /usr/local/lib
+-  )
+ endif()
+ 
+ #----------------------------------------------------------------------------
 diff --git a/Modules/Platform/Darwin.cmake b/Modules/Platform/Darwin.cmake
 index 42c6b35424..f2985f3765 100644
 --- a/Modules/Platform/Darwin.cmake
@@ -1905,10 +1930,10 @@ index b977d955ca..5ff835298d 100644
      set(_jar_doc "NOTSET")
  
 diff --git a/Utilities/cmcurl/CMakeLists.txt b/Utilities/cmcurl/CMakeLists.txt
-index 8ff651fd90..9659deedf5 100644
+index 2c6a6e6a19..3a43da619a 100644
 --- a/Utilities/cmcurl/CMakeLists.txt
 +++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -1826,43 +1826,6 @@
+@@ -1566,43 +1566,6 @@ if(_curl_ca_bundle_supported)
    endif()
    mark_as_advanced(CURL_CA_PATH_SET)
  
@@ -1929,8 +1954,8 @@ index 8ff651fd90..9659deedf5 100644
 -        if(EXISTS "${_search_ca_bundle_path}")
 -          message(STATUS "Found CA bundle: ${_search_ca_bundle_path}")
 -          set(CURL_CA_BUNDLE "${_search_ca_bundle_path}" CACHE
--            STRING "Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
--          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+-            STRING "Absolute path to the CA bundle. ${_ca_opt_desc}")
+-          set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
 -          break()
 -        endif()
 -      endforeach()
@@ -1943,8 +1968,8 @@ index 8ff651fd90..9659deedf5 100644
 -        unset(_curl_ca_files_found)
 -        message(STATUS "Found CA path: ${_search_ca_path}")
 -        set(CURL_CA_PATH "${_search_ca_path}" CACHE
--          STRING "Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
--        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
+-          STRING "Absolute path to a directory containing CA certificates stored individually. ${_ca_opt_desc}")
+-        set(CURL_CA_PATH_SET TRUE CACHE BOOL "Absolute path to the CA bundle has been set")
 -      endif()
 -    endif()
 -  endif()

pkgs/by-name/co/cockpit-zfs/package.nix

@@ -46,14 +46,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-zfs";
-  version = "1.2.30";
+  version = "1.2.33";
 
   src = fetchFromGitHub {
     owner = "45Drives";
     repo = "cockpit-zfs";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-G24xNoKoBnlXxxyo9IJIoQW3PrktQxsx37/cX6QYfyE=";
+    hash = "sha256-3KoCp4gcWYuama+7t1oQhif3/Ii/zSlhyeNTH3mvbNg=";
   };
 
   missingHashes = ./missing-hashes.json;

pkgs/by-name/co/codespell/package.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "codespell";
-  version = "2.4.2";
+  version = "2.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "codespell-project";
     repo = "codespell";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-OMnkTXt6ok3ll9ocZMY4jdpYl3PlI2ZZtLuiMYrCRNI=";
+    sha256 = "sha256-oWVhD9KINWNW75ufPK3yKJJ3zV2AaR6LNok4RQK1PLA=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -22,7 +22,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   nativeCheckInputs = with python3.pkgs; [
-    aspell-python
+    aspell-python-py3
     chardet
     pytestCheckHook
     pytest-cov-stub

pkgs/by-name/co/coinmp/package.nix

@@ -41,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://projects.coin-or.org/CoinMP/";
     description = "COIN-OR lightweight API for COIN-OR libraries CLP, CBC, and CGL";
+    maintainers = with lib.maintainers; [ coolcuber ];
     platforms = lib.platforms.unix;
     license = lib.licenses.epl10;
   };

pkgs/by-name/co/commitizen/package.nix

@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "commitizen";
-  version = "4.16.4";
+  version = "4.16.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = "commitizen";
     tag = "v${version}";
-    hash = "sha256-lVc1Kdy/IWRa8uoPZfOSSa379bDDknE3dpm0U7DVv0s=";
+    hash = "sha256-OIaQcdkvLKUgHvlqsVTk9DaIAQUUZiP8BP9z5Xprdfc=";
   };
 
   postPatch = ''

pkgs/by-name/co/concord-tui/package.nix

@@ -7,8 +7,6 @@
   opus,
   lib,
   stdenv,
-  # TODO: Clean up on `staging`
-  lld,
   nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -33,21 +31,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeBuildInputs = [
     pkg-config
     cmake
-  ]
-  # TODO: Clean up on `staging`
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    lld
   ];
 
   __darwinAllowLocalNetworking = true;
 
   __structuredAttrs = true;
 
-  # TODO: Clean up on `staging`
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=${lib.getExe' lld "ld64.lld"}";
-  };
-
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/ct/ctpv/package.nix

@@ -8,6 +8,7 @@
   atool,
   bat,
   chafa,
+  coreutils,
   delta,
   ffmpeg,
   ffmpegthumbnailer,
@@ -16,7 +17,7 @@
   imagemagick,
   jq,
   poppler-utils,
-  ueberzug,
+  ueberzugpp,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -46,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
           atool # for archive files
           bat
           chafa # for image files on Wayland
+          coreutils
           delta # for diff files
           ffmpeg
           ffmpegthumbnailer
@@ -54,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
           imagemagick
           jq # for json files
           poppler-utils # for pdf files
-          ueberzug # for image files on X11
+          ueberzugpp # for image files on X11
         ]
       }";
   '';

pkgs/by-name/cu/curlMinimal/package.nix

@@ -6,6 +6,8 @@
   perl,
   nixosTests,
   autoreconfHook,
+  buildPackages,
+  runtimeShellPackage,
   brotliSupport ? false,
   brotli,
   c-aresSupport ? false,
@@ -82,6 +84,9 @@ assert
     ]) > 1
   );
 
+let
+  isCross = !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
   version = "8.21.0";
@@ -241,7 +246,20 @@ stdenv.mkDerivation (finalAttrs: {
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4
     ln $out/lib/libcurl${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/libcurl-gnutls${stdenv.hostPlatform.extensions.sharedLibrary}.4.4.0
+  ''
+  # The wcurl shell script found in `''${!outputBin}/bin`, is located in the
+  # source along with all the scripts patched in `postPatch` above.
+  # `patchShebangs` at that stage causes the host intended wcurl script to get
+  # the buildPlatform's runtimeShell shebang, instead of the hostPlatform's. To
+  # make sure this doesn't happen we disallow it, and fix it above in the
+  # postInstall, and also with the conditional hostPlatform's
+  # runtimeShellPackage added in buildInputs.
+  + lib.optionalString isCross ''
+    patchShebangs --update --host "''${!outputBin}/bin"
   '';
+  outputChecks.bin.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  outputChecks.out.disallowedReferences = lib.optional isCross buildPackages.runtimeShellPackage;
+  buildInputs = lib.optional isCross runtimeShellPackage;
 
   passthru =
     let

pkgs/by-name/da/darktable/package.nix

@@ -103,8 +103,7 @@ stdenv.mkDerivation rec {
     pkg-config
     wrapGAppsHook3
     saxon # Use Saxon instead of libxslt to fix XSLT generate-id() consistency issues
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
+  ];
 
   buildInputs = [
     SDL2
@@ -185,12 +184,6 @@ stdenv.mkDerivation rec {
     "-DUSE_KWALLET=OFF"
   ];
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Work around ld64's libc++ hardening issue.
-    # TODO: Remove once #536365 reaches this branch.
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   # darktable changed its rpath handling in commit
   # 83c70b876af6484506901e6b381304ae0d073d3c and as a result the
   # binaries can't find libdarktable.so, so change LD_LIBRARY_PATH in

pkgs/by-name/di/diffoscope/package.nix

@@ -98,6 +98,11 @@ let
             tag = version;
             hash = "sha256-ZYEjT/yShfA4+zpbGOtaFOx1nSSOWPtMvskPhHv3c9U=";
           };
+
+          postPatch = ''
+            substituteInPlace py_ext/setup.py \
+              --replace-fail "0.2.0" "${version}"
+          '';
         }
       );
     };

pkgs/by-name/dm/dmarc-metrics-exporter/package.nix

@@ -1,16 +1,11 @@
 {
   lib,
   stdenv,
-  python312,
+  python3Packages,
   fetchFromGitHub,
 }:
 
-let
-  # more-itertools unsupported on 3.13
-  python3 = python312;
-in
-
-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "dmarc-metrics-exporter";
   version = "1.3.1";
 
@@ -25,15 +20,14 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   pythonRelaxDeps = true;
 
-  build-system = with python3.pkgs; [
+  build-system = with python3Packages; [
     poetry-core
   ];
 
   dependencies =
-    with python3.pkgs;
+    with python3Packages;
     [
       bite-parser
-      dataclasses-serialization
       prometheus-client
       pydantic
       structlog
@@ -42,7 +36,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     ]
     ++ uvicorn.optional-dependencies.standard;
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     aiohttp
     pytest-asyncio
     pytestCheckHook

pkgs/by-name/dn/dnscontrol/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dnscontrol";
-  version = "4.42.0";
+  version = "4.43.0";
 
   src = fetchFromGitHub {
     owner = "DNSControl";
     repo = "dnscontrol";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iB2PFPvcASRwpBkFJQ3Vi2r89H3a9BBbC1moAymWDOI=";
+    hash = "sha256-7t/j6vLeoYHTf7wMIZ1hns1Uo0udEqTu/0K/96C5aPQ=";
   };
 
-  vendorHash = "sha256-8rL5v/0Vb+gxmbDaEB57UsQEnKCJtbZh0lFUyKYMZgs=";
+  vendorHash = "sha256-NEFfYDLo/UiITlUd7XptBmWesJQexvaXH95gyMpgNqA=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/du/duckdb/package.nix

@@ -152,11 +152,12 @@ stdenv.mkDerivation (finalAttrs: {
       );
       LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";
     in
+    # FIXME: do something about the excessive logging on x86_64-linux (> 250 MiB).
     ''
       runHook preInstallCheck
       (($(ulimit -n) < 1024)) && ulimit -n 1024
 
-      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}
+      HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}${lib.optionalString stdenv.hostPlatform.isx86_64 " >/dev/null"}
 
       runHook postInstallCheck
     '';

pkgs/by-name/du/duckdb/versions.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.5.3",
-  "rev": "14eca11bd9d4a0de2ea0f078be588a9c1c5b279c",
-  "hash": "sha256-k7mtYXHS8IcBAuOCJ/09lPYLxF3RMODIeDaz3tKmQAA=",
-  "python_hash": "sha256-r0jfYIyBHN5z4QKKxS/yjnkGjUy/yg9Kt/O6adBbH7Q="
+  "version": "1.5.4",
+  "rev": "08e34c447bae34eaee3723cac61f2878b6bdf787",
+  "hash": "sha256-6xpKZKfH5/nwE2nU5kcpgITKFm3ilb1PYf9QEk+bKoM=",
+  "python_hash": "sha256-2TgMuaeAehJ5rvpfA57KTmHtTZnvfa/nl/Y9ASCwVs0="
 }

pkgs/by-name/em/emoji-runner/package.nix

@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "emoji-runner";
-  version = "3.0.5";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "alex1701c";
     repo = "EmojiRunner";
     tag = finalAttrs.version;
-    hash = "sha256-Rt7Z0uEbzqRKxV1EpDr//RYaVr3D+Nj+7JS3EAO+hsM=";
+    hash = "sha256-bATM93BreumyKbyYwPZ8nXL44B3sfSPn7Ob6qHcbGhY=";
   };
 
   dontWrapQtApps = true;

pkgs/by-name/en/enzyme/package.nix

@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.280";
+  version = "0.0.286";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-EVs7gBEDFINdbob51AlUsgH21sR/V/5/Cc+ADnOwDgM=";
+    hash = "sha256-MEGkV83xGArRZAwlRRTALOUpQV9W2tH7SLOcOyH7RCA=";
   };
 
   postPatch = ''