Merge 6e369fe949 into haskell-updates

A fix has been merged upstream, but not released, yet - so adding the
warning to pick that up automatically on the next bump.

maintainers/maintainer-list.nix

@@ -15629,12 +15629,6 @@
     githubId = 632767;
     name = "Guillaume Maudoux";
   };
-  layzyoldman = {
-    email = "ricardopaivacampos@gmail.com";
-    github = "layzyoldman";
-    githubId = 193278607;
-    name = "Ricardo Campos";
-  };
   LazilyStableProton = {
     email = "LazilyStable@proton.me";
     github = "LazyStability";
@@ -19316,12 +19310,6 @@
     githubId = 220262;
     name = "Ion Mudreac";
   };
-  mugaizzo = {
-    email = "mugahedman@hotmail.com";
-    github = "mugaizzo";
-    githubId = 15838537;
-    name = "Mugahed Izzeldin";
-  };
   mulatta = {
     email = "seungwon@mulatta.io";
     github = "mulatta";
@@ -19819,12 +19807,6 @@
     githubId = 364510;
     name = "Tobias Geerinckx-Rice";
   };
-  ndavd = {
-    email = "email@ndavd.com";
-    github = "ndavd";
-    githubId = 74260683;
-    name = "Nuno David";
-  };
   ndl = {
     email = "ndl@endl.ch";
     github = "ndl";
@@ -30909,11 +30891,6 @@
     githubId = 106241330;
     name = "Success Kingsley";
   };
-  xqtc161 = {
-    github = "xqtc161";
-    githubId = 65857432;
-    name = "tila";
-  };
   xrelkd = {
     github = "xrelkd";
     githubId = 46590321;

maintainers/scripts/haskell/eval-pkg-sets.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+#!nix-shell -p jq git
+# shellcheck shell=bash
+#
+# Usage: eval-pkg-sets.sh [extra flags for nix-* commands ...]
+#
+# Must be executed in a git checkout of Nixpkgs.
+
+set -euo pipefail
+
+NIXPKGS="$(git rev-parse --show-toplevel)"
+PKGSETS="$(nix-env --readonly-mode --json --drv-path -f "$NIXPKGS" -qaP -A haskell.compiler "$@" \
+  | jq -r 'to_entries | unique_by(.value.drvPath) .[] .key | sub("^haskell.compiler";"haskell.packages")')"
+
+trap 'exit 1' SIGINT SIGTERM
+
+set +e
+
+badsets=""
+for set in $PKGSETS; do
+  # Confirm an equivalent package set to haskell.compiler.$entry exists and is usable
+  if ! nix-instantiate --readonly-mode -A "$set.ghc" "$@" > /dev/null 2>&1; then
+    echo "Skipping $set... ($set.ghc does not evaluate)"
+  else
+    echo "Evaluating $set..."
+
+    if ! nix-env --readonly-mode -f "$NIXPKGS" -qaP --drv-path -A "$set" "$@" > /dev/null; then
+      badsets+="$set "
+    fi
+  fi
+done
+
+if [ -n "$badsets" ]; then
+  echo "Found potential eval issues in the following sets:" >&2
+  # shellcheck disable=SC2086
+  printf '%s\n' $badsets
+  exit 1
+fi

maintainers/scripts/haskell/update-stackage.sh

@@ -33,7 +33,7 @@ fi
 
 # Stackage solver to use, LTS or Nightly
 # (should be capitalized like the display name)
-SOLVER=LTS
+SOLVER=Nightly
 # Stackage solver verson, if any. Use latest if empty
 VERSION=
 TMP_TEMPLATE=update-stackage.XXXXXXX
@@ -105,6 +105,7 @@ sed -r \
     -e '/ hledger-ui /d' \
     -e '/ hledger-web /d' \
     -e '/ spacecookie /d' \
+    -e '/ hnix-store-core /d' \
     < "${tmpfile_new}" >> $stackage_config
 # Explanations:
 # cabal2nix, distribution-nixpkgs, jailbreak-cabal, language-nix: These are our packages and we know what we are doing.

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -77,12 +77,6 @@
 
 - A number of options for `services.llama-cpp` have been removed in favor of the structured [](#opt-services.llama-cpp.settings) option, attributes from which are used as arguments to `llama-server` executable, you can see all available options by running `llama-server --help`. Configuring model presets using Nix attribute set via `services.llama-cpp.modelsPreset` is no longer supported, please use `services.llama-cpp.settings.models-preset` with a path to an INI file containing desired options.
 
-- The `NIX_XDG_DESKTOP_PORTAL_DIR` environment variable is no longer used in the `xdg-desktop-portal` package and is therefore no longer set in `xdg.portal` module.
-  Instead the `XDG_DATA_DIRS` environment variable is used to find xdg-portals.
-
-  If you were relying on `NIX_XDG_DESKTOP_PORTAL_DIR` to point at custom portal
-  definitions, add the package providing them to `xdg.portal.extraPortals`.
-
 - Python 2 has been removed from the top-level package set, as it is long past end-of-life. The `python2`, `python27`, `python2Full`, `python27Full`, `python2Packages`, and `python27Packages` attributes, along with the legacy `python`, `pythonFull`, and `pythonPackages` aliases, now throw an error directing you to `python3`. The `isPy2` and `isPy27` package flags have been removed accordingly. The only remaining Python 2 interpreter is vendored inside the `resholve` package for its `oil` dependency and is not exposed for general use.
 
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.

nixos/modules/config/xdg/portal.nix

@@ -150,6 +150,7 @@ in
 
         sessionVariables = {
           NIXOS_XDG_OPEN_USE_PORTAL = mkIf cfg.xdgOpenUsePortal "1";
+          NIX_XDG_DESKTOP_PORTAL_DIR = "/run/current-system/sw/share/xdg-desktop-portal/portals";
         };
 
         etc = lib.concatMapAttrs (

nixos/modules/programs/bat.nix

@@ -8,7 +8,6 @@ let
   inherit (builtins) isList;
   inherit (lib)
     concatMapStrings
-    escapeShellArg
     literalExpression
     maintainers
     mapAttrs'
@@ -35,7 +34,7 @@ let
     else if isBool value then
       boolToString value
     else
-      escapeShellArg (toString value);
+      toString value;
 in
 {
   options.programs.bat = {

nixos/modules/services/misc/jellyfin.nix

@@ -33,11 +33,7 @@ let
     ;
   cfg = config.services.jellyfin;
   filteredDecodingCodecs = builtins.filter (
-    c:
-    c != "hevc10bit"
-    && c != "hevcRExt10bit"
-    && c != "hevcRExt12bit"
-    && cfg.transcoding.hardwareDecodingCodecs.${c}
+    c: c != "hevcRExt10bit" && c != "hevcRExt12bit" && cfg.transcoding.hardwareDecodingCodecs.${c}
   ) (builtins.attrNames cfg.transcoding.hardwareDecodingCodecs);
   encodingXmlText = ''
     <?xml version="1.0" encoding="utf-8"?>
@@ -62,7 +58,6 @@ let
       <AllowAv1Encoding>${boolToString cfg.transcoding.hardwareEncodingCodecs.av1}</AllowAv1Encoding>
       <EnableIntelLowPowerH264HwEncoder>${boolToString cfg.transcoding.enableIntelLowPowerEncoding}</EnableIntelLowPowerH264HwEncoder>
       <EnableIntelLowPowerHevcHwEncoder>${boolToString cfg.transcoding.enableIntelLowPowerEncoding}</EnableIntelLowPowerHevcHwEncoder>
-      <EnableDecodingColorDepth10Hevc>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevc10bit}</EnableDecodingColorDepth10Hevc>
       <EnableDecodingColorDepth10HevcRext>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevcRExt10bit}</EnableDecodingColorDepth10HevcRext>
       <EnableDecodingColorDepth12HevcRext>${boolToString cfg.transcoding.hardwareDecodingCodecs.hevcRExt12bit}</EnableDecodingColorDepth12HevcRext>
       <HardwareDecodingCodecs>

nixos/modules/system/boot/resolved.nix

@@ -30,8 +30,9 @@ let
 
   dnsmasqResolve = config.services.dnsmasq.enable && config.services.dnsmasq.resolveLocalQueries;
 
-  transformSettings = settings: {
-    Resolve = lib.mapAttrs (
+  transformSettings =
+    settings:
+    lib.mapAttrs (
       key: value:
       # concat lists for options that should result in space-separated values
       if
@@ -45,8 +46,7 @@ let
         concatStringsSep " " value
       else
         value
-    ) settings.Resolve;
-  };
+    ) settings;
 
   resolvedConf = settingsToSections (transformSettings cfg.settings);
 in

nixos/tests/geoclue2.nix

@@ -31,6 +31,6 @@
       assert ("Latitude:    12.345000°" in whereAmI), f"Incorrect latitude in:\n{whereAmI}"
       assert ("Longitude:   -67.890000°" in whereAmI), f"Incorrect longitude in:\n{whereAmI}"
       assert ("Altitude:    123.450000 meters" in whereAmI), f"Incorrect altitude in:\n{whereAmI}"
-      assert ("Accuracy:    1000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
+      assert ("Accuracy:    1000.000000 meters" in whereAmI), f"Incorrect accuracy in:\n{whereAmI}"
     '';
 }

nixos/tests/jellyfin.nix

@@ -33,7 +33,6 @@
           hardwareDecodingCodecs = {
             h264 = true;
             hevc = true;
-            hevc10bit = true;
             vp9 = true;
             hevcRExt10bit = true;
             hevcRExt12bit = true;
@@ -175,8 +174,7 @@
           assert config.get("EnableIntelLowPowerH264HwEncoder") == True, f"Intel low power H264: expected True, got '{config.get('EnableIntelLowPowerH264HwEncoder')}'"
           assert config.get("EnableIntelLowPowerHevcHwEncoder") == True, f"Intel low power HEVC: expected True, got '{config.get('EnableIntelLowPowerHevcHwEncoder')}'"
 
-          # HEVC color depth verification
-          assert config.get("EnableDecodingColorDepth10Hevc") == True, f"HEVC 10bit: expected True, got '{config.get('EnableDecodingColorDepth10Hevc')}'"
+          # HEVC RExt color depth verification
           assert config.get("EnableDecodingColorDepth10HevcRext") == True, f"HEVC RExt 10bit: expected True, got '{config.get('EnableDecodingColorDepth10HevcRext')}'"
           assert config.get("EnableDecodingColorDepth12HevcRext") == True, f"HEVC RExt 12bit: expected True, got '{config.get('EnableDecodingColorDepth12HevcRext')}'"
 

nixos/tests/systemd-boot.nix

@@ -460,17 +460,19 @@ in
       nodes.machine = common;
 
       testScript =
+        let
+          oldVersion = "222";
+        in
         # python
         ''
           machine.succeed("mount -o remount,rw /boot")
 
           def switch():
-              # Replace version inside sd-boot with something older. See SD_MAGIC in systemd src/boot/boot.c
-              # Note: the sed replacement has to be length-preserving, because section length matters.
+              # Replace version inside sd-boot with something older. See magic[] string in systemd src/boot/efi/boot.c
               machine.succeed(
-                r"""
+                """
                 find /boot -iname '*boot*.efi' -print0 | \
-                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot [0-9]\(.*\) ####/#### LoaderInfo: systemd-boot 0\1 ####/' '{}'
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot ${oldVersion} ####/' '{}'
                 """
               )
               return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")

pkgs/applications/emulators/wibo/default.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
         meta.license = lib.licenses.unfree;
       };
     in
-    lib.optionalString finalAttrs.finalPackage.doCheck ''
+    lib.optionalString finalAttrs.doCheck ''
       MWCIncludes=../test ./wibo ${gc}/GC/2.7/mwcceppc.exe -c ../test/test.c
       file test.o | grep "ELF 32-bit"
     '';

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1319,11 +1319,11 @@
     "vendorHash": "sha256-QvtirfTfnvy7CBNUng07OZnbXLHJAyRlf1I9Mur44N4="
   },
   "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-mIiTAFVWNoD2JkVJNYUbrhOPNwCY/ocbTnoGbFROggo=",
+    "hash": "sha256-1UBML3E5ZnOcsdGZlZ5qkaqQsE1+Q9Uw9R8FeWJXFSw=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.83.13",
+    "rev": "v1.83.10",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1508,12 +1508,12 @@
     "vendorHash": "sha256-8p6dJwGyTK+qtgplSLtIRKxnNAQAgHfs4z/EsBcg/iY="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-0155GXJMfoCnyqaJiF5SJIA1Qz1q2AYe/BB0AYODG/0=",
+    "hash": "sha256-YiUARVEsGfD4IUuTFSrkAIAD6kOyFUoLebSaZtW9FcE=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.218.0",
+    "rev": "v0.215.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-FfZvuC/XXhKS03E+l4/9KCLSwx+uTP1LzywckZqX6pA="
+    "vendorHash": "sha256-YNCd1i2HDa0aToZ0vEr6tRugXnBXE+zymhLM+rmRNPI="
   }
 }

pkgs/applications/networking/instant-messengers/profanity/default.nix

@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # see also: https://profanity-im.github.io/guide/latest/build.html#expl
   mesonFlags = [
-    (lib.mesonBool "tests" finalAttrs.finalPackage.doCheck)
+    (lib.mesonBool "tests" finalAttrs.doCheck)
     (lib.mesonEnable "notifications" notifySupport)
     (lib.mesonEnable "python-plugins" pythonPluginSupport)
     (lib.mesonEnable "c-plugins" true)

pkgs/applications/virtualization/docker/default.nix

@@ -420,18 +420,18 @@ in
 
   docker_29 =
     let
-      version = "29.6.2";
+      version = "29.6.1";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-WpPSePMCfWAVxCkX1nZyI+sra/Vug009ZPmnVKDaX0I=";
+      cliHash = "sha256-cpK2UMRP/WXHsehG9Sq5UJAjhMesmXTrhe00y4RMRZc=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-zrvrZCRUuiZ2vixZNOUFeGmDehHzSI+FzDMzV1gMqMc=";
+      mobyHash = "sha256-gv+mea9X5TYDWN3IBRpmw0+R2waGxCiubdatNTeUQZI=";
       runcRev = "v1.3.6";
       runcHash = "sha256-cBMYZOElWHQ4OkF2NlYJSZrlW4833WD8CRJRkkXeKJc=";
-      containerdRev = "v2.2.6";
-      containerdHash = "sha256-Ngo9x847cXFYPnj/0I+g7BeV7e1/5T2YXfA1zkIdiPg=";
+      containerdRev = "v2.2.5";
+      containerdHash = "sha256-3ui+0AjEU6H4VHYwF3G85ggVMUdONCLJ5KfciFasmkk=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };

pkgs/by-name/af/afew/package.nix

@@ -3,7 +3,8 @@
   python3Packages,
   fetchPypi,
   pkgs,
-  versionCheckHook,
+  testers,
+  afew,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
@@ -38,7 +39,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   nativeCheckInputs = [
     pkgs.notmuch
-    versionCheckHook
   ]
   ++ (with python3Packages; [
     freezegun
@@ -55,6 +55,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "man"
   ];
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = afew;
+    };
+  };
+
   meta = {
     homepage = "https://github.com/afewmail/afew";
     description = "Initial tagging script for notmuch mail";

pkgs/by-name/ap/apparmor-parser/package.nix

@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     "POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
     "MANDIR=share/man"
   ]
-  ++ lib.optional finalAttrs.finalPackage.doCheck "PROVE=${lib.getExe' perl "prove"}";
+  ++ lib.optional finalAttrs.doCheck "PROVE=${lib.getExe' perl "prove"}";
 
   installFlags = [
     "DESTDIR=$(out)"

pkgs/by-name/ar/ardour/package.nix

@@ -193,7 +193,7 @@ let
       # https://discourse.ardour.org/t/ardour-8-2-released/109615/8
       # "--use-external-libs"
     ]
-    ++ lib.optional finalAttrs.finalPackage.doCheck "--test"
+    ++ lib.optional finalAttrs.doCheck "--test"
     ++ lib.optional optimize "--optimize";
 
     env = {

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -345,9 +345,9 @@
 
   vm-repair = mkAzExtension rec {
     pname = "vm-repair";
-    version = "2.2.1";
+    version = "2.2.0";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/vm_repair-${version}-py2.py3-none-any.whl";
-    hash = "sha256-k/6ATtYT2YXaHm5nbb0Tf7xE98Oz9svRlbjodCOOuo8=";
+    hash = "sha256-ppsK4rJa/nFFkO2XJvjnK0PIRp9/haVwWfqfF7oN5WQ=";
     description = "Support for repairing Azure Virtual Machines";
     propagatedBuildInputs = with python3Packages; [ opencensus ];
     meta.maintainers = [ ];

pkgs/by-name/bi/bitcoin-knots/package.nix

@@ -151,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_USDT" enableTracing)
     (lib.cmakeFeature "RDTS_CONSENT" "RUNTIME_WARN")
   ]
-  ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
+  ++ lib.optionals (!finalAttrs.doCheck) [
     (lib.cmakeBool "BUILD_TESTS" false)
     (lib.cmakeBool "BUILD_FUZZ_BINARY" false)
     (lib.cmakeBool "BUILD_GUI_TESTS" false)

pkgs/by-name/bi/bitcoin/package.nix

@@ -158,7 +158,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_ZMQ" true)
     (lib.cmakeBool "WITH_USDT" enableTracing)
   ]
-  ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
+  ++ lib.optionals (!finalAttrs.doCheck) [
     (lib.cmakeBool "BUILD_TESTS" false)
     (lib.cmakeBool "BUILD_FUZZ_BINARY" false)
     (lib.cmakeBool "BUILD_GUI_TESTS" false)

pkgs/by-name/br/brlcad/package.nix

@@ -227,7 +227,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeBool "BRLCAD_ENABLE_STRICT" false)
-    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
     (lib.cmakeBool "BRLCAD_ENABLE_QT" enableQt)
     (lib.cmakeFeature "GTE_INCLUDE_DIR" "${gtmathematics}/include/gtmathematics")
     (lib.cmakeFeature "LMDB_LIBRARY" "${lmdb.out}/lib/liblmdb${stdenv.hostPlatform.extensions.sharedLibrary}")

pkgs/by-name/ca/cacert/package.nix

@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.126";
+  version = "3.125";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg=";
+    hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
   };
 
   unpackPhase = ''

pkgs/by-name/ca/caesura/package.nix

@@ -1,10 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   rustPlatform,
-  cacert,
-  writableTmpDirAsHomeHook,
   flac,
   lame,
   makeBinaryWrapper,
@@ -19,37 +16,24 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "caesura";
-  version = "0.31.0";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "RogueOneEcho";
     repo = "caesura";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+REt+MKImO7fnYWJ32P6mKzulGJTnxc+9ednVF5aCJU=";
+    hash = "sha256-ifaZ+rmMmWhn8HM25sRPXJKuXvWE5VG+5hFMi9hqxA0=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "normalize-sox-dependent-full-spectrogram-widths.patch";
-      url = "https://github.com/RogueOneEcho/caesura/commit/3af818ae35a3e18f444c889d9d3b88294f4f110f.patch?full_index=1";
-      hash = "sha256-znAbk6hFVj198BUUwwDo76SWei0cKINeXzlYEFvTwHA=";
-    })
-  ];
-
-  cargoHash = "sha256-0+vZma8AC44XqVHzmJT/roV7sy8w6DYhujRK9N91J5c=";
+  cargoHash = "sha256-g8Duhl5nZ6umIrAafW7s4vtDS+f06CWnFLoLSw0wa4o=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
   ];
-  nativeCheckInputs = [
-    cacert
-    writableTmpDirAsHomeHook
-  ]
-  ++ runtimeDeps;
+  nativeCheckInputs = runtimeDeps;
 
   env = {
     CAESURA_NIX = "1";
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
   };
 
   postPatch = ''

pkgs/by-name/ca/cargo-edit/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-edit";
-  version = "0.13.13";
+  version = "0.13.11";
 
   src = fetchFromGitHub {
     owner = "killercup";
     repo = "cargo-edit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yaY6krZ+kt2g3Wnnzsw4P3xnpsaZuNwFfRk9GLvwps8=";
+    hash = "sha256-u4mjbIs9rLZOZ4MUITc4QYnfEcTyZT5aXt6U7fwefoo=";
   };
 
-  cargoHash = "sha256-Q4GDA81w0JR9rcpKSPe9Y+9HPpFdAvYP2RI+91R4NWE=";
+  cargoHash = "sha256-1PCncmiY+olGGMOT2AfIbGY5sup4ysPVqdBmuecDWk0=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/cl/closurecompiler/package.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/share/java $out/bin
     cp ${finalAttrs.src} $out/share/java/closure-compiler-v${finalAttrs.version}.jar
     makeWrapper ${jre}/bin/java $out/bin/closure-compiler \
-      --add-flags "\$NIX_JAVA_ARGS -jar $out/share/java/closure-compiler-v${finalAttrs.version}.jar"
+      --add-flags "-jar $out/share/java/closure-compiler-v${finalAttrs.version}.jar"
   '';
 
   meta = {

pkgs/by-name/cm/cmocka/package.nix

@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags =
-    lib.optional finalAttrs.finalPackage.doCheck "-DUNIT_TESTING=ON"
+    lib.optional finalAttrs.doCheck "-DUNIT_TESTING=ON"
     ++ lib.optional stdenv.hostPlatform.isStatic "-DBUILD_SHARED_LIBS=OFF";
 
   doCheck = true;

pkgs/by-name/co/codex/package.nix

@@ -14,6 +14,7 @@
   librusty_v8 ? callPackage ./librusty_v8.nix {
     inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
   },
+  livekit-libwebrtc,
   lld,
   makeBinaryWrapper,
   nix-update-script,
@@ -25,18 +26,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.145.0";
+  version = "0.144.4";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-/r4mBoJhHB1v5NTA4Hk565/D5B0deYJf9xJW330hyf0=";
+    hash = "sha256-NmYZxjNFPkRWN4rw+eeka10pJt6/oU3ZoLXBxj3dPRU=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-t9IMRK9R+Z67ThEcgBI0HQU0E4aJHcOjKp22RFclh9U=";
+  cargoHash = "sha256-S4dsZXfmKvJItL2XYKyxfhqdCMATEG6oPjrtVRwkuYc=";
 
   __structuredAttrs = true;
 
@@ -56,6 +57,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   postPatch = ''
+    # webrtc-sys asks rustc to link libwebrtc statically by default,
+    # but nixpkgs provides libwebrtc as a shared library.
+    # use LK_CUSTOM_WEBRTC to point to the packaged library and adjust linking
+    # to use the shared library instead
+    substituteInPlace $cargoDepsCopy/*/webrtc-sys-*/build.rs \
+      --replace-fail "cargo:rustc-link-lib=static=webrtc" "cargo:rustc-link-lib=dylib=webrtc"
     substituteInPlace Cargo.toml \
       --replace-fail 'lto = "thin"' "" \
       --replace-fail 'codegen-units = 4' ""
@@ -84,6 +91,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # character-conversion warning-as-error disabled.
   env = {
     LIBCLANG_PATH = "${lib.getLib libclang}/lib";
+    LK_CUSTOM_WEBRTC = lib.getDev livekit-libwebrtc;
     NIX_CFLAGS_COMPILE = toString (
       lib.optionals stdenv.cc.isGNU [
         "-Wno-error=stringop-overflow"

pkgs/by-name/da/dash/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.13.5";
+  version = "0.5.13.4";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-QAkBAaKkkfE+kB09SOkEFPJmNGKLm//zX/VANjwien0=";
+    hash = "sha256-0Q39Qc2lkWVWDbOcqRXCxKdjb/8EKB2NLfd62Sx1Pis=";
   };
 
   strictDeps = true;

pkgs/by-name/do/doctest/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doctest";
-  version = "2.5.3";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+/IEISqN9HdaCJ0udLVUitOUziLvF/D3POecZMoXuho=";
+    hash = "sha256-4jW6xPFCFxk1l47EkSUVojhycrtluPhOc5Adf/25R7M=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/eg/egctl/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "egctl";
-  version = "1.8.3";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "envoyproxy";
     repo = "gateway";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dhAzFpo+pnttcVBVTbOK7sOEeXaIkdPF058Zt8M2JHU=";
+    hash = "sha256-givYesuucfw/gumEwxpU/NTtyfZQgmGXg7u+xg9Yx0s=";
   };
 
-  vendorHash = "sha256-rAShQLNGffK/l8H6b004HfC/Jt3I4ReVlb2YV9yMrwQ=";
+  vendorHash = "sha256-5Hlycq0+/wvboP81MKlKBFLEgxa545eyXwPtueHONNE=";
   # Fix case-insensitive conflicts producing platform-dependent checksums
   # https://github.com/microsoft/go-mssqldb/issues/234
   proxyVendor = true;

pkgs/by-name/el/elements/package.nix

@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-boost-libdir=${boost.out}/lib"
     "--disable-bench"
   ]
-  ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
+  ++ lib.optionals (!finalAttrs.doCheck) [
     "--disable-tests"
     "--disable-gui-tests"
   ]

pkgs/by-name/es/esphome/package.nix

@@ -9,7 +9,6 @@
   esptool,
   git,
   versionCheckHook,
-  addBinToPathHook,
   nixosTests,
 }:
 
@@ -25,14 +24,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "esphome";
-  version = "2026.6.5";
+  version = "2026.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = finalAttrs.version;
-    hash = "sha256-4sbc/X86OWN/Bx2sPk3H2lgzGxdQNS6bIspNLAVqHz8=";
+    hash = "sha256-h7aMPSXmIUutCGMoZlE3Z1wX2xNxdmZsHfBllcFHBHc=";
   };
 
   patches = [
@@ -86,6 +85,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     jinja2
     paho-mqtt
     pillow
+    platformio
     puremagic
     py7zr
     pyparsing
@@ -138,7 +138,6 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     ++ [
       git
       versionCheckHook
-      addBinToPathHook
     ];
 
   disabledTestPaths = [
@@ -150,6 +149,10 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     "tests/unit_tests/test_espidf_component.py"
   ];
 
+  preCheck = ''
+    export PATH=$PATH:$out/bin
+  '';
+
   postInstall =
     let
       argcomplete = lib.getExe' python.pkgs.argcomplete "register-python-argcomplete";
@@ -161,6 +164,8 @@ python.pkgs.buildPythonApplication (finalAttrs: {
         --fish <(${argcomplete} --shell fish esphome)
     '';
 
+  doInstallCheck = true;
+
   disabledTests = [
     # tries to import platformio, which is wrapped in an fhsenv
     "test_clean_build"
@@ -202,7 +207,6 @@ python.pkgs.buildPythonApplication (finalAttrs: {
       picnoir
       thanegill
       karlbeecken
-      tmarkus
     ];
     mainProgram = "esphome";
   };

pkgs/by-name/et/ethtool/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ethtool";
-  version = "7.1";
+  version = "7.0";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/ethtool-${finalAttrs.version}.tar.xz";
-    hash = "sha256-TXjCbtwCVbyS9LmVtf1mEI11/5Zu1GlPYCWm03C8JJY=";
+    hash = "sha256-Zgv5clp4cTQ6DSMgaKdjT7z7abbC+O/0VYJ/rvsM0WI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fe/feedbackd-device-themes/package.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    (lib.mesonOption "validate" (if finalAttrs.finalPackage.doCheck then "enabled" else "disabled"))
+    (lib.mesonOption "validate" (if finalAttrs.doCheck then "enabled" else "disabled"))
   ];
 
   doCheck = true;

pkgs/by-name/fe/fex/package.nix

@@ -233,7 +233,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
       cmakeFlagsArray+=("-DBUILD_TESTING:BOOL=FALSE")
     else
       echo "Keeping checkPhase as-is"
-      cmakeFlagsArray+=("${lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck}")
+      cmakeFlagsArray+=("${lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck}")
     fi
   '';
 

pkgs/by-name/fl/flatpak/package.nix

@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     # and cannot bind FHS paths since those are not available on NixOS.
     finalAttrs.passthru.icon-validator-patch
   ]
-  ++ lib.optionals finalAttrs.finalPackage.doCheck [
+  ++ lib.optionals finalAttrs.doCheck [
     # Hardcode paths used by tests and change test runtime generation to use files from Nix store.
     # https://github.com/flatpak/flatpak/issues/1460
     (replaceVars ./fix-test-paths.patch {

pkgs/by-name/fl/fluidsynth/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.6";
+  version = "2.5.5";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q4NdfemCprYEYCrKlHumeRM8TyNz8eJcFM18EsB0p0c=";
+    hash = "sha256-WEzOYHtPIUkPZu3v4dWcCh3dOJUyG1xRxDuoSXqiGbk=";
     fetchSubmodules = true;
   };
 
@@ -52,7 +52,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    changelog = "https://github.com/FluidSynth/fluidsynth/blob/${finalAttrs.src.tag}/doc/wiki/ChangeLog.md";
     description = "Real-time software synthesizer based on the SoundFont 2 specifications";
     homepage = "https://www.fluidsynth.org";
     license = lib.licenses.lgpl21Plus;

pkgs/by-name/ft/ftxui/package.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "FTXUI_BUILD_EXAMPLES" false)
     (lib.cmakeBool "FTXUI_BUILD_DOCS" true)
-    (lib.cmakeBool "FTXUI_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "FTXUI_BUILD_TESTS" finalAttrs.doCheck)
   ];
 
   meta = {

pkgs/by-name/fw/fwup/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     unzip
     zip
   ]
-  ++ lib.optionals finalAttrs.finalPackage.doCheck [
+  ++ lib.optionals finalAttrs.doCheck [
     mtools
     dosfstools
   ];

pkgs/by-name/ge/gecode/package.nix

@@ -2,8 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   bison,
-  cmake,
   flex,
   perl,
   gmp,
@@ -12,22 +12,30 @@
   enableGist ? true,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "gecode";
-  version = "6.4.0";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "Gecode";
     repo = "gecode";
-    tag = "release-${finalAttrs.version}";
-    hash = "sha256-WhMN7QC+VQfvHUV1LLaW7I7fG++/fznh1ZDUY/Q8zD8=";
+    rev = "release-${version}";
+    sha256 = "0b1cq0c810j1xr2x9y9996p894571sdxng5h74py17c6nr8c6dmk";
   };
 
+  patches = [
+    # https://github.com/Gecode/gecode/pull/74
+    (fetchpatch {
+      name = "fix-const-weights-clang.patch";
+      url = "https://github.com/Gecode/gecode/commit/c810c96b1ce5d3692e93439f76c4fa7d3daf9fbb.patch";
+      sha256 = "0270msm22q5g5sqbdh8kmrihlxnnxqrxszk9a49hdxd72736p4fc";
+    })
+  ];
+
   enableParallelBuilding = true;
   dontWrapQtApps = true;
   nativeBuildInputs = [
     bison
-    cmake
     flex
   ];
   buildInputs = [
@@ -44,4 +52,4 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.all;
     maintainers = [ ];
   };
-})
+}

pkgs/by-name/ge/geoclue2/fix-sysusers_dir.patch

@@ -1,13 +0,0 @@
-diff --git a/data/meson.build b/data/meson.build
-index 2591e6a..dc1bd8d 100644
---- a/data/meson.build
-+++ b/data/meson.build
-@@ -69,7 +69,7 @@ if get_option('enable-backend')
-         if systemd.found()
-             sysusers_dir = systemd.get_variable(pkgconfig: 'sysusersdir')
-         else
--            sysusers_dir = '/usr/lib/sysusers.d'
-+            sysusers_dir = join_paths(get_option('prefix'), 'usr/lib/sysusers.d')
-         endif
-         configure_file(output: 'geoclue-sysusers.conf',
-                        input: 'geoclue-sysusers.conf.in',

pkgs/by-name/ge/geoclue2/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "geoclue";
-  version = "2.8.1";
+  version = "2.7.2";
 
   outputs = [
     "out"
@@ -42,12 +42,11 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "geoclue";
     repo = "geoclue";
     tag = finalAttrs.version;
-    hash = "sha256-CyZhUMAa2vMUi61sL+gGBZFxGo0lu7Cm68fTjcbblTg=";
+    hash = "sha256-LwL1WtCdHb/NwPr3/OLISwaAwplhJwiZT9vUdX29Bbs=";
   };
 
   patches = [
     ./add-option-for-installation-sysconfdir.patch
-    ./fix-sysusers_dir.patch
   ];
 
   separateDebugInfo = true;

pkgs/by-name/gi/gitea-actions-runner/package.nix

@@ -4,22 +4,21 @@
   buildGoModule,
   testers,
   gitea-actions-runner,
-  nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "gitea-actions-runner";
-  version = "2.1.0";
+  version = "1.0.3";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jkK61OZgbMDHD5yxrpyP1BWCVzDiR79dVaC5ItS99BU=";
+    hash = "sha256-p6NdkQiZiEeuQjJp3CKTayStZlyk3d1XGigSI5uuLp0=";
   };
 
-  vendorHash = "sha256-5K0vL0CDYgL/Ud7i4um3mz887Er4qmuhCd9dt5zyUHA=";
+  vendorHash = "sha256-T1T5ZpGqGmipIkTWlYxlsLdAthW8bhcAvr0xyZ74+wQ=";
 
   # Tests require network access (artifactcache tests try to determine outbound IP)
   doCheck = false;
@@ -34,12 +33,9 @@ buildGoModule (finalAttrs: {
     mv "$out/bin/runner" "$out/bin/gitea-runner"
   '';
 
-  passthru = {
-    tests.version = testers.testVersion {
-      package = gitea-actions-runner;
-      version = "v${finalAttrs.version}";
-    };
-    updateScript = nix-update-script { };
+  passthru.tests.version = testers.testVersion {
+    package = gitea-actions-runner;
+    version = "v${finalAttrs.version}";
   };
 
   meta = {

pkgs/by-name/gi/gitlab-runner/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-runner";
-  version = "19.1.1";
+  version = "19.0.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QKiHd4UFTuAZElQ/793Tyid983RnfU9TeNpe1gFwChA=";
+    hash = "sha256-uScTzj4pSRtSFCMxoOR5KqipCbPknwnydPYG6xU5dOo=";
   };
 
-  vendorHash = "sha256-Ed2PrEkkqZEWhFLtT1BJavWiacLuv4U7kIAcscMDQgM=";
+  vendorHash = "sha256-QqqTkIgR9ca1dYQ32SG7C+SpEIA07Hlf8x3lVhZ5vRQ=";
 
   # For patchShebangs
   buildInputs = [ bash ];

pkgs/by-name/gi/gitte/package.nix

@@ -22,7 +22,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitte";
-  version = "0.9.1";
+  version = "0.9.0";
 
   __structuredAttrs = true;
 
@@ -30,12 +30,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ckruse";
     repo = "Gitte";
     tag = finalAttrs.version;
-    hash = "sha256-/vVNWYuTsFf9SsL/PvM5hOJfULeibRn+9ukAbTs5rXk=";
+    hash = "sha256-k10Rqpf9fhcG+PU6WGr7Q2nVwZb0tLp2B2r3BNeicoI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-oz8pX33jua+bOBEmI87p4rkUxYrhzagBLcQvSHPOkp0=";
+    hash = "sha256-eK8o/psq0eHwUlbfD0I/TwIqoA40Ay0eJ9CtZypZCi4=";
   };
 
   strictDeps = true;

pkgs/by-name/gn/gn/package.nix

@@ -11,11 +11,11 @@
   version ?
     # This is a workaround for update-source-version to be able to update this
     let
-      _version = "0-unstable-2026-05-27";
+      _version = "0-unstable-2026-04-01";
     in
     _version,
-  rev ? "3357c4f51b1a9e676378c695dd9c7e9911c35ee6",
-  hash ? "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8=",
+  rev ? "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
+  hash ? "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ=",
 }:
 
 stdenv.mkDerivation {

pkgs/by-name/gp/gphoto2fs/package.nix

@@ -1,61 +1,39 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
-  autoreconfHook,
-  pkg-config,
-  gettext,
+  fetchurl,
   libtool,
+  pkg-config,
   libgphoto2,
-  fuse3,
+  fuse,
   glib,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gphoto2fs";
-  version = "1.0";
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
-  src = fetchFromGitHub {
-    owner = "gphoto";
-    repo = "gphotofs";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-3DdL4FQzLEzvREhoZYfZlzZvyow/EATN/Q0HtOmdWKA=";
+  version = "0.5.0";
+  src = fetchurl {
+    url = "mirror://sourceforge/gphoto/gphotofs/${finalAttrs.version}/gphotofs-0.5.tar.bz2";
+    hash = "sha256-Z27E3mmoHBk//DG9x7WHrCosw3gLFPDnycTApRezQ8w=";
   };
 
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-    gettext
-    libtool
-    glib
-  ];
-
+  nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libgphoto2
-    fuse3
+    fuse
     glib
+    libtool
   ];
 
-  # gphotofs_init() still declares the FUSE 2 callback signature, which GCC 14 rejects
-  env = lib.optionalAttrs stdenv.cc.isGNU {
-    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
-  };
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/gphotofs --help > /dev/null
-  '';
-
   meta = {
     description = "Fuse FS to mount a digital camera";
     mainProgram = "gphotofs";
     homepage = "http://www.gphoto.org/";
-    changelog = "https://github.com/gphoto/gphotofs/releases/tag/${finalAttrs.src.tag}";
     maintainers = [ lib.maintainers.raskin ];
     platforms = lib.platforms.linux;
-    license = lib.licenses.gpl2Only;
+    license = with lib.licenses; [
+      lgpl2
+      gpl2
+    ];
   };
 })

pkgs/by-name/gr/graphviz/package.nix

@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphviz";
-  version = "15.1.0";
+  version = "14.1.2";
 
   src = fetchFromGitLab {
     owner = "graphviz";
     repo = "graphviz";
     tag = finalAttrs.version;
-    hash = "sha256-5v/ib8hwqHrJLs+jvDGvg0aJiKIt8ipXEd1EUzew7XU=";
+    hash = "sha256-LkyiKl0ulS9ujEdVLfyeoc4CtjITd6CAc35IUtlHSfw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gs/gsl-lite/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    (lib.cmakeBool "GSL_LITE_OPT_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "GSL_LITE_OPT_BUILD_TESTS" finalAttrs.doCheck)
   ];
 
   # Building tests is broken on Darwin.

pkgs/by-name/gz/gz-cmake/package.nix

@@ -45,8 +45,8 @@ stdenv.mkDerivation (finalAttrs: {
   doBuildExamples = false;
 
   cmakeFlags = [
-    (lib.cmakeBool "BUILDSYSTEM_TESTING" finalAttrs.finalPackage.doCheck)
-    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "BUILDSYSTEM_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
     (lib.cmakeBool "BUILD_EXAMPLES" finalAttrs.doBuildExamples)
   ];
 

pkgs/by-name/hd/hdrhistogram_c/package.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Fix build on i686 by not trying to build AVX2 code
   # Submitted upstream: https://github.com/HdrHistogram/HdrHistogram_c/pull/143
-  patches = [
+  ${if stdenv.hostPlatform.isi686 then "patches" else null} = [
     ./no-avx2-i386.patch
   ];
 

pkgs/by-name/hy/hyprpanel/package.nix

@@ -0,0 +1,142 @@
+{
+  lib,
+  config,
+  ags,
+  astal,
+  awww,
+  bluez,
+  bluez-tools,
+  brightnessctl,
+  btop,
+  dart-sass,
+  fetchFromGitHub,
+  glib,
+  glib-networking,
+  gnome-bluetooth,
+  gpu-screen-recorder,
+  gpustat,
+  grimblast,
+  gtksourceview3,
+  gvfs,
+  hyprpicker,
+  libgtop,
+  libnotify,
+  libsoup_3,
+  matugen,
+  networkmanager,
+  nix-update-script,
+  python3,
+  pywal16,
+  stdenv,
+  upower,
+  wireplumber,
+  wl-clipboard,
+  writeShellScript,
+  writeShellScriptBin,
+
+  enableCuda ? config.cudaSupport,
+}:
+
+let
+  # TODO: Remove once hyprpanel updates to use `awww`
+  swww-compat = writeShellScriptBin "swww" ''
+    exec awww "$@"
+  '';
+  swww-daemon-compat = writeShellScriptBin "swww-daemon" ''
+    exec awww-daemon "$@"
+  '';
+in
+
+ags.bundle {
+  pname = "hyprpanel";
+  version = "0-unstable-2026-04-23";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "Jas-SinghFSU";
+    repo = "HyprPanel";
+    rev = "1961ba86ad5ab880beb639e5454054b2b5037e0d";
+    hash = "sha256-QowlCOrE4jGOTDCUCEx/E8gHjqSx3r25y7v4dEBpBhk=";
+  };
+
+  # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
+  dependencies = [
+    astal.apps
+    astal.battery
+    astal.bluetooth
+    astal.cava
+    astal.hyprland
+    astal.mpris
+    astal.network
+    astal.notifd
+    astal.powerprofiles
+    astal.tray
+    astal.wireplumber
+
+    awww
+    bluez
+    bluez-tools
+    brightnessctl
+    btop
+    dart-sass
+    glib
+    gnome-bluetooth
+    grimblast
+    gtksourceview3
+    gvfs
+    hyprpicker
+    libgtop
+    libnotify
+    libsoup_3
+    matugen
+    networkmanager
+    pywal16
+    swww-compat
+    swww-daemon-compat
+    upower
+    wireplumber
+    wl-clipboard
+    (python3.withPackages (
+      ps:
+      with ps;
+      [
+        dbus-python
+        pygobject3
+      ]
+      ++ lib.optional enableCuda gpustat
+    ))
+  ]
+  ++ (lib.optionals (stdenv.hostPlatform.system == "x86_64-linux") [ gpu-screen-recorder ]);
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  postFixup =
+    let
+      script = writeShellScript "hyprpanel" ''
+        export GIO_EXTRA_MODULES='${glib-networking}/lib/gio/modules'
+        if [ "$#" -eq 0 ]; then
+          exec @out@/bin/.hyprpanel
+        else
+          exec ${astal.io}/bin/astal -i hyprpanel "$*"
+        fi
+      '';
+    in
+    # bash
+    ''
+      mv "$out/bin/hyprpanel" "$out/bin/.hyprpanel"
+      cp '${script}' "$out/bin/hyprpanel"
+      substituteInPlace "$out/bin/hyprpanel" \
+        --replace-fail '@out@' "$out"
+    '';
+
+  meta = {
+    description = "Bar/Panel for Hyprland with extensive customizability";
+    homepage = "https://github.com/Jas-SinghFSU/HyprPanel";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ PerchunPak ];
+    mainProgram = "hyprpanel";
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/ig/igprof/package.nix

@@ -4,25 +4,32 @@
   fetchFromGitHub,
   libunwind,
   cmake,
-  pcre2,
+  pcre,
   gdb,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "6.0.0";
+  version = "5.9.18";
   pname = "igprof";
 
   src = fetchFromGitHub {
     owner = "igprof";
     repo = "igprof";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-RIDnilCoYlq0D9CBJKMX1zg1DBQ4RPcOlfGcZ2xosUo=";
+    sha256 = "sha256-UTrAaH8C79km78Z/7NxvQ6dnl4u4Ki80nORf4bsoSNw=";
   };
 
+  postPatch = ''
+    substituteInPlace src/igprof \
+      --replace-fail libigprof.so $out/lib/libigprof.so
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "CMAKE_MINIMUM_REQUIRED(VERSION 2.6)" "CMAKE_MINIMUM_REQUIRED(VERSION 3.10)"
+  '';
+
   buildInputs = [
     libunwind
     gdb
-    pcre2
+    pcre
   ];
   nativeBuildInputs = [ cmake ];
 
@@ -34,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
     description = "Ignominous Profiler";
 
     longDescription = ''

pkgs/by-name/im/imagemagick/package.nix

@@ -67,6 +67,26 @@
 assert libXtSupport -> libX11Support;
 assert libraqmSupport -> freetypeSupport;
 
+let
+  arch =
+    if stdenv.hostPlatform.system == "i686-linux" then
+      "i686"
+    else if
+      stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin"
+    then
+      "x86-64"
+    else if stdenv.hostPlatform.system == "armv7l-linux" then
+      "armv7l"
+    else if
+      stdenv.hostPlatform.system == "aarch64-linux" || stdenv.hostPlatform.system == "aarch64-darwin"
+    then
+      "aarch64"
+    else if stdenv.hostPlatform.system == "powerpc64le-linux" then
+      "ppc64le"
+    else
+      null;
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
   version = "7.1.2-27";
@@ -93,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
     "MVDelegate=${lib.getExe' coreutils "mv"}"
     "RMDelegate=${lib.getExe' coreutils "rm"}"
     "--with-frozenpaths"
-    "--with-gcc-arch=generic"
+    (lib.withFeatureAs (arch != null) "gcc-arch" arch)
     (lib.withFeature librsvgSupport "rsvg")
     (lib.withFeature librsvgSupport "pango")
     (lib.withFeature liblqr1Support "lqr")

pkgs/by-name/in/iniparser/package.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-z10S9ODLprd7CbL5Ecgh7H4eOwTetYwFXiWBUm6fIr4=";
   };
 
-  patches = lib.optional finalAttrs.finalPackage.doCheck (
+  patches = lib.optional finalAttrs.doCheck (
     # 1. Do not fetch the Unity GitHub repository
     # 2. Lookup the Unity pkgconfig file
     # 3. Get the generate_test_runner.rb file from the Unity share directory

pkgs/by-name/ja/jasterix/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeBool "BUILD_STATIC" stdenv.hostPlatform.isStatic)
-    (lib.cmakeBool "WITH_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "WITH_UNIT_TESTS" finalAttrs.doCheck)
   ];
 
   buildInputs = [

pkgs/by-name/js/json-tui/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     "-Wno-dev" # suppress cmake warning about deprecated usage
-    (lib.cmakeBool "JSON_TUI_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "JSON_TUI_BUILD_TESTS" finalAttrs.doCheck)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GOOGLETEST" "${gtest.src}")
   ];
 

pkgs/by-name/ki/kiro-cli/package.nix

@@ -3,17 +3,10 @@
   stdenv,
   fetchurl,
   autoPatchelfHook,
-  makeBinaryWrapper,
   undmg,
   versionCheckHook,
   xz,
   bzip2,
-  wl-clipboard,
-  # On Wayland, kiro-cli shells out to wl-clipboard (wl-copy/wl-paste) for
-  # clipboard access. Enabling this puts wl-clipboard on the runtime PATH so
-  # clipboard support works out of the box under Wayland sessions. Has no
-  # effect on Darwin.
-  waylandSupport ? stdenv.hostPlatform.isLinux,
 }:
 
 let
@@ -48,9 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionals stdenv.hostPlatform.isLinux [
       autoPatchelfHook
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isLinux && waylandSupport) [
-      makeBinaryWrapper
-    ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       undmg
     ];
@@ -75,12 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
     install -Dm755 bin/kiro-cli-chat $out/bin/kiro-cli-chat
     install -Dm755 bin/kiro-cli-term $out/bin/kiro-cli-term
   ''
-  + lib.optionalString (stdenv.hostPlatform.isLinux && waylandSupport) ''
-    for bin in kiro-cli kiro-cli-chat kiro-cli-term; do
-      wrapProgram $out/bin/$bin \
-        --suffix PATH : ${lib.makeBinPath [ wl-clipboard ]}
-    done
-  ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/bin $out/Applications
     cp -r "../Kiro CLI.app" "$out/Applications/"

pkgs/by-name/ko/koka/package.nix

@@ -68,7 +68,7 @@ haskellPackages.mkDerivation {
     hashable
     isocline
     lens
-    lsp_2_8_0_0
+    lsp
     mtl
     network
     network-simple

pkgs/by-name/ku/ku/package.nix

@@ -8,14 +8,14 @@
 
 buildGo126Module (finalAttrs: {
   pname = "ku";
-  version = "0.9.0";
+  version = "0.8.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "bjarneo";
     repo = "ku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4z4lPvmkEqC7YBEaAa8cUyB42hkFkTFRkHGaA58/Vpg=";
+    hash = "sha256-vUv4eKTCucJ/ol76z0Q3jOigYBSwM823ZxjvBFqv1yY=";
   };
 
   vendorHash = "sha256-x7O2/uKnIIFDr8WK0ej3FJiIGxN5Fq5Czqrv4OJ5A44=";

pkgs/by-name/li/libapparmor/package.nix

@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "5.0.2";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Kuc5Nrz4iq5MC5AOcJL9Sb54DWNKlEk3b3DW0vpgSZg=";
+    hash = "sha256-y5r8X7Cpwp7TSsKYXNoAeyy0MbgxLSW8gNtLsIvKP8c=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
 

pkgs/by-name/li/libffiReal/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libffi";
-  version = "3.7.1";
+  version = "3.7.0";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-1emmY43b0lE921RRjrZ+S75vpwe8wBwQ9iEvCgiNgZ0=";
+    hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY=";
   };
 
   # Note: this package is used for bootstrapping fetchurl, and thus
@@ -32,6 +32,9 @@ stdenv.mkDerivation (finalAttrs: {
     ./freebsd-tsan-pthread.patch
   ];
 
+  # To workaround https://github.com/libffi/libffi/issues/993, we empty the test file:
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c";
+
   strictDeps = true;
   outputs = [
     "out"
@@ -91,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "http://sourceware.org/libffi/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ aduh95 ];
+    maintainers = [ ];
     platforms = lib.platforms.all;
     pkgConfigModules = [ "libffi" ];
   };

pkgs/by-name/li/libmemcached/package.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.doCheck)
     "-DENABLE_SASL=ON"
   ];
 

pkgs/by-name/li/libmwaw/package.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmwaw";
-  version = "0.3.23";
+  version = "0.3.22";
 
   src = fetchurl {
     url = "mirror://sourceforge/libmwaw/libmwaw/libmwaw-${finalAttrs.version}/libmwaw-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-rDWQ9pGikE64x9yLdXuKKfEl9ZJEnkIUWa6PqSizmes=";
+    sha256 = "sha256-oaOf/Oo/8qenquDCOHfd9JGLVUv4Kw3l186Of2HqjjI=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/li/libmysofa/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmysofa";
-  version = "1.3.4";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "hoene";
     repo = "libmysofa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gP/RjKzMx8JIYcyiivBGvy3kIdwHMEKY6abssyVUKNQ=";
+    hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc=";
   };
 
   outputs = [

pkgs/by-name/li/libpointmatcher/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeFeature "EIGEN_INCLUDE_DIR" "${eigen}/include/eigen3")
-    (lib.cmakeBool "BUILD_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "BUILD_TESTS" finalAttrs.doCheck)
   ];
 
   doCheck = true;

pkgs/by-name/li/libressl/default.nix

@@ -100,17 +100,6 @@ let
         moveToOutput "share/man/man1/nc.1.gz" "$nc"
       '';
 
-      doInstallCheck = true;
-      installCheckPhase = ''
-        runHook preInstallCheck
-
-        # Check whether the build target actually contains our cacert.
-        # A simple binary match for the path is enough.
-        grep "${cacert}/etc/ssl/certs/ca-bundle.crt" $out/lib/*libtls*
-
-        runHook postInstallCheck
-      '';
-
       meta = {
         description = "Free TLS/SSL implementation";
         homepage = "https://www.libressl.org";
@@ -150,13 +139,6 @@ let
     url = "https://github.com/libressl/portable/commit/a15ea0710398eaeed3be53cf643e80a1e80c981d.patch";
     hash = "sha256-Mlf4SrGCCqALQicbGtmVGdkdfcE8DEGYkOuVyG2CozM=";
   };
-
-  # https://github.com/libressl/portable/issues/1295
-  # https://github.com/libressl/portable/pull/1303
-  tls-default-ca-patch = fetchpatch {
-    url = "https://github.com/libressl/portable/commit/c85e07d0d68129fc1b1c9039b266099c8d735c3d.patch";
-    hash = "sha256-oNL3v8Ef1HrayXn+/3T4UhHLJos8eVMlqebVyaxnWVo=";
-  };
 in
 {
   # 4.2 was released October 2025 and will become unsupported on October 22,
@@ -166,7 +148,6 @@ in
     hash = "sha256-bVwvWFg1iOp5H0yGRQBAcdAN+lVKW/eIoAbKHrWr1ws=";
     patches = [
       common-cmake-install-full-dirs-patch
-      tls-default-ca-patch
     ];
   };
 
@@ -175,8 +156,5 @@ in
   libressl_4_3 = generic {
     version = "4.3.2";
     hash = "sha256-7fAa7iTGXWnmqe/LnUS82mgv+dTzu72V55Th36kIR7U=";
-    patches = [
-      tls-default-ca-patch
-    ];
   };
 }

pkgs/by-name/li/libsodium/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsodium";
-  version = "1.0.22-unstable-2026-07-08";
+  version = "1.0.22-unstable-2026-04-16";
 
   src = fetchFromGitHub {
     owner = "jedisct1";
     repo = "libsodium";
-    rev = "77a422c85a3b8b487de50c811b38d18394831ba6";
-    hash = "sha256-Ahka2PnrmYvTLjZMzik5mFsxhDpMLRMKT/I5ftUb0Xc=";
+    rev = "33cc75ab1565d9dcbe808354191bd572ad6b64d0";
+    hash = "sha256-8kS9FBoaFaJOjH7XZc8IG3GaQaUiYD/awQOhs7j0n1Y=";
   };
 
   outputs = [

pkgs/by-name/li/libssh/package.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libssh";
-  version = "0.12.1";
+  version = "0.12.0";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor finalAttrs.version}/libssh-${finalAttrs.version}.tar.xz";
-    hash = "sha256-05Qa8KLXjV2C7Xo2mI6RM5lDEvA1uWWabkP42zloeEw=";
+    hash = "sha256-Gmr0JNgyfl7t705f5/W5JCJt1hesnz3oDyF9gqNqcSE=";
   };
 
   outputs = [

pkgs/by-name/li/libtiff/package.nix

@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtiff";
-  version = "4.7.2";
+  version = "4.7.1";
 
   src = fetchFromGitLab {
     owner = "libtiff";
     repo = "libtiff";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-60Lpg5WRfWMzlOoOUA+C6KLlYIZ+3BjXidOVqv4M2GA=";
+    hash = "sha256-UiC6s86i7UavW86EKm74oPVlEacvoKmwW7KETjpnNaI=";
   };
 
   patches = [

pkgs/by-name/li/libvncserver/package.nix

@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_SYSTEMD" withSystemd)
     (lib.cmakeBool "BUILD_SHARED_LIBS" enableShared)
     (lib.cmakeBool "WITH_EXAMPLES" buildExamples)
-    (lib.cmakeBool "WITH_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "WITH_TESTS" finalAttrs.doCheck)
   ];
 
   # This test checks if using the **installed** headers works.

pkgs/by-name/li/libxmp/package.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED" (!stdenv.hostPlatform.isStatic))
     (lib.cmakeBool "BUILD_STATIC" stdenv.hostPlatform.isStatic)
-    (lib.cmakeBool "WITH_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "WITH_UNIT_TESTS" finalAttrs.doCheck)
   ];
 
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

pkgs/by-name/li/lightningcss/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lightningcss";
-  version = "1.33.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = "parcel-bundler";
     repo = "lightningcss";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-twodhkzM/h4ijZFeB2tQAOAV131r1ggLr3tcXUUGHFo=";
+    hash = "sha256-JqAzBPYbJq52exCpVTdhd90BQGsbfMOx68PD1xUripg=";
   };
 
-  cargoHash = "sha256-Jz6kpaan1HNJKhG7Jb5f5mfZoYNDwQhemTuVCf5Cn0Q=";
+  cargoHash = "sha256-zndBkOJ/U6lLaOJn273TabMAPbz96hQeWs4cPKFDGro=";
 
   patches = [
     # Backport fix for build error for lightningcss-napi

pkgs/by-name/ma/markdown-code-runner/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "markdown-code-runner";
-  version = "0.5.2";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "drupol";
     repo = "markdown-code-runner";
     tag = finalAttrs.version;
-    hash = "sha256-xToBnuWjjh1Zle6lcWdYWO9iDhSJh1cbOOEr9p0n1vU=";
+    hash = "sha256-GcPMkwXwLyHoVljOpfnhmysDYIFXSyvNL5P3f6q/KJw=";
   };
 
-  cargoHash = "sha256-tGEXJMlrxIBCzWVgOfcDNHq2Zli0mJVaOMdmwP9GhCk=";
+  cargoHash = "sha256-ul5cl6FDYkW02HGtQmLHkOsSaTIn2lCaTpKjCUzdcjM=";
 
   dontUseCargoParallelTests = true;
 

pkgs/by-name/ma/mathic/package.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   configureFlags = [
-    (lib.withFeature finalAttrs.finalPackage.doCheck "gtest")
+    (lib.withFeature finalAttrs.doCheck "gtest")
   ];
 
   __structuredAttrs = true;

pkgs/by-name/ma/mathicgb/package.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   configureFlags = [
-    (lib.withFeature finalAttrs.finalPackage.doCheck "gtest")
+    (lib.withFeature finalAttrs.doCheck "gtest")
   ];
 
   enableParallelBuilding = true;

pkgs/by-name/ma/matrix-authentication-service/package.nix

@@ -20,21 +20,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.21.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4z+u1IM2pclccv9+IH8IWjCodDxWZmffbqWPC726sIg=";
+    hash = "sha256-0fvGhBxwXhSzWvNhflreEFoCBycM10vMkMf4sj95vfY=";
   };
 
-  cargoHash = "sha256-HQU0zaK7rLJnTX5WVZrqNEaT5HfFLDzs+pHRxx5XTaA=";
+  cargoHash = "sha256-3V50qNvg24WZvQ9z7IZJAnPXHTibZ6o3EzUoinLU6Gw=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 4;
-    hash = "sha256-9a62WlBQW8lgXluMh+DM21CkFCqFYd7yUz220G1uTIY=";
+    hash = "sha256-j2A2VCKQPfoyrNDtazu8hzUHpS130Ju/Cy3yfu9tC5I=";
   };
 
   pnpmRoot = "frontend";

pkgs/by-name/ma/mayo/package.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeOptionType "string" "Mayo_VersionMajor" (lib.versions.major finalAttrs.version))
     (lib.cmakeOptionType "string" "Mayo_VersionMinor" (lib.versions.minor finalAttrs.version))
     (lib.cmakeOptionType "string" "Mayo_VersionPatch" (lib.versions.patch finalAttrs.version))
-    (lib.cmakeBool "Mayo_BuildTests" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "Mayo_BuildTests" finalAttrs.doCheck)
   ]
   ++ lib.optional withAssimp "-DMayo_BuildPluginAssimp=ON";
 

pkgs/by-name/mb/mbedtls/4.nix

@@ -5,8 +5,8 @@
 }:
 
 callPackage ./generic.nix {
-  version = "4.2.0";
-  hash = "sha256-Xz5W5zYPNlASPyc1/Sz2O1LONdxpUkg1hgzKdax/3ag=";
+  version = "4.1.0";
+  hash = "sha256-TA1uka13So8URttw+JJVdKIL+IonkhIQSc0IfraXpIM=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

pkgs/by-name/mb/mbedtls/package.nix

@@ -6,8 +6,8 @@
 }:
 
 callPackage ./generic.nix {
-  version = "3.6.7";
-  hash = "sha256-t1ZPeFA3ftKaEIaXQ7RXZEsiOAYK4KSSm55SFr9g17A=";
+  version = "3.6.6";
+  hash = "sha256-+PW41/c8M/Yz0EVWM4Gt4HTNBMUTU5MayaKVZ+upLIo=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.

pkgs/by-name/me/memtailor/package.nix

@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   configureFlags = [
-    (lib.withFeature finalAttrs.finalPackage.doCheck "gtest")
+    (lib.withFeature finalAttrs.doCheck "gtest")
   ];
 
   enableParallelBuilding = true;

pkgs/by-name/mi/mimalloc/package.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     MI_SECURE = secureBuild;
     MI_BUILD_SHARED = stdenv.hostPlatform.hasSharedLibraries;
     MI_LIBC_MUSL = stdenv.hostPlatform.libc == "musl";
-    MI_BUILD_TESTS = finalAttrs.finalPackage.doCheck;
+    MI_BUILD_TESTS = finalAttrs.doCheck;
 
     # MI_OPT_ARCH is inaccurate (e.g. it assumes aarch64 == armv8.1-a).
     # Nixpkgs's native platform configuration does a better job.

pkgs/by-name/mi/minizinc/package.nix

@@ -13,6 +13,22 @@
   zlib,
 }:
 
+let
+  gecode_6_3_0 = gecode.overrideAttrs (_: {
+    version = "6.3.0";
+    src = fetchFromGitHub {
+      owner = "gecode";
+      repo = "gecode";
+      rev = "f7f0d7c273d6844698f01cec8229ebe0b66a016a";
+      hash = "sha256-skf2JEtNkRqEwfHb44WjDGedSygxVuqUixskTozi/5k=";
+    };
+    patches = [ ];
+  });
+in
+let
+  gecode = gecode_6_3_0;
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "minizinc";
   version = "2.9.7";

pkgs/by-name/mi/minizip-ng/package.nix

@@ -42,8 +42,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "MZ_OPENSSL" true)
     (lib.cmakeBool "MZ_PPMD" false) # PPMD support requres internet access to make a git clone
     (lib.cmakeBool "MZ_LIBCOMP" false) # builds only on Darwin by default where it fails due to mising headers
-    (lib.cmakeBool "MZ_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
-    (lib.cmakeBool "MZ_BUILD_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "MZ_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "MZ_BUILD_UNIT_TESTS" finalAttrs.doCheck)
     (lib.cmakeBool "MZ_COMPAT" enableCompat)
   ]
   ++ lib.optionals stdenv.hostPlatform.isi686 [

pkgs/by-name/mk/mkjson/generated.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation,
   lib,
-  fetchFromGitHub,
+  fetchFromCodeberg,
   aeson,
   base,
   bytestring,
@@ -26,7 +26,7 @@
 mkDerivation rec {
   pname = "mkjson";
   version = "0.4.0";
-  src = fetchFromGitHub {
+  src = fetchFromCodeberg {
     owner = "mfussenegger";
     repo = "mkjson";
     rev = "${version}";

pkgs/by-name/mk/mkjson/package.nix

@@ -1,2 +1,19 @@
-{ haskell, haskellPackages }:
-haskell.lib.justStaticExecutables (haskellPackages.callPackage ./generated.nix { })
+{
+  haskell,
+  haskellPackages,
+  lib,
+}:
+let
+  inherit (haskell.lib.compose) justStaticExecutables overrideCabal;
+
+  # The mkjson-doctest suite depends on specific RNG results not provided by the
+  # GHC in Nixpkgs as of this writing.
+  overrides = {
+    testTargets = [ "mkjson-test" ];
+  };
+  raw-pkg = haskellPackages.callPackage ./generated.nix { };
+in
+lib.pipe raw-pkg [
+  (overrideCabal overrides)
+  justStaticExecutables
+]

pkgs/by-name/mo/mosquitto/package.nix

@@ -85,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "WITH_BUNDLED_DEPS" false)
     (lib.cmakeBool "WITH_WEBSOCKETS" true)
     (lib.cmakeBool "WITH_SYSTEMD" withSystemd)
-    (lib.cmakeBool "WITH_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "WITH_TESTS" finalAttrs.doCheck)
   ];
 
   postFixup = ''

pkgs/by-name/mu/mu/package.nix

@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.strings.mesonEnable "guile" false)
     (lib.strings.mesonEnable "scm" false)
     (lib.strings.mesonEnable "readline" false)
-    (lib.strings.mesonEnable "tests" finalAttrs.finalPackage.doCheck)
+    (lib.strings.mesonEnable "tests" finalAttrs.doCheck)
     (lib.strings.mesonOption "lispdir" "${placeholder "mu4e"}/share/emacs/site-lisp")
   ];
 

pkgs/by-name/mu/muon/package.nix

@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals buildDocs [
     scdoc
   ]
-  ++ lib.optionals (buildDocs || finalAttrs.finalPackage.doCheck) [
+  ++ lib.optionals (buildDocs || finalAttrs.doCheck) [
     (python3.withPackages (ps: [ ps.pyyaml ]))
   ];
 
@@ -73,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     find subprojects -name "*.py" -exec chmod +x {} \;
     patchShebangs subprojects
   ''
-  + lib.optionalString finalAttrs.finalPackage.doCheck ''
+  + lib.optionalString finalAttrs.doCheck ''
     substituteInPlace \
       "subprojects/meson-tests/common/14 configure file/test.py.in" \
       "subprojects/meson-tests/common/274 customtarget exe for test/generate.py" \
@@ -106,7 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
         (muonBool "static" stdenv.targetPlatform.isStatic)
         (muonEnable "man-pages" buildDocs)
         (muonEnable "meson-docs" buildDocs)
-        (muonEnable "meson-tests" finalAttrs.finalPackage.doCheck)
+        (muonEnable "meson-tests" finalAttrs.doCheck)
         (muonEnable "samurai" embedSamurai)
         (muonEnable "tracy" false)
         (muonEnable "website" false)
@@ -177,7 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
       owner = "muon-build";
       rev = "db92588773a24f67cda2f331b945825ca3a63fa7";
       hash = "sha256-z4Fc1lr/m2MwIwhXJwoFWpzeNg+udzMxuw5Q/zVvpSM=";
-      passthru.use = finalAttrs.finalPackage.doCheck;
+      passthru.use = finalAttrs.doCheck;
     };
   };
 

pkgs/by-name/ne/nelm/package.nix

@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nelm";
-  version = "1.25.3";
+  version = "1.25.2";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "nelm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b0gO1V7yv8RMjIxwnqFX9CPRcRFm/j8u2PwNzyA7jtc=";
+    hash = "sha256-2YIxnuHbY9zCVZer+b7JD0fbmUC/ZYyaWmHts7s5ldw=";
   };
 
   vendorHash = "sha256-rIiphGjE/a5IwF6Fkk3Ffq36AfEkfAZb12ZljlYP6X4=";

pkgs/by-name/ne/nexusmods-app/package.nix

@@ -70,7 +70,7 @@ buildDotnetModule (finalAttrs: {
     substituteInPlace src/NexusMods.Networking.NexusWebApi/NexusMods.Networking.NexusWebApi.csproj \
       --replace-fail '$(BaseIntermediateOutputPath)games.json' ${./vendored/games.json}
 
-    ${lib.optionalString finalAttrs.finalPackage.doCheck ''
+    ${lib.optionalString finalAttrs.doCheck ''
       # For some reason these tests fail (intermittently?) with a zero timestamp
       touch tests/NexusMods.UI.Tests/WorkspaceSystem/*.verified.png
     ''}

pkgs/by-name/ni/nil/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nil";
-  version = "2026-07-23";
+  version = "2025-06-13";
 
   src = fetchFromGitHub {
     owner = "oxalica";
     repo = "nil";
     rev = finalAttrs.version;
-    hash = "sha256-upJVI2pq9sOKgF2AILt8l6O4/3GNcMtT/s0rmnbO5UA=";
+    hash = "sha256-oxvVAFUO9husnRk6XZcLFLjLWL9z0pW25Fk6kVKwt1c=";
   };
 
-  cargoHash = "sha256-ZyTrxGX0mRdskxp4o5ssDCyZzNn36rIgP9fDaA1fDws=";
+  cargoHash = "sha256-OZIajxv8xNfCGalVw/FUAwWdQzPqfGuDoeRg2E2RR7s=";
 
   nativeBuildInputs = [ nix ];
 

pkgs/by-name/nl/nlopt/package.nix

@@ -88,7 +88,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "NLOPT_MATLAB" false)
     (lib.cmakeBool "NLOPT_GUILE" false)
     (lib.cmakeBool "NLOPT_LUKSAN" (!withoutLuksanSolvers))
-    (lib.cmakeBool "NLOPT_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "NLOPT_TESTS" finalAttrs.doCheck)
   ]
   ++ lib.optional withPython (
     lib.cmakeFeature "Python_EXECUTABLE" "${buildPythonBindingsEnv.interpreter}"

pkgs/by-name/ns/ns-3/package.nix

@@ -152,7 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DNS3_GTK3=ON"
     "-DGTK3_GLIBCONFIG_INCLUDE_DIR=${glib.out}/lib/glib-2.0/include"
   ]
-  ++ lib.optional finalAttrs.finalPackage.doCheck "-DNS3_TESTS=ON";
+  ++ lib.optional finalAttrs.doCheck "-DNS3_TESTS=ON";
 
   # strictoverflow prevents clang from discovering pyembed when bindings
   hardeningDisable = [

pkgs/by-name/on/onnx/package.nix

@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     # NOTE: Darwin requires a static build; otherwise, tests fail in the Python package.
     BUILD_SHARED_LIBS = if stdenv.hostPlatform.isDarwin then "0" else "1";
     ONNX_BUILD_PYTHON = "1";
-    ONNX_BUILD_TESTS = if finalAttrs.finalPackage.doCheck then "1" else "0";
+    ONNX_BUILD_TESTS = if finalAttrs.doCheck then "1" else "0";
     # ONNX_ML is enabled by default.
     # See: https://github.com/onnx/onnx/blob/b751946c3d59a3c8358abcc0569b59e6ddb08cdd/CMakeLists.txt#L66-L73
     ONNX_ML = "1";

pkgs/by-name/on/onnxruntime/package.nix

@@ -286,7 +286,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     # fails to find protoc on darwin, so specify it
     (lib.cmakeFeature "ONNX_CUSTOM_PROTOC_EXECUTABLE" (lib.getExe buildPackages.protobuf))
     (lib.cmakeBool "onnxruntime_BUILD_SHARED_LIB" true)
-    (lib.cmakeBool "onnxruntime_BUILD_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "onnxruntime_BUILD_UNIT_TESTS" finalAttrs.doCheck)
     (lib.cmakeBool "onnxruntime_USE_FULL_PROTOBUF" withFullProtobuf)
     (lib.cmakeBool "onnxruntime_USE_CUDA" cudaSupport)
     (lib.cmakeBool "onnxruntime_USE_NCCL" ncclSupport)

pkgs/by-name/op/open-webui/package.nix

@@ -214,7 +214,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       gcp-storage-emulator
       moto
       oracledb
-      pinecone
+      pinecone-client
       playwright
       pymilvus
       pymongo

pkgs/by-name/pa/particl-core/package.nix

@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--disable-bench"
     "--with-boost-libdir=${boost.out}/lib"
   ]
-  ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
+  ++ lib.optionals (!finalAttrs.doCheck) [
     "--enable-tests=no"
   ];
 

pkgs/by-name/ph/phpantom-lsp/package.nix

@@ -6,17 +6,19 @@
   _experimental-update-script-combinators,
   nix-update-script,
 }:
+
 let
   stubsSrc = fetchFromGitHub {
     owner = "JetBrains";
     repo = "phpstorm-stubs";
-    rev = "f6dd2dd35d99fb774251a83555fe07bf2109d57e";
-    hash = "sha256-H9Td/yi9Um0Z9ifxZdh74bvGCMVSC+MA1OHrtbGD8vE=";
+    rev = "517b9ad1adaf2c5453c00ec2fbb02d192a4a9b6c";
+    hash = "sha256-IDWAuy301avfTF/E7Mby2JQQtIr/gnN5flZ3uctUpus=";
   };
 in
+
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "phpantom-lsp";
-  version = "0.9.0";
+  version = "0.8.0";
 
   __structuredAttrs = true;
 
@@ -24,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "AJenbo";
     repo = "phpantom_lsp";
     tag = finalAttrs.version;
-    hash = "sha256-euWaFH40VHefZewUcKvsLwwHZP+GwfTN8kfuAkaABB8=";
+    hash = "sha256-00NAiPm3qqxyS1u1GPpJlgnBlUjDx9VmjK6oOwH8kcU=";
   };
 
   postPatch = ''
@@ -36,7 +38,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       > stubs/jetbrains/phpstorm-stubs/.commit
   '';
 
-  cargoHash = "sha256-2MIJxVRqyCv5HzCwY1s+rCp1A4vFRsyAEEuyIEegZMA=";
+  cargoHash = "sha256-FyMI8Kb3QUD8Jui9k7vayMcQC+KWL8sZi3A05NPbXsg=";
 
   checkFlags = [
     "--test"