[release-25.05] treewide: fix rec-set-dynamic-attrs (#480803)

This is a backport of `#479126`.

Not-cherry-picked-because: there was more packages to fix then in 25.11 and master.

> Lix will soon warn, and in the future, error on `rec-set-dynamic-attrs`.
> This commit fix where attrs are dynamically set in a recursive function
> currently present in nixpkgs.

lib/default.nix

@@ -119,7 +119,7 @@ let
         const
         pipe
         concat
-        or
+        "or"
         and
         xor
         bitAnd

lib/options.nix

@@ -436,7 +436,7 @@ rec {
     else if all isAttrs list then
       foldl' lib.mergeAttrs { } list
     else if all isBool list then
-      foldl' lib.or false list
+      foldl' lib."or" false list
     else if all isString list then
       lib.concatStrings list
     else if all isInt list && all (x: x == head list) list then

lib/trivial.nix

@@ -180,7 +180,7 @@ in
 
     : 2\. Function argument
   */
-  or = x: y: x || y;
+  "or" = x: y: x || y;
 
   /**
     boolean “and”

pkgs/applications/editors/sublime/4/common.nix

@@ -142,15 +142,13 @@ stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  ${primaryBinary} = binaryPackage;
-
   nativeBuildInputs = [
     makeWrapper
   ];
 
   installPhase = ''
     mkdir -p "$out/bin"
-    makeWrapper "''$${primaryBinary}/${primaryBinary}" "$out/bin/${primaryBinary}"
+    makeWrapper "${binaryPackage}/${primaryBinary}" "$out/bin/${primaryBinary}"
   ''
   + builtins.concatStringsSep "" (
     map (binaryAlias: "ln -s $out/bin/${primaryBinary} $out/bin/${binaryAlias}\n") primaryBinaryAliases
@@ -159,18 +157,20 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share/applications"
 
     substitute \
-      "''$${primaryBinary}/${primaryBinary}.desktop" \
+      "${binaryPackage}/${primaryBinary}.desktop" \
       "$out/share/applications/${primaryBinary}.desktop" \
       --replace-fail "/opt/${primaryBinary}/${primaryBinary}" "${primaryBinary}"
 
-    for directory in ''$${primaryBinary}/Icon/*; do
+    for directory in ${binaryPackage}/Icon/*; do
       size=$(basename $directory)
       mkdir -p "$out/share/icons/hicolor/$size/apps"
-      ln -s ''$${primaryBinary}/Icon/$size/* $out/share/icons/hicolor/$size/apps
+      ln -s ${binaryPackage}/Icon/$size/* $out/share/icons/hicolor/$size/apps
     done
   '';
 
   passthru = {
+    unwrapped = binaryPackage;
+
     updateScript =
       let
         script = writeShellScript "${packageAttribute}-update-script" ''
@@ -191,7 +191,7 @@ stdenv.mkDerivation rec {
           fi
 
           for platform in ${lib.escapeShellArgs meta.platforms}; do
-              update-source-version "${packageAttribute}.${primaryBinary}" "$latestVersion" --ignore-same-version --file="$versionFile" --version-key=buildVersion --source-key="sources.$platform"
+              update-source-version "${packageAttribute}".unwrapped "$latestVersion" --ignore-same-version --file="$versionFile" --version-key=buildVersion --source-key="sources.$platform"
           done
         '';
       in

pkgs/applications/graphics/ImageMagick/default.nix

@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-10";
+  version = "7.1.2-8";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-96lhd0B4yV2s/zVazKrqAcDZvn+yIiXxp8fqyKSfxLc=";
+    hash = "sha256-2jSQ59Wi6/1dbS/AgM1DfW6WlwoYuJlnTLoM8Mc6Ji8=";
   };
 
   outputs = [

pkgs/applications/version-management/sublime-merge/common.nix

@@ -144,8 +144,6 @@ stdenv.mkDerivation rec {
 
   dontUnpack = true;
 
-  ${primaryBinary} = binaryPackage;
-
   nativeBuildInputs = [
     makeWrapper
   ];
@@ -153,7 +151,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     mkdir -p "$out/bin"
-    makeWrapper "''$${primaryBinary}/${primaryBinary}" "$out/bin/${primaryBinary}"
+    makeWrapper "${binaryPackage}/${primaryBinary}" "$out/bin/${primaryBinary}"
   ''
   + builtins.concatStringsSep "" (
     map (binaryAlias: "ln -s $out/bin/${primaryBinary} $out/bin/${binaryAlias}\n") primaryBinaryAliases
@@ -162,19 +160,21 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/share/applications"
 
     substitute \
-      "''$${primaryBinary}/${primaryBinary}.desktop" \
+      "${binaryPackage}/${primaryBinary}.desktop" \
       "$out/share/applications/${primaryBinary}.desktop" \
       --replace-fail "/opt/${primaryBinary}/${primaryBinary}" "${primaryBinary}"
 
-    for directory in ''$${primaryBinary}/Icon/*; do
+    for directory in ${binaryPackage}/Icon/*; do
       size=$(basename $directory)
       mkdir -p "$out/share/icons/hicolor/$size/apps"
-      ln -s ''$${primaryBinary}/Icon/$size/* $out/share/icons/hicolor/$size/apps
+      ln -s ${binaryPackage}/Icon/$size/* $out/share/icons/hicolor/$size/apps
     done
     runHook postInstall
   '';
 
   passthru = {
+    unwrapped = binaryPackage;
+
     updateScript =
       let
         script = writeShellScript "${packageAttribute}-update-script" ''
@@ -196,7 +196,7 @@ stdenv.mkDerivation rec {
           fi
 
           for platform in ${lib.escapeShellArgs meta.platforms}; do
-              update-source-version "${packageAttribute}.${primaryBinary}" "$latestVersion" --ignore-same-version --file="$versionFile" --version-key=buildVersion --source-key="sources.$platform"
+              update-source-version "${packageAttribute}".unwrapped "$latestVersion" --ignore-same-version --file="$versionFile" --version-key=buildVersion --source-key="sources.$platform"
           done
         '';
       in

pkgs/by-name/cu/cups/package.nix

@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cups";
-  version = "2.4.15";
+  version = "2.4.14";
 
   src = fetchurl {
     url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    hash = "sha256-7/C71I/xq8u45G4o6Frvr/o5Gh2cTY3JKrOCKhMAjX8=";
+    hash = "sha256-ZgKIAg3W95yveZgRxMGjIHpIaJiZrCCTlZ1wo73Ldpk=";
   };
 
   outputs = [

pkgs/by-name/fs/fstar/z3/default.nix

@@ -98,11 +98,9 @@ stdenvNoCC.mkDerivation {
     ln -s ${lib.getExe fstarOldZ3} $out/bin/z3-${lib.escapeShellArg fstarOldZ3.version}
   '';
 
-  passthru = rec {
-    new = fstarNewZ3;
-    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarNewZ3.version}" = new;
+  passthru = {
+    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarNewZ3.version}" = fstarNewZ3;
 
-    old = fstarOldZ3;
-    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarOldZ3.version}" = old;
+    "z3_${lib.replaceStrings [ "." ] [ "_" ] fstarOldZ3.version}" = fstarOldZ3;
   };
 }

pkgs/by-name/un/unbound/package.nix

@@ -56,13 +56,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.24.2";
+  version = "1.24.1";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-kyTcDmNGKJuOMZ7cxIWh6o7aasRUoAB4M0tIG81BQsE=";
+    hash = "sha256-meWgu1UGhR9d8wVb8guqbnGE3UHs6uJHR20iDFnIThQ=";
   };
 
   outputs = [

pkgs/development/ada-modules/gnatcoll/db.nix

@@ -49,19 +49,19 @@ let
   ];
 in
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
+  version = "25.0.0";
   # executables don't adhere to the string gnatcoll-* scheme
   pname =
     if onlyExecutable then
       builtins.replaceStrings [ "_" ] [ "-" ] component
     else
       "gnatcoll-${component}";
-  version = "25.0.0";
 
   src = fetchFromGitHub {
     owner = "AdaCore";
     repo = "gnatcoll-db";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "0q35ii0aa4hh59v768l5cilg1b30a4ckcvlbfy0lkcbp3rcfnbz3";
   };
 
@@ -108,4 +108,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.sternenseemann ];
     platforms = platforms.all;
   };
-}
+})

pkgs/development/compilers/dotnet/packages.nix

@@ -32,6 +32,9 @@ let
       )
     );
   inherit (vmr) targetRid releaseManifest;
+  sdkVersion = releaseManifest.sdkVersion;
+  runtimeVersion = releaseManifest.runtimeVersion;
+  aspnetcoreVersion = releaseManifest.aspNetCoreVersion or releaseManifest.runtimeVersion;
 
   # TODO: do this properly
   hostRid = targetRid;
@@ -114,9 +117,9 @@ let
     ];
   };
 
-  sdk = mkCommon "sdk" rec {
+  sdk = mkCommon "sdk" {
     pname = "${baseName}-sdk";
-    version = releaseManifest.sdkVersion;
+    version = sdkVersion;
 
     src = vmr;
     dontUnpack = true;
@@ -136,7 +139,7 @@ let
       runHook preInstall
 
       mkdir -p "$out"/share
-      cp -r "$src"/dotnet-sdk-${version}-${targetRid} "$out"/share/dotnet
+      cp -r "$src"/lib/dotnet-sdk-${sdkVersion}-${targetRid} "$out"/share/dotnet
       chmod +w "$out"/share/dotnet
       mkdir "$out"/bin
       ln -s "$out"/share/dotnet/dotnet "$out"/bin/dotnet
@@ -158,10 +161,16 @@ let
       runHook postInstall
     '';
 
-    ${if stdenvNoCC.isDarwin && lib.versionAtLeast version "10" then "postInstall" else null} = ''
-      mkdir -p "$out"/nix-support
-      cp "$src"/nix-support/manual-sdk-deps "$out"/nix-support/manual-sdk-deps
-    '';
+    ${
+      if stdenvNoCC.hostPlatform.isDarwin && lib.versionAtLeast sdkVersion "10" then
+        "postInstall"
+      else
+        null
+    } =
+      ''
+        mkdir -p "$out"/nix-support
+        cp "$src"/nix-support/manual-sdk-deps "$out"/nix-support/manual-sdk-deps
+      '';
 
     passthru = {
       inherit (vmr) icu targetRid hasILCompiler;
@@ -179,9 +188,9 @@ let
     };
   };
 
-  runtime = mkCommon "runtime" rec {
+  runtime = mkCommon "runtime" {
     pname = "${baseName}-runtime";
-    version = releaseManifest.runtimeVersion;
+    version = runtimeVersion;
 
     src = vmr;
     dontUnpack = true;
@@ -190,7 +199,7 @@ let
       runHook preInstall
 
       mkdir -p "$out"/share
-      cp -r "$src/dotnet-runtime-${version}-${targetRid}" "$out"/share/dotnet
+      cp -r "$src/lib/dotnet-runtime-${runtimeVersion}-${targetRid}" "$out"/share/dotnet
       chmod +w "$out"/share/dotnet
       mkdir "$out"/bin
       ln -s "$out"/share/dotnet/dotnet "$out"/bin/dotnet
@@ -207,9 +216,9 @@ let
     };
   };
 
-  aspnetcore = mkCommon "aspnetcore" rec {
+  aspnetcore = mkCommon "aspnetcore" {
     pname = "${baseName}-aspnetcore-runtime";
-    version = releaseManifest.aspNetCoreVersion or releaseManifest.runtimeVersion;
+    version = aspnetcoreVersion;
 
     src = vmr;
     dontUnpack = true;
@@ -223,7 +232,7 @@ let
       mkdir "$out"/bin
       ln -s "$out"/share/dotnet/dotnet "$out"/bin/dotnet
 
-      cp -Tr "$src/aspnetcore-runtime-${version}-${targetRid}"/shared/Microsoft.AspNetCore.App "$out"/share/dotnet/shared/Microsoft.AspNetCore.App
+      cp -Tr "$src/lib/aspnetcore-runtime-${aspnetcoreVersion}-${targetRid}"/shared/Microsoft.AspNetCore.App "$out"/share/dotnet/shared/Microsoft.AspNetCore.App
       chmod +w "$out"/share/dotnet/shared
 
       runHook postInstall

pkgs/development/compilers/dotnet/vmr.nix

@@ -59,10 +59,11 @@ let
 
   _icu = if isDarwin then darwin.ICU else icu;
 
-in
-stdenv.mkDerivation rec {
-  pname = "${baseName}-vmr";
   version = release;
+in
+stdenv.mkDerivation {
+  pname = "${baseName}-vmr";
+  inherit version;
 
   # TODO: fix this in the binary sdk packages
   preHook = lib.optionalString stdenv.hostPlatform.isDarwin ''

pkgs/development/compilers/ghc/8.6.5-binary.nix

@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
 
   # Cannot patchelf beforehand due to relative RPATHs that anticipate
   # the final install location/
-  ${libEnvVar} = libPath;
+  env.${libEnvVar} = libPath;
 
   postUnpack =
     # GHC has dtrace probes, which causes ld to try to open /usr/lib/libdtrace.dylib

pkgs/development/compilers/go/1.24.nix

@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.24.11";
+  version = "1.24.10";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-/9+XdmpMSxNc1TgJcTl46e4alDssjiitIhpUKd4w4hA=";
+    hash = "sha256-NAANzEelF7ePzyZX7n0DMyilcHn+YMTti3uEJg0dGdM=";
   };
 
   strictDeps = true;

pkgs/development/python-modules/django/4.nix

@@ -45,7 +45,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "4.2.27";
+  version = "4.2.26";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -54,7 +54,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-vdY85Ib2knRFLPmZZ6ojiD5R9diuvpVut1+nOVXSp0Y=";
+    hash = "sha256-2NkkQcsY+BDvLGtvjYfGwgAK2S6LDbbcl7CwbwuF5a0=";
   };
 
   patches = [

pkgs/development/python-modules/filelock/default.nix

@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  fetchpatch,
   hatch-vcs,
   hatchling,
   pytest-asyncio,
@@ -23,15 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-rbyI6ruZ0v7IycGyKbFx8Yr6ZVQAFz3cZT1dAVAfufI=";
   };
 
-  patches = [
-    # Fix TOCTOU symlink vulnerability in lock file creation
-    # https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
-    (fetchpatch {
-      url = "https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e.patch";
-      hash = "sha256-oVXkAiIFCwXpAHkhJC1kFOMBOuXL3KZJVfYLqt24IzQ=";
-    })
-  ];
-
   build-system = [
     hatch-vcs
     hatchling

pkgs/development/python-modules/xmltodict/default.nix

@@ -1,21 +1,22 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
   pytestCheckHook,
+  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "xmltodict";
-  version = "1.0.2";
+  version = "0.14.2";
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "martinblech";
-    repo = "xmltodict";
-    tag = "v${version}";
-    hash = "sha256-gnTNkh0GLfRmjMsLhfvpNrewfinNOhem0i3wzIZvKpA=";
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-IB58KLshDjdJmdHd5jgpI6sO0ail+u7OSKtSW3gQpVM=";
   };
 
   build-system = [ setuptools ];
@@ -24,11 +25,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "xmltodict" ];
 
-  meta = {
+  meta = with lib; {
     description = "Makes working with XML feel like you are working with JSON";
     homepage = "https://github.com/martinblech/xmltodict";
-    changelog = "https://github.com/martinblech/xmltodict/blob/${src.tag}/CHANGELOG.md";
-    license = lib.licenses.mit;
+    changelog = "https://github.com/martinblech/xmltodict/blob/v${version}/CHANGELOG.md";
+    license = licenses.mit;
     maintainers = [ ];
   };
 }