Merge staging-next into staging

https://github.com/ruby/ruby/releases/tag/v3_4_11

doc/hooks/guileImportsCheckHook.section.md

@@ -0,0 +1,28 @@
+# `guileImportsCheckHook` {#guileImportsCheckHook}
+
+This hook checks if a guile package can be imported. The hook is automatically
+propagated by `guile`, so using it is as simple as:
+
+```nix
+{
+  lib,
+  stdenv,
+  guile,
+  # ...
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  # ...
+
+  nativeBuildInputs = [ guile ];
+
+  guileImportsCheck = [
+    "package"
+  ];
+
+  # ...
+})
+```
+
+The `guileImportsCheckHook` package can also included manually in
+`nativeBuildInputs` if one desires.

doc/hooks/meson.section.md

@@ -92,3 +92,10 @@ Meson setup hook.
 - `prefixKey`
 - `enableParallelBuilding`
 - `enableParallelChecking`
+- `disabledTests`
+
+#### `disabledTests` {#meson-disabled-tests}
+
+Specifies a list of tests to skip in `mesonCheckPhase`.
+You can optionally specify a subproject using a colon prefix, e.g. `subproject:test_name`.
+Meson will pick up the main project name as a default if no subproject is specified.

doc/nav.json

@@ -364,6 +364,9 @@
                 {
                   "file": "hooks/gnome.section.md"
                 },
+                {
+                  "file": "hooks/guileImportsCheckHook.section.md"
+                },
                 {
                   "file": "hooks/haredo.section.md"
                 },

doc/redirects.json

@@ -164,6 +164,9 @@
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
+  "guileImportsCheckHook": [
+    "index.html#guileImportsCheckHook"
+  ],
   "how-channels-work": [
     "index.html#how-channels-work"
   ],
@@ -2981,6 +2984,9 @@
   "meson-honored-variables": [
     "index.html#meson-honored-variables"
   ],
+  "meson-disabled-tests": [
+    "index.html#meson-disabled-tests"
+  ],
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],

nixos/modules/security/wrappers/default.nix

@@ -361,19 +361,16 @@ in
 
     ###### wrappers consistency checks
     system.checks = lib.singleton (
-      pkgs.runCommandLocal "ensure-wrapper-integrity"
+      pkgs.runCommandLocal "ensure-all-wrappers-paths-exist"
         {
-          nativeBuildInputs = [
-            pkgs.libcap-text-verifier
-            pkgs.file
-          ];
+          nativeBuildInputs = [ pkgs.libcap-text-verifier ];
           preferLocalBuild = true;
         }
         ''
           # make sure we produce output
           mkdir -p $out
 
-          echo -n "Checking that Nix store paths of all wrapped programs exist and are ELF executables... "
+          echo -n "Checking that Nix store paths of all wrapped programs exist... "
           ${lib.toShellVar "wrappers" (lib.mapAttrs (n: v: v.source) wrappers)}
           for name in "''${!wrappers[@]}"; do
             path="''${wrappers[$name]}"
@@ -385,15 +382,6 @@ in
               test -t 1 && echo -ne '\033[0m'
               exit 1
             fi
-            magic=$(file --mime --brief --dereference "$path")
-            if ! [[ "$magic" =~ application/x-executable || "$magic" =~ application/x-pie-executable ]]; then
-              test -t 1 && echo -ne '\033[1;31m'
-              echo "FAIL"
-              echo "The target executable $path is not an ELF! This is a security risk."
-              echo "Script wrappers (e.g. bash or python) are commonly susceptible to dangerous env var injections."
-              test -t 1 && echo -ne '\033[0m'
-              exit 1
-            fi
           done
           echo "OK"
 

nixos/modules/services/networking/rpcbind.nix

@@ -5,6 +5,8 @@
   ...
 }:
 
+with lib;
+
 {
 
   ###### interface
@@ -13,8 +15,8 @@
 
     services.rpcbind = {
 
-      enable = lib.mkOption {
-        type = lib.types.bool;
+      enable = mkOption {
+        type = types.bool;
         default = false;
         description = ''
           Whether to enable `rpcbind`, an ONC RPC directory service
@@ -30,34 +32,29 @@
 
   ###### implementation
 
-  config = lib.mkMerge [
-    (lib.mkIf config.services.rpcbind.enable {
-      environment.systemPackages = [ pkgs.rpcbind ];
+  config = mkIf config.services.rpcbind.enable {
+    environment.systemPackages = [ pkgs.rpcbind ];
 
-      systemd.packages = [ pkgs.rpcbind ];
+    systemd.packages = [ pkgs.rpcbind ];
 
-      systemd.services.rpcbind = {
-        wantedBy = [ "multi-user.target" ];
-        # rpcbind performs a check for /var/run/rpcbind.lock at startup
-        # and will crash if /var/run isn't present. In the stock NixOS
-        # var.conf tmpfiles configuration file, /var/run is symlinked to
-        # /run, so rpcbind can enter a race condition in which /var/run
-        # isn't symlinked yet but tries to interact with the path, so
-        # controlling the order explicitly here ensures that rpcbind can
-        # start successfully. The `wants` instead of `requires` should
-        # avoid creating a strict/brittle dependency.
-        wants = [ "systemd-tmpfiles-setup.service" ];
-        after = [ "systemd-tmpfiles-setup.service" ];
-      };
-    })
+    systemd.services.rpcbind = {
+      wantedBy = [ "multi-user.target" ];
+      # rpcbind performs a check for /var/run/rpcbind.lock at startup
+      # and will crash if /var/run isn't present. In the stock NixOS
+      # var.conf tmpfiles configuration file, /var/run is symlinked to
+      # /run, so rpcbind can enter a race condition in which /var/run
+      # isn't symlinked yet but tries to interact with the path, so
+      # controlling the order explicitly here ensures that rpcbind can
+      # start successfully. The `wants` instead of `requires` should
+      # avoid creating a strict/brittle dependency.
+      wants = [ "systemd-tmpfiles-setup.service" ];
+      after = [ "systemd-tmpfiles-setup.service" ];
+    };
 
-    {
-      users.users.rpc = {
-        enable = config.services.rpcbind.enable;
-        group = "nogroup";
-        uid = config.ids.uids.rpc;
-      };
-    }
-  ];
+    users.users.rpc = {
+      group = "nogroup";
+      uid = config.ids.uids.rpc;
+    };
+  };
 
 }

nixos/modules/virtualisation/qemu-vm.nix

@@ -337,7 +337,7 @@ let
             ${if share.writable then "--writeback" else "--readonly"} \
             --sandbox=none \
             --seccomp=none \
-            --cache=${share.cache} \
+            --cache=always \
             --no-announce-submounts \
             --translate-uid=host:65534:0:1 \
             --translate-gid=host:65534:0:1 \
@@ -595,23 +595,6 @@ in
           options.writable = lib.mkEnableOption "" // {
             description = "Whether the directory is writable on the host and guest.";
           };
-          options.cache = mkOption {
-            type = types.enum [
-              "auto"
-              "always"
-              "metadata"
-              "never"
-            ];
-            default = "auto";
-            description = ''
-              Cache policy for the virtiofs daemon.
-
-              For details refer to the [virtiofsd documentation](https://virtio-fs.gitlab.io/virtiofsd/doc/virtiofsd/passthrough/enum.CachePolicy.html).
-
-              Effective on Linux hosts only.
-              Ignored when using VirtFS (9P) (the default on non-Linux hosts).
-            '';
-          };
         }
       );
       default = { };
@@ -1255,7 +1238,6 @@ in
         # Always mount this to /nix/.ro-store because we never want to actually
         # write to the host Nix Store.
         target = "/nix/.ro-store";
-        cache = mkIf useVirtiofs "always";
       };
       xchg = {
         source = ''"$TMPDIR"/xchg'';

nixos/tests/all-tests.nix

@@ -1572,7 +1572,6 @@ in
   qemu-firmware = runTestOn [ "x86_64-linux" ] ./qemu-firmware.nix;
   qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
-  qemu-vm-shared-directories = runTest ./qemu-vm-shared-directories.nix;
   qemu-vm-store = runTest ./qemu-vm-store.nix;
   qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
   qgis = handleTest ./qgis.nix { package = pkgs.qgis; };

nixos/tests/qemu-vm-shared-directories.nix

@@ -1,56 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-{
-  name = "qemu-vm-shared-directories";
-
-  meta.maintainers = with lib.maintainers; [
-    fricklerhandwerk
-  ];
-
-  meta.platforms = lib.platforms.linux;
-
-  nodes = lib.listToAttrs (
-    map
-      (policy: {
-        name = policy;
-        value.virtualisation.sharedDirectories.test = {
-          source = "/tmp/${policy}";
-          target = "/mnt/test";
-          cache = policy;
-          writable = true;
-        };
-      })
-      [
-        "never"
-        "metadata"
-        "auto"
-        "always"
-      ]
-  );
-
-  testScript = ''
-    import os
-
-    for policy in ${with builtins; toJSON (attrNames config.nodes)}:
-        os.makedirs(f"/tmp/{policy}", exist_ok=True)
-        with open(f"/tmp/{policy}/hello.txt", "w") as f:
-            f.write("before")
-
-    start_all()
-
-    for machine, policy in [${
-      lib.concatMapStringsSep ", " (p: ''(${p}, "${p}")'') (builtins.attrNames config.nodes)
-    }]:
-        with subtest(f"cache={policy} propagates host file changes to the guest as expected"):
-            machine.succeed("grep before /mnt/test/hello.txt")
-            with open(f"/tmp/{policy}/hello.txt", "w") as f:
-                f.write("after")
-            if policy == "always":
-                always.succeed("grep before /mnt/test/hello.txt")
-            else:
-                machine.succeed("grep after /mnt/test/hello.txt")
-  '';
-}

pkgs/by-name/aw/aws-c-auth/package.nix

@@ -16,13 +16,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-auth";
   # nixpkgs-update: no auto update
-  version = "0.9.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-auth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8oQTTqBuEzhBUWqXHVYrGtaX44SmB2sJQZchiweHekM=";
+    hash = "sha256-vVwKBnGYo8/2nRNoEAeJi1uCjnP2XBE3btgG/utQn98=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-cal/package.nix

@@ -11,13 +11,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-cal";
   # nixpkgs-update: no auto update
-  version = "0.9.2";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-cal";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ufMoB71xebxO/Cu/xVQ3BMrcCgIlkG+MXH2Ru2i6uXo=";
+    hash = "sha256-7oKJcvoMpHVsajVkBYkAypBn1IXsddylN9Sq9KDYLwM=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/aws-c-common/package.nix

@@ -9,13 +9,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-common";
   # nixpkgs-update: no auto update
-  version = "0.12.4";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-common";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hKCIPZlLPyH7D3Derk2onyqTzWGUtCx+f2+EKtAKlwA=";
+    hash = "sha256-m3CZwGUDnI+DIrxMPGpjVszZ0UI2aSQ18afbscafW6o=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -38,6 +38,8 @@ stdenv.mkDerivation (finalAttrs: {
         "promise_test_multiple_waiters"
         # Flaky test https://github.com/NixOS/nixpkgs/issues/443233
         "test_memory_usage_maxrss"
+        # Broken upstream test https://github.com/NixOS/nixpkgs/pull/565568#issuecomment-5802423215
+        "test_file_path_read_from_offset_direct_io"
       ];
     in
     ''

pkgs/by-name/aw/aws-c-compression/package.nix

@@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-compression";
   # nixpkgs-update: no auto update
-  version = "0.3.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-compression";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-gpru+hnppgLHhcPfVBOaMdcT6e8wUjZmY7Caaa/KAW4=";
+    sha256 = "sha256-JEByt04Rg3Yl/IgqTNSIzF+zb2TQpqkqKZgiKpnsoi0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-event-stream/package.nix

@@ -15,13 +15,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-event-stream";
   # nixpkgs-update: no auto update
-  version = "0.7.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-event-stream";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jMtLJjKC7TuNZ0c0Nc3+KRh226RBl0omkiKNXXBltoc=";
+    hash = "sha256-J8bcDIK6rEM2AyhTiRvPA2ikbv8gfDxEY8izuKLBNac=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/aws-c-http/package.nix

@@ -14,13 +14,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-http";
   # nixpkgs-update: no auto update
-  version = "0.11.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-http";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SCdZfGIIHU6f0OArygZm0yY0wE6Hdx/JWvHZcK1DQOw=";
+    hash = "sha256-P2/YahGYuX8TiY4sJYU+QSlDroAUyFTFLGeZIqEYGi4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-io/package.nix

@@ -12,13 +12,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-io";
   # nixpkgs-update: no auto update
-  version = "0.27.2";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-io";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0vzuSvJ/4you0YYnizjctKP5AcLm5sJieDOSCHwm1HM=";
+    hash = "sha256-gdu1v6ui9y5Y+tp0K0fpbE2e2O4Ky/WPEekphWbhUDQ=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/aws-c-mqtt/package.nix

@@ -15,13 +15,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-mqtt";
   # nixpkgs-update: no auto update
-  version = "0.13.3";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-mqtt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Nf8c5iVl+NOPZFjsAPCMOGq2e7D8e7PafuMQh6t0DYw=";
+    hash = "sha256-6k3Ca25fRPqV+QW0+VEUdbB0JUFjqvZo8R7eaiEby0c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-s3/package.nix

@@ -17,13 +17,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-s3";
   # nixpkgs-update: no auto update
-  version = "0.8.7";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-s3";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8yUwgiZ50BiItapeg0zIc5vr0+OFHvzIRrwWH4lQFBM=";
+    hash = "sha256-s3oH2Z7pctiH00W2TN6WTDrTX1dLhZ/mes1JmPemIGw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-c-sdkutils/package.nix

@@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-sdkutils";
   # nixpkgs-update: no auto update
-  version = "0.2.4";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-sdkutils";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zc8E5ESZxXBJ6WA/V5i2Us61UcNf9wXa2k63NWqGRtI=";
+    hash = "sha256-SxEt4W5Bxdo+gJiP09FRKzGrqW/wO4NufRgBbWDph/g=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/aws-checksums/package.nix

@@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-checksums";
   # nixpkgs-update: no auto update
-  version = "0.2.7";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-checksums";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-dYDTDWZJJ0JlvkMfLS376uUt5QzSmbV0UNRC4aq35TY=";
+    sha256 = "sha256-Yvv4NT90715zMBqBeJz7o2WTDRSjszPpBsFGMVTMc4I=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/aws-crt-cpp/package.nix

@@ -20,7 +20,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-crt-cpp";
   # nixpkgs-update: no auto update
-  version = "0.34.3";
+  version = "0.43.6";
 
   outputs = [
     "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "awslabs";
     repo = "aws-crt-cpp";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-jKmIsWAzxnfsNgHavR6crhIQXVJq/PbQgaj4KVGrMP0=";
+    sha256 = "sha256-nzhGELzTjQxdxg2jX6hCRs1nRUdhKitk14zUrouJnhE=";
   };
 
   postPatch = ''

pkgs/by-name/cp/cpio/package.nix

@@ -41,6 +41,13 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  postPatch = ''
+    # This file determines the date shown in the infopage.
+    # It is unreproducible because CVE-2026-66486.patch touches it.
+    # We could reset it to SOURCE_DATE_EPOCH or the date of that patch.
+    touch -d $(date --utc --date="@''${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d) doc/cpio.texi
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
     texinfo # for makeinfo
@@ -70,6 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.gnu.org/software/cpio/";
     description = "Program to create or extract from cpio archives";
     license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ raboof ];
     platforms = lib.platforms.all;
     priority = 6; # resolves collision with gnutar's "libexec/rmt"
     mainProgram = "cpio";

pkgs/by-name/ff/ffado/package.nix

@@ -5,12 +5,11 @@
   dbus,
   dbus_cplusplus,
   fetchurl,
-  glibmm_2_4,
   libavc1394,
   libconfig,
   libiec61883,
   libraw1394,
-  libxmlxx3,
+  expat,
   pkg-config,
   python3,
   scons,
@@ -37,7 +36,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ffado";
-  version = "2.4.9";
+  version = "2.5.0";
 
   outputs = [
     "out"
@@ -47,7 +46,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://www.ffado.org/files/libffado-${version}.tgz";
-    hash = "sha256-xELFL60Ryv1VE7tOhGyFHxAchIT4karFRe0ZDo/U0Q8=";
+    hash = "sha256-JcEtk9U5iPPK+ZZSNu03nxZ6vePqTMYzsTTuYlTYfKE=";
   };
 
   prePatch = ''
@@ -93,17 +92,17 @@ stdenv.mkDerivation rec {
     "BINDIR=${placeholder "bin"}/bin"
     "INCLUDEDIR=${placeholder "dev"}/include"
     "PYTHON_INTERPRETER=${python.interpreter}"
+    "SERIALIZE_USE_EXPAT=True"
   ];
 
   buildInputs = [
     dbus
     dbus_cplusplus
-    glibmm_2_4
     libavc1394
     libconfig
     libiec61883
     libraw1394
-    libxmlxx3
+    expat
     python
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isGnu) [

pkgs/by-name/fr/fribidi/package.nix

@@ -9,11 +9,18 @@
   fixDarwinDylibNames,
   python3,
   testers,
+
+  # for passthru.tests
+  pango,
+  libass,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fribidi";
-  version = "1.0.16";
+  version = "1.0.17";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   outputs = [
     "out"
@@ -26,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/fribidi/fribidi/releases/download/v${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-GxzeWyNdQEeekb4vDoijCeMhTIq0cOyKJ0TYKlqeoFw=";
+    sha256 = "sha256-aUnc3ifUHOutH9dB/K/DbVWhAg0thy1KbrORTKq7raI=";
   };
 
   postPatch = ''
@@ -40,8 +47,17 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
+  # necessary to compile helper which runs during build to generate tables
+  # see gen.tab/meson.build for details
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
+  mesonFlags = lib.mapAttrsToList lib.mesonBool {
+    tests = finalAttrs.finalPackage.doCheck;
+    docs = true;
+    bin = true;
+    deprecated = true;
+  };
+
   doCheck = true;
   nativeCheckInputs = [ python3 ];
 
@@ -49,14 +65,18 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config = testers.hasPkgConfigModules {
       package = finalAttrs.finalPackage;
     };
+    inherit pango libass;
   };
 
   meta = {
     homepage = "https://github.com/fribidi/fribidi";
+    changelog = "https://github.com/fribidi/fribidi/releases/tag/v${finalAttrs.version}";
     description = "GNU implementation of the Unicode Bidirectional Algorithm (bidi)";
     mainProgram = "fribidi";
     license = lib.licenses.lgpl21;
     platforms = lib.platforms.unix;
     pkgConfigModules = [ "fribidi" ];
+    maintainers = with lib.maintainers; [ tmarkus ];
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
   };
 })

pkgs/by-name/gl/glib/glib-appinfo-watch.patch

@@ -47,15 +47,15 @@ index 87db7a97a..2e1689ed7 100644
      {
        gchar *alternative_dir;
  
-@@ -1650,6 +1660,40 @@ desktop_file_dirs_lock (void)
+@@ -1650,6 +1660,47 @@ desktop_file_dirs_lock (void)
        for (i = 0; dirs[i]; i++)
          g_ptr_array_add (desktop_file_dirs, desktop_file_dir_new (dirs[i]));
  
 +      {
-+        /* Monitor the system and user profile under /nix/var/nix/profiles and
-+         * treat modifications to them as if they were modifications to their
-+         * /share sub-directory.  */
++        /* Monitor the system and user profiles and treat modifications to them
++         * as if they were modifications to their /share sub-directory.  */
 +        const gchar *user;
++        gchar *profile_dir, *user_data_dir;
 +        DesktopFileDir *system_profile_dir, *user_profile_dir, *user_env_dir;
 +
 +        system_profile_dir =
@@ -63,10 +63,17 @@ index 87db7a97a..2e1689ed7 100644
 +        system_profile_dir->nix_profile_watch_dir = g_strdup ("/nix/var/nix/profiles");
 +        g_ptr_array_add (desktop_file_dirs, desktop_file_dir_ref (system_profile_dir));
 +
++        profile_dir = g_build_filename (g_get_user_state_dir (), "nix", "profiles", NULL);
++        user_data_dir = g_build_filename (profile_dir, "profile", "share", NULL);
++        user_profile_dir = desktop_file_dir_new (user_data_dir);
++        user_profile_dir->nix_profile_watch_dir = profile_dir;
++        g_ptr_array_add (desktop_file_dirs, user_profile_dir);
++        g_free (user_data_dir);
++
 +        user = g_get_user_name ();
 +        if (user != NULL)
 +          {
-+            gchar *profile_dir, *user_data_dir, *env_dir, *env_data_dir;
++            gchar *env_dir, *env_data_dir;
 +
 +            profile_dir = g_build_filename ("/nix/var/nix/profiles/per-user", user, NULL);
 +            user_data_dir = g_build_filename (profile_dir, "profile", "share", NULL);

pkgs/by-name/gl/glslang/package.nix

@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "glslang";
-  version = "16.4.0";
+  version = "16.6.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     tag = finalAttrs.version;
-    hash = "sha256-nPXwBROAj/zYccM5Lydwws13e/nW96gm+f4218sQhE8=";
+    hash = "sha256-Dg51nelPWj19Ug1Eo2NFerDoSxEB0mo8VWsRWkNgcn8=";
   };
 
   outputs = [

pkgs/by-name/gr/groff/package.nix

@@ -41,11 +41,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "groff";
-  version = "1.24.1";
+  version = "1.24.2";
 
   src = fetchurl {
     url = "mirror://gnu/groff/groff-${finalAttrs.version}.tar.gz";
-    hash = "sha256-dOKBl5W2r/QxrqyYPWOpyJaO6roqLrp9+LpMe0Hnz9g=";
+    hash = "sha256-+cHv1b6743/G4QY9t0c86N8ePgvk/w9DzgT85X6cXdk=";
   };
 
   patches = [

pkgs/by-name/gr/grpc/package.nix

@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation (finalAttrs: {
   pname = "grpc";
-  version = "1.83.1"; # N.B: if you change this, please update:
+  version = "1.84.0"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "grpc";
     repo = "grpc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-h2F+lKF9GH5CGjzS5326ovLUHbYwsPjoqmb8Ljgj2ao=";
+    hash = "sha256-cuNa/Juh8/whghdtbSaEDMqGRASt6vbzeEtHp34STrc=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/gu/guile-commonmark/package.nix

@@ -39,6 +39,10 @@ stdenv.mkDerivation {
     "GUILE_AUTO_COMPILE=0"
   ];
 
+  guileImportsCheck = [
+    "commonmark"
+  ];
+
   meta = {
     homepage = "https://github.com/OrangeShark/guile-commonmark";
     description = "Implementation of CommonMark for Guile";

pkgs/by-name/gu/guile-git/package.nix

@@ -61,6 +61,10 @@ stdenv.mkDerivation (finalAttrs: {
     sed -i -e '94i (test-skip 1)' ./tests/proxy.scm
   '';
 
+  guileImportsCheck = [
+    "git"
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   meta = {

pkgs/by-name/gu/guile-json/package.nix

@@ -13,9 +13,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://savannah/guile-json/guile-json-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-OLoEjtKdEvBbMsWy+3pReVxEi0HkA6Kxty/wA1gX84g=";
+    hash = "sha256-OLoEjtKdEvBbMsWy+3pReVxEi0HkA6Kxty/wA1gX84g=";
   };
 
+  __structuredAttrs = true;
   strictDeps = true;
   nativeBuildInputs = [
     guile
@@ -28,6 +29,10 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
   makeFlags = [ "GUILE_AUTO_COMPILE=0" ];
 
+  guileImportsCheck = [
+    "json"
+  ];
+
   meta = {
     description = "JSON Bindings for GNU Guile";
     homepage = "https://savannah.nongnu.org/projects/guile-json";

pkgs/by-name/gu/guileImportsCheckHook/guileImportsCheckHook.sh

@@ -0,0 +1,20 @@
+# shellcheck shell=bash
+
+# Setup hook for checking whether Guile imports succeed
+echo "Sourcing guileImportsCheckHook.sh"
+
+guileImportsCheckHook () {
+  echo "Executing guileImportsCheckHook"
+
+  if [[ -n "${guileImportsCheck[*]-}" ]]; then
+    echo "Check whether the following modules can be imported: ${guileImportsCheck[*]}"
+    for i in "${guileImportsCheck[@]}"
+    do
+      # prevent guile from trying to AOT compile during import
+      # guile can't find the library to import unless we set this
+      GUILE_LOAD_PATH="$out/share/guile/site/@effectiveVersion@" GUILE_AUTO_COMPILE=0 guile -c "(use-modules (${i}))"
+    done
+  fi
+}
+
+appendToVar preDistPhases guileImportsCheckHook

pkgs/by-name/gu/guileImportsCheckHook/package.nix

@@ -0,0 +1,17 @@
+{
+  lib,
+  makeSetupHook,
+  guile,
+  effectiveVersion ? guile.effectiveVersion,
+}:
+
+makeSetupHook {
+  name = "guileImportsCheckHook";
+  substitutions = {
+    effectiveVersion = guile.effectiveVersion;
+  };
+  meta = {
+    description = "Import Guile libraries";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+  };
+} ./guileImportsCheckHook.sh

pkgs/by-name/hw/hwloc/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwloc";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "open-mpi";
     repo = "hwloc";
     tag = "hwloc-${finalAttrs.version}";
-    hash = "sha256-lbh8tkKeUcHta7/q9TuHQhccyWjkBgrC5fVifFJqQyY=";
+    hash = "sha256-IZXTjKUp3wULSF87b/JNMtaQGBUoUZiG4grgxfZ1nX0=";
   };
 
   configureFlags = [

pkgs/by-name/il/ilo/install-doc.patch

@@ -0,0 +1,35 @@
+From 6b8302213d37c84a7d4d036c733f68116d738189 Mon Sep 17 00:00:00 2001
+From: jopejoe1 <jopejoe1@missing.ninja>
+Date: Fri, 31 Jul 2026 09:39:27 +0200
+Subject: [PATCH] Install documentation
+
+This makes it so that documentation can be easly installed by distors
+---
+ doc/CMakeLists.txt | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt
+index a74cfd8..e886a7e 100644
+--- a/doc/CMakeLists.txt
++++ b/doc/CMakeLists.txt
+@@ -38,6 +38,20 @@ if(DOXYGEN_FOUND)
+     VERBATIM
+     DEPENDS ${PROJECT_NAME}_doc
+   )
++
++  include(GNUInstallDirs)
++
++  install(
++    DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/doc/html/
++    DESTINATION ${CMAKE_INSTALL_DOCDIR}
++    OPTIONAL
++  )
++
++  install(
++    FILES ${CMAKE_CURRENT_BINARY_DIR}/doc/latex/refman.pdf
++    DESTINATION ${CMAKE_INSTALL_DOCDIR}
++    OPTIONAL
++  )
+ else()
+   message("Doxygen need to be installed to generate the doxygen documentation")
+ endif()

pkgs/by-name/il/ilo/package.nix

@@ -0,0 +1,88 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  testers,
+  gitUpdater,
+  doxygen,
+  texliveBasic,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ilo";
+  version = "2.0.2";
+
+  src = fetchFromGitHub {
+    owner = "Fraunhofer-IIS";
+    repo = "ilo";
+    tag = "r${finalAttrs.version}";
+    hash = "sha256-az7fnZG8js+vGVtECcwcHu2JuvME1vJoQlKbkAwgO9w=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  patches = [
+    # https://github.com/Fraunhofer-IIS/ilo/pull/2
+    ./pkg-config.patch
+    # https://github.com/Fraunhofer-IIS/ilo/pull/1
+    ./install-doc.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    doxygen
+    writableTmpDirAsHomeHook
+    (texliveBasic.withPackages (ps: [
+      ps.float
+      ps.varwidth
+      ps.xcolor
+      ps.xltabular
+      ps.ltablex
+      ps.tabularray
+      ps.ninecolors
+      ps.fancyvrb
+      ps.multirow
+      ps.hanging
+      ps.adjustbox
+      ps.stackengine
+      ps.enumitem
+      ps.alphalph
+      ps.ulem
+      ps.wasysym
+      ps.changepage
+      ps.tocloft
+      ps.newunicodechar
+      ps.caption
+      ps.etoc
+      ps.helvetic
+      ps.wasy
+      ps.courier
+    ]))
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "ilo_BUILD_DOC" true)
+  ];
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+  ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = gitUpdater { rev-prefix = "r"; };
+  };
+
+  meta = {
+    description = "Collection of helpful datatypes and algorithms for MPEG-H software";
+    homepage = "https://github.com/Fraunhofer-IIS/ilo";
+    license = lib.licenses.fraunhofer-fdk;
+    maintainers = [ lib.maintainers.jopejoe1 ];
+    pkgConfigModules = [ "ilo" ];
+  };
+})

pkgs/by-name/il/ilo/pkg-config.patch

@@ -0,0 +1,23 @@
+From 13d48426fbcfc94e7e87f3127d925abc37307a63 Mon Sep 17 00:00:00 2001
+From: jopejoe1 <jopejoe1@missing.ninja>
+Date: Fri, 31 Jul 2026 09:03:17 +0200
+Subject: [PATCH] fix pkgconfig generation when install dirs are absolute paths
+
+This makes the .pc files work correctly on destibutions like NixOS and GUIX
+---
+ ilo.pc.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ilo.pc.in b/ilo.pc.in
+index 752c038..4c0f4ee 100644
+--- a/ilo.pc.in
++++ b/ilo.pc.in
+@@ -1,6 +1,6 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: @PROJECT_NAME@
+ Description: @PROJECT_DESCRIPTION@

pkgs/by-name/im/imagemagick/package.nix

@@ -69,13 +69,13 @@ assert libraqmSupport -> freetypeSupport;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-31";
+  version = "7.1.2-32";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-RQpvpWSEMIIGIDLk5X9BwsWgD0AKPBgJ2m9dSipq8Lc=";
+    hash = "sha256-/8U47oVkzU6VeYec6ZND+wAAJonsmwlcgeBvQ+M7hk8=";
   };
 
   outputs = [

pkgs/by-name/im/imlib2/package.nix

@@ -44,11 +44,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "imlib2";
-  version = "1.12.6";
+  version = "1.12.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/imlib2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-JQ+XUvadxSLlKagaqpOVcF9/wxL/JFPl3lmsK6HyhY8=";
+    hash = "sha256-1x7lNRzBkU+wGWgSPQ3PJ2dA5a9WYpQ6xHrmDK+k0Ts=";
   };
 
   buildInputs = [

pkgs/by-name/je/jemalloc/package.nix

@@ -39,13 +39,13 @@ assert lib.asserts.assertOneOf "pageSizeKiB" (toString pageSizeKiB) (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jemalloc";
-  version = "5.3.1";
+  version = "5.4.0";
 
   src = fetchFromGitHub {
     owner = "jemalloc";
     repo = "jemalloc";
     tag = finalAttrs.version;
-    hash = "sha256-uGQppR2LS/Hhx4eWnavPDW3tzMyI1Df4XYrWEMQwBuw=";
+    hash = "sha256-T3f+BWk+/LeB2Ul7If7TqtJH7qYLq53CcYaU82EMeSg=";
   };
 
   patches = [
@@ -61,16 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
     # A (longer) patch addressing the failure posted upstream at:
     # https://github.com/jemalloc/jemalloc/pull/2954
     ./skip-extent-test-with-prof-active.patch
-
-    # the nonstandard `std::__throw_bad_alloc` is no longer exposed in gcc 16.
-    # this makes it conditional on exceptions and defers to either
-    # `throw std::bad_alloc()` or `std::terminate` as appropriate.
-    # https://github.com/jemalloc/jemalloc/pull/2900
-    (fetchpatch {
-      name = "jemalloc-dont-use-nonstandard-throw-bad-alloc.patch";
-      url = "https://github.com/jemalloc/jemalloc/commit/1a15fe33a48c52bfe26ea83e49f0d317a47da3ea.patch";
-      hash = "sha256-pL9fo8UMSbFlHCo3LFFkw0qBsdrVHcEJIkLutZYa2Yg=";
-    })
   ];
 
   nativeBuildInputs = [

pkgs/by-name/li/libcamera/package.nix

@@ -1,6 +1,8 @@
 {
   stdenv,
-  fetchgit,
+  fetchFromGitLab,
+  testers,
+  nix-update-script,
   lib,
   meson,
   ninja,
@@ -13,13 +15,14 @@
   libyuv,
   gst_all_1,
   gtest,
-  graphviz,
-  doxygen,
   python3,
   python3Packages,
   udev,
   libpisp,
   libglvnd,
+  enableDocumentation ? false,
+  graphviz,
+  doxygen,
   withTracing ? lib.meta.availableOn stdenv.hostPlatform lttng-ust,
   lttng-ust, # withTracing
   withSoftispGPU ? true, # software ISP GPU acceleration
@@ -31,13 +34,15 @@
   SDL2,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libcamera";
   version = "0.7.2";
 
-  src = fetchgit {
-    url = "https://git.libcamera.org/libcamera/libcamera.git";
-    rev = "v${version}";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "camera";
+    repo = "libcamera";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-vhFkeT1j2KKm+CVvGrtH5BEYJSEdaX7N7DRdA0a9EWk=";
   };
 
@@ -112,36 +117,43 @@ stdenv.mkDerivation rec {
     python3Packages.jinja2
     python3Packages.pyyaml
     python3Packages.ply
+    openssl
+  ]
+  ++ lib.optionals enableDocumentation [
     python3Packages.sphinx
     graphviz
     doxygen
-    openssl
   ]
   ++ lib.optional withQcam qt6.wrapQtAppsHook;
 
-  mesonFlags = [
-    (lib.mesonEnable "v4l2" true)
-    (lib.mesonEnable "tracing" withTracing)
-    (lib.mesonEnable "qcam" withQcam)
-    (lib.mesonEnable "apps-output-dng" withQcam)
-    (lib.mesonEnable "cam-output-sdl2" withQcam)
-    (lib.mesonEnable "cam-jpeg" withQcam)
-    (lib.mesonEnable "softisp-gpu" withSoftispGPU)
-    (lib.mesonEnable "libunwind" false)
-    (lib.mesonEnable "libdw" false)
-    (lib.mesonEnable "lc-compliance" false) # tries unconditionally to download gtest when enabled
-    # Avoid blanket -Werror to evade build failures on less
-    # tested compilers.
-    (lib.mesonBool "werror" false)
-    # Documentation breaks binary compatibility.
-    # Given that upstream also provides public documentation,
-    # we can disable it here.
-    (lib.mesonEnable "documentation" false)
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isAarch [
-    # we don't have tensorflow-lite to build this
-    (lib.mesonEnable "rpi-awb-nn" false)
-  ];
+  mesonFlags =
+    lib.mapAttrsToList lib.mesonEnable {
+      v4l2 = true;
+      tracing = true;
+      pycamera = true;
+      qcam = withQcam;
+      apps-output-dng = withQcam;
+      cam-output-sdl2 = withQcam;
+      cam-jpeg = withQcam;
+      softisp-gpu = withSoftispGPU;
+      libunwind = false;
+      libdw = false;
+      lc-compliance = true;
+
+      # Documentation breaks binary compatibility.
+      # Given that upstream also provides public documentation,
+      # we can disable it here.
+      documentation = enableDocumentation;
+
+      rpi-awb-nn = false;
+    }
+    ++ [
+      (lib.mesonBool "test" finalAttrs.finalPackage.doCheck)
+
+      # Avoid blanket -Werror to evade build failures on less
+      # tested compilers.
+      (lib.mesonBool "werror" false)
+    ];
 
   env = {
     # Fixes error on a deprecated declaration
@@ -151,16 +163,30 @@ stdenv.mkDerivation rec {
     FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
   };
 
+  passthru = {
+    updateScript = nix-update-script { };
+
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  };
+
   meta = {
     description = "Open source camera stack and framework for Linux, Android, and ChromeOS";
     homepage = "https://libcamera.org";
-    changelog = "https://git.libcamera.org/libcamera/libcamera.git/tag/?h=${src.rev}";
+    downloadPage = "https://gitlab.freedesktop.org/camera/libcamera";
+    changelog = "https://gitlab.freedesktop.org/camera/libcamera/-/releases/${finalAttrs.src.tag}";
     license = lib.licenses.lgpl2Plus;
-    maintainers = with lib.maintainers; [ citadelcore ];
+    pkgConfigModules = [
+      "libcamera"
+      "libcamera-base"
+    ];
+    maintainers = with lib.maintainers; [
+      citadelcore
+      tmarkus
+    ];
     platforms = lib.platforms.linux;
     badPlatforms = [
       # Mandatory shared libraries.
       lib.systems.inspect.platformPatterns.isStatic
     ];
   };
-}
+})

pkgs/by-name/li/libdeflate/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeflate";
-  version = "1.25";
+  version = "1.26";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2TiV3kmFs9j4aYetoYeWg3+MoZ542/0zaD0hwn9b8ZA=";
+    hash = "sha256-QVF2XL8Qu3mTszKKtx+8BExkTGkpMANXjkAe3XXPUJQ=";
   };
 
   cmakeFlags = [

pkgs/by-name/li/libhwy/package.nix

@@ -30,8 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./move-contrib-to-its-own-output.patch
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+
     # backport GCC 16/aarch64 fix
     (fetchpatch {
       url = "https://github.com/google/highway/commit/8a0da774fe6b3f9ab02f5f33e763b8c2133f38fc.patch";

pkgs/by-name/li/libopus/package.nix

@@ -1,7 +1,8 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitLab,
+  fetchzip,
   gitUpdater,
   meson,
   python3,
@@ -16,13 +17,24 @@
   testers,
 }:
 
+let
+  models = fetchzip (finalAttrs: {
+    pname = "opus-models";
+    version = "a5177ec6fb7d15058e99e57029746100121f68e4890b1467d4094aa336b6013e";
+    url = "https://media.xiph.org/opus/models/opus_data-${finalAttrs.version}.tar.gz";
+    hash = "sha256-aCOYMJoOGgdFCYZdFlUKiXjzssQKlQnCsTD3i5gGzCA=";
+  });
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libopus";
   version = "1.6.1";
 
-  src = fetchurl {
-    url = "https://downloads.xiph.org/releases/opus/opus-${finalAttrs.version}.tar.gz";
-    hash = "sha256-b/y1kyB76SWE3xWzJGbtZLvsmRCfAHyCIF8BlFckEaE=";
+  src = fetchFromGitLab {
+    domain = "gitlab.xiph.org";
+    owner = "xiph";
+    repo = "opus";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-I1f+J//ZJBMj88+PQhsYBjz3fm4Ll3ckZD+fYa6/3Y0=";
   };
 
   patches = [
@@ -32,6 +44,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs meson/
+    echo 'PACKAGE_VERSION="${finalAttrs.version}"' > package_version
+    ln -s ${models}/* ./dnn/
   '';
 
   outputs = [
@@ -62,6 +76,8 @@ stdenv.mkDerivation (finalAttrs: {
       rev-prefix = "v";
     };
 
+    inherit models;
+
     tests = {
       inherit ffmpeg-headless;
 

pkgs/by-name/li/libpfm/package.nix

@@ -7,12 +7,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "4.13.0";
+  version = "4.14.1";
   pname = "libpfm";
 
   src = fetchurl {
     url = "mirror://sourceforge/perfmon2/libpfm4/libpfm-${finalAttrs.version}.tar.gz";
-    hash = "sha256-0YuXdkx1VSjBBR03bjNUXQ62DG6/hWgENoE/pbBMw9E=";
+    hash = "sha256-r1GOqyEUsOEd/qz43WGLCh6gTyjNCzisrS7Jmr/y/QQ=";
   };
 
   # Don't install libpfm.so on windows as it doesn't exist

pkgs/by-name/li/libsecret/package.nix

@@ -12,7 +12,7 @@
   python3Packages,
   docbook-xsl-nons,
   docbook_xml_dtd_42,
-  libgcrypt,
+  gnutls,
   gobject-introspection,
   buildPackages,
   withIntrospection ?
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    libgcrypt
+    gnutls
   ]
   ++ lib.optionals withTpm2Tss [ tpm2-tss ]
   ++ lib.optionals abrmdSupport [ tpm2-abrmd ];
@@ -128,6 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "gtk_doc" withIntrospection)
     (lib.mesonBool "tpm2" withTpm2Tss)
     (lib.mesonOption "bashcompdir" "share/bash-completion/completions")
+    (lib.mesonOption "crypto" "gnutls")
   ];
 
   doCheck = stdenv.hostPlatform.isLinux && withIntrospection;

pkgs/by-name/li/libslirp/package.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libslirp";
-  version = "4.9.5";
+  version = "4.9.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "slirp";
     repo = "libslirp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iWu3/Klsm8e9MH147BJhn9Vqyneq5ROqPvll1cnieL0=";
+    hash = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/me/meson/setup-hook.sh

@@ -63,6 +63,12 @@ mesonCheckPhase() {
         flagsArray+=("--timeout-multiplier=0")
     fi
 
+    local _disabledTestsArray=()
+    concatTo _disabledTestsArray disabledTests
+    for disabledTest in "${_disabledTestsArray[@]}"; do
+        flagsArray+=("--exclude" "$disabledTest")
+    done
+
     # Parallel building is enabled by default.
     local buildCores=1
     if [ "${enableParallelBuilding-1}" ]; then

pkgs/by-name/mm/mmtisobmff/demo.patch

@@ -0,0 +1,109 @@
+From 226e5da303449d034957621573eecaa1c9fca267 Mon Sep 17 00:00:00 2001
+From: jopejoe1 <jopejoe1@missing.ninja>
+Date: Fri, 31 Jul 2026 10:57:47 +0200
+Subject: [PATCH] install demo bins
+
+---
+ demo/CMakeLists.txt | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/demo/CMakeLists.txt b/demo/CMakeLists.txt
+index 38ab146..8e6632f 100644
+--- a/demo/CMakeLists.txt
++++ b/demo/CMakeLists.txt
+@@ -16,6 +16,7 @@ add_executable(printMP4 print_mp4_boxes.cpp)
+ target_link_libraries(printMP4 mmtisobmff)
+ target_compile_features(printMP4 PUBLIC cxx_std_11)
+ set_target_properties(printMP4 PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS printMP4 RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(printMP4 PUBLIC ${emscriptenLinkOptions})
+@@ -27,6 +28,7 @@ add_executable(simpleFileReader simple_file_reader.cpp)
+ target_link_libraries(simpleFileReader mmtisobmff)
+ target_compile_features(simpleFileReader PUBLIC cxx_std_11)
+ set_target_properties(simpleFileReader PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS simpleFileReader RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(simpleFileReader PUBLIC ${emscriptenLinkOptions})
+@@ -38,6 +40,7 @@ add_executable(advancedFileReader advanced_file_reader.cpp)
+ target_link_libraries(advancedFileReader mmtisobmff)
+ target_compile_features(advancedFileReader PUBLIC cxx_std_11)
+ set_target_properties(advancedFileReader PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS advancedFileReader RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(advancedFileReader PUBLIC ${emscriptenLinkOptions})
+@@ -49,6 +52,7 @@ add_executable(simpleFileReader_c simple_file_reader_c.c)
+ target_link_libraries(simpleFileReader_c mmtisobmff_c)
+ target_compile_features(simpleFileReader_c PUBLIC cxx_std_11)
+ set_target_properties(simpleFileReader_c PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS simpleFileReader_c RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(simpleFileReader_c PUBLIC ${emscriptenLinkOptions})
+@@ -60,6 +64,7 @@ add_executable(simpleMemoryReader_c simple_memory_reader_c.c)
+ target_link_libraries(simpleMemoryReader_c mmtisobmff_c)
+ target_compile_features(simpleMemoryReader_c PUBLIC cxx_std_11)
+ set_target_properties(simpleMemoryReader_c PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS simpleMemoryReader_c RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(simpleMemoryReader_c PUBLIC ${emscriptenLinkOptions})
+@@ -71,6 +76,7 @@ add_executable(seekingAndTimestampsApiDemo seeking_and_timestamps_api_demo.cpp)
+ target_link_libraries(seekingAndTimestampsApiDemo mmtisobmff)
+ target_compile_features(seekingAndTimestampsApiDemo PUBLIC cxx_std_11)
+ set_target_properties(seekingAndTimestampsApiDemo PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS seekingAndTimestampsApiDemo RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(seekingAndTimestampsApiDemo PUBLIC ${emscriptenLinkOptions})
+@@ -82,6 +88,7 @@ add_executable(mp4Defragment mp4_defragment.cpp)
+ target_link_libraries(mp4Defragment mmtisobmff)
+ target_compile_features(mp4Defragment PUBLIC cxx_std_11)
+ set_target_properties(mp4Defragment PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS mp4Defragment RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(mp4Defragment PUBLIC ${emscriptenLinkOptions})
+@@ -93,6 +100,7 @@ add_executable( mp4SamplesDiff mp4_samples_diff.cpp )
+ target_link_libraries( mp4SamplesDiff mmtisobmff )
+ target_compile_features(mp4SamplesDiff PUBLIC cxx_std_11)
+ set_target_properties(mp4SamplesDiff PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS mp4SamplesDiff RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(mp4SamplesDiff PUBLIC ${emscriptenLinkOptions})
+@@ -104,6 +112,7 @@ add_executable(mp4Combine mp4_combine.cpp)
+ target_link_libraries(mp4Combine mmtisobmff)
+ target_compile_features(mp4Combine PUBLIC cxx_std_11)
+ set_target_properties(mp4Combine PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS mp4Combine RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(mp4Combine PUBLIC ${emscriptenLinkOptions})
+@@ -115,6 +124,7 @@ add_executable(mp4Fragment mp4_fragment.cpp)
+ target_link_libraries(mp4Fragment mmtisobmff)
+ target_compile_features(mp4Fragment PUBLIC cxx_std_11)
+ set_target_properties(mp4Fragment PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS mp4Fragment RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(mp4Fragment PUBLIC ${emscriptenLinkOptions})
+@@ -126,6 +136,7 @@ add_executable(mp4Segment mp4_segment.cpp)
+ target_link_libraries(mp4Segment mmtisobmff)
+ target_compile_features(mp4Segment PUBLIC cxx_std_11)
+ set_target_properties(mp4Segment PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS mp4Segment RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(mp4Segment PUBLIC ${emscriptenLinkOptions})
+@@ -137,6 +148,7 @@ add_executable(simpleFileWriter simple_file_writer.cpp)
+ target_link_libraries(simpleFileWriter mmtisobmff)
+ target_compile_features(simpleFileWriter PUBLIC cxx_std_11)
+ set_target_properties(simpleFileWriter PROPERTIES CXX_EXTENSIONS OFF)
++install(TARGETS simpleFileWriter RUNTIME)
+ 
+ if (EMSCRIPTEN)
+   target_link_options(simpleFileWriter PUBLIC ${emscriptenLinkOptions})

pkgs/by-name/mm/mmtisobmff/install-doc.patch

@@ -0,0 +1,33 @@
+From 6b8302213d37c84a7d4d036c733f68116d738189 Mon Sep 17 00:00:00 2001
+From: jopejoe1 <jopejoe1@missing.ninja>
+Date: Fri, 31 Jul 2026 09:39:27 +0200
+Subject: [PATCH] Install documentation
+
+This makes it so that documentation can be easly installed by distors
+---
+ doc/CMakeLists.txt | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt
+index e6c43a5277..880e6bc728 100644
+--- a/doc/CMakeLists.txt
++++ b/doc/CMakeLists.txt
+@@ -38,6 +38,18 @@
+     VERBATIM
+     DEPENDS ${PROJECT_NAME}_doc
+   )
++
++  include(GNUInstallDirs)
++
++  install(
++    DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/doc/html/
++    DESTINATION ${CMAKE_INSTALL_DOCDIR}
++  )
++
++  install(
++    FILES ${CMAKE_CURRENT_BINARY_DIR}/doc/latex/refman.pdf
++    DESTINATION ${CMAKE_INSTALL_DOCDIR}
++  )
+ else()
+   message("Doxygen need to be installed to generate the doxygen documentation")
+ endif()

pkgs/by-name/mm/mmtisobmff/package.nix

@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  testers,
+  gitUpdater,
+  doxygen,
+  pkg-config,
+  texliveBasic,
+  writableTmpDirAsHomeHook,
+  ilo,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mmtisobmff";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "Fraunhofer-IIS";
+    repo = "mmtisobmff";
+    tag = "r${finalAttrs.version}";
+    hash = "sha256-2W5H4GfJu2tOOWp8x1z1DJe5yJ3htc0o8nIeEdwiMd4=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  patches = [
+    # https://github.com/Fraunhofer-IIS/mmtisobmff/pull/4
+    ./pkg-config.patch
+    # https://github.com/Fraunhofer-IIS/mmtisobmff/pull/5
+    ./install-doc.patch
+    # https://github.com/Fraunhofer-IIS/mmtisobmff/pull/6
+    ./demo.patch
+  ];
+
+  buildInputs = [
+    ilo
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    doxygen
+    writableTmpDirAsHomeHook
+    (texliveBasic.withPackages (ps: [
+      ps.float
+      ps.varwidth
+      ps.xcolor
+      ps.xltabular
+      ps.ltablex
+      ps.tabularray
+      ps.ninecolors
+      ps.fancyvrb
+      ps.multirow
+      ps.hanging
+      ps.adjustbox
+      ps.stackengine
+      ps.enumitem
+      ps.alphalph
+      ps.ulem
+      ps.wasysym
+      ps.changepage
+      ps.tocloft
+      ps.newunicodechar
+      ps.caption
+      ps.etoc
+      ps.helvetic
+      ps.wasy
+      ps.courier
+    ]))
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "mmtisobmff_BUILD_BINARIES" true)
+    (lib.cmakeBool "mmtisobmff_BUILD_DOC" true)
+    (lib.cmakeBool "USE_PKGCONFIG_DEPS" true)
+  ];
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "bin"
+  ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = gitUpdater { rev-prefix = "r"; };
+  };
+
+  meta = {
+    description = "ISOBMFF reader and writer library with MPEG-H 3D Audio support";
+    homepage = "https://github.com/Fraunhofer-IIS/mmtisobmff";
+    license = lib.licenses.fraunhofer-fdk;
+    maintainers = [ lib.maintainers.jopejoe1 ];
+    pkgConfigModules = [ "mmtisobmff" ];
+  };
+})

pkgs/by-name/mm/mmtisobmff/pkg-config.patch

@@ -0,0 +1,23 @@
+From c4faec1c717fb9d2edd2c967c180c3a3f6b4c268 Mon Sep 17 00:00:00 2001
+From: jopejoe1 <jopejoe1@missing.ninja>
+Date: Fri, 31 Jul 2026 10:34:31 +0200
+Subject: [PATCH] fix pkgconfig generation when install dirs are absolute paths
+
+This makes the .pc files work correctly on destibutions like NixOS and GUIX
+---
+ mmtisobmff.pc.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mmtisobmff.pc.in b/mmtisobmff.pc.in
+index 752c038..4c0f4ee 100644
+--- a/mmtisobmff.pc.in
++++ b/mmtisobmff.pc.in
+@@ -1,6 +1,6 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: @PROJECT_NAME@
+ Description: @PROJECT_DESCRIPTION@

pkgs/by-name/mp/mpeghdec/install-bin.patch

@@ -0,0 +1,18 @@
+diff --git a/demo/CMakeLists.txt b/demo/CMakeLists.txt
+index 5af09d86ae..971eee7774 100755
+--- a/demo/CMakeLists.txt
++++ b/demo/CMakeLists.txt
+@@ -20,6 +20,7 @@
+       "mpeghUiManager/mpeghUiManagerProcessor.h"
+     )
+   endif()
++  install(TARGETS mpeghDecoder RUNTIME)
+ endif()
+
+ if(${mpeghdec_BUILD_UIMANAGER})
+@@ -30,4 +31,5 @@
+     "mpeghUiManager/mpeghUiManagerProcessor.h"
+   )
+   target_link_libraries(mpeghUiManager mpeghdec mmtisobmff ilo)
++  install(TARGETS mpeghUiManager RUNTIME)
+ endif()

pkgs/by-name/mp/mpeghdec/install-doc.patch

@@ -0,0 +1,23 @@
+diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt
+index eb60d2dc69..69d937b55f 100644
+--- a/doc/CMakeLists.txt
++++ b/doc/CMakeLists.txt
+@@ -41,6 +41,18 @@
+     VERBATIM
+     DEPENDS ${PROJECT_NAME}_doc
+   )
++
++  include(GNUInstallDirs)
++
++  install(
++    DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/doc/html/
++    DESTINATION ${CMAKE_INSTALL_DOCDIR}
++  )
++
++  install(
++    FILES ${CMAKE_CURRENT_BINARY_DIR}/doc/latex/refman.pdf
++    DESTINATION ${CMAKE_INSTALL_DOCDIR}
++  )
+ else()
+   message("Doxygen need to be installed to generate the doxygen documentation")
+ endif()

pkgs/by-name/mp/mpeghdec/package.nix

@@ -0,0 +1,103 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  testers,
+  gitUpdater,
+  cmake,
+  pkg-config,
+  doxygen,
+  writableTmpDirAsHomeHook,
+  texliveBasic,
+  ilo,
+  mmtisobmff,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mpeghdec";
+  version = "4.0.1";
+
+  src = fetchFromGitHub {
+    owner = "Fraunhofer-IIS";
+    repo = "mpeghdec";
+    tag = "r${finalAttrs.version}";
+    hash = "sha256-P+xPaigy9YkXCyk9iIMdJzkXVipUHM68cLr4nepb2yc=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  patches = [
+    # https://github.com/Fraunhofer-IIS/mpeghdec/pull/19
+    ./pkg-config.patch
+    # https://github.com/Fraunhofer-IIS/mpeghdec/pull/20
+    ./install-doc.patch
+    # https://github.com/Fraunhofer-IIS/mpeghdec/pull/21
+    ./install-bin.patch
+  ];
+
+  buildInputs = [
+    ilo
+    mmtisobmff
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    doxygen
+    writableTmpDirAsHomeHook
+    (texliveBasic.withPackages (ps: [
+      ps.float
+      ps.varwidth
+      ps.xcolor
+      ps.xltabular
+      ps.ltablex
+      ps.tabularray
+      ps.ninecolors
+      ps.fancyvrb
+      ps.multirow
+      ps.hanging
+      ps.adjustbox
+      ps.stackengine
+      ps.enumitem
+      ps.alphalph
+      ps.ulem
+      ps.wasysym
+      ps.changepage
+      ps.tocloft
+      ps.newunicodechar
+      ps.caption
+      ps.etoc
+      ps.helvetic
+      ps.wasy
+      ps.courier
+    ]))
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "mpeghdec_BUILD_BINARIES" true)
+    (lib.cmakeBool "mpeghdec_BUILD_DOC" true)
+    (lib.cmakeBool "USE_PKGCONFIG_DEPS" true)
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+  ];
+
+  outputs = [
+    "out"
+    "dev"
+    "doc"
+    "bin"
+  ];
+
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = gitUpdater { rev-prefix = "r"; };
+  };
+
+  meta = {
+    description = "C/C++ implementation of the MPEG-H Audio standard as defined in ISO/IEC 23008-3:2022";
+    homepage = "https://github.com/Fraunhofer-IIS/mpeghdec";
+    license = lib.licenses.fraunhofer-fdk;
+    maintainers = [ lib.maintainers.jopejoe1 ];
+    pkgConfigModules = [ "mpeghdec" ];
+  };
+})

pkgs/by-name/mp/mpeghdec/pkg-config.patch

@@ -0,0 +1,13 @@
+diff --git a/mpeghdec.pc.in b/mpeghdec.pc.in
+index 752c038bfd..4c0f4ee0fb 100644
+--- a/mpeghdec.pc.in
++++ b/mpeghdec.pc.in
+@@ -1,6 +1,6 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
++includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+
+ Name: @PROJECT_NAME@
+ Description: @PROJECT_DESCRIPTION@

pkgs/by-name/pc/pcre2/package.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pcre2";
-  version = "10.48";
+  version = "10.49";
 
   src = fetchurl {
     url = "https://github.com/PCRE2Project/pcre2/releases/download/pcre2-${finalAttrs.version}/pcre2-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-tsaP3286wxOItQqon/D8ScAMmHwW57UUZJHRIAPyyO0=";
+    hash = "sha256-U8FW4bpBaiDajmU5XaoTLaDYDnaRBCTKyj/Nrngx04Q=";
   };
 
   __structuredAttrs = true;

pkgs/by-name/pc/pcsclite/package.nix

@@ -21,6 +21,7 @@
   pname ? "pcsclite",
   polkitSupport ? false,
   nixosTests,
+  runCommand,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -86,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     # pcsc-spy is a debugging utility and it drags python into the closure
     moveToOutput bin/pcsc-spy "$dev"
+    patchShebangs --host "$dev/bin/pcsc-spy"
   '';
 
   __structuredAttrs = true;
@@ -117,6 +119,13 @@ stdenv.mkDerivation (finalAttrs: {
         package = finalAttrs.finalPackage;
         command = "pcscd --version";
       };
+      pcsc-spy = runCommand "pcsc-spy-test" { } ''
+        status=0
+        ${finalAttrs.finalPackage.dev}/bin/pcsc-spy --help > help.txt 2>&1 || status=$?
+        test "$status" -eq 1
+        grep -F "Usage: pcsc-spy" help.txt
+        touch "$out"
+      '';
     };
     updateScript = nix-update-script { };
   };

pkgs/by-name/rd/rdma-core/package.nix

@@ -31,26 +31,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputs = [
     "out"
+    "dev"
+    "scripts"
   ]
   ++ lib.optionals withManPages [
     "man"
-  ]
-  ++ [
-    "dev"
-    "scripts"
   ];
 
   nativeBuildInputs = [
     cmake
+    pkg-config
+    python3
+    udevCheckHook
   ]
   ++ lib.optionals withManPages [
     docutils
     pandoc
-  ]
-  ++ [
-    pkg-config
-    python3
-    udevCheckHook
   ];
 
   buildInputs = [

pkgs/by-name/ru/ruff/package.nix

@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.16.9";
+  version = "0.16.8";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-gxQXIlle9LGs1HcPiJn7KW0p21xsr62/FGypyqEfnSI=";
+    hash = "sha256-vfyEulokZqx5VyQA3jlKhQhgr/flLIGHcgC7CeegGl0=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-5ZolzeBEj6dolhObhWS/jMyB7KJPRSIbN0+zcG+0AGY=";
+  cargoHash = "sha256-aX9Vu1egtvloe9dspXHR0Amc0mEuWG67EAOQU2b3oM0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/sp/speechd/package.nix

@@ -5,19 +5,23 @@
   pkg-config,
   fetchurl,
   fetchpatch,
+  testers,
   python3Packages,
   gettext,
   itstool,
   libtool,
   texinfo,
-  systemdMinimal,
   util-linux,
   autoreconfHook,
   glib,
   dotconf,
   libsndfile,
+  withSystemd ? stdenv.hostPlatform.isLinux,
+  systemdLibs,
   withLibao ? true,
   libao,
+  withPipewire ? true,
+  pipewire,
   withPulse ? false,
   libpulseaudio,
   withAlsa ? false,
@@ -36,13 +40,13 @@
   nixosTests,
 }:
 
-let
-  inherit (python3Packages) python pyxdg wrapPython;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "speech-dispatcher";
   version = "0.12.1";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchurl {
     url = "https://github.com/brailcom/speechd/releases/download/${finalAttrs.version}/speech-dispatcher-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-sUpSONKH0tzOTdQrvWbKZfoijn5oNwgmf3s0A297pLQ=";
@@ -74,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     libtool
     itstool
     texinfo
-    wrapPython
+    python3Packages.wrapPython
   ];
 
   buildInputs = [
@@ -83,10 +87,13 @@ stdenv.mkDerivation (finalAttrs: {
     libsndfile
     libao
     libpulseaudio
-    python
+    python3Packages.python
   ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    systemdMinimal # libsystemd
+  ++ lib.optionals withSystemd [
+    systemdLibs
+  ]
+  ++ lib.optionals withPipewire [
+    pipewire
   ]
   ++ lib.optionals withAlsa [
     alsa-lib
@@ -104,37 +111,39 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   pythonPath = [
-    pyxdg
+    python3Packages.pyxdg
   ];
 
-  configureFlags = [
-    "--sysconfdir=/etc"
-    # Audio method falls back from left to right.
-    "--with-default-audio-method=\"libao,pulse,alsa,oss\""
-    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
-  ]
-  ++ lib.optionals withPulse [
-    "--with-pulse"
-  ]
-  ++ lib.optionals withAlsa [
-    "--with-alsa"
-  ]
-  ++ lib.optionals withLibao [
-    "--with-libao"
-  ]
-  ++ lib.optionals withOss [
-    "--with-oss"
-  ]
-  ++ lib.optionals withEspeak [
-    "--with-espeak-ng"
-  ]
-  ++ lib.optionals withPico [
-    "--with-pico"
-  ];
+  configureFlags =
+    let
+      inherit (lib) withFeature;
+    in
+    [
+      "--sysconfdir=/etc"
+      # Audio method falls back from left to right.
+      ''--with-default-audio-method="${
+        lib.concatStringsSep "," (
+          lib.optional withLibao "libao"
+          ++ lib.optional withPulse "pulse"
+          ++ lib.optional withAlsa "alsa"
+          ++ lib.optional withPipewire "pipewire"
+          ++ lib.optional withOss "oss"
+        )
+      }"''
+      "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+      "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
+      (withFeature withPulse "pulse")
+      (withFeature withLibao "libao")
+      (withFeature withPipewire "pipewire")
+      (withFeature withAlsa "alsa")
+      (withFeature withOss "oss")
+      (withFeature withEspeak "espeak-ng")
+      (withFeature withFlite "flite")
+      (withFeature withPico "pico")
+    ];
 
   postPatch = lib.optionalString withPico ''
-    substituteInPlace src/modules/pico.c --replace "/usr/share/pico/lang" "${picotts}/share/pico/lang"
+    substituteInPlace src/modules/pico.c --replace-fail "/usr/share/pico/lang" "${picotts}/share/pico/lang"
   '';
 
   installFlags = [
@@ -153,12 +162,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  passthru.tests.nixos = nixosTests.speechd;
+  passthru = {
+    tests = lib.optionalAttrs (!libsOnly) {
+      nixos = nixosTests.speechd;
+
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+    };
+  };
 
   meta = {
     description =
-      "Common interface to speech synthesis" + lib.optionalString libsOnly " - client libraries only";
+      "Common high-level interface to speech synthesis"
+      + lib.optionalString libsOnly " - client libraries only";
     homepage = "https://devel.freebsoft.org/speechd";
+    changelog = "https://github.com/brailcom/speechd/blob/${finalAttrs.version}/NEWS";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ jtojnar ];
     # TODO: remove checks for `withPico` once PR #375450 is merged

pkgs/by-name/sp/spirv-cross/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-HjAVP+yMeybM8VQQO3aKmuxpvjA03EGjKUPWVQKoRuc=";
+    hash = "sha256-9ET3qtdCeCUC069lAtEhDCUi85qedllOncwn7Hx6zJk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sp/spirv-headers/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-headers";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-tGY4H3+5p9M5LBK/xxRdMT9CX+qq3e7fPkaftnpjU9I=";
+    hash = "sha256-PTD3GxQnENDngl6bf9YCmCVmvRgdBZczBosFCOCYEXU=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/sp/spirv-tools/package.nix

@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-tools";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-ne2JF68MJNriPIiA/fRCb6VYH3vWsoyov4S82QQY2AI=";
+    hash = "sha256-EYMtZe3gcskWKgJ1VTS89poc/RyuzmcnJiOys5qfrwU=";
   };
 
   patches = [

pkgs/by-name/su/sudo/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch2,
   fetchurl,
   buildPackages,
   coreutils,
@@ -31,9 +32,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   prePatch = ''
     # do not set sticky bit in nix store
-    substituteInPlace src/Makefile.in --replace 04755 0755
+    substituteInPlace src/Makefile.in --replace-fail 04755 0755
   '';
 
+  patches = [
+    (fetchpatch2 {
+      name = "CVE-2026-96512_1.patch";
+      url = "https://github.com/sudo-project/sudo/commit/db669167ca599f2a94cd8a4c5fae9e473c81a2fd.patch?full_index=1";
+      hash = "sha256-VqfWo/z7CQCtgefzE8xAehjgKn2h1It6GkEt5BUn/OQ=";
+    })
+    (fetchpatch2 {
+      name = "CVE-2026-96512_2.patch";
+      url = "https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c.patch?full_index=1";
+      hash = "sha256-guOdOaIqmXAftpj9gpsRFaAS5g2cS4j7o5DQFqyLZv8=";
+    })
+  ];
+
   configureFlags = [
     "--with-env-editor"
     "--with-editor=/run/current-system/sw/bin/nano"

pkgs/by-name/ut/utf8proc/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "utf8proc";
-  version = "2.11.3";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "JuliaStrings";
     repo = "utf8proc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DF2//R8Oc/+IEJuiG9+rTxQ7nltPcPqdCkzR4T7pUes=";
+    hash = "sha256-+MLxHKgssEM/q4eEHYnbpNTwz/5xZ72ut6AozaLNwo0=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/vu/vulkan-extension-layer/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-extension-layer";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-R9hs69SvZeK0w7YF7rhhVp9mRQing3y8NffWfRlXBQI=";
+    hash = "sha256-m32p7l+uHsXTHySV4ycBBdWONfceZZHtkcAcjDk4MtA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/vu/vulkan-headers/package.nix

@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-headers";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   # Adding `ninja` here to enable Ninja backend. Otherwise on gcc-14 or
   # later the build fails as:
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-tAYvYx/Mqvf/I177xmx7oLZVc7S7GK3MArY3i+FCYuw=";
+    hash = "sha256-E/SBlMW1oUeUT0MtWzQp0k+OSZLc9ho7g+1oTd7z7+Y=";
   };
 
   passthru.updateScript = ./update.sh;

pkgs/by-name/vu/vulkan-loader/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-loader";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-sPv3pA/oclV75CuxsYeIAZ6zH3C6FPmhdI0+djxRExk=";
+    hash = "sha256-hm+e1rynOMa9uBGSzmxaYgzR32ZhWV9VC2q961UoCKo=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];

pkgs/by-name/vu/vulkan-tools-lunarg/package.nix

@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-tools-lunarg";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "VulkanTools";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-7nrEXdt0c02D2Z270W45YBwbfzsTwt854tKx+HlTHYA=";
+    hash = "sha256-ga/vc1EH5+pfFsNsyey/2wFWqiOv0N8NW3jyhUNX1UM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/vu/vulkan-tools/package.nix

@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-kbySCu2c5nh6icnPQV6qplfg1gHFnGPEYOG6G6TG8EU=";
+    hash = "sha256-N0N4ORT1gNe3SWu28498j/UzACBxgkVujTADhegBWIs=";
   };
 
   patches = [ ./wayland-scanner.patch ];

pkgs/by-name/vu/vulkan-utility-libraries/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-WcSiUe3vB7zUO0vpqcVJkKqhnZXz76ApWaoMO49efXg=";
+    hash = "sha256-80+TpPaAbOKg/PrIfc+uYpj1mJ9VLiMXpWnEYjiw048=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/vu/vulkan-validation-layers/package.nix

@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-validation-layers";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-AO1ci608M6CoCrPR6UI2ZjCRlyzOeN8lkimZZODazb0=";
+    hash = "sha256-ljhp40roUrqGD1xVUZmm/g9KECeDDMRVO53a5MhMN68=";
   };
 
   strictDeps = true;

pkgs/by-name/vu/vulkan-volk/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
-  version = "1.4.357.0";
+  version = "1.4.363.0";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "volk";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-iaKwjY4oJz4IdZ4JYuinOmWIFo6TkF7VikWZRhCWfNk=";
+    hash = "sha256-bewo8ZLkNrM9ja5QdXzfdcPaakKtDH0uV8TtGSTv/Q8=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/xd/xdg-utils/package.nix

@@ -3,8 +3,10 @@
   stdenv,
   fetchurl,
   fetchFromGitLab,
+  fetchpatch,
   runCommand,
   writeText,
+  versionCheckHook,
   # docs deps
   libxslt,
   docbook_xml_dtd_412,
@@ -142,7 +144,6 @@ let
         "ktraderclient" # KDE 3
         "ktradertest" # KDE 3
         "mimetype" # alternative tool for file, pulls in perl, avoid
-        "qtpaths" # Plasma
         "qtxdg-mat" # LXQT
       ];
       fix."/usr/bin/file" = true;
@@ -305,7 +306,7 @@ stdenv.mkDerivation (finalAttrs: {
     domain = "gitlab.freedesktop.org";
     owner = "xdg";
     repo = "xdg-utils";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-58ElbrVlk+13DUODSEHBPcDDt9H+Kuee8Rz9CIcoy0I=";
   };
 
@@ -315,6 +316,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./allow-forcing-portal-use.patch
     #  Enable build of xdg-terminal
     ./enable-xdg-terminal.patch
+    # Get rid of qtpaths runtime dependency (can be dropped in next release)
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/xdg/xdg-utils/-/commit/e6a6e4f1fbcb029bac0cb8eecdeb2879694e1ba8.patch";
+      hash = "sha256-toSFzIaw7gCWZH/kvIalWDQYL1xecOsRBAHvpbBlsY8=";
+    })
   ];
 
   # just needed when built from git
@@ -333,6 +339,10 @@ stdenv.mkDerivation (finalAttrs: {
     map (resholve.phraseSolution "xdg-utils-resholved") solutions
   );
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/xdg-terminal";
+
   passthru.tests.xdg-mime =
     runCommand "xdg-mime-test"
       {
@@ -365,6 +375,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.freedesktop.org/wiki/Software/xdg-utils/";
+    downloadPage = "https://gitlab.freedesktop.org/xdg/xdg-utils";
+    changelog = "https://gitlab.freedesktop.org/xdg/xdg-utils/-/releases/${finalAttrs.src.tag}";
     description = "Set of command line tools that assist applications with a variety of desktop integration tasks";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;

pkgs/data/fonts/dejavu-fonts/default.nix

@@ -40,6 +40,8 @@ let
       perlPackages.FontTTF
     ];
 
+    strictDeps = true;
+
     src = fetchFromGitHub {
       owner = "dejavu-fonts";
       repo = "dejavu-fonts";
@@ -53,25 +55,37 @@ let
 
     installPhase = "install -m444 -Dt $out/share/fonts/truetype build/*.ttf";
 
+    __structuredAttrs = true;
+
     inherit meta;
   };
 
   minimal = stdenv.mkDerivation {
     pname = "dejavu-fonts-minimal";
     inherit version;
+    strictDeps = true;
+
     buildCommand = ''
       install -m444 -Dt $out/share/fonts/truetype ${full-ttf}/share/fonts/truetype/DejaVuSans.ttf
     '';
+
+    __structuredAttrs = true;
+
     inherit meta;
   };
 in
 stdenv.mkDerivation {
   pname = "dejavu-fonts";
   inherit version;
+  strictDeps = true;
+
   buildCommand = ''
     install -m444 -Dt $out/share/fonts/truetype ${full-ttf}/share/fonts/truetype/*.ttf
     ln -s --relative --force --target-directory=$out/share/fonts/truetype ${minimal}/share/fonts/truetype/DejaVuSans.ttf
   '';
+
+  __structuredAttrs = true;
+
   inherit meta;
 
   passthru = { inherit minimal full-ttf; };

pkgs/development/compilers/ocaml/5.5.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
   major_version = "5";
   minor_version = "5";
-  patch_version = "0";
-  sha256 = "sha256-/MauZl0exR1SUQ6qx4NKhqmAa/WiWLt8ynhzP8zwFbo=";
+  patch_version = "1";
+  sha256 = "sha256-zQqXvb/JnwD1P07khJGWTHNievsJ7Y5N4jC6RIij1rk=";
 }

pkgs/development/interpreters/guile/1.8.nix

@@ -10,14 +10,15 @@
   pkg-config,
   pkgsBuildBuild,
   readline,
+  guileImportsCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "guile";
   version = "1.8.8";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
+    url = "mirror://gnu/guile/guile-${finalAttrs.version}.tar.gz";
     sha256 = "0l200a0v7h8bh0cwz6v7hc13ds39cgqsmfrks55b1rbj5vniyiy3";
   };
 
@@ -57,6 +58,9 @@ stdenv.mkDerivation rec {
     # see below.
     libtool
   ];
+  propagatedNativeBuildInputs = lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+    (guileImportsCheckHook.override { effectiveVersion = finalAttrs.passthru.effectiveVersion; })
+  ];
 
   patches = [
     # Fix doc snarfing with GCC 4.5.
@@ -89,12 +93,12 @@ stdenv.mkDerivation rec {
   # This is fixed here:
   # <https://git.savannah.gnu.org/cgit/guile.git/commit/?h=branch_release-1-8&id=a0aa1e5b69d6ef0311aeea8e4b9a94eae18a1aaf>.
   doCheck = false;
-  doInstallCheck = doCheck;
+  doInstallCheck = finalAttrs.doCheck;
 
   setupHook = ./setup-hook-1.8.sh;
 
   passthru = {
-    effectiveVersion = lib.versions.majorMinor version;
+    effectiveVersion = lib.versions.majorMinor finalAttrs.version;
     siteCcacheDir = "lib/guile/site-ccache";
     siteDir = "share/guile/site";
   };
@@ -114,4 +118,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ ludo ];
     platforms = lib.platforms.all;
   };
-}
+})

pkgs/development/interpreters/guile/2.0.nix

@@ -5,7 +5,6 @@
   fetchpatch,
   boehmgc,
   buildPackages,
-  coverageAnalysis ? null,
   gawk,
   gmp,
   libffi,
@@ -15,18 +14,15 @@
   pkg-config,
   pkgsBuildBuild,
   readline,
+  guileImportsCheckHook,
 }:
 
-let
-  # Do either a coverage analysis build or a standard build.
-  builder = if coverageAnalysis != null then coverageAnalysis else stdenv.mkDerivation;
-in
-builder rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "guile";
   version = "2.0.13";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
+    url = "mirror://gnu/guile/guile-${finalAttrs.version}.tar.xz";
     sha256 = "12yqkr974y91ylgw6jnmci2v90i90s7h9vxa4zk0sai8vjnz4i1p";
   };
 
@@ -63,6 +59,9 @@ builder rec {
     libtool
     libunistring
   ];
+  propagatedNativeBuildInputs = lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+    (guileImportsCheckHook.override { effectiveVersion = finalAttrs.passthru.effectiveVersion; })
+  ];
 
   enableParallelBuilding = true;
 
@@ -81,7 +80,6 @@ builder rec {
       sha256 = "0p6c1lmw1iniq03z7x5m65kg3lq543kgvdb4nrxsaxjqf3zhl77v";
     })
   ]
-  ++ (lib.optional (coverageAnalysis != null) ./gcov-file-name.patch)
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     ./filter-mkostemp-darwin.patch
     (fetchpatch {
@@ -136,14 +134,14 @@ builder rec {
   # make check doesn't work on darwin
   # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
   doCheck = false;
-  doInstallCheck = doCheck;
+  doInstallCheck = finalAttrs.doCheck;
 
   setupHook = ./setup-hook-2.0.sh;
 
-  passthru = rec {
-    effectiveVersion = lib.versions.majorMinor version;
-    siteCcacheDir = "lib/guile/${effectiveVersion}/site-ccache";
-    siteDir = "share/guile/site/${effectiveVersion}";
+  passthru = {
+    effectiveVersion = lib.versions.majorMinor finalAttrs.version;
+    siteCcacheDir = "lib/guile/${finalAttrs.passthru.effectiveVersion}/site-ccache";
+    siteDir = "share/guile/site/${finalAttrs.passthru.effectiveVersion}";
   };
 
   meta = {
@@ -162,7 +160,7 @@ builder rec {
     maintainers = with lib.maintainers; [ ludo ];
     platforms = lib.platforms.all;
   };
-}
+})
 
 //
 

pkgs/development/interpreters/guile/2.2.nix

@@ -15,18 +15,15 @@
   pkg-config,
   pkgsBuildBuild,
   readline,
+  guileImportsCheckHook,
 }:
 
-let
-  # Do either a coverage analysis build or a standard build.
-  builder = if coverageAnalysis != null then coverageAnalysis else stdenv.mkDerivation;
-in
-builder rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "guile";
   version = "2.2.7";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
+    url = "mirror://gnu/guile/guile-${finalAttrs.version}.tar.xz";
     sha256 = "013mydzhfswqci6xmyc1ajzd59pfbdak15i0b090nhr9bzm7dxyd";
   };
 
@@ -62,6 +59,9 @@ builder rec {
     libtool
     libunistring
   ];
+  propagatedNativeBuildInputs = lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+    (guileImportsCheckHook.override { effectiveVersion = finalAttrs.passthru.effectiveVersion; })
+  ];
 
   # According to Bernhard M. Wiedemann <bwiedemann suse de> on
   # #reproducible-builds on irc.oftc.net, (2020-01-29): they had to
@@ -75,7 +75,6 @@ builder rec {
     # Read the header of the patch to more info
     ./eai_system.patch
   ]
-  ++ lib.optional (coverageAnalysis != null) ./gcov-file-name.patch
   ++ lib.optional stdenv.hostPlatform.isDarwin (fetchpatch {
     url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
     sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
@@ -124,14 +123,14 @@ builder rec {
   # make check doesn't work on darwin
   # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
   doCheck = false;
-  doInstallCheck = doCheck;
+  doInstallCheck = finalAttrs.doCheck;
 
   setupHook = ./setup-hook-2.2.sh;
 
-  passthru = rec {
-    effectiveVersion = lib.versions.majorMinor version;
-    siteCcacheDir = "lib/guile/${effectiveVersion}/site-ccache";
-    siteDir = "share/guile/site/${effectiveVersion}";
+  passthru = {
+    effectiveVersion = lib.versions.majorMinor finalAttrs.version;
+    siteCcacheDir = "lib/guile/${finalAttrs.passthru.effectiveVersion}/site-ccache";
+    siteDir = "share/guile/site/${finalAttrs.passthru.effectiveVersion}";
   };
 
   meta = {
@@ -149,4 +148,4 @@ builder rec {
     maintainers = with lib.maintainers; [ ludo ];
     platforms = lib.platforms.all;
   };
-}
+})

pkgs/development/interpreters/guile/3.0.nix

@@ -5,7 +5,6 @@
   fetchpatch,
   boehmgc,
   buildPackages,
-  coverageAnalysis ? null,
   gawk,
   gmp,
   libffi,
@@ -19,19 +18,16 @@
   readline,
   writeScript,
   pkgsStatic,
+  guileImportsCheckHook,
 }:
 
-let
-  # Do either a coverage analysis build or a standard build.
-  builder = if coverageAnalysis != null then coverageAnalysis else stdenv.mkDerivation;
-in
-builder rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "guile";
   version = "3.0.11";
 
   src = fetchurl {
-    url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-gYx50jZlen+pb7NkE3zHtBs73uDWXGF0ygN2lVlXlGA=";
+    url = "mirror://gnu/guile/guile-${finalAttrs.version}.tar.xz";
+    hash = "sha256-gYx50jZlen+pb7NkE3zHtBs73uDWXGF0ygN2lVlXlGA=";
   };
 
   outputs = [
@@ -77,6 +73,9 @@ builder rec {
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     libxcrypt
   ];
+  propagatedNativeBuildInputs = lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+    (guileImportsCheckHook.override { effectiveVersion = finalAttrs.passthru.effectiveVersion; })
+  ];
 
   strictDeps = true;
 
@@ -89,7 +88,6 @@ builder rec {
   patches = [
     ./eai_system.patch
   ]
-  ++ lib.optional (coverageAnalysis != null) ./gcov-file-name.patch
   ++ lib.optional stdenv.hostPlatform.isDarwin (fetchpatch {
     url = "https://gitlab.gnome.org/GNOME/gtk-osx/raw/52898977f165777ad9ef169f7d4818f2d4c9b731/patches/guile-clocktime.patch";
     sha256 = "12wvwdna9j8795x59ldryv9d84c1j3qdk2iskw09306idfsis207";
@@ -145,7 +143,7 @@ builder rec {
   # make check doesn't work on darwin
   # On Linuxes+Hydra the tests are flaky; feel free to investigate deeper.
   doCheck = false;
-  doInstallCheck = doCheck;
+  doInstallCheck = finalAttrs.doCheck;
 
   # guile-3 uses ELF files to store bytecode. strip does not
   # always handle them correctly and destroys the image:
@@ -156,12 +154,12 @@ builder rec {
 
   setupHook = ./setup-hook-3.0.sh;
 
-  passthru = rec {
+  passthru = {
     tests.static = pkgsStatic.guile;
 
-    effectiveVersion = lib.versions.majorMinor version;
-    siteCcacheDir = "lib/guile/${effectiveVersion}/site-ccache";
-    siteDir = "share/guile/site/${effectiveVersion}";
+    effectiveVersion = lib.versions.majorMinor finalAttrs.version;
+    siteCcacheDir = "lib/guile/${finalAttrs.passthru.effectiveVersion}/site-ccache";
+    siteDir = "share/guile/site/${finalAttrs.passthru.effectiveVersion}";
 
     updateScript = writeScript "update-guile-3" ''
       #!/usr/bin/env nix-shell
@@ -193,4 +191,4 @@ builder rec {
     platforms = lib.platforms.all;
     mainProgram = "guile";
   };
-}
+})

pkgs/development/interpreters/guile/gcov-file-name.patch

@@ -1,42 +0,0 @@
-This patch arranges so that we don't end up, with profiling builds, with a
-file named `<stdout>.gcov' since that confuses lcov:
-
-  <stdout>:cannot open source file
-  geninfo: ERROR: cannot read <stdout>.gcov!
-
---- guile/libguile/c-tokenize.c	2009-09-13 13:05:15.000000000 +0200
-+++ guile/libguile/c-tokenize.c	2009-10-28 16:24:15.000000000 +0100
-@@ -1,5 +1,5 @@
- 
--#line 3 "<stdout>"
-+#line 3 "c-tokenize.c"
- 
- #define  YY_INT_ALIGNED short int
- 
-@@ -616,7 +616,7 @@ int cookie_was_last = 0; 
- #define IS_COOKIE cookie_was_last = 1
- #define IS_NOT_COOKIE cookie_was_last = 0
-  
--#line 620 "<stdout>"
-+#line 620 "c-tokenize.c"
- 
- #define INITIAL 0
- 
-@@ -799,7 +799,7 @@ YY_DECL
- #line 65 "./c-tokenize.lex"
- 
- 
--#line 803 "<stdout>"
-+#line 803 "c-tokenize.c"
- 
- 	if ( !(yy_init) )
- 		{
-@@ -1235,7 +1235,7 @@ YY_RULE_SETUP
- #line 181 "./c-tokenize.lex"
- ECHO;
- 	YY_BREAK
--#line 1239 "<stdout>"
-+#line 1239 "c-tokenize.c"
- case YY_STATE_EOF(INITIAL):
- 	yyterminate();
- 

pkgs/development/interpreters/ruby/default.nix

@@ -399,14 +399,14 @@ in
   mkRuby = generic;
 
   ruby_3_3 = generic {
-    version = rubyVersion "3" "3" "10" "";
-    hash = "sha256-tVW6pGejBs/I5sbtJNDSeyfpob7R2R2VUJhZ6saw6Sg=";
+    version = rubyVersion "3" "3" "12" "";
+    hash = "sha256-sG1jvq4nGTMDPifwo4m8WCoAnnhFNX1ENlw53lJaBRs=";
     cargoHash = "sha256-xE7Cv+NVmOHOlXa/Mg72CTSaZRb72lOja98JBvxPvSs=";
   };
 
   ruby_3_4 = generic {
-    version = rubyVersion "3" "4" "9" "";
-    hash = "sha256-e7TU9egHzCclHRTZ1ghtGCxbJYdRkeRKsVtwnNen3Zw=";
+    version = rubyVersion "3" "4" "11" "";
+    hash = "sha256-XCK+RFJDErPUM9aHObzFMGM7HaXvi6CvoKN2gNoX094=";
     cargoHash = "sha256-5Tp8Kth0yO89/LIcU8K01z6DdZRr8MAA0DPKqDEjIt0=";
   };
 

pkgs/development/interpreters/spidermonkey/140.nix

@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "140.14.0";
-  hash = "sha512-BgnMqb+uy/9WzfE0WFNL2M+kPxOQVoZ9O2OUp2coFZnuYA+DFlrSVWXO1ZtVJZKqhEMTV0WMzs++W/EE3KUBxw==";
+  version = "140.16.0";
+  hash = "sha512-+r9bSBWUqahgtq43nS7om6KRuAfJQzTuFbrR/oYu20fCLokNiS4z1qbsV/zkqxKqnJxvpKUBuIHsxiEawEvZoA==";
 }

pkgs/development/interpreters/tcl/generic.nix

@@ -228,6 +228,7 @@ stdenv.mkDerivation (finalAttrs: {
           name = "tcl-requires-check-hook";
           substitutions = {
             tcl_hook = ./tcl-requires-check-hook.tcl;
+            tclsh = lib.getExe finalAttrs.finalPackage;
           };
           meta = {
             inherit (finalAttrs.meta) maintainers platforms;

pkgs/development/interpreters/tcl/tcl-requires-check-hook.sh

@@ -7,7 +7,7 @@ tclRequiresCheckPhase () {
     if [ -n "$tclRequiresCheck" ]; then
         export TCLLIBPATH="$out/lib $TCLLIBPATH" # Redundant if tcl-package-hook is also used
         # FIXME: For some reason the output gets swallowed unless we pipe it through cat‽
-        tclsh @tcl_hook@ 2>&1 | cat
+        @tclsh@ @tcl_hook@ 2>&1 | cat
     fi
 }
 

pkgs/development/libraries/ffmpeg/generic.nix

@@ -54,6 +54,7 @@
   withBs2b ? withFullDeps, # bs2b DSP library
   withBzlib ? withHeadlessDeps,
   withCaca ? withFullDeps, # Textual display (ASCII art)
+  withCairo ? withFullDeps && lib.versionAtLeast version "8.1", # drawing via vgs
   withCdio ? withFullDeps && withGPL, # Audio CD grabbing
   withCelt ? withFullDeps && lib.versionOlder version "9.0", # CELT decoder
   withChromaprint ? withFullDeps, # Audio fingerprinting
@@ -112,6 +113,7 @@
   withMfx ? false, # Hardware acceleration via intel-media-sdk/libmfx
   withModplug ? withFullDeps && !stdenv.hostPlatform.isDarwin, # ModPlug support
   withMp3lame ? withHeadlessDeps, # LAME MP3 encoder
+  withMpeghdec ? withFullDeps && (!withGPL || withUnfree) && lib.versionAtLeast version "8.1", # MPEG-H decoder
   withMysofa ? withFullDeps, # HRTF support via SOFAlizer
   withNpp ? withFullDeps && withUnfree && config.cudaSupport, # Nvidia Performance Primitives-based code
   withNvdec ? withHeadlessDeps && withNvcodec,
@@ -119,6 +121,7 @@
   withOpenal ? withFullDeps, # OpenAL 1.1 capture support
   withOpenapv ? withHeadlessDeps && lib.versionAtLeast version "8.0", # APV encoding support
   withOpencl ? withHeadlessDeps,
+  withOpenColorIO ? withFullDeps && lib.versionAtLeast version "8.1", # Color Managment
   withOpencoreAmrnb ? withFullDeps && withVersion3, # AMR-NB de/encoder
   withOpencoreAmrwb ? withFullDeps && withVersion3, # AMR-WB decoder
   withOpengl ? withFullDeps && !stdenv.hostPlatform.isDarwin, # OpenGL rendering
@@ -258,6 +261,7 @@
   aribb24,
   avisynthplus,
   bzip2,
+  cairo,
   celt,
   chromaprint,
   codec2,
@@ -326,12 +330,14 @@
   libxext,
   libxml2,
   libxv,
+  mpeghdec,
   nv-codec-headers,
   nv-codec-headers-12,
   ocl-icd, # OpenCL ICD
   openal,
   openapv,
   opencl-headers, # OpenCL headers
+  opencolorio,
   opencore-amr,
   openh264,
   openjpeg,
@@ -625,6 +631,11 @@ stdenv.mkDerivation (
       (enableFeature withBs2b "libbs2b")
       (enableFeature withBzlib "bzlib")
       (enableFeature withCaca "libcaca")
+    ]
+    ++ optionals (versionAtLeast version "8.1") [
+      (enableFeature withCairo "cairo")
+    ]
+    ++ [
       (enableFeature withCdio "libcdio")
     ]
     ++ optionals (versionOlder version "9.0") [
@@ -693,6 +704,11 @@ stdenv.mkDerivation (
       (enableFeature withMfx "libmfx")
       (enableFeature withModplug "libmodplug")
       (enableFeature withMp3lame "libmp3lame")
+    ]
+    ++ optionals (versionAtLeast version "8.1") [
+      (enableFeature withMpeghdec "libmpeghdec")
+    ]
+    ++ [
       (enableFeature withMysofa "libmysofa")
       (enableFeature withNpp "libnpp")
       (enableFeature withNvdec "nvdec")
@@ -704,6 +720,11 @@ stdenv.mkDerivation (
     ]
     ++ [
       (enableFeature withOpencl "opencl")
+    ]
+    ++ lib.optionals (versionAtLeast version "8.1") [
+      (enableFeature withOpenColorIO "libopencolorio")
+    ]
+    ++ [
       (enableFeature withOpencoreAmrnb "libopencore-amrnb")
       (enableFeature withOpencoreAmrwb "libopencore-amrwb")
       (enableFeature withOpengl "opengl")
@@ -878,6 +899,7 @@ stdenv.mkDerivation (
       ++ optionals withBs2b [ libbs2b ]
       ++ optionals withBzlib [ bzip2 ]
       ++ optionals withCaca [ libcaca ]
+      ++ optionals withCairo [ cairo ]
       ++ optionals withCdio [
         libcdio
         libcdio-paranoia
@@ -922,6 +944,7 @@ stdenv.mkDerivation (
       ++ optionals withMfx [ intel-media-sdk ]
       ++ optionals withModplug [ libmodplug ]
       ++ optionals withMp3lame [ lame ]
+      ++ optionals withMpeghdec [ mpeghdec ]
       ++ optionals withMysofa [ libmysofa ]
       ++ optionals withNpp [
         libnpp
@@ -934,6 +957,7 @@ stdenv.mkDerivation (
         ocl-icd
         opencl-headers
       ]
+      ++ optionals withOpenColorIO [ opencolorio ]
       ++ optionals (withOpencoreAmrnb || withOpencoreAmrwb) [ opencore-amr ]
       ++ optionals withOpengl [
         libGL

pkgs/development/libraries/glibc/common.nix

@@ -51,7 +51,7 @@
 
 let
   version = "2.44";
-  patchSuffix = "-25";
+  patchSuffix = "-50";
   sha256 = "sha256-N/YA8r7zxegwAUcFlWiyouQKetbMxlzpQlVtSUKcxmc=";
 in
 
@@ -69,7 +69,7 @@ stdenv.mkDerivation (
       /*
         No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
          $ git fetch --all -p && git checkout origin/release/2.42/master && git describe
-         glibc-2.44-25-gafd131806b
+         glibc-2.44-50-g1848099f06
          $ git show --minimal --reverse glibc-2.44.. ':!ADVISORIES' > 2.44-master.patch
 
         To compare the archive contents zdiff can be used.

pkgs/development/libraries/gstreamer/good/default.nix

@@ -24,7 +24,6 @@
   libshout,
   cairo,
   gdk-pixbuf,
-  aalib,
   libcaca,
   libsoup_3,
   libpulseaudio,
@@ -154,7 +153,6 @@ stdenv.mkDerivation (finalAttrs: {
     taglib
     cairo
     gdk-pixbuf
-    aalib
     libcaca
     libsoup_3
     libshout
@@ -237,6 +235,8 @@ stdenv.mkDerivation (finalAttrs: {
       ximagesrc = enableX11; # Linux-only
       jack = enableJack;
 
+      aalib = false;
+
       # Linux only
       dv1394 = enableFireWire;
       oss = enableOSS;

pkgs/development/libraries/libxml2/common.nix

@@ -120,9 +120,13 @@ stdenv'.mkDerivation (finalAttrs: {
     substituteInPlace python/libxml2mod.la --replace-fail "$dev/${python3.sitePackages}" "$py/${python3.sitePackages}"
   '';
 
+  preFixup = ''
+    # xml2-config will end up in $dev, so we must patch its shebangs for the build host
+    patchShebangs --build $bin/bin/xml2-config
+  '';
+
   postFixup = ''
     moveToOutput bin/xml2-config "$dev"
-    moveToOutput lib/xml2Conf.sh "$dev"
   ''
   + lib.optionalString (enableStatic && enableShared) ''
     moveToOutput lib/libxml2.a "$static"

pkgs/development/libraries/openssl/default.nix

@@ -413,8 +413,8 @@ in
   # - backport every security critical fix release e.g. 3.0.y -> 3.0.y+1 but no new version, e.g. 3.1 -> 3.2
 
   openssl_3_5 = common {
-    version = "3.5.8";
-    hash = "sha256-qPhKOZGOxkFc52XZtCnTE7qXuBQxacFy5zS5UURk9bI=";
+    version = "3.5.9";
+    hash = "sha256-YD9WAuLu8A13+9Qp003NWCK7MBdXobyc2yTGcPHrhZo=";
 
     patches = [
       # Support for NIX_SSL_CERT_FILE, motivation:

pkgs/development/python-modules/gitpython/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gitpython";
-  version = "3.1.58";
+  version = "3.1.62";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gitpython-developers";
     repo = "GitPython";
     tag = finalAttrs.version;
-    hash = "sha256-C6hrN7SRWngwkD/NYvsoEVQUagdurkxzWbnn42EJOHE=";
+    hash = "sha256-g7qZSFFWAa7iJSn+HAxCTfNZfrYZsZRJGUIZGYQjoUI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/grpcio-channelz/default.nix

@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.83.1";
+  version = "1.84.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_channelz";
     inherit version;
-    hash = "sha256-XrsLFMK8yBFJ4oSNHSZCQEJnYqBQsinTNzRruzfT4x8=";
+    hash = "sha256-hCIO8ufsCjeSoVG2/7xwaRvw8JzQCf5zTylGuRdWVpQ=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/grpcio-health-checking/default.nix

@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.83.1";
+  version = "1.84.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_health_checking";
     inherit version;
-    hash = "sha256-1gkk5vutOPNcNyd5vF62UaAORG1tJPHRxy8UKXodDlY=";
+    hash = "sha256-xp6jd1pfkM0JTylIWd/QFQpWD3EBqJNr97Tgi3GGoU4=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/grpcio-reflection/default.nix

@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.83.1";
+  version = "1.84.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_reflection";
     inherit version;
-    hash = "sha256-wzlT8urhMTqx0sK2oc7G3a6+Z2PaGyYxmAeS2XkuYjM=";
+    hash = "sha256-Br89fYzvmvvMch7lIZFlK0SDgxd0JV4XRASw4FUXQbw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/grpcio-status/default.nix

@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.83.1";
+  version = "1.84.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_status";
     inherit version;
-    hash = "sha256-wIyNVT1quW7/rh2SODneIpJvWjFqlC9IpIBA4EfFF68=";
+    hash = "sha256-XK8ounGEuB9hi19/CUhZ/SVBv0KdIYm7vNcVycLNzuI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/grpcio-testing/default.nix

@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.83.1";
+  version = "1.84.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_testing";
     inherit version;
-    hash = "sha256-xye7371SOlXGMECLeX/43w89GEFyHV8+eOoV4C/39Vs=";
+    hash = "sha256-QT0NHlyGab385gx380aoBryPcUtZfJC/IA9D3sYGJFg=";
   };
 
   postPatch = ''

pkgs/development/python-modules/grpcio-tools/default.nix

@@ -13,13 +13,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.83.1";
+  version = "1.84.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_tools";
     inherit version;
-    hash = "sha256-qBSO7OOW+KNJCXlYvADxSIIAMzHzt8KugHnBxjLRfW8=";
+    hash = "sha256-IQrFrJgDVpSQ7DNXS36ZW8CHgVsA2bd34BNMq17Zo3k=";
   };
 
   postPatch = ''

pkgs/development/python-modules/grpcio/default.nix

@@ -18,12 +18,12 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.83.1";
+  version = "1.84.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-nO5vy/LrV8S0lFF4e/qHvo78HKAqCzJ91LVNRFAuNis=";
+    hash = "sha256-Garxcvwu2+/Mzj9uksUVCXXb5WxFdE6eh89y69+Fv74=";
   };
 
   postPatch = ''