nix-prefetch-scripts: enable structuredAttrs (#552697)

Measured on a PySide6 application, dropping the propagation removes 17 paths
and 1.72 GiB, 813 MiB of which is clang-21.1.8-lib alone.

The generator is now depended on directly by the packages that run it to
generate bindings: pyside6 and the KDE python bindings. pyside6-qtads already
did this.

Assisted-by: claude-code with claude-opus-5[1m]-high

doc/interoperability/cyclonedx.md

@@ -39,7 +39,7 @@ The `nix:narinfo` properties should be accompanied by a `nix:store_path` propert
 | `nix:narinfo:system`      | The hardware and software platform on which this component is produced. |
 | `nix:narinfo:sig`         | Signatures claiming that this component is what it claims to be. |
 | `nix:narinfo:ca`          | Content address of this store object's file system object, used to compute its store path. |
-| `nix:narinfo:references`  | A whitespace separated array of store paths that this component references. |
+| `nix:narinfo:references`  | A whitespace-separated array of store paths that this component references. |
 
 ### `nix:fod` {#sec-interop.cylonedx-fod}
 

doc/release-notes/rl-2611.section.md

@@ -82,6 +82,8 @@
 
 - `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
 
+- `writeTextFile` now uses structured attributes and `passAsFile` is no longer used or supported.
+
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:
@@ -142,6 +144,8 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
+- `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
+
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
 
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -199,6 +199,8 @@
 
 - `services.pfix-srsd` and the supporting `pfixtools` package have been removed, as the project is dormant and does not support pcre2.  `services.postsrsd` is the recommended replacement for Sender Rewriting Scheme support with Postfix.
 
+- `services.quake3-server.port` has been removed in favor of the structured [](#opt-services.quake3-server.settings.net_port) option. Use `services.quake3-server.settings.net_port` to set any custom UDP port directly.
+
 - Package `overseerr` has been removed as the `overseerr` and `jellyseerr` projects were merged under `seerr`.
 
 - The papra NixOS module is now hardening the systemd unit by default. If this breaks any of the configured directories, please reconfigure them through `services.papra.environment` to enable sandbox passthrough.

nixos/modules/services/audio/mpd.nix

@@ -84,7 +84,6 @@ let
           }
         }
       '';
-      __structuredAttrs = true;
     };
     checkPhase = ''
       printf "%s" "$expectScript" | ${lib.getExe pkgs.buildPackages.expect} -f -

nixos/modules/services/audio/mympd.nix

@@ -108,7 +108,7 @@ in
         DynamicUser = true;
         ExecStart = lib.getExe cfg.package;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         PrivateDevices = true;
         ProtectClock = true;
         ProtectControlGroups = true;

nixos/modules/services/cluster/hadoop/hbase.nix

@@ -167,7 +167,7 @@ in
       zookeeperQuorum = lib.mkOption {
         description = ''
           This option will set "hbase.zookeeper.quorum" in hbase-site.xml.
-          Comma separated list of servers in the ZooKeeper ensemble.
+          Comma-separated list of servers in the ZooKeeper ensemble.
         '';
         type = with lib.types; nullOr commas;
         example = "zk1.internal,zk2.internal,zk3.internal";

nixos/modules/services/databases/mysql.nix

@@ -752,7 +752,7 @@ in
             "AF_INET6"
           ];
           LockPersonality = true;
-          MemoryDenyWriteExecute = true;
+          MemoryDenyWriteExecute = false; # pcre2 jit
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           PrivateMounts = true;

nixos/modules/services/games/quake3-server.nix

@@ -15,9 +15,16 @@ let
     ;
   cfg = config.services.quake3-server;
 
-  configFile = pkgs.writeText "q3ds-extra.cfg" ''
-    set net_port ${toString cfg.port}
+  toQuake3Value = value: if lib.isBool value then (if value then "1" else "0") else toString value;
 
+  toQuake3Config =
+    settings:
+    lib.concatStrings (
+      lib.mapAttrsToList (name: value: ''seta ${name} "${toQuake3Value value}"'' + "\n") settings
+    );
+
+  configFile = pkgs.writeText "q3ds-extra.cfg" ''
+    ${toQuake3Config cfg.settings}
     ${cfg.extraConfig}
   '';
 
@@ -50,19 +57,19 @@ let
   '';
 in
 {
+
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "quake3-server" "port" ]
+      [ "services" "quake3-server" "settings" "net_port" ]
+    )
+  ];
+
   options = {
     services.quake3-server = {
       enable = mkEnableOption "Quake 3 dedicated server";
       package = lib.mkPackageOption pkgs "ioquake3" { };
 
-      port = mkOption {
-        type = types.port;
-        default = 27960;
-        description = ''
-          UDP Port the server should listen on.
-        '';
-      };
-
       openFirewall = mkOption {
         type = types.bool;
         default = false;
@@ -71,16 +78,59 @@ in
         '';
       };
 
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = types.attrsOf (
+            types.nullOr (
+              types.oneOf [
+                types.str
+                types.bool
+                types.int
+                types.float
+                types.port
+              ]
+            )
+          );
+          options = {
+            net_port = lib.mkOption {
+              type = lib.types.port;
+              default = 27960;
+              description = "UDP port for the dedicated server to bind to.";
+            };
+          };
+        };
+        default = { };
+        example = {
+          sv_hostname = "My Quake 3 server";
+          g_gametype = 0;
+          sv_pure = true;
+        };
+        description = ''
+          Quake 3 cvars set via `seta` on server start (i.e. persisted,
+          archive-flagged cvars – the vast majority of server settings).
+          Note that options changed via RCON will not be persisted. To list
+          all possible options, use "cvarlist 1" via RCON.
+        '';
+      };
+
       extraConfig = mkOption {
         type = types.lines;
         default = "";
         example = ''
-          seta rconPassword "superSecret"      // sets RCON password for remote console
-          seta sv_hostname "My Quake 3 server"      // name that appears in server list
+          // map rotation and other things that don't map onto plain cvars
+          set d1 "map q3dm1 ; set nextmap vstr d2"
+          set d2 "map q3dm7 ; set nextmap vstr d1"
+          vstr d1
+
+          // rarely needed: cvars with a non-seta flag
+          sets sv_privatePassword "hidden"
         '';
         description = ''
-          Extra configuration options. Note that options changed via RCON will not be persisted. To list all possible
-          options, use "cvarlist 1" via RCON.
+          Extra configuration lines appended after `settings`, for anything
+          that isn't a plain persisted cvar: map-rotation scripts, `exec`,
+          `vstr`, aliases, or cvars that need `set`/`sets`/`sett`/`setu`
+          instead of `seta`. Note that options changed via RCON will not be
+          persisted. To list all possible options, use "cvarlist 1" via RCON.
         '';
       };
 
@@ -103,7 +153,7 @@ in
       baseq3InStore = builtins.typeOf cfg.baseq3 == "set";
     in
     mkIf cfg.enable {
-      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.port ];
+      networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.settings.net_port ];
 
       systemd.services.q3ds = {
         description = "Quake 3 dedicated server";
@@ -115,7 +165,7 @@ in
         serviceConfig = with lib; {
           Restart = "always";
           DynamicUser = true;
-          WorkingDirectory = home;
+          WorkingDirectory = if baseq3InStore then home else cfg.baseq3;
 
           # It is possible to alter configuration files via RCON. To ensure reproducibility we have to prevent this
           ReadOnlyPaths = if baseq3InStore then home else cfg.baseq3;

nixos/modules/services/mail/cyrus-imap.nix

@@ -355,7 +355,7 @@ in
         PrivateDevices = true;
         ProtectSystem = "full";
         CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectControlGroups = true;

nixos/modules/services/mail/dovecot.nix

@@ -1061,7 +1061,7 @@ in
           "CAP_SYS_RESOURCE"
         ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         NoNewPrivileges = false; # e.g for sendmail
         OOMPolicy = "continue";
         PrivateTmp = true;

nixos/modules/services/mail/postfix.nix

@@ -1011,7 +1011,7 @@ in
             PrivateDevices = true;
             ProtectSystem = "full";
             CapabilityBoundingSet = [ "~CAP_NET_ADMIN CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_MODULE" ];
-            MemoryDenyWriteExecute = true;
+            MemoryDenyWriteExecute = false; # pcre2 jit
             ProtectKernelModules = true;
             ProtectKernelTunables = true;
             ProtectControlGroups = true;

nixos/modules/services/misc/forgejo.nix

@@ -777,7 +777,7 @@ in
         ];
         RestrictNamespaces = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         RemoveIPC = true;

nixos/modules/services/misc/gitea.nix

@@ -953,7 +953,7 @@ in
         ++ lib.optional (useSendmail && config.services.postfix.enable) "AF_NETLINK";
         RestrictNamespaces = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         RemoveIPC = true;

nixos/modules/services/networking/supplicant.nix

@@ -226,7 +226,7 @@ in
         The value of this option is an attribute set. Each attribute configures a
         {command}`wpa_supplicant` service, where the attribute name specifies
         the name of the interface that {command}`wpa_supplicant` operates on.
-        The attribute name can be a space separated list of interfaces.
+        The attribute name can be a space-separated list of interfaces.
         The attribute names `WLAN`, `LAN` and `DBUS`
         have a special meaning. `WLAN` and `LAN` are
         configurations for universal {command}`wpa_supplicant` service that is

nixos/modules/services/networking/suricata/default.nix

@@ -273,7 +273,7 @@ in
               ProtectSystem = "strict";
               DevicePolicy = "closed";
               LockPersonality = true;
-              MemoryDenyWriteExecute = true;
+              MemoryDenyWriteExecute = false; # pcre2 jit
               ProtectHostname = true;
               ProtectProc = true;
               ProtectKernelLogs = true;

nixos/modules/services/networking/vsftpd.nix

@@ -168,7 +168,7 @@ in
         default = pkgs.writeText "userlist" (concatMapStrings (x: "${x}\n") cfg.userlist);
         defaultText = literalExpression ''pkgs.writeText "userlist" (concatMapStrings (x: "''${x}\n") cfg.userlist)'';
         description = ''
-          Newline separated list of names to be allowed/denied if {option}`userlistEnable`
+          Newline-separated list of names to be allowed/denied if {option}`userlistEnable`
           is `true`. Meaning see {option}`userlistDeny`.
 
           The default is a file containing the users from {option}`userlist`.

nixos/modules/services/web-servers/nginx/default.nix

@@ -1626,11 +1626,7 @@ in
           ];
           RestrictNamespaces = true;
           LockPersonality = true;
-          MemoryDenyWriteExecute =
-            !(
-              (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
-              || (lib.getName cfg.package == "openresty")
-            );
+          MemoryDenyWriteExecute = false; # for pcre2 & several plugins
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
           RemoveIPC = true;

nixos/modules/services/web-servers/unit/default.nix

@@ -139,7 +139,7 @@ in
           "AF_INET6"
         ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = false; # pcre2 jit
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         PrivateMounts = true;

nixos/modules/system/boot/loader/limine/limine.nix

@@ -360,7 +360,7 @@ in
           default = null;
           type = lib.types.nullOr lib.types.str;
           description = ''
-            A ; seperated array of 8 colors in the format RRGGBB:
+            A semicolon-separated array of 8 colors in the format RRGGBB:
             black, red, green, brown, blue, magenta, cyan, and gray.
           '';
         };
@@ -369,7 +369,7 @@ in
           default = null;
           type = lib.types.nullOr lib.types.str;
           description = ''
-            A ; seperated array of 8 colors in the format RRGGBB:
+            A semicolon-separated array of 8 colors in the format RRGGBB:
             dark gray, bright red, bright green, yellow, bright blue, bright magenta, bright cyan, and white.
           '';
         };

pkgs/applications/editors/vim/plugins/generated.nix

@@ -15316,6 +15316,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  profile-nvim = buildVimPlugin {
+    pname = "profile.nvim";
+    version = "0-unstable-2025-03-05";
+    src = fetchFromGitHub {
+      owner = "stevearc";
+      repo = "profile.nvim";
+      rev = "30433d7513f0d14665c1cfcea501c90f8a63e003";
+      hash = "sha256-2Mk6VbC+K/WhTWF+yHyDhQKJhTi2rpo8VJsnO7ofHXs=";
+    };
+    meta.homepage = "https://github.com/stevearc/profile.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
     version = "6.0.2-1";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1092,6 +1092,7 @@ https://github.com/sotte/presenting.vim/,,
 https://github.com/ewilazarus/preto/,,
 https://github.com/anuvyklack/pretty-fold.nvim/,,
 https://github.com/vim-scripts/prev_indent/,,
+https://github.com/stevearc/profile.nvim/,,
 https://github.com/DrKJeff16/project.nvim/,,
 https://github.com/GnikDroy/projections.nvim/,,
 https://github.com/kevinhwang91/promise-async/,,

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-oOytttotGI7f4RlnNBRM6TvXaXUht6v99Kzxc9GP404=";
+          hash = "sha256-Yabd8DFEh1wq0K4IQPFUBNFDkyHhXl695wSfKa5RX7k=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-9Ne1PGz0k1E1wY/HhoR5mqB3SFQiFkHt236+L5jXE60=";
+          hash = "sha256-gzMUtolNlNxFUofsL9JgOnaxfUGeSxFQY7C4smJ8fr8=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-2nwDsS4tVRikMZWZW4TKshQE7HVeQ/yY7CxpGg0os7w=";
+          hash = "sha256-U8S7U5sYj9LukYfmC2yyUjeenAYYHsMrx8snhXqATck=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.238";
+      version = "2.1.245";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/misc/inochi2d/default.nix

@@ -36,7 +36,7 @@ in
     patches = [
       # Upstream asks that we change the bug tracker URL to not point to the upstream bug tracker
       (replaceVars ./support-url.patch {
-        assignees = "TomaSajt"; # should be a comma separated list of the github usernames of the maintainers
+        assignees = "TomaSajt"; # should be a comma-separated list of the github usernames of the maintainers
       })
       # Change how duplicate locales differentiate themselves (the store paths were too long)
       ./translations.patch

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-YcKLw5PotrwRdGEmPzy1Ka/doJ9fDbKuP6Q9Dw24mG0=",
+    "hash": "sha256-3/apEon1W1iaB7UIkYgI4POV+f1uVDVXX4V6dyeqsLk=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.27.0",
+    "rev": "v8.28.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -112,8 +112,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.13.0esr";
-    sha512 = "778d2fc2837ba367e90c4336f3873da5a0823c182e2f50aa9373cd1ee9ee2b5310372ad9d33e1e11978791b67de4a6952d3036ff7d57b257a06f49c8cd4a830e";
+    version = "140.14.0esr";
+    sha512 = "4c95b1ca3fc7f6429b2360a7e732635bdfb60927622a7da4d8af9ca2abd550611b91763c587cddad5d51c0dd4e905ba8e106da3cd21591a1bec3dba1b9a2502d";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

pkgs/build-support/bintools-wrapper/default.nix

@@ -478,6 +478,8 @@ stdenvNoCC.mkDerivation {
       apple-sdk.__spliced.buildTarget or apple-sdk;
   };
 
+  __structuredAttrs = true;
+
   meta =
     let
       bintools_ = optionalAttrs (bintools != null) bintools;

pkgs/build-support/fetchbzr/default.nix

@@ -17,6 +17,9 @@ lib.fetchers.withNormalizedHash { } (
     builder = ./builder.sh;
     nativeBuildInputs = [ breezy ];
 
+    strictDeps = true;
+    __structuredAttrs = true;
+
     inherit outputHash outputHashAlgo;
     outputHashMode = "recursive";
 

pkgs/build-support/fetchcvs/default.nix

@@ -29,6 +29,9 @@ lib.makeOverridable (
         openssh
       ];
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       inherit outputHash outputHashAlgo;
       outputHashMode = "recursive";
 

pkgs/build-support/fetchdarcs/default.nix

@@ -27,6 +27,9 @@ lib.makeOverridable (
         darcs
       ];
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       inherit outputHash outputHashAlgo;
       outputHashMode = "recursive";
 

pkgs/build-support/fetchfirefoxaddon/default.nix

@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   fetchurl,
   jq,
   strip-nondeterminism,
@@ -35,7 +35,7 @@ let
           ;
       };
 in
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   inherit name;
 
   passthru = {
@@ -62,4 +62,7 @@ stdenv.mkDerivation {
     unzip
     zip
   ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
 }

pkgs/build-support/fetchfossil/default.nix

@@ -22,6 +22,9 @@ lib.fetchers.withNormalizedHash { } (
       cacert
     ];
 
+    strictDeps = true;
+    __structuredAttrs = true;
+
     # Envvar docs are hard to find. A link for the future:
     # https://www.fossil-scm.org/index.html/doc/trunk/www/env-opts.md
     impureEnvVars = [ "http_proxy" ];

pkgs/build-support/fetchgit/default.nix

@@ -155,6 +155,8 @@ lib.makeOverridable (
           ++ lib.optionals fetchLFS [ git-lfs ]
           ++ nativeBuildInputs;
 
+          strictDeps = true;
+
           hash =
             if outputHashAlgo == null || outputHash == "" || lib.hasPrefix outputHashAlgo outputHash then
               outputHash

pkgs/build-support/fetchhg/default.nix

@@ -24,6 +24,9 @@ lib.extendMkDerivation {
       builder = ./builder.sh;
       nativeBuildInputs = [ mercurial ];
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
       subrepoClause = lib.optionalString fetchSubrepos "S";

pkgs/build-support/fetchmavenartifact/default.nix

@@ -84,6 +84,10 @@ in
 stdenv.mkDerivation {
   inherit pname version meta;
   dontUnpack = true;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
   # By moving the jar to $out/share/java we make it discoverable by java
   # packages packages that mention this derivation in their buildInputs.
   installPhase = ''

pkgs/build-support/fetchpijul/default.nix

@@ -33,6 +33,8 @@ lib.makeOverridable (
       ];
       strictDeps = true;
 
+      __structuredAttrs = true;
+
       dontUnpack = true;
       dontConfigure = true;
       dontBuild = true;
@@ -41,7 +43,7 @@ lib.makeOverridable (
         runHook preInstall
 
         success=
-        for remote in $remotes; do
+        for remote in "''${remotes[@]}"; do
           if
             pijul clone \
               ''${change:+--change "$change"} \

pkgs/build-support/fetchsvn/default.nix

@@ -66,7 +66,12 @@ else
     ]
     ++ lib.optional sshSupport openssh;
 
-    SVN_SSH = if sshSupport then "${buildPackages.openssh}/bin/ssh" else null;
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    env = lib.optionalAttrs sshSupport {
+      SVN_SSH = lib.getExe buildPackages.openssh;
+    };
 
     outputHashAlgo = if hash != "" then null else "sha256";
     outputHashMode = "recursive";

pkgs/build-support/fetchsvnrevision/default.nix

@@ -2,7 +2,7 @@ runCommand: subversion: repository:
 import (
   runCommand "head-revision"
     {
-      buildInputs = [ subversion ];
+      nativeBuildInputs = [ subversion ];
       dummy = builtins.currentTime;
     }
     ''

pkgs/build-support/fetchsvnssh/builder.sh

@@ -1,9 +1,5 @@
 echo "exporting $url (r$rev) into $out"
 
-if test "$sshSupport"; then
-    export SVN_SSH="$openssh/bin/ssh"
-fi
-
 # Pipe the "p" character into Subversion to force it to accept the
 # server's certificate.  This is perfectly safe: we don't care
 # whether the server is being spoofed --- only the cryptographic

pkgs/build-support/fetchsvnssh/default.nix

@@ -24,6 +24,13 @@ lib.fetchers.withNormalizedHash { } (
       expect
     ];
 
+    strictDeps = true;
+    __structuredAttrs = true;
+
+    env = lib.optionalAttrs sshSupport {
+      SVN_SSH = lib.getExe openssh;
+    };
+
     inherit outputHash outputHashAlgo;
     outputHashMode = "recursive";
 
@@ -34,8 +41,6 @@ lib.fetchers.withNormalizedHash { } (
       password
       url
       rev
-      sshSupport
-      openssh
       ;
   }
 )

pkgs/build-support/go/module.nix

@@ -322,7 +322,7 @@ lib.extendMkDerivation {
               getGoDirs() {
                 local -r type="$1"
 
-                # Support strucuredAttrs, they are not space seperated
+                # Support structuredAttrs, they are not space separated
                 local -a subPackagesArray
                 concatTo subPackagesArray subPackages
 

pkgs/build-support/trivial-builders/default.nix

@@ -108,9 +108,7 @@ rec {
 
     extendDrvArgs =
       let
-        defaultPassAsFile = [ "text" ];
         removedDerivationNames = [
-          "passAsFile"
           "meta"
           "passthru"
         ];
@@ -149,7 +147,9 @@ rec {
               Ensure that the path starts with a / and specifies at least the filename.
             '';
           destination;
-        passAsFile = defaultPassAsFile ++ derivationArgs.passAsFile or [ ];
+
+        __structuredAttrs = true;
+        strictDeps = true;
 
         buildCommand = ''
           target=$out$destination
@@ -735,7 +735,6 @@ rec {
       meta ? { },
       passthru ? { },
       substitutions ? { },
-      __structuredAttrs ? false,
     }@args:
     script:
     runCommand name
@@ -745,10 +744,6 @@ rec {
           # Make the position of the derivation accurate.
           # Since not having `name` is deprecated, this should be fairly accurate.
           pos = lib.unsafeGetAttrPos "name" args;
-          # TODO(@Artturin:) substitutions should be inside the env attrset
-          # but users are likely passing non-substitution arguments through substitutions
-          # turn off __structuredAttrs to unbreak substituteAll
-          inherit __structuredAttrs;
           pname = name;
           version = "26.05pre-git";
           inherit meta;
@@ -756,6 +751,7 @@ rec {
           inherit propagatedBuildInputs;
           inherit propagatedNativeBuildInputs;
           strictDeps = true;
+          __structuredAttrs = true;
           # TODO 2023-01, no backport: simplify to inherit passthru;
           passthru =
             passthru
@@ -771,7 +767,9 @@ rec {
           recordPropagatedDependencies
         ''
         + lib.optionalString (substitutions != { }) ''
-          substituteAll ${script} $out/nix-support/setup-hook
+          substitute ${script} $out/nix-support/setup-hook ${
+            lib.concatMapAttrsStringSep " " (name: _: "--subst-var ${name}") substitutions
+          }
         ''
       );
 

pkgs/by-name/_2/_2ship2harkinian/package.nix

@@ -19,6 +19,7 @@
   libpulseaudio,
   libzip,
   nlohmann_json,
+  stb,
   SDL2,
   spdlog,
   tinyxml-2,
@@ -89,12 +90,6 @@ let
     '';
   };
 
-  stb' = fetchurl {
-    name = "stb_image.h";
-    url = "https://raw.githubusercontent.com/nothings/stb/0bc88af4de5fb022db643c2d8e549a0927749354/stb_image.h";
-    hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
-  };
-
   stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
@@ -220,7 +215,7 @@ stdenv.mkDerivation (finalAttrs: {
   preConfigure = ''
     # mirror 2ship's stb
     mkdir stb
-    cp ${stb'} ./stb/${stb'.name}
+    cp ${stb}/include/stb/stb_image.h ./stb/stb_image.h
     cp ${stb_impl} ./stb/${stb_impl.name}
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
       --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"

pkgs/by-name/ab/abseil-cpp_202505/package.nix

@@ -45,6 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

pkgs/by-name/ab/abseil-cpp_202508/package.nix

@@ -50,6 +50,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

pkgs/by-name/ab/abseil-cpp_202601/package.nix

@@ -39,6 +39,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gtest ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Open-source collection of C++ code designed to augment the C++ standard library";
     homepage = "https://abseil.io/";

pkgs/by-name/ad/ada/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ada";
-  version = "3.4.4";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "ada-url";
     repo = "ada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kfUbsqQ+CsqnySKgeL1GFJLcDe1Irivp4CoZG93BZYg=";
+    hash = "sha256-TvjoLUKO2+YgS1mlyglLb+rBLTO/SWSBVA2S34Z6kMI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adhammer/package.nix

@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "adhammer";
-  version = "1.3.10";
+  version = "1.4.2";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "icedracon";
     repo = "adhammer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QQjiyvj3e5unEsh17UyKck2rs8oKeLO5eodBG7cn1LQ=";
+    hash = "sha256-Jn3hmCSpc/9zxfIzebrCkDOgZ4HzfXdKOcJSXNvxZGM=";
   };
 
-  cargoHash = "sha256-Ebkvxl/JyiZ84ucv7FmOluHTqYd14I3B6z53QNmVQZw=";
+  cargoHash = "sha256-037x5bhTizcCqW/pszIadAVA9ElQzJOQ9W1dh5Kpg9Y=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/al/alsa-utils/package.nix

@@ -5,6 +5,7 @@
   fetchurl,
   alsa-lib,
   alsa-plugins,
+  bashNonInteractive,
   gettext,
   makeWrapper,
   pkg-config,
@@ -45,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
   ];
   buildInputs = [
+    bashNonInteractive
     alsa-lib
     ncurses
     libsamplerate

pkgs/by-name/ar/argp-standalone/package.nix

@@ -22,8 +22,12 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
   ];
 
+  strictDeps = true;
+
   doCheck = true;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/argp-standalone/argp-standalone";
     description = "Standalone version of arguments parsing functions from Glibc";

pkgs/by-name/as/asciidoc/package.nix

@@ -151,7 +151,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   src = fetchFromGitHub {
     owner = "asciidoc-py";
     repo = "asciidoc-py";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-td3C7xTWfSzdo9Bbz0dHW2oPaCQYmUE9H2sUFfg5HH0=";
   };
 
@@ -320,6 +320,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     runHook postCheck
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Text-based document generation system";
     longDescription = ''

pkgs/by-name/au/auto-patchelf/package.nix

@@ -15,6 +15,8 @@ stdenv.mkDerivation {
 
   buildInputs = [ pythonEnv ];
 
+  strictDeps = true;
+
   src = ./source;
 
   buildPhase = ''
@@ -33,6 +35,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Automatically patch ELF binaries using patchelf";
     mainProgram = "auto-patchelf";

pkgs/by-name/au/auto-patchelf/source/auto-patchelf.py

@@ -240,6 +240,35 @@ def find_first_matching_rpath_with_origin(binary: Path, lib_dir: Path, rpaths: l
             return Path(rpath)
     return None
 
+
+def relativize_rpath_to_origin(*, binary_path: Path, rpath_entries: list[Path], containing_path: Path) -> list[Path]:
+    """
+    Rewrite absolute RPATH entries to use $ORIGIN when the entry sits
+    under containing_path (the --paths entry the binary was found
+    under).
+
+    The resulting RPATH is relocatable: as long as the directory layout
+    within containing_path is preserved, the whole tree can be moved
+    and the binary will still find its dependencies.
+
+    Entries that already contain $ORIGIN are left untouched.
+    Entries outside containing_path are also left absolute.
+    """
+    containing_norm: Path = Path(os.path.normpath(containing_path))
+    new_rpath_entries: list[Path] = []
+    for entry in rpath_entries:
+        if "$ORIGIN" in entry.as_posix():
+            new_rpath_entries.append(entry)
+            continue
+        entry_norm: Path = Path(os.path.normpath(entry))
+        if not entry_norm.is_relative_to(containing_norm):
+            new_rpath_entries.append(entry)
+            continue
+        rel = os.path.relpath(entry_norm, binary_path.parent)
+        new_rpath_entries.append(Path("$ORIGIN") / rel)
+    return new_rpath_entries
+
+
 class Event(Protocol):
     """Protocol for loggable events that occur during the auto-patchelf process."""
     def to_human_readable_str(self) -> str: ...
@@ -317,7 +346,18 @@ class Logger:
 
 
 
-def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], append_rpaths: list[Path] = [], keep_libc: bool = False, preserve_origin: bool = False, extra_args: list[str] = []) -> list[Dependency]:
+def auto_patchelf_file(
+    *,
+    logger: Logger,
+    runtime_deps: list[Path],
+    append_rpaths: list[Path] = [],
+    keep_libc: bool = False,
+    preserve_origin: bool = False,
+    relativize_rpath: bool = False,
+    extra_args: list[str] = [],
+    path: Path,
+    containing_path: Path
+) -> list[Dependency]:
     try:
         with open_elf(path) as elf:
 
@@ -436,6 +476,9 @@ def auto_patchelf_file(logger: Logger, path: Path, runtime_deps: list[Path], app
             if "$ORIGIN" in existing_rpath:
                 rpath.append(Path(existing_rpath))
 
+    if relativize_rpath:
+        rpath = relativize_rpath_to_origin(binary_path=path, rpath_entries=rpath, containing_path=containing_path)
+
     # Dedup the rpath
     rpath_str = ":".join(dict.fromkeys(map(Path.as_posix, rpath)))
 
@@ -458,6 +501,7 @@ def auto_patchelf(
         append_rpaths: list[Path] = [],
         keep_libc: bool = False,
         preserve_origin: bool = False,
+        relativize_rpath: bool = False,
         add_existing: bool = True,
         extra_args: list[str] = []) -> None:
 
@@ -472,9 +516,20 @@ def auto_patchelf(
     populate_cache(lib_dirs)
 
     dependencies = []
-    for path in chain.from_iterable(glob(p, '*', recursive) for p in paths_to_patch):
-        if not path.is_symlink() and path.is_file():
-            dependencies += auto_patchelf_file(logger, path, runtime_deps, append_rpaths, keep_libc, preserve_origin, extra_args)
+    for containing_path in paths_to_patch:
+        for path in glob(containing_path, '*', recursive):
+            if not path.is_symlink() and path.is_file():
+                dependencies += auto_patchelf_file(
+                    logger=logger,
+                    runtime_deps=runtime_deps,
+                    append_rpaths=append_rpaths,
+                    keep_libc=keep_libc,
+                    preserve_origin=preserve_origin,
+                    relativize_rpath=relativize_rpath,
+                    extra_args=extra_args,
+                    path=path,
+                    containing_path=containing_path
+                )
 
     missing = [dep for dep in dependencies if not dep.found]
 
@@ -560,6 +615,12 @@ def main() -> None:
         action="store_true",
         help="When possible, replace absolute RPATH entries with original $ORIGIN entries that resolve to the same directory.",
     )
+    parser.add_argument(
+        "--relativize-rpath",
+        dest="relativize_rpath",
+        action="store_true",
+        help="Rewrite absolute RPATH entries to use $ORIGIN when the binary and the entry live under the same --paths root, so the patched tree is relocatable.",
+    )
     parser.add_argument(
         "--ignore-existing",
         dest="add_existing",
@@ -597,6 +658,7 @@ def main() -> None:
         append_rpaths=args.append_rpaths,
         keep_libc=args.keep_libc,
         preserve_origin=args.preserve_origin,
+        relativize_rpath=args.relativize_rpath,
         add_existing=args.add_existing,
         extra_args=args.extra_args)
 

pkgs/by-name/au/autoconf-archive/package.nix

@@ -28,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ xz ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Archive of autoconf m4 macros";
     homepage = "https://www.gnu.org/software/autoconf-archive/";

pkgs/by-name/bi/bison/package.nix

@@ -28,10 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     "host"
   ];
 
-  # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
-  # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
-  # cannot add bash to buildInputs due to infinite recursion
-  strictDeps = stdenv.hostPlatform != stdenv.buildPlatform;
+  strictDeps = true;
 
   nativeBuildInputs = [
     m4
@@ -40,6 +37,13 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.hostPlatform.isSunOS help2man;
   propagatedBuildInputs = [ m4 ];
 
+  # there's a /bin/sh shebang in bin/yacc which when no strictDeps is patched with the build stdenv shell
+  # however when cross-compiling it would still be patched with the build stdenv shell which would be wrong
+  # cannot add bash to buildInputs due to infinite recursion
+  postFixup = lib.optionalString (lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform) ''
+    patchShebangs --build $out/bin/yacc
+  '';
+
   enableParallelBuilding = true;
   # tests are flaky / timing sensitive on FreeBSD
   enableParallelChecking = !stdenv.hostPlatform.isFreeBSD;
@@ -50,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
   # TODO: enable doInstallCheck unconditionally when fixed upstream.
   doInstallCheck = !stdenv.cc.isClang;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/bison/";
     description = "Yacc-compatible parser generator";

pkgs/by-name/bl/bluez-headers/package.nix

@@ -24,6 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   dontConfigure = true;
   dontBuild = true;
 
+  strictDeps = true;
+
   installPhase = ''
     mkdir -p $out/include/
     cp -rv lib/* "$out/include/"
@@ -33,6 +35,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit bluez; # inherits bluez-headers.src
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://bluez.github.io/";
     description = "Official Linux Bluetooth protocol stack";

pkgs/by-name/bo/boost-build/package.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation {
     useBoost.src or (fetchFromGitHub {
       owner = "boostorg";
       repo = "build";
-      rev = defaultVersion;
+      tag = defaultVersion;
       sha256 = "1r4rwlq87ydmsdqrik4ly5iai796qalvw7603mridg2nwcbbnf54";
     });
 
@@ -58,6 +58,8 @@ stdenv.mkDerivation {
     bison
   ];
 
+  strictDeps = true;
+
   buildPhase = ''
     runHook preBuild
     ./bootstrap.sh
@@ -76,6 +78,8 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.boost.org/build/";
     license = lib.licenses.boost;

pkgs/by-name/br/brotli/package.nix

@@ -32,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   cmakeFlags = lib.optional staticOnly "-DBUILD_SHARED_LIBS=OFF";
 
   outputs = [
@@ -60,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://github.com/google/brotli";
     changelog = "https://github.com/google/brotli/blob/${finalAttrs.src.tag}/CHANGELOG.md";

pkgs/by-name/bs/bsky-cli/package.nix

@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "bsky-cli";
-  version = "0.0.81";
+  version = "0.0.82";
 
   src = fetchFromGitHub {
     owner = "mattn";
     repo = "bsky";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Su2AhHaIozuqTzK1vyAjZR/a01j0dnlayV14Q7hTcCU=";
+    hash = "sha256-2Qtr9Q01ZbjfrZFw8315hDGiX2CmyQ0ru1MhqTvdjVw=";
   };
 
-  vendorHash = "sha256-jGeKaAR0rAqrhoUx/FqdDwdOxA/WioppFjGyi/PsIQs=";
+  vendorHash = "sha256-pICYDE5rpGdyII53Ucxx2u51MG604/yjz9W9xsO3ZLs=";
 
   buildInputs = [
     libpcap

pkgs/by-name/bu/buf/package.nix

@@ -44,7 +44,7 @@ buildGoModule (finalAttrs: {
 
   preCheck = ''
     # Some tests take longer depending on builder load.
-    substituteInPlace private/bufpkg/bufcheck/lint_test.go \
+    substituteInPlace private/bufpkg/bufcheck/lint_test.go private/bufpkg/bufcheck/breaking_test.go \
       --replace-fail 'context.WithTimeout(t.Context(), 60*time.Second)' \
                      'context.WithTimeout(t.Context(), 600*time.Second)'
     # For WebAssembly runtime tests

pkgs/by-name/by/byacc/package.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-thjF+0TC9fBIhD25D30bJPePR7B5E8jHuoyULT6ySwA=";
   };
 
+  strictDeps = true;
+
   configureFlags = [
     # change yacc to byacc
     "--program-transform-name='s,^,b,'"
@@ -27,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/byacc $out/bin/yacc
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://invisible-island.net/byacc/byacc.html";
     description = "Berkeley YACC";

pkgs/by-name/ca/cacert/package.nix

@@ -70,6 +70,8 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ buildcatrust ];
 
+  strictDeps = true;
+
   buildPhase = ''
     mkdir unbundled hashed
     buildcatrust \
@@ -247,5 +249,7 @@ stdenv.mkDerivation {
       };
   };
 
+  __structuredAttrs = true;
+
   inherit meta;
 }

pkgs/by-name/ca/catch2/package.nix

@@ -12,14 +12,18 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "catchorg";
     repo = "Catch2";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XnT2ziES94Y4uzWmaxSw7nWegJFQjAqFUG8PkwK5nLU=";
   };
 
   nativeBuildInputs = [ cmake ];
 
+  strictDeps = true;
+
   cmakeFlags = [ "-H.." ];
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Multi-paradigm automated test framework for C++ and Objective-C (and, maybe, C)";
     homepage = "http://catch-lib.net";

pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix

@@ -6,8 +6,6 @@
 makeSetupHook {
   name = "check-phase-thread-limit-hook";
 
-  __structuredAttrs = true;
-
   meta = {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ grimmauld ];

pkgs/by-name/ch/chromaprint/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   fetchurl,
   cmake,
   ninja,
@@ -17,23 +16,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chromaprint";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "acoustid";
     repo = "chromaprint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G3HIMgbjaAXsC+8nt7mkj58xA62qwA8FC+PfTGblhNg=";
+    hash = "sha256-Es903zeZ++9/Xb/npUU3rB0V87DVqwT9uTMbQdSzfJI=";
   };
 
-  patches = [
-    # fix generated pkg-config files
-    (fetchpatch {
-      url = "https://github.com/acoustid/chromaprint/commit/782ef6bb5f6498e35f8e275f76998fbd5ffa36d6.patch";
-      hash = "sha256-drUfAMzTrqqB5UbzOnfPq6XD3HI+3sxyJJSTCa0BmD8=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja

pkgs/by-name/cl/claude-code/manifest.json

@@ -1,57 +1,51 @@
 {
-  "version": "2.1.238",
-  "commit": "46283063a4c23f7afadb8440f549264ad93b7c06",
-  "buildDate": "2026-08-20T15:26:31Z",
+  "version": "2.1.245",
+  "commit": "28b7e8c41235a9e2fcb24248e60c4cc2d29c853a",
+  "buildDate": "2026-08-25T04:08:50Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "1c196c456373b57818ae87df84aecee96cb659448c0d6a6bbb401ac5758431b2",
-      "size": 321263536
+      "checksum": "9f7c2260251765a18d0b35198669dacc1912f6e8129a3b01f6b58d93365ff1f1",
+      "size": 376109392
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "d10bc7bb1720435f8830aa3ee74085f09348d2b1a2a152bdee251b770d76cc73",
-      "size": 329970544
+      "checksum": "de044bb543e826352f31587a74356e1b2dae94dc1b9c960a362d9f07df96c2a7",
+      "size": 385137136
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "28d736120a6b14c5eae1ad1470e73371818c9c2fa41e0b3c7040207aa2d4edee",
-      "size": 335993064
+      "checksum": "d0da299303d710a7cc5cdece9629958f5128ce1a727e15463c651ed5cf385c7f",
+      "size": 389077224
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "0933b286cf94e1b2504b35ac165ab76b8f822735d53371c56393988c23040d58",
-      "size": 338860336
+      "checksum": "16ad2b94deaf7b29abed966d981c9991a47af0420f5be8ed4a3f83bea9f678bc",
+      "size": 391948592
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "a47d45149ea7c74e4474bce3c7628c4643b0541801b42053d6e26fd5e3203fdd",
-      "size": 329137944
+      "checksum": "8707fbe629fdd9876d9c356baa833a697dac76cd9a7157088f667199b8492851",
+      "size": 382222104
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "33546c2f7947bbfdb46a969123c5329e607c414045cd3645a29aa3cfe023c6ab",
-      "size": 332988384
+      "checksum": "d25564bc5d84ec988a762cfe25fe51cb706b96eaec614f704ddbf653ab08ba00",
+      "size": 386060256
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "223bc058b5aef48138876e28de5d00387e4fd7362a18e733143bf00819c01aab",
-      "size": 334150816
+      "checksum": "d1649bf5261792fee7e1a1b63fdd2197082adec36ce9701aa0c1723bdcd2348a",
+      "size": 384213664
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "645800d24201c93e5fd6f4308e0292bba9a75900693667401cdffb4361f8e616",
-      "size": 322051744
+      "checksum": "9cff8169be24a8b3e59e89e58d9e3d37f3c17ca1b3a149e60666fe53c789d80a",
+      "size": 372111520
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.201",
-      "0.3.202",
-      "0.3.204",
-      "0.3.205",
-      "0.3.206",
-      "0.3.207",
       "0.3.208",
       "0.3.209",
       "0.3.210",
@@ -67,6 +61,8 @@
       "0.3.221",
       "0.3.222",
       "0.3.223",
+      "0.3.224",
+      "0.3.225",
       "0.3.226",
       "0.3.227"
     ],

pkgs/by-name/cl/clboss/package.nix

@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clboss";
-  version = "0.16.2";
+  version = "0.16.3";
 
   # The release tarball includes the pre-generated file `commit_hash.h` that is required for building
   src = fetchzip {
     url = "https://github.com/ZmnSCPxj/clboss/releases/download/v${finalAttrs.version}/clboss-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-I83OH+31oqx2FSjzEIsz7uOko3/MbUqjrZ+xZTXxtto=";
+    hash = "sha256-lniKkyynkyzFBJBRTaPiGTVG9semZDhjpCxjyRDzt/g=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/coreutils/package.nix

@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     # sandbox does not allow setgid
     sed '2i echo Skipping chmod setgid test && exit 77' -i ./tests/chmod/setgid.sh
     substituteInPlace ./tests/install/install-C.sh \
-      --replace 'mode3=2755' 'mode3=1755'
+      --replace-fail 'mode3=2755' 'mode3=1755'
 
     # Fails on systems with a rootfs. Looks like a bug in the test, see
     # https://lists.gnu.org/archive/html/bug-coreutils/2019-12/msg00000.html
@@ -162,6 +162,8 @@ stdenv.mkDerivation (finalAttrs: {
     # TODO(@Ericson2314): Investigate whether Darwin could benefit too
     ++ optional (isCross && stdenv.hostPlatform.libc != "glibc") libiconv;
 
+  strictDeps = true;
+
   hardeningDisable = [ "trivialautovarinit" ];
 
   configureFlags = [
@@ -271,6 +273,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/coreutils/";
     description = "GNU Core Utilities";

pkgs/by-name/co/corteza/package.nix

@@ -4,18 +4,29 @@
   buildGoModule,
   callPackage,
   fetchFromGitHub,
+  fetchpatch,
+  applyPatches,
   lib,
   nixosTests,
   stdenvNoCC,
 }:
 
 let
-  version = "2024.9.2";
-  src = fetchFromGitHub {
-    owner = "cortezaproject";
-    repo = "corteza";
-    tag = version;
-    hash = "sha256-1mekSiRfFSNa/6MSzwRrI3rb9GHABkn3i1b6tX+73fI=";
+  version = "2024.9.9";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "cortezaproject";
+      repo = "corteza";
+      tag = version;
+      hash = "sha256-r6/z5yplkT2d1iEhA4S29C1LcbdEJQiOWr0JRP5Pvb0=";
+    };
+    patches = [
+      # CVE-2026-6093
+      (fetchpatch {
+        url = "https://github.com/cortezaproject/corteza/commit/64b58b9d7324e77248bacd183fb994ff338091ec.patch";
+        hash = "sha256-0Ume1zkksS3kwf6QS6T5lDXklAboZVlTt5ZJReqwu3w=";
+      })
+    ];
   };
   meta = {
     description = "Low-code platform";
@@ -47,13 +58,13 @@ let
     };
 
   webApps = lib.mapAttrs mkWebApp {
-    admin = "sha256-34lfnK2mecvu1Lgg9IM61+fbnqRgZC/Agi7iyugn0fM=";
-    compose = "sha256-1/Fyl6Z27TtZzNBeerKYNs4VhLWEW3wJyr0SCapzc9E=";
-    discovery = "sha256-mL+ibAgVFCRV5AvN0VZc4LCCY8hyaIC8gOlgEdXayuU=";
-    one = "sha256-SuGf72y4PXatZJQgbW5X4mPjtJmQlpwbjfFYCEZElBU=";
-    privacy = "sha256-yHi6pq0OKCh+2reygNL7TvwULCHwxeD8BXVVMjlnpLc=";
-    reporter = "sha256-AWKSzULOTdUZ5wdlTo8dJwVGc7RlYbimR4YF4ZAN1pQ=";
-    workflow = "sha256-cxD2mG4uuO8KT1r2Y4opPlY84Hvqu7cbWh2BSo8CcEc=";
+    admin = "sha256-fen4KxPbYpH0ikWco1w3Zr+4WeghFITdmsOqHMGa3gA=";
+    compose = "sha256-UHhyzCeSWTROgzULYkDKN/2hgZ25aDZ7roHTLkt466o=";
+    discovery = "sha256-GHmALrqLTBie0VTDmZz4zJ9Ls2JYsfV0A3VkRwCKSuQ=";
+    one = "sha256-GHCtouGYrFgghWlBVbF5rD9cXrAfleVVxVqZtuLOSr0=";
+    privacy = "sha256-PlmeAJZY/S+osdM650tpJI3XSOanc80WYuMQ6jsiJwQ=";
+    reporter = "sha256-4O6FEF7Ol4V0FxznKGISaIA0w68XL0E3HvQ8bbt2klE=";
+    workflow = "sha256-2vyx3lCxICtVlRFLPkpy0fzXZ9W4li9ESm9sJzInc8g=";
   };
 
   server-webconsole = callPackage ./buildYarnDistOnly.nix {
@@ -67,8 +78,8 @@ let
   corteza-locale = fetchFromGitHub {
     owner = "cortezaproject";
     repo = "corteza-locale";
-    rev = "64b6d5d562dce642652db55949231abf8b9af4ef";
-    sha256 = "sha256-OKr/M91sEDlTwYBiDXwWkShlfazJBm21G0uU429fjW0=";
+    rev = "57b1f2403207c44055ebce19d95cedd5573f39df";
+    sha256 = "sha256-j+mfWG6tED8AACkUcRWpol2G05qknTxp8b+kwu7c2NA=";
   };
 
   corteza-webapp = stdenvNoCC.mkDerivation (finalAttrs: {
@@ -116,6 +127,7 @@ let
       cp -r ${server-webconsole}/* webconsole/dist/
     ''
     + lib.optionalString withLocales ''
+      chmod -R u+w pkg/locale/src
       cp -r ${corteza-locale}/src/* pkg/locale/src/
     '';
 

pkgs/by-name/cp/cpio/package.nix

@@ -2,7 +2,9 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   autoreconfHook,
+  texinfo,
 
   # for passthru.tests
   git,
@@ -20,7 +22,29 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-k3YQuXwymh7JJoVT+3gAN7z/8Nz/6XJevE/ZwaqQdds=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-66484.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=e2b9cbdd3354d2b1569b7390d1bc15c1930559ad";
+      hash = "sha256-WjphVpMaI/ePg8MTZx+vvilKzpRAAzhAFwCwrbsPLRE=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-66485.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=3cd514031371d8aeeaf2048aa10103e02831aaa9";
+      hash = "sha256-YDlROEYYlZERNzzlx1cQD29gV5IrU01aVcZ/sKpWrRo=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-66486.patch";
+      url = "https://git.savannah.gnu.org/cgit/cpio.git/patch/?id=2ff9600c9ef32e88759843cdbde74c8db5ae9b30";
+      excludes = [ "NEWS" ];
+      hash = "sha256-qi9/9xhKnIyPpji63RgzbnnHZsJgwRnQVMaMiLxQipk=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    texinfo # for makeinfo
+  ];
 
   separateDebugInfo = true;
 

pkgs/by-name/cp/cpp-netlib/0001-Compatibility-with-boost-1.83.patch

@@ -1,33 +0,0 @@
-From 8be99f5972826c25378bccb9fbd7291623c7b2a7 Mon Sep 17 00:00:00 2001
-From: Moraxyc <i@qaq.li>
-Date: Fri, 9 May 2025 13:39:17 +0800
-Subject: [PATCH] Compatibility with boost 1.83
-
----
- boost/network/protocol/http/server/impl/parsers.ipp | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/boost/network/protocol/http/server/impl/parsers.ipp b/boost/network/protocol/http/server/impl/parsers.ipp
-index c31e60e..3272c2f 100755
---- a/boost/network/protocol/http/server/impl/parsers.ipp
-+++ b/boost/network/protocol/http/server/impl/parsers.ipp
-@@ -13,6 +13,7 @@
- #include <tuple>
- #include <boost/fusion/include/std_tuple.hpp>
- #include <boost/network/protocol/http/message/header.hpp>
-+#include <boost/regex/pending/unicode_iterator.hpp>
- 
- #ifdef BOOST_NETWORK_NO_LIB
- #ifndef BOOST_NETWORK_INLINE
-@@ -32,7 +33,7 @@ typedef std::basic_string<uint32_t> u32_string;
- template <>  // <typename Attrib, typename T, typename Enable>
- struct assign_to_container_from_value<std::string, u32_string, void> {
-   static void call(u32_string const& val, std::string& attr) {
--    u32_to_u8_iterator<u32_string::const_iterator> begin = val.begin(),
-+    boost::u32_to_u8_iterator<u32_string::const_iterator> begin = val.begin(),
-                                                    end = val.end();
-     for (; begin != end; ++begin) attr += *begin;
-   }
--- 
-2.48.1
-

pkgs/by-name/cp/cpp-netlib/package.nix

@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  cmake,
-  boost186,
-  openssl,
-  llvmPackages_18,
-}:
-let
-  # std::char_traits has been removed
-  stdenvForCppNetlib = if stdenv.hostPlatform.isDarwin then llvmPackages_18.stdenv else stdenv;
-in
-stdenvForCppNetlib.mkDerivation rec {
-  pname = "cpp-netlib";
-  version = "0.13.0-final";
-
-  src = fetchFromGitHub {
-    owner = "cpp-netlib";
-    repo = "cpp-netlib";
-    tag = "cpp-netlib-${version}";
-    sha256 = "18782sz7aggsl66b4mmi1i0ijwa76iww337fi9sygnplz2hs03a3";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # 'u32_to_u8_iterator' was not declared
-    ./0001-Compatibility-with-boost-1.83.patch
-  ];
-
-  # CMake 2.8 is deprecated and is no longer supported by CMake > 4
-  # https://github.com/NixOS/nixpkgs/issues/445447
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace-fail \
-      "cmake_minimum_required(VERSION 2.8)" \
-      "cmake_minimum_required(VERSION 3.10)"
-  '';
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs = [
-    # io_service.hpp has been removed in boost 1.87+
-    boost186
-    openssl
-  ];
-
-  cmakeFlags = [
-    "-DCPP-NETLIB_BUILD_SHARED_LIBS=ON"
-    # fatal error: 'boost/asio/stream_socket_service.hpp' file not found
-    "-DCPP-NETLIB_BUILD_EXAMPLES=OFF"
-    "-DCPP-NETLIB_BUILD_TESTS=OFF"
-  ];
-
-  # Most tests make network GET requests to various websites
-  doCheck = false;
-
-  meta = {
-    description = "Collection of open-source libraries for high level network programming";
-    homepage = "https://cpp-netlib.org";
-    license = lib.licenses.boost;
-    platforms = lib.platforms.all;
-  };
-}

pkgs/by-name/cr/cri-o-unwrapped/package.nix

@@ -17,13 +17,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cri-o";
-  version = "1.36.3";
+  version = "1.36.4";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AhsSi79HUbNvPoa7duOl9290ZjKss2a6RLvRPHDh6Sg=";
+    hash = "sha256-GgjOY+TE9RcLjy9aSu8Um0Zdzd0juxbTaoT8ljThqws=";
   };
   vendorHash = null;
 

pkgs/by-name/cr/cryptsetup/package.nix

@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cryptsetup";
-  version = "2.8.6";
+  version = "2.8.7";
 
   outputs = [
     "bin"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor finalAttrs.version}/"
       + "cryptsetup-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gAQmX9mTiF0I97Yz2+BWhR3hohAwdhOk693HQ/zO/lo=";
+    hash = "sha256-53bw04HobKYQQsRXBpSR/o4KwoZ4DHw7Hk+ZIavJYdo=";
   };
 
   patches = [

pkgs/by-name/cs/csharp-ls/package.nix

@@ -33,11 +33,5 @@ buildDotnetGlobalTool (finalAttrs: {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ GaetanLepage ];
-    badPlatforms = [
-      # Crashes immediately at runtime
-      # terminated by signal SIGKILL (Forced quit)
-      # https://github.com/razzmatazz/csharp-language-server/issues/211
-      "aarch64-darwin"
-    ];
   };
 })

pkgs/by-name/cu/cunit/package.nix

@@ -19,11 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ libtool ];
 
+  strictDeps = true;
+
   src = fetchurl {
     url = "mirror://sourceforge/cunit/CUnit/${finalAttrs.version}/CUnit-${finalAttrs.version}.tar.bz2";
     sha256 = "057j82da9vv4li4z5ri3227ybd18nzyq81f6gsvhifs5z0vr3cpm";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Unit Testing Framework for C";
 

pkgs/by-name/cu/cups/package.nix

@@ -14,7 +14,6 @@
   systemdLibs,
   acl,
   gmp,
-  darwin,
   libusb1 ? null,
   gnutls ? null,
   avahi ? null,
@@ -40,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     "lib"
     "dev"
     "man"
+    "doc"
   ];
 
   postPatch = ''

pkgs/by-name/cu/curl-impersonate/deps.nix

@@ -1,5 +1,7 @@
 # Generated by update.sh
-{ fetchurl }: {
+{ fetchurl }:
+
+{
   "curl-8_21_0.tar.gz" = fetchurl {
     url = "https://github.com/curl/curl/archive/curl-8_21_0.tar.gz";
     hash = "sha256-7HU6pvQIo8qfDW1fendBeuzRVE2xPAOuXUQ2Er82c2Q=";

pkgs/by-name/cu/curl-impersonate/package.nix

@@ -17,7 +17,7 @@
 }:
 stdenv.mkDerivation rec {
   pname = "curl-impersonate";
-  version = "2.1.0";
+  version = "2.1.1";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     owner = "lexiforest";
     repo = "curl-impersonate";
     tag = "v${version}";
-    hash = "sha256-gN4TD+WxQM2eJofHsOHA/JpH6bQ8CI3VUTPL8NuySn4=";
+    hash = "sha256-AgC66L0z6cYVqePwc7yO1iO9F/6YD6dTqWKCcCrNLzc=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/cu/cutter/package.nix

@@ -32,6 +32,7 @@ let
       cmake
       pkg-config
       python3
+      python3.pkgs.shiboken6-generator
       qt6.wrapQtAppsHook
     ];
 

pkgs/by-name/da/dash/package.nix

@@ -63,6 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "http://gondor.apana.org.au/~herbert/dash/";
     description = "POSIX-compliant implementation of /bin/sh that aims to be as small as possible";

pkgs/by-name/de/dejagnu/package.nix

@@ -2,6 +2,7 @@
   fetchurl,
   lib,
   stdenv,
+  bashNonInteractive,
   expect,
   makeWrapper,
   updateAutotoolsGnuConfigScriptsHook,
@@ -13,14 +14,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/dejagnu/dejagnu-${finalAttrs.version}.tar.gz";
-    sha256 = "1qx2cv6qkxbiqg87jh217jb62hk3s7dmcs4cz1llm2wmsynfznl7";
+    hash = "sha256-h9rvrNeVi0pp+IxoVtvRY0JhljxBQHnQw3H1ic1mouM=";
   };
 
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
     makeWrapper
   ];
-  buildInputs = [ expect ];
+  buildInputs = [
+    bashNonInteractive
+    expect
+  ];
+
+  strictDeps = true;
 
   # dejagnu-1.6.3 can't successfully run tests in source tree:
   #   https://wiki.linuxfromscratch.org/lfs/ticket/4871
@@ -53,6 +59,8 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${expect}/bin/expect $out/bin/expect
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Framework for testing other programs";
 

pkgs/by-name/di/diffutils/package.nix

@@ -12,12 +12,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "diffutils";
   version = "3.12";
 
   src = fetchurl {
-    url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
+    url = "mirror://gnu/diffutils/diffutils-${finalAttrs.version}.tar.xz";
     hash = "sha256-fIt/n8hgkUH96pzs6FJJ0whiQ5H/Yd7a9Sj8szdyff0=";
   };
 
@@ -42,6 +42,8 @@ stdenv.mkDerivation rec {
   # If no explicit coreutils is given, use the one from stdenv.
   buildInputs = [ coreutils ];
 
+  strictDeps = true;
+
   # Disable stack-related gnulib tests on x86_64-darwin because they have problems running under
   # Rosetta 2: test-c-stack hangs, test-sigsegv-catch-stackoverflow and test-sigaction fail.
   # Disable all gnulib tests when building on Darwin due to test-nl_langinfo-mt failure
@@ -78,6 +80,8 @@ stdenv.mkDerivation rec {
   # Test failure on QEMU only (#300550)
   doCheck = !stdenv.buildPlatform.isRiscV64;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/diffutils/diffutils.html";
     description = "Commands for showing the differences between files (diff, cmp, etc.)";
@@ -88,4 +92,4 @@ stdenv.mkDerivation rec {
       helsinki-Jo
     ];
   };
-}
+})

pkgs/by-name/dn/dns-root-data/package.nix

@@ -27,6 +27,9 @@ stdenv.mkDerivation {
     cp ${./root.ds} $out/root.ds
   '';
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.iana.org/domains/root/files";
     description = "DNS root data including root hints and DNSSEC root trust anchor + key";

pkgs/by-name/du/duckdb/package.nix

@@ -5,15 +5,33 @@
   cmake,
   ninja,
   openssl,
-  openjdk11,
   python3,
-  unixodbc,
-  withJdbc ? false,
-  withOdbc ? false,
   versionCheckHook,
 }:
 
 let
+  canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  # Keep this in sync with DuckDBPlatform() in DuckDB's platform.hpp.
+  duckdbPlatform =
+    let
+      os =
+        if stdenv.hostPlatform.isWindows then
+          "windows"
+        else if stdenv.hostPlatform.isDarwin then
+          "osx"
+        else if stdenv.hostPlatform.isFreeBSD then
+          "freebsd"
+        else
+          "linux";
+      arch =
+        if stdenv.hostPlatform.isAarch64 then
+          "arm64"
+        else if stdenv.hostPlatform.is64bit then
+          "amd64"
+        else
+          "i686";
+    in
+    "${os}_${arch}${lib.optionalString stdenv.hostPlatform.isMusl "_musl"}${lib.optionalString stdenv.hostPlatform.isMinGW "_mingw"}";
   versions = lib.importJSON ./versions.json;
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -40,22 +58,19 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     python3
   ];
-  buildInputs = [
-    openssl
-  ]
-  ++ lib.optionals withJdbc [ openjdk11 ]
-  ++ lib.optionals withOdbc [ unixodbc ];
+  buildInputs = [ openssl ];
 
   cmakeFlags = [
     (lib.cmakeFeature "DUCKDB_EXTENSION_CONFIGS" "${finalAttrs.src}/.github/config/in_tree_extensions.cmake")
-    (lib.cmakeBool "BUILD_ODBC_DRIVER" withOdbc)
-    (lib.cmakeBool "JDBC_DRIVER" withJdbc)
     (lib.cmakeFeature "OVERRIDE_GIT_DESCRIBE" "v${finalAttrs.version}-0-g${finalAttrs.rev}")
     # development settings
-    (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.doInstallCheck)
+    (lib.cmakeBool "BUILD_UNITTESTS" finalAttrs.finalPackage.doInstallCheck)
+  ]
+  ++ lib.optionals (!canExecute) [
+    (lib.cmakeFeature "DUCKDB_EXPLICIT_PLATFORM" duckdbPlatform)
   ];
 
-  doInstallCheck = true;
+  doInstallCheck = canExecute;
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/ed/ed/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ed";
-  version = "1.22.5";
+  version = "1.22.6";
 
   src = fetchurl {
     url = "mirror://gnu/ed/ed-${finalAttrs.version}.tar.lz";
-    hash = "sha256-VuEH3cLyna1mkDdsFb+XUVCeHuO4JBcQ5E7b5cOhWMw=";
+    hash = "sha256-PzOyITUhnDnDxpX3txccJWfT4qF8eYwKkGBzIMuyaPI=";
   };
 
   nativeBuildInputs = [ lzip ];
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/ed/";
     description = "GNU implementation of the standard Unix editor";

pkgs/by-name/ei/eigen/package.nix

@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     ctestCheckHook
   ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "EIGEN_LEAVE_TEST_IN_ALL_TARGET" true) # Build tests in parallel
   ];
@@ -47,6 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
   # too many flaky tests
   doCheck = false;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://eigen.tuxfamily.org";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";

pkgs/by-name/el/elfutils/package.nix

@@ -113,6 +113,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedNativeBuildInputs = [ setupDebugInfoDirs ];
 
+  strictDeps = true;
+
   hardeningDisable = [ "strictflexarrays3" ];
 
   configureFlags = [
@@ -144,6 +146,8 @@ stdenv.mkDerivation (finalAttrs: {
     rev-prefix = "elfutils-";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://sourceware.org/elfutils/";
     description = "Set of utilities to handle ELF objects";

pkgs/by-name/ex/expand-response-params/package.nix

@@ -26,6 +26,8 @@ stdenv.mkDerivation {
     mv expand-response-params${stdenv.hostPlatform.extensions.executable} $prefix/bin/
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Internal tool used by the nixpkgs wrapper scripts for processing response files";
     longDescription = ''

pkgs/by-name/ex/expat/package.nix

@@ -23,13 +23,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "expat";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tagFor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-OtibhYjmZEvU5JmBSA1IshKJ7rvNTwoaSvscKfmbarQ=";
+    hash = "sha256-9iVt+QyQZ3PTRNoIRAK30+TyLtQbGlnJiQmKg9PqDIU=";
   };
 
   strictDeps = true;
@@ -72,6 +72,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/libexpat/libexpat/blob/${tagFor finalAttrs.version}/expat/Changes";
     homepage = "https://libexpat.github.io/";

pkgs/by-name/ex/extism-js-core/package.nix

@@ -49,11 +49,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     wasm-opt --enable-reference-types --enable-bulk-memory --strip -O3 $out/bin/js_pdk_core.wasm -o $out/bin/js_pdk_core.wasm
   '';
 
+  depsBuildBuild = [
+    nodejs
+    npmHooks.npmConfigHook
+  ];
+
   nativeBuildInputs = [
     binaryen
     lld
-    nodejs
-    npmHooks.npmConfigHook
     rustPlatform.bindgenHook
   ];
 

pkgs/by-name/fo/fortify-headers/package.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation (finalAttrs: {
     ./restore-macros.patch
   ];
 
+  strictDeps = true;
+
   dontBuild = true;
 
   installPhase = ''
@@ -36,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
     url = "git://git.2f30.org/fortify-headers";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Standalone header-based fortify-source implementation";
     homepage = "https://git.2f30.org/fortify-headers";

pkgs/by-name/gb/gbenchmark/package.nix

@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeCheckInputs = lib.optionals (glibcLocales != null) [ glibcLocales ];
 
+  strictDeps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "BENCHMARK_USE_BUNDLED_GTEST" false)
     (lib.cmakeBool "BENCHMARK_ENABLE_WERROR" false)
@@ -73,6 +75,8 @@ stdenv.mkDerivation (finalAttrs: {
     inherit prometheus-cpp;
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Microbenchmark support library";
     homepage = "https://github.com/google/benchmark";

pkgs/by-name/gd/gdbm/package.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
 
+  strictDeps = true;
+
   hardeningDisable = [ "strictflexarrays3" ];
 
   configureFlags = [ (lib.enableFeature true "libgdbm-compat") ];
@@ -63,6 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/gdbm/";
     description = "GNU dbm key/value database library";

pkgs/by-name/ge/geoclue2/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geoclue";
-  version = "2.8.1";
+  version = "2.8.2";
 
   outputs = [
     "out"
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "geoclue";
     repo = "geoclue";
     tag = finalAttrs.version;
-    hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg=";
+    hash = "sha256-fjF0yd3+b+q3gTW2PpPNFE6zQafilj/g9rXWSgs/XGE=";
   };
 
   patches = [

pkgs/by-name/ge/getopt/package.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation (finalAttrs: {
   # attempt to use C library functions without declaring them, which is raised as an error.
   env.NIX_CFLAGS_COMPILE = "-D__GNU_LIBRARY__";
 
+  strictDeps = true;
+
   makeFlags = [
     "WITHOUT_GETTEXT=1"
     "LIBCGETOPT=0"
@@ -23,6 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
     "CC:=$(CC)"
   ];
 
+  __structuredAttrs = true;
+
   meta = {
     platforms = lib.platforms.unix;
     homepage = "https://frodo.looijaard.name/project/getopt";

pkgs/by-name/gh/ghostfolio/package.nix

@@ -12,13 +12,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "ghostfolio";
-  version = "3.50.0";
+  version = "3.59.1";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = finalAttrs.version;
-    hash = "sha256-jW/qcLIAVNcLlg9NqPcH2QeTouFZEzUHy4qqOzZ3h/8=";
+    hash = "sha256-Wf5uxU4lLB/Xw8SoZKFyyZulmpQCKKIIonDmyUlDyHs=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: {
     '';
   };
 
-  npmDepsHash = "sha256-wi8NfGBCiCbGUdVGWrX4XMRLUyLoBnur/v8og6RufKU=";
+  npmDepsHash = "sha256-pUE/zXM+q9RcV9pEMBMAhGUMB6Exn3ZWCbvFggzz0N8=";
 
   postPatch = ''
     substituteInPlace replace.build.mjs \

pkgs/by-name/gi/git/package.nix

@@ -133,6 +133,12 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://lore.kernel.org/git/20260504101429.340123-1-joerg@thalheim.io/raw";
       hash = "sha256-44EPfEJ39LjPWjqjFb52EKNaJGzYxZzJaJOis8QnazU=";
     })
+    # Fix fortify darwin crashes when dealing with unicode filenames.
+    (fetchurl {
+      name = "darwin-unicode-filename-fix.patch";
+      url = "https://lore.kernel.org/git/20260704233724.16928-1-ihar.hrachyshka@gmail.com/raw";
+      hash = "sha256-lpGz3nFKQvFDtW2TtQLx/684ECJVBLGPGqip0XEtOdU=";
+    })
   ]
   ++ lib.optionals withSsh [
     # Hard-code the ssh executable to ${pkgs.openssh}/bin/ssh instead of
@@ -207,6 +213,8 @@ stdenv.mkDerivation (finalAttrs: {
     buildPackages.stdenv.cc
   ];
 
+  strictDeps = true;
+
   env = {
     # required to support pthread_cancel()
     NIX_LDFLAGS =
@@ -228,7 +236,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   preBuild = ''
-    makeFlagsArray+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
+    makeFlags+=( perllibdir=$out/$(perl -MConfig -wle 'print substr $Config{installsitelib}, 1 + length $Config{siteprefixexp}') )
   '';
 
   makeFlags = [
@@ -274,7 +282,7 @@ stdenv.mkDerivation (finalAttrs: {
         ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}}
         SHELL="$SHELL"
     )
-    concatTo flagsArray makeFlags makeFlagsArray buildFlags buildFlagsArray
+    concatTo flagsArray makeFlags buildFlags
     echoCmd 'build flags' "''${flagsArray[@]}"
   ''
   + lib.optionalString withManual ''
@@ -335,7 +343,7 @@ stdenv.mkDerivation (finalAttrs: {
         ''${enableParallelInstalling:+-j''${NIX_BUILD_CORES}}
         SHELL="$SHELL"
     )
-    concatTo flagsArray makeFlags makeFlagsArray installFlags installFlagsArray
+    concatTo flagsArray makeFlags installFlags
     echoCmd 'install flags' "''${flagsArray[@]}"
 
     # Install git-subtree.
@@ -478,7 +486,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   installCheckTarget = "test";
 
-  # see also installCheckFlagsArray
+  # see also installCheckFlags in preInstallCheck
   installCheckFlags = [
     "DEFAULT_TEST_TARGET=prove"
     "PERL_PATH=${buildPackages.perl}/bin/perl"
@@ -502,7 +510,7 @@ stdenv.mkDerivation (finalAttrs: {
       NIX_BUILD_CORES=32
     fi
 
-    installCheckFlagsArray+=(
+    installCheckFlags+=(
       GIT_PROVE_OPTS="--jobs $NIX_BUILD_CORES --failures --state=failed,save"
       GIT_TEST_INSTALLED=$out/bin
       ${lib.optionalString (!svnSupport) "NO_SVN_TESTS=y"}

pkgs/by-name/gl/glib/package.nix

@@ -366,6 +366,8 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
+  __structuredAttrs = true;
+
   meta = {
     description = "C library of programming buildings blocks";
     homepage = "https://gitlab.gnome.org/GNOME/glib";

pkgs/by-name/gn/gnu-config/package.nix

@@ -67,6 +67,8 @@ stdenv.mkDerivation {
 
   strictDeps = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Attempt to guess a canonical system name";
     homepage = "https://savannah.gnu.org/projects/config";

pkgs/by-name/gn/gnugrep/package.nix

@@ -15,16 +15,12 @@
 # cgit) that are needed here should be included directly in Nixpkgs as
 # files.
 
-let
-  version = "3.12";
-in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnugrep";
-  inherit version;
+  version = "3.12";
 
   src = fetchurl {
-    url = "mirror://gnu/grep/grep-${version}.tar.xz";
+    url = "mirror://gnu/grep/grep-${finalAttrs.version}.tar.xz";
     hash = "sha256-JkmyfA6Q5jLq3NdXvgbG6aT0jZQd5R58D4P/dkCKB7k=";
   };
 
@@ -39,13 +35,9 @@ stdenv.mkDerivation {
   # - on Musl: https://github.com/NixOS/nixpkgs/pull/228714
   # - on x86_64-darwin: https://github.com/NixOS/nixpkgs/pull/228714#issuecomment-1576826330
   # - when building on Darwin (cross-compilation): test-nl_langinfo-mt fails
-  postPatch =
-    if stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin then
-      ''
-        sed -i 's:gnulib-tests::g' Makefile.in
-      ''
-    else
-      null;
+  postPatch = lib.optionalString (stdenv.hostPlatform.isMusl || stdenv.buildPlatform.isDarwin) ''
+    substituteInPlace Makefile.in --replace-fail "gnulib-tests" ""
+  '';
 
   nativeCheckInputs = [
     perl
@@ -63,6 +55,8 @@ stdenv.mkDerivation {
   ]
   ++ lib.optional (!stdenv.hostPlatform.isWindows) runtimeShellPackage;
 
+  strictDeps = true;
+
   # cygwin: FAIL: multibyte-white-space
   # freebsd: FAIL mb-non-UTF8-performance
   # x86_64-darwin: fails 'stack-overflow' tests on Rosetta 2 emulator
@@ -97,6 +91,8 @@ stdenv.mkDerivation {
     NIX_CFLAGS_COMPILE = "-Wno-error=format-security";
   };
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/grep/";
     description = "GNU implementation of the Unix grep command";
@@ -116,7 +112,7 @@ stdenv.mkDerivation {
     teams = [ lib.teams.security-review ];
     platforms = lib.platforms.all;
     mainProgram = "grep";
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version // {
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version // {
       product = "grep";
     };
   };
@@ -124,4 +120,4 @@ stdenv.mkDerivation {
   passthru = {
     inherit pcre2;
   };
-}
+})