hareThirdParty.hare-http: 0.26.0.0 -> 0.26.0.1 (#556580)

Diff: https://github.com/home-assistant-libs/aioshelly/compare/13.29.0...13.32.0

Changelog: https://github.com/home-assistant-libs/aioshelly/releases/tag/13.32.0

doc/interoperability/cyclonedx.md

@@ -39,7 +39,7 @@ The `nix:narinfo` properties should be accompanied by a `nix:store_path` propert
 | `nix:narinfo:system`      | The hardware and software platform on which this component is produced. |
 | `nix:narinfo:sig`         | Signatures claiming that this component is what it claims to be. |
 | `nix:narinfo:ca`          | Content address of this store object's file system object, used to compute its store path. |
-| `nix:narinfo:references`  | A whitespace-separated array of store paths that this component references. |
+| `nix:narinfo:references`  | A whitespace separated array of store paths that this component references. |
 
 ### `nix:fod` {#sec-interop.cylonedx-fod}
 

doc/release-notes/rl-2611.section.md

@@ -82,8 +82,6 @@
 
 - `tengine` has been removed as it has seen seriously delayed responses to security vulnerabilities.
 
-- `writeTextFile` now uses structured attributes and `passAsFile` is no longer used or supported.
-
 - `nix-serve-ng` (and `haskellPackages.nix-serve-ng`) is now built against Lix instead of CppNix, following upstream which has switched to Lix as its supported Nix implementation.
 
 - Linux kernel configuration has been moved out of the `linux-kernel` field of the platform structure into the kernel builders:

maintainers/maintainer-list.nix

@@ -81,6 +81,12 @@
     githubId = 54892055;
     name = "David mp";
   };
+  _0k4r1m = {
+    matrix = "@darkdesync:matrix.org";
+    name = "0k4r1m";
+    github = "0k4r1m";
+    githubId = 318737393;
+  };
   _0nyr = {
     email = "onyr.maintainer@gmail.com";
     github = "0nyr";

nixos/modules/services/audio/mpd.nix

@@ -84,6 +84,7 @@ let
           }
         }
       '';
+      __structuredAttrs = true;
     };
     checkPhase = ''
       printf "%s" "$expectScript" | ${lib.getExe pkgs.buildPackages.expect} -f -

nixos/modules/services/cluster/hadoop/hbase.nix

@@ -167,7 +167,7 @@ in
       zookeeperQuorum = lib.mkOption {
         description = ''
           This option will set "hbase.zookeeper.quorum" in hbase-site.xml.
-          Comma-separated list of servers in the ZooKeeper ensemble.
+          Comma separated list of servers in the ZooKeeper ensemble.
         '';
         type = with lib.types; nullOr commas;
         example = "zk1.internal,zk2.internal,zk3.internal";

nixos/modules/services/home-automation/matter-server.nix

@@ -71,7 +71,7 @@ in
         # specified. This symlinks /data at the systemd-managed
         # /var/lib/matter-server, so all files get dropped into the state
         # directory.
-        ln -s $STATE_DIRECTORY $RUNTIME_DIRECTORY/data
+        ln -s "$STATE_DIRECTORY" "$RUNTIME_DIRECTORY/data"
 
         # Create directories to hold certificates and OTA updates.
         CERT_DIR="$CACHE_DIRECTORY/certs"
@@ -87,8 +87,8 @@ in
                 vendorid = vendorId;
                 storage-path = storagePath;
                 log-level = cfg.logLevel;
-                paa-root-cert-dir = "$CERT_DIR";
-                ota-provider-dir = "$OTA_UPDATE_DIR";
+                paa-root-cert-dir = ''"$CERT_DIR"'';
+                ota-provider-dir = ''"$OTA_UPDATE_DIR"'';
               }
               // cfg.extraArgs
             )

nixos/modules/services/networking/supplicant.nix

@@ -226,7 +226,7 @@ in
         The value of this option is an attribute set. Each attribute configures a
         {command}`wpa_supplicant` service, where the attribute name specifies
         the name of the interface that {command}`wpa_supplicant` operates on.
-        The attribute name can be a space-separated list of interfaces.
+        The attribute name can be a space separated list of interfaces.
         The attribute names `WLAN`, `LAN` and `DBUS`
         have a special meaning. `WLAN` and `LAN` are
         configurations for universal {command}`wpa_supplicant` service that is

nixos/modules/services/networking/vsftpd.nix

@@ -168,7 +168,7 @@ in
         default = pkgs.writeText "userlist" (concatMapStrings (x: "${x}\n") cfg.userlist);
         defaultText = literalExpression ''pkgs.writeText "userlist" (concatMapStrings (x: "''${x}\n") cfg.userlist)'';
         description = ''
-          Newline-separated list of names to be allowed/denied if {option}`userlistEnable`
+          Newline separated list of names to be allowed/denied if {option}`userlistEnable`
           is `true`. Meaning see {option}`userlistDeny`.
 
           The default is a file containing the users from {option}`userlist`.

nixos/modules/system/boot/loader/limine/limine.nix

@@ -360,7 +360,7 @@ in
           default = null;
           type = lib.types.nullOr lib.types.str;
           description = ''
-            A semicolon-separated array of 8 colors in the format RRGGBB:
+            A ; seperated array of 8 colors in the format RRGGBB:
             black, red, green, brown, blue, magenta, cyan, and gray.
           '';
         };
@@ -369,7 +369,7 @@ in
           default = null;
           type = lib.types.nullOr lib.types.str;
           description = ''
-            A semicolon-separated array of 8 colors in the format RRGGBB:
+            A ; seperated array of 8 colors in the format RRGGBB:
             dark gray, bright red, bright green, yellow, bright blue, bright magenta, bright cyan, and white.
           '';
         };

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.1001";
+  version = "9.2.0782";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-dV1rqGt10gNb2jBABfaLQ5Noqt8hb0WcCBBSChDfAFA=";
+    hash = "sha256-D4IyDgl1JdmumDzO0uMg2LhoSnFUeqhcMJ6ImC17wzs=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/misc/inochi2d/default.nix

@@ -36,7 +36,7 @@ in
     patches = [
       # Upstream asks that we change the bug tracker URL to not point to the upstream bug tracker
       (replaceVars ./support-url.patch {
-        assignees = "TomaSajt"; # should be a comma-separated list of the github usernames of the maintainers
+        assignees = "TomaSajt"; # should be a comma separated list of the github usernames of the maintainers
       })
       # Change how duplicate locales differentiate themselves (the store paths were too long)
       ./translations.patch

pkgs/build-support/fetchbzr/default.nix

@@ -17,9 +17,6 @@ lib.fetchers.withNormalizedHash { } (
     builder = ./builder.sh;
     nativeBuildInputs = [ breezy ];
 
-    strictDeps = true;
-    __structuredAttrs = true;
-
     inherit outputHash outputHashAlgo;
     outputHashMode = "recursive";
 

pkgs/build-support/fetchcvs/default.nix

@@ -29,9 +29,6 @@ lib.makeOverridable (
         openssh
       ];
 
-      strictDeps = true;
-      __structuredAttrs = true;
-
       inherit outputHash outputHashAlgo;
       outputHashMode = "recursive";
 

pkgs/build-support/fetchdarcs/default.nix

@@ -27,9 +27,6 @@ lib.makeOverridable (
         darcs
       ];
 
-      strictDeps = true;
-      __structuredAttrs = true;
-
       inherit outputHash outputHashAlgo;
       outputHashMode = "recursive";
 

pkgs/build-support/fetchfirefoxaddon/default.nix

@@ -1,5 +1,5 @@
 {
-  stdenvNoCC,
+  stdenv,
   fetchurl,
   jq,
   strip-nondeterminism,
@@ -35,7 +35,7 @@ let
           ;
       };
 in
-stdenvNoCC.mkDerivation {
+stdenv.mkDerivation {
   inherit name;
 
   passthru = {
@@ -62,7 +62,4 @@ stdenvNoCC.mkDerivation {
     unzip
     zip
   ];
-
-  strictDeps = true;
-  __structuredAttrs = true;
 }

pkgs/build-support/fetchfossil/default.nix

@@ -22,9 +22,6 @@ lib.fetchers.withNormalizedHash { } (
       cacert
     ];
 
-    strictDeps = true;
-    __structuredAttrs = true;
-
     # Envvar docs are hard to find. A link for the future:
     # https://www.fossil-scm.org/index.html/doc/trunk/www/env-opts.md
     impureEnvVars = [ "http_proxy" ];

pkgs/build-support/fetchgit/default.nix

@@ -155,8 +155,6 @@ lib.makeOverridable (
           ++ lib.optionals fetchLFS [ git-lfs ]
           ++ nativeBuildInputs;
 
-          strictDeps = true;
-
           hash =
             if outputHashAlgo == null || outputHash == "" || lib.hasPrefix outputHashAlgo outputHash then
               outputHash

pkgs/build-support/fetchhg/default.nix

@@ -24,9 +24,6 @@ lib.extendMkDerivation {
       builder = ./builder.sh;
       nativeBuildInputs = [ mercurial ];
 
-      strictDeps = true;
-      __structuredAttrs = true;
-
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
       subrepoClause = lib.optionalString fetchSubrepos "S";

pkgs/build-support/fetchitchio/default.nix

@@ -85,8 +85,6 @@ lib.extendMkDerivation {
         ]
         ++ nativeBuildInputs;
 
-        strictDeps = true;
-
         inherit preferLocalBuild;
 
         # ENV

pkgs/build-support/fetchmavenartifact/default.nix

@@ -84,10 +84,6 @@ in
 stdenv.mkDerivation {
   inherit pname version meta;
   dontUnpack = true;
-
-  strictDeps = true;
-  __structuredAttrs = true;
-
   # By moving the jar to $out/share/java we make it discoverable by java
   # packages packages that mention this derivation in their buildInputs.
   installPhase = ''

pkgs/build-support/fetchpijul/default.nix

@@ -33,8 +33,6 @@ lib.makeOverridable (
       ];
       strictDeps = true;
 
-      __structuredAttrs = true;
-
       dontUnpack = true;
       dontConfigure = true;
       dontBuild = true;
@@ -43,7 +41,7 @@ lib.makeOverridable (
         runHook preInstall
 
         success=
-        for remote in "''${remotes[@]}"; do
+        for remote in $remotes; do
           if
             pijul clone \
               ''${change:+--change "$change"} \

pkgs/build-support/fetchsvn/default.nix

@@ -66,12 +66,7 @@ else
     ]
     ++ lib.optional sshSupport openssh;
 
-    strictDeps = true;
-    __structuredAttrs = true;
-
-    env = lib.optionalAttrs sshSupport {
-      SVN_SSH = lib.getExe buildPackages.openssh;
-    };
+    SVN_SSH = if sshSupport then "${buildPackages.openssh}/bin/ssh" else null;
 
     outputHashAlgo = if hash != "" then null else "sha256";
     outputHashMode = "recursive";

pkgs/build-support/fetchsvnrevision/default.nix

@@ -2,7 +2,7 @@ runCommand: subversion: repository:
 import (
   runCommand "head-revision"
     {
-      nativeBuildInputs = [ subversion ];
+      buildInputs = [ subversion ];
       dummy = builtins.currentTime;
     }
     ''

pkgs/build-support/fetchsvnssh/builder.sh

@@ -1,5 +1,9 @@
 echo "exporting $url (r$rev) into $out"
 
+if test "$sshSupport"; then
+    export SVN_SSH="$openssh/bin/ssh"
+fi
+
 # Pipe the "p" character into Subversion to force it to accept the
 # server's certificate.  This is perfectly safe: we don't care
 # whether the server is being spoofed --- only the cryptographic

pkgs/build-support/fetchsvnssh/default.nix

@@ -24,13 +24,6 @@ lib.fetchers.withNormalizedHash { } (
       expect
     ];
 
-    strictDeps = true;
-    __structuredAttrs = true;
-
-    env = lib.optionalAttrs sshSupport {
-      SVN_SSH = lib.getExe openssh;
-    };
-
     inherit outputHash outputHashAlgo;
     outputHashMode = "recursive";
 
@@ -41,6 +34,8 @@ lib.fetchers.withNormalizedHash { } (
       password
       url
       rev
+      sshSupport
+      openssh
       ;
   }
 )

pkgs/build-support/go/module.nix

@@ -322,7 +322,7 @@ lib.extendMkDerivation {
               getGoDirs() {
                 local -r type="$1"
 
-                # Support structuredAttrs, they are not space separated
+                # Support strucuredAttrs, they are not space seperated
                 local -a subPackagesArray
                 concatTo subPackagesArray subPackages
 

pkgs/build-support/pkg-config-wrapper/default.nix

@@ -180,8 +180,6 @@ stdenv.mkDerivation {
       ;
   };
 
-  __structuredAttrs = true;
-
   meta =
     let
       pkg-config_ = optionalAttrs (pkg-config != null) pkg-config;

pkgs/build-support/trivial-builders/default.nix

@@ -108,7 +108,9 @@ rec {
 
     extendDrvArgs =
       let
+        defaultPassAsFile = [ "text" ];
         removedDerivationNames = [
+          "passAsFile"
           "meta"
           "passthru"
         ];
@@ -147,9 +149,7 @@ rec {
               Ensure that the path starts with a / and specifies at least the filename.
             '';
           destination;
-
-        __structuredAttrs = true;
-        strictDeps = true;
+        passAsFile = defaultPassAsFile ++ derivationArgs.passAsFile or [ ];
 
         buildCommand = ''
           target=$out$destination

pkgs/by-name/au/audiness/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "audiness";
-  version = "1.0.1";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "audius";
     repo = "audiness";
     tag = finalAttrs.version;
-    hash = "sha256-zru37eNQyY9AcbALge1qlINuxzVKq3RTNypm5Pyhkz8=";
+    hash = "sha256-Fy5T2WyC5MGYzNDEJpgtuvSnoTS0EzAcXR9qpHYT6aM=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/bl/bluez-headers/package.nix

@@ -24,8 +24,6 @@ stdenv.mkDerivation (finalAttrs: {
   dontConfigure = true;
   dontBuild = true;
 
-  strictDeps = true;
-
   installPhase = ''
     mkdir -p $out/include/
     cp -rv lib/* "$out/include/"
@@ -35,8 +33,6 @@ stdenv.mkDerivation (finalAttrs: {
     inherit bluez; # inherits bluez-headers.src
   };
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://bluez.github.io/";
     description = "Official Linux Bluetooth protocol stack";

pkgs/by-name/by/byacc/package.nix

@@ -16,8 +16,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-thjF+0TC9fBIhD25D30bJPePR7B5E8jHuoyULT6ySwA=";
   };
 
-  strictDeps = true;
-
   configureFlags = [
     # change yacc to byacc
     "--program-transform-name='s,^,b,'"
@@ -29,8 +27,6 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/byacc $out/bin/yacc
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://invisible-island.net/byacc/byacc.html";
     description = "Berkeley YACC";

pkgs/by-name/ca/cargo-swift/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-swift";
-  version = "0.11.0";
+  version = "0.11.1";
 
   src = fetchFromGitHub {
     owner = "antoniusnaumann";
     repo = "cargo-swift";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-abLXt9wIw/qhSkusRSmHJHU8feojaLVQeFP8DAkE1Gc=";
+    hash = "sha256-42Ssc75VKhVaIgvQxaq7zzKY41DyRrwzf3/ePVA57SY=";
   };
 
-  cargoHash = "sha256-u4lzPbXyBCcZk5kzxuYHjtJQTTxjRYeDeMpIcK+Dr8Q=";
+  cargoHash = "sha256-jbOTbJmlQioi3+RFkJN6ig66hoDzqmtylHKbllCySd0=";
 
   meta = {
     description = "Cargo plugin to easily build Swift packages from Rust code";

pkgs/by-name/de/dejagnu/package.nix

@@ -2,7 +2,6 @@
   fetchurl,
   lib,
   stdenv,
-  bashNonInteractive,
   expect,
   makeWrapper,
   updateAutotoolsGnuConfigScriptsHook,
@@ -14,19 +13,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/dejagnu/dejagnu-${finalAttrs.version}.tar.gz";
-    hash = "sha256-h9rvrNeVi0pp+IxoVtvRY0JhljxBQHnQw3H1ic1mouM=";
+    sha256 = "1qx2cv6qkxbiqg87jh217jb62hk3s7dmcs4cz1llm2wmsynfznl7";
   };
 
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
     makeWrapper
   ];
-  buildInputs = [
-    bashNonInteractive
-    expect
-  ];
-
-  strictDeps = true;
+  buildInputs = [ expect ];
 
   # dejagnu-1.6.3 can't successfully run tests in source tree:
   #   https://wiki.linuxfromscratch.org/lfs/ticket/4871
@@ -59,8 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${expect}/bin/expect $out/bin/expect
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Framework for testing other programs";
 

pkgs/by-name/ed/ed/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ed";
-  version = "1.22.6";
+  version = "1.22.5";
 
   src = fetchurl {
     url = "mirror://gnu/ed/ed-${finalAttrs.version}.tar.lz";
-    hash = "sha256-PzOyITUhnDnDxpX3txccJWfT4qF8eYwKkGBzIMuyaPI=";
+    hash = "sha256-VuEH3cLyna1mkDdsFb+XUVCeHuO4JBcQ5E7b5cOhWMw=";
   };
 
   nativeBuildInputs = [ lzip ];

pkgs/by-name/el/elan/package.nix

@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "elan";
-  version = "4.2.3";
+  version = "4.2.4";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "elan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ael2hla+jqiaP8FfYYQ0u3V8cVt+CEFEQU7jB3LYG2E=";
+    hash = "sha256-HojR0Q8J1nrTk7tA3kcQ8Y3kYzrrl2nAlD0kUo2EgPw=";
   };
 
-  cargoHash = "sha256-MDe/QBE1gd/4yMAuwBga8x9yv3duf3vaudMongurtQI=";
+  cargoHash = "sha256-dgqIu3SM134g/qLsetOLxed8/gAG8i90IKEy6xnK2rg=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/en/entire/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "entire";
-  version = "0.10.0";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "entireio";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PeCzPnIoeeyNsGqY7SXKykv8qmt2rY/3bQG0xqcPDP0=";
+    hash = "sha256-Di9o3D7LGpIxq4XYTIDSesNsQ1Z65qdOBWsiveXdWgg=";
   };
 
-  vendorHash = "sha256-7/SWL5axi1jJur0mGEO9dMnGO8NXT1RlUnSzz/IvE0g=";
+  vendorHash = "sha256-b+WjeqPM+NhKJZrV+2sl3Ihy6ABPR+TB82EKzqyUBYU=";
 
   subPackages = [ "cmd/entire" ];
 

pkgs/by-name/ex/expand-response-params/package.nix

@@ -26,8 +26,6 @@ stdenv.mkDerivation {
     mv expand-response-params${stdenv.hostPlatform.extensions.executable} $prefix/bin/
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Internal tool used by the nixpkgs wrapper scripts for processing response files";
     longDescription = ''

pkgs/by-name/fo/fortify-headers/package.nix

@@ -21,8 +21,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./restore-macros.patch
   ];
 
-  strictDeps = true;
-
   dontBuild = true;
 
   installPhase = ''
@@ -38,8 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     url = "git://git.2f30.org/fortify-headers";
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Standalone header-based fortify-source implementation";
     homepage = "https://git.2f30.org/fortify-headers";

pkgs/by-name/fv/fvm/package.nix

@@ -8,19 +8,16 @@
   nix-update-script,
 }:
 
-let
-  version = "4.1.2";
+buildDartApplication (finalAttrs: {
+  pname = "fvm";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "conceptadev";
     repo = "fvm";
-    tag = version;
-    hash = "sha256-Kyxyt2UsrQ6Bc6EuYJjpEFdYwcus2/bcVrWsd/gs3Ok=";
+    tag = finalAttrs.version;
+    hash = "sha256-SAWWKNbE/TyrP5bcIdDeAZa6/3d4D/Ru1PbcPvy9EDo=";
   };
-in
-buildDartApplication {
-  pname = "fvm";
-  inherit version src;
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
@@ -28,7 +25,7 @@ buildDartApplication {
     pubspecSource =
       runCommand "pubspec.lock.json"
         {
-          inherit src;
+          inherit (finalAttrs) src;
           nativeBuildInputs = [ yq-go ];
         }
         ''
@@ -52,4 +49,4 @@ buildDartApplication {
     mainProgram = "fvm";
     maintainers = [ ];
   };
-}
+})

pkgs/by-name/im/imagemagick/package.nix

@@ -69,13 +69,13 @@ assert libraqmSupport -> freetypeSupport;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-30";
+  version = "7.1.2-29";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-s2MC/14rNfbuOTI7xVNqr+YN2MobZ/EMnq0hxkJVAj8=";
+    hash = "sha256-gVp6eAXLl11KhtcpZ4hPeurCRHtRhhrAggJi7PatQ+M=";
   };
 
   outputs = [

pkgs/by-name/im/imath/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imath";
-  version = "3.2.3";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "imath";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kmWj9g6PnvgEOojjiWYpJ9+lXwT1svpezYDsCns4NP0=";
+    hash = "sha256-uLGH2kMo5S6iT2gS1091qKkCAxQ/iuQ8xx9507k6SzY=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/jb/jbig2dec/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   python3,
   autoconf,
   automake,
@@ -18,15 +17,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-qXBTaaZjOrpTJpNFDsgCxWI5fhuCRmLegJ7ekvZ6/yE=";
   };
 
-  # Remove with the first release containing cc37d0931aa71582f7128736a068c92cd8712d9b.
-  patches = [
-    (fetchpatch {
-      name = "CVE-2026-38076.patch";
-      url = "https://github.com/ArtifexSoftware/jbig2dec/commit/cc37d0931aa71582f7128736a068c92cd8712d9b.patch";
-      hash = "sha256-NdmE3xT5M6Ini6FJcKqCJmJkBTFnnq66/YV3Ky5PVNM=";
-    })
-  ];
-
   postPatch = ''
     patchShebangs test_jbig2dec.py
   '';

pkgs/by-name/je/jemalloc/package.nix

@@ -4,7 +4,6 @@
   fetchFromGitHub,
   fetchpatch,
   autoreconfHook,
-  bashNonInteractive,
   # By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
   # then stops downstream builds (mariadb in particular) from detecting it. This
   # option should remove the prefix and give us a working jemalloc.
@@ -77,12 +76,6 @@ stdenv.mkDerivation (finalAttrs: {
     autoreconfHook
   ];
 
-  buildInputs = [
-    bashNonInteractive
-  ];
-
-  strictDeps = true;
-
   configureFlags = [
     "--with-version=${finalAttrs.version}-0-g0000000000000000000000000000000000000000"
     "--with-lg-vaddr=${with stdenv.hostPlatform; toString (if isILP32 then 32 else parsed.cpu.bits)}"
@@ -115,8 +108,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Parallel builds break reproducibility.
   enableParallelBuilding = false;
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://jemalloc.net/";
     downloadPage = "https://github.com/jemalloc/jemalloc";

pkgs/by-name/js/json_c/package.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "json-c";
     repo = "json-c";
-    tag = "json-c-0.18-20240915";
+    rev = "json-c-0.18-20240915";
     hash = "sha256-UyMXr8Vc6kDOx1/lD2YKPiHdaTotXAF9ak0yQuwrSUA=";
   };
 
@@ -23,14 +23,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
-  strictDeps = true;
-
   cmakeFlags = [
     (lib.cmakeBool "BUILD_APPS" false)
   ];
 
-  __structuredAttrs = true;
-
   meta = {
     description = "JSON implementation in C";
     longDescription = ''

pkgs/by-name/ke/keyutils/package.nix

@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  bashNonInteractive,
   fetchurl,
 }:
 
@@ -16,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/keyutils.git/snapshot/keyutils-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ph1XBhNq5MBb1I+GGGvP29iN2L1RB+Phlckkz8Gzm7Q=";
+    sha256 = "sha256-ph1XBhNq5MBb1I+GGGvP29iN2L1RB+Phlckkz8Gzm7Q=";
   };
 
   patches = [
@@ -35,12 +34,6 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  buildInputs = [
-    bashNonInteractive
-  ];
-
-  strictDeps = true;
-
   makeFlags = lib.optionals stdenv.hostPlatform.isStatic [ "NO_SOLIB=1" ];
 
   outputs = [
@@ -53,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     # https://github.com/archlinux/svntogit-packages/blob/packages/keyutils/trunk/reproducible.patch
     substituteInPlace Makefile \
-      --replace-fail \
+      --replace \
         'VCPPFLAGS	:= -DPKGBUILD="\"$(shell date -u +%F)\""' \
         'VCPPFLAGS	:= -DPKGBUILD="\"$(date -ud "@$SOURCE_DATE_EPOCH" +%F)\""'
   '';
@@ -75,8 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     "USRLIBDIR=$(lib)/lib"
   ];
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://people.redhat.com/dhowells/keyutils/";
     description = "Tools used to control the Linux kernel key management system";

pkgs/by-name/la/lasuite-meet/frontend.nix

@@ -17,7 +17,7 @@ buildNpmPackage (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-CRq4qpdUBOPBelmrbOgrBdQxD0tY84S3YSbCTQXBkvA=";
+    hash = "sha256-wmAyH35rNgju0GyhvQJHS6vDkFKOoIgiN4ctnu4clN0=";
   };
   npmBuildScript = "build";
 

pkgs/by-name/la/lasuite-meet/mail.nix

@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
     pname = "${finalAttrs.pname}-npm-deps";
     inherit version src;
     inherit (finalAttrs) sourceRoot;
-    hash = "sha256-EpUeQpEerHfZ5nZMCanZ+ayzqKHnCeRE4MqVa8TApKk=";
+    hash = "sha256-kArjyi8Jp5gfC/VW5Idzobxgt+NwGHSVP/UxQf7ds4Y=";
   };
   npmBuildScript = "build";
 

pkgs/by-name/la/lasuite-meet/package.nix

@@ -6,13 +6,13 @@
   python3,
 }:
 let
-  version = "1.28.0";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-BGYyAm4iX0/E1Fv9siRtOT9FXfpc3EAGhKwGRMTkoeQ=";
+    hash = "sha256-SqWKhb4oLKzFkcl96IX4OxzUHVAJn3zh2ZVEDnFVz4E=";
   };
 
   meta = {

pkgs/by-name/li/libcap_ng/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcap-ng";
-  version = "0.9.5";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "stevegrubb";
     repo = "libcap-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HYVbPoFSlkmNuL5EsEQVAekE4fwidgL+biTBBS1BdPM=";
+    hash = "sha256-anuPOBWp4Hlpo+m6kYlSd2v7H3P7LQ9brZdq1lo7Po4=";
   };
 
   # NEWS needs to exist or else the build fails
@@ -58,20 +58,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   configureFlags = [
-    # cap_audit is deliberately not enabled here.
-    # First, it'd create a cyclic dependency on audit, which we want to avoid.
-    # Second, it requires a vmlinux.h for utils/cap-audit/cap_audit.bpf.c
-    # The vmlinux.h header can either be generated from the running kernel of the build system
-    # (which does not work on cross with a non-linux build machine, and is never reproducible),
-    # or it can be supplied to configure by path (necessitating a dependency on a specific linux kernel).
-    # A compromise could be introducing a cap_audit package as part of linuxPackages set,
-    # but the cost on CI would not be insignificant due to that being built once per kernel.
-    # All current options are bad in their own way, so this stays disabled until we have a proper
-    # solution for vmlinux.h to not rebuild the world, or provably a user requiring this.
-    # "--enable-cap-audit"
-    # "--with-vmlinux-h=provided"
-    # "--with-vmlinux-h-path="
-
     (lib.withFeature withPython "python")
     "--with-capability_header='${linuxHeaders}/include/linux/capability.h'" # required to link bindings
   ];

pkgs/by-name/li/libconfuse/package.nix

@@ -2,21 +2,34 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   flex,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libconfuse";
-  version = "3.4";
+  version = "3.3";
 
   src = fetchFromGitHub {
-    owner = "libconfuse";
-    repo = "libconfuse";
+    sha256 = "1npfk5jv59kk4n8pkyx89fn9s6p8x3gbffs42jaw24frgxfgp8ca";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sC8O6vcMKvRdRCTXpKl6lgmzFUVG8/LBE7XsGX8F9e4=";
+    repo = "libconfuse";
+    owner = "libconfuse";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-40320.patch";
+      urls = [
+        "https://sources.debian.org/data/main/libc/libconfuse/3.3-3/debian/patches/CVE-2022-40320.patch"
+        # files on sources.debian.org can disappear
+        "https://web.archive.org/web/20230107133212/https://sources.debian.org/data/main/libc/libconfuse/3.3-3/debian/patches/CVE-2022-40320.patch"
+      ];
+      sha256 = "sha256-ftfE9JFz4nyRSOb2xHb9BAtgWn5Yv2WLm4RegDLtiBw=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace tests/Makefile.am \
       --replace 'TESTS            += empty_string' "" \

pkgs/by-name/li/libei/package.nix

@@ -11,7 +11,6 @@
   pkg-config,
   protobuf,
   protobufc,
-  systemdSupport ? stdenv.hostPlatform.isLinux,
   systemdLibs,
   buildPackages,
   epoll-shim,
@@ -53,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     protobuf
     protobufc
   ]
-  ++ lib.optionals systemdSupport [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     systemdLibs
   ]
   ++ lib.optionals stdenv.hostPlatform.isFreeBSD [

pkgs/by-name/li/libgpg-error/package.nix

@@ -24,106 +24,99 @@ let
   };
 in
 stdenv.mkDerivation (
-  finalAttrs:
-  (
-    {
-      pname = "libgpg-error";
-      version = "1.61";
+  rec {
+    pname = "libgpg-error";
+    version = "1.61";
 
-      src = fetchurl {
-        url = "mirror://gnupg/libgpg-error/libgpg-error-${finalAttrs.version}.tar.bz2";
-        hash = "sha256-eoVBPyvDVPT4qoMrcYrxIuSJZeng65AS7mWcE8Y4XJM=";
-      };
+    src = fetchurl {
+      url = "mirror://gnupg/libgpg-error/libgpg-error-${version}.tar.bz2";
+      hash = "sha256-eoVBPyvDVPT4qoMrcYrxIuSJZeng65AS7mWcE8Y4XJM=";
+    };
 
-      patches = [
-        # Fixes t-printf test on platforms where LDBL_MAX == DBL_MAX (armhf, ppc64)
-        # Upstream's git forge doesn't seem to have a nice way to download it :/
-        ./libgpg-error-tests-skip-a-test-when-not-HAVE_LONG_DOUBLE_WIDER.patch
-      ];
+    patches = [
+      # Fixes t-printf test on platforms where LDBL_MAX == DBL_MAX (armhf, ppc64)
+      # Upstream's git forge doesn't seem to have a nice way to download it :/
+      ./libgpg-error-tests-skip-a-test-when-not-HAVE_LONG_DOUBLE_WIDER.patch
+    ];
 
-      postPatch = ''
-        sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
+    postPatch = ''
+      sed '/BUILD_TIMESTAMP=/s/=.*/=1970-01-01T00:01+0000/' -i ./configure
+    ''
+    # libgpg-error insists on having these generated files. They should be fairly ABI stable,
+    # so add one for FreeBSD.
+    + lib.optionalString (stdenv.hostPlatform.system == "x86_64-freebsd") ''
+      cp ${./lock-obj-pub.x86_64-unknown-freebsd.h} src/syscfg/lock-obj-pub.freebsd.h
+    ''
+    # Fails on powerpc64-linux
+    # https://lists.gnupg.org/pipermail/gnupg-users/2026-July/068440.html
+    + lib.optionalString (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) ''
+      substituteInPlace tests/t-printf.c \
+        --replace-fail \
+          '# ifdef HAVE_LONG_DOUBLE_WIDER' \
+          '# if 0' \
+        --replace-fail \
+          'show ("LDBL_MAX == DBL_MAX - skipping LDBL_MAX test\n")' \
+          'show ("LDBL_MAX is weird on this platform - skipping LDBL_MAX test\n")'
+    '';
+
+    hardeningDisable = [ "strictflexarrays3" ];
+
+    configureFlags = [
+      # See https://dev.gnupg.org/T6257#164567
+      "--enable-install-gpg-error-config"
+    ];
+
+    outputs = [
+      "out"
+      "dev"
+      "info"
+    ];
+    outputBin = "dev"; # deps want just the lib, most likely
+
+    # If architecture-dependent MO files aren't available, they're generated
+    # during build, so we need gettext for cross-builds.
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    nativeBuildInputs = [
+      autoreconfHook # HAVE_LONG_DOUBLE_WIDER patch changes configure.ac
+      gettext
+    ];
+
+    postConfigure =
+      # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
+      # `config.status' run:
+      #   ./config.status[1401]: shift: (null): bad number
+      # (See <https://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
+      # Thus, re-run it with Bash.
+      lib.optionalString stdenv.hostPlatform.isSunOS ''
+        ${stdenv.shell} config.status
       ''
-      # libgpg-error insists on having these generated files. They should be fairly ABI stable,
-      # so add one for FreeBSD.
-      + lib.optionalString (stdenv.hostPlatform.system == "x86_64-freebsd") ''
-        cp ${./lock-obj-pub.x86_64-unknown-freebsd.h} src/syscfg/lock-obj-pub.freebsd.h
-      ''
-      # Fails on powerpc64-linux
-      # https://lists.gnupg.org/pipermail/gnupg-users/2026-July/068440.html
-      + lib.optionalString (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) ''
-        substituteInPlace tests/t-printf.c \
-          --replace-fail \
-            '# ifdef HAVE_LONG_DOUBLE_WIDER' \
-            '# if 0' \
-          --replace-fail \
-            'show ("LDBL_MAX == DBL_MAX - skipping LDBL_MAX test\n")' \
-            'show ("LDBL_MAX is weird on this platform - skipping LDBL_MAX test\n")'
+      # ./configure erroneous decides to use weak symbols on pkgsStatic,
+      # which, together with other defines results in locking functions in
+      # src/posix-lock.c to be no-op, causing tests/t-lock.c to fail.
+      + lib.optionalString stdenv.hostPlatform.isStatic ''
+        sed '/USE_POSIX_THREADS_WEAK/ d' config.h
+        echo '#undef USE_POSIX_THREADS_WEAK' >> config.h
       '';
 
-      hardeningDisable = [ "strictflexarrays3" ];
+    doCheck = true; # not cross
 
-      configureFlags = [
-        # See https://dev.gnupg.org/T6257#164567
-        "--enable-install-gpg-error-config"
-      ];
+    meta = {
+      homepage = "https://www.gnupg.org/software/libgpg-error/index.html";
+      changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;hb=refs/tags/libgpg-error-${version}";
+      description = "Small library that defines common error values for all GnuPG components";
+      mainProgram = "gen-posix-lock-obj";
 
-      outputs = [
-        "out"
-        "dev"
-        "info"
-      ];
-      outputBin = "dev"; # deps want just the lib, most likely
+      longDescription = ''
+        Libgpg-error is a small library that defines common error values
+        for all GnuPG components.  Among these are GPG, GPGSM, GPGME,
+        GPG-Agent, libgcrypt, Libksba, DirMngr, Pinentry, SmartCard
+        Daemon and possibly more in the future.
+      '';
 
-      # If architecture-dependent MO files aren't available, they're generated
-      # during build, so we need gettext for cross-builds.
-      depsBuildBuild = [ buildPackages.stdenv.cc ];
-      nativeBuildInputs = [
-        autoreconfHook # HAVE_LONG_DOUBLE_WIDER patch changes configure.ac
-        gettext
-      ];
-
-      strictDeps = true;
-
-      postConfigure =
-        # For some reason, /bin/sh on OpenIndiana leads to this at the end of the
-        # `config.status' run:
-        #   ./config.status[1401]: shift: (null): bad number
-        # (See <https://hydra.nixos.org/build/2931046/nixlog/1/raw>.)
-        # Thus, re-run it with Bash.
-        lib.optionalString stdenv.hostPlatform.isSunOS ''
-          ${stdenv.shell} config.status
-        ''
-        # ./configure erroneous decides to use weak symbols on pkgsStatic,
-        # which, together with other defines results in locking functions in
-        # src/posix-lock.c to be no-op, causing tests/t-lock.c to fail.
-        + lib.optionalString stdenv.hostPlatform.isStatic ''
-          sed '/USE_POSIX_THREADS_WEAK/ d' config.h
-          echo '#undef USE_POSIX_THREADS_WEAK' >> config.h
-        '';
-
-      doCheck = true; # not cross
-
-      __structuredAttrs = true;
-
-      meta = {
-        homepage = "https://www.gnupg.org/software/libgpg-error/index.html";
-        changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;hb=refs/tags/libgpg-error-${finalAttrs.version}";
-        description = "Small library that defines common error values for all GnuPG components";
-        mainProgram = "gen-posix-lock-obj";
-
-        longDescription = ''
-          Libgpg-error is a small library that defines common error values
-          for all GnuPG components.  Among these are GPG, GPGSM, GPGME,
-          GPG-Agent, libgcrypt, Libksba, DirMngr, Pinentry, SmartCard
-          Daemon and possibly more in the future.
-        '';
-
-        license = lib.licenses.lgpl2Plus;
-        platforms = lib.platforms.all;
-        maintainers = [ ];
-      };
-    }
-    // genPosixLockObjOnlyAttrs
-  )
+      license = lib.licenses.lgpl2Plus;
+      platforms = lib.platforms.all;
+      maintainers = [ ];
+    };
+  }
+  // genPosixLockObjOnlyAttrs
 )

pkgs/by-name/li/libheif/package.nix

@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
-  version = "1.23.2";
+  version = "1.23.1";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fqz2BfdcnnR5tylKcxM1xESoTRh5WgqvgdsBLJcnySU=";
+    hash = "sha256-o+gQCv/lpRx+IaqpjHACh8ysgl/N4Mo/9zbAI/cnWas=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libidn/package.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnu/libidn/libidn-${finalAttrs.version}.tar.gz";
-    hash = "sha256-SZYIurOmVlCg6lKIjBOo3uvj9xQI4xms2exS4C6xOVk=";
+    sha256 = "sha256-SZYIurOmVlCg6lKIjBOo3uvj9xQI4xms2exS4C6xOVk=";
   };
 
   outputs = [
@@ -27,12 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
 
-  strictDeps = true;
-
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
-  __structuredAttrs = true;
-
   meta = {
     changelog = "https://codeberg.org/libidn/libidn/src/tag/v${finalAttrs.version}/NEWS";
     homepage = "https://www.gnu.org/software/libidn/";

pkgs/by-name/li/libpsl/package.nix

@@ -56,8 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt
   ];
 
-  strictDeps = true;
-
   propagatedBuildInputs = [
     publicsuffix-list
   ];
@@ -85,8 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  __structuredAttrs = true;
-
   meta = {
     description = "C library for the Publix Suffix List";
     longDescription = ''

pkgs/by-name/li/librsvg/librsvg-libpixbufloader-install-names.patch

@@ -1,25 +0,0 @@
---- a/gdk-pixbuf-loader/meson_install.py
-+++ b/gdk-pixbuf-loader/meson_install.py
-@@ -13,6 +13,22 @@ if __name__ == '__main__':
-     argparse.add_argument('--cache-file', type=Path, metavar="PATH", help="module cache file to write")
-     argparse.add_argument('--show-cross-message', action='store_true', help="tell the user to run query-loaders manually")
-     args = argparse.parse_args()
-+    if sys.platform in ['darwin', 'ios']:
-+        modulepath = Path(args.moduledir).resolve()
-+        prefix = modulepath.parent.parent.parent
-+        location = modulepath
-+        if 'DESTDIR' in os.environ:
-+            location = Path(os.environ['DESTDIR']) / modulepath.relative_to('/')
-+        oldfilepath = location / 'libpixbufloader_svg.dylib'
-+        newfilename = 'libpixbufloader-svg.so'
-+        newfilepath = location / newfilename
-+        installfilepath = modulepath / 'libpixbufloader-svg.so'
-+        librsvgpath = prefix / 'librsvg-2.2.dylib'
-+        os.rename(oldfilepath.as_posix(), newfilepath.as_posix())
-+        subprocess.run(
-+            ['install_name_tool', '-id', installfilepath.as_posix(), newfilepath.as_posix()])
-+        subprocess.run(
-+            ['install_name_tool', '-change', '@rpath/librsvg-2.2.dylib', librsvgpath.as_posix(), newfilepath.as_posix()])
- 
-     if not(args.show_cross_message or (args.queryloaders and args.moduledir and args.cache_file)):
-         argparse.print_help()

pkgs/by-name/li/librsvg/package.nix

@@ -65,14 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-frRJsnIqdoAhNW9m3+4yAsIptU7U5qcM5AwJDpf/FvI=";
   };
 
-  # FIXME: This patch should be made unconditional the next time librsvg is
-  # updated.
-  patches = lib.optionals stdenv.hostPlatform.isDarwin [
-    # Rebased copy of https://gitlab.gnome.org/GNOME/gtk-osx/-/blob/2c1492036ff92d1c87d7b7a4c3c5a7a3f042f825/patches/librsvg-libpixbufloader-install-names.patch.
-    # Fixes https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1161.
-    ./librsvg-libpixbufloader-install-names.patch
-  ];
-
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";

pkgs/by-name/li/libstemmer/package.nix

@@ -13,20 +13,18 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "snowballstem";
     repo = "snowball";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-qXrypwv/I+5npvGHGsHveijoui0ZnoGYhskCfLkewVE=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-qXrypwv/I+5npvGHGsHveijoui0ZnoGYhskCfLkewVE=";
   };
 
   nativeBuildInputs = [ perl ];
 
-  strictDeps = true;
-
   prePatch = ''
     patchShebangs .
   ''
   + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     substituteInPlace GNUmakefile \
-      --replace-fail './snowball ' '${lib.getExe' buildPackages.libstemmer "snowball"} '
+      --replace './snowball' '${lib.getBin buildPackages.libstemmer}/bin/snowball'
   '';
 
   makeTarget = "libstemmer.a";
@@ -39,8 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Snowball Stemming Algorithms";
     homepage = "https://snowballstem.org/";

pkgs/by-name/ll/llama-cpp/package.nix

@@ -4,7 +4,6 @@
   cmake,
   fetchFromGitHub,
   installShellFiles,
-  nix-update-script,
   stdenv,
 
   config,
@@ -46,6 +45,8 @@
 }:
 
 let
+  buildNumber = "10566";
+
   # It's necessary to consistently use backendStdenv when building with CUDA support,
   # otherwise we get libstdc++ errors downstream.
   # cuda imposes an upper bound on the gcc version
@@ -79,7 +80,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "10408";
+  version = "0.2.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -92,8 +93,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
-    tag = "b${finalAttrs.version}";
-    hash = "sha256-b01kyCjcrAJ4zFPNRM2GU/9TR5y1mi7WIJDNYrhSJZo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6cK5BMCCEUWL+590+WbrRInH3eEnsZ/S5m71IIBgDsA=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -142,7 +143,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   preConfigure = ''
     prependToVar cmakeFlags "-DLLAMA_BUILD_COMMIT:STRING=$(cat COMMIT)"
     pushd ${finalAttrs.npmRoot}
-    LLAMA_BUILD_NUMBER=${finalAttrs.version} npm run build
+    LLAMA_BUILD_NUMBER=${buildNumber} npm run build
     popd
   '';
 
@@ -151,6 +152,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     (cmakeBool "LLAMA_BUILD_EXAMPLES" false)
     (cmakeBool "LLAMA_BUILD_SERVER" true)
     (cmakeBool "LLAMA_BUILD_TESTS" (finalAttrs.finalPackage.doCheck or false))
+    (cmakeBool "LLAMA_BUILD_IS_DEV" false)
     (cmakeBool "LLAMA_OPENSSL" true)
     (cmakeBool "BUILD_SHARED_LIBS" true)
     (cmakeBool "GGML_BLAS" blasSupport)
@@ -160,7 +162,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     (cmakeBool "GGML_METAL" metalSupport)
     (cmakeBool "GGML_RPC" rpcSupport)
     (cmakeBool "GGML_VULKAN" vulkanSupport)
-    (cmakeFeature "LLAMA_BUILD_NUMBER" finalAttrs.version)
+    (cmakeFeature "LLAMA_BUILD_NUMBER" buildNumber)
   ]
   ++ optionals cpuArchDynamicDispatch [
     # Build all CPU backend variants for runtime dynamic dispatch.
@@ -201,13 +203,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   doCheck = false;
 
   passthru = {
-    updateScript = nix-update-script {
-      attrPath = "llama-cpp";
-      extraArgs = [
-        "--version-regex"
-        "b(.*)"
-      ];
-    };
+    updateScript = ./update.sh;
   };
 
   meta = {

pkgs/by-name/ll/llama-cpp/update.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils gitMinimal gnused nix-update
+# shellcheck shell=bash
+
+set -euo pipefail
+
+repo_url="https://github.com/ggml-org/llama.cpp.git"
+
+version="$({
+  git ls-remote --refs --tags "$repo_url" 'refs/tags/v*' \
+    | sed -nE 's|^[^[:space:]]+[[:space:]]+refs/tags/v([0-9]+\.[0-9]+\.[0-9]+)$|\1|p' \
+    | sort -V \
+    | tail -n1
+})"
+
+if [[ -z "$version" ]]; then
+  echo "Failed to find the latest semantic version tag" >&2
+  exit 1
+fi
+
+tag_refs="$(
+  git ls-remote --tags "$repo_url" \
+    "refs/tags/v$version" "refs/tags/v$version^{}" 'refs/tags/b*'
+)"
+release_commit="$(
+  awk -v ref="refs/tags/v$version^{}" '$2 == ref { print $1 }' <<<"$tag_refs"
+)"
+if [[ -z "$release_commit" ]]; then
+  release_commit="$(
+    awk -v ref="refs/tags/v$version" '$2 == ref { print $1 }' <<<"$tag_refs"
+  )"
+fi
+build_number="$({
+  awk -v commit="$release_commit" '
+    $1 == commit && $2 ~ /^refs\/tags\/b[0-9]+(\^\{\})?$/ {
+      sub(/^refs\/tags\/b/, "", $2)
+      sub(/\^\{\}$/, "", $2)
+      print $2
+    }
+  ' <<<"$tag_refs" | sort -n | tail -n1
+})"
+
+if [[ -z "$release_commit" || -z "$build_number" ]]; then
+  echo "Failed to find the build number for v$version" >&2
+  exit 1
+fi
+
+cd "$(git rev-parse --show-toplevel)"
+nix-update "${UPDATE_NIX_ATTR_PATH:-llama-cpp}" --version "$version"
+sed -i -E \
+  's|(buildNumber = ")[0-9]+(";)|\1'"$build_number"'\2|' \
+  pkgs/by-name/ll/llama-cpp/package.nix

pkgs/by-name/lz/lzip/package.nix

@@ -40,8 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
   strictDeps = true;
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://www.nongnu.org/lzip/lzip.html";
     description = "Lossless data compressor based on the LZMA algorithm";

pkgs/by-name/ma/mailcap/package.nix

@@ -22,12 +22,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-mkAyIC/A0rCFj0GxZzianP5SrCTsKC5kebkHZTGd4RM=";
   };
 
-  strictDeps = true;
-
   installPhase = ''
     runHook preInstall
 
-    substituteInPlace mailcap --replace-fail "/usr/bin/" ""
+    substituteInPlace mailcap --replace "/usr/bin/" ""
     sh generate-nginx-mimetypes.sh < mime.types > nginx-mime.types
 
     install -D -m0644 nginx-mime.types $out/etc/nginx/mime.types
@@ -58,8 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.nginx-mime = nixosTests.nginx-mime;
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Helper application and MIME type associations for file types";
     homepage = "https://pagure.io/mailcap";

pkgs/by-name/ma/maturin/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "maturin";
-  version = "1.15.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-elK82eg/m33GYNWeZUSfKxFVJS6fMRatHl66NgvxcxE=";
+    hash = "sha256-sqcNRN8oAZ2AK5gHr3ipb035VOiB+zDA10wTtiaeUBM=";
   };
 
-  cargoHash = "sha256-WRVXmhwhbOf2Isjvyqw3d4scA5Vs8Vkyy1m7WC3xb0s=";
+  cargoHash = "sha256-pD8/S7GsFFeAjc8U4fQ9ZTu+o3mKyPagMPKKRI40n4w=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv

pkgs/by-name/me/media-player-info/package.nix

@@ -7,6 +7,7 @@
   python3,
   udev,
   udevCheckHook,
+  systemd,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -21,14 +22,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-VoMr5Lxy6u/BA/9t65/S8AW41YU0FLp6eftYUVdoMjY=";
   };
 
+  buildInputs = [
+    udev
+    systemd
+  ];
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
-    udevCheckHook
-
-    # used at *build* time only
     python3
-    udev
+    udevCheckHook
   ];
 
   doInstallCheck = true;

pkgs/by-name/me/mendeley/package.nix

@@ -6,11 +6,11 @@
 
 appimageTools.wrapType2 (finalAttrs: {
   pname = "mendeley";
-  version = "2.148.0";
+  version = "2.149.0";
 
   src = fetchurl {
     url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${finalAttrs.version}-x86_64.AppImage";
-    hash = "sha256-ZejpXyq5ILlvppBfj+F2zHhJ3dLJyGlCYHJlNISCSSs=";
+    hash = "sha256-XarirKKV7hyW+I5kfRLWX78yS2BiLJOL16/Vw0vGswg=";
   };
 
   strictDeps = true;

pkgs/by-name/mu/musl/package.nix

@@ -185,9 +185,6 @@ stdenv.mkDerivation (finalAttrs: {
     threadModel = "posix";
   };
 
-  strictDeps = true;
-  __structuredAttrs = true;
-
   meta = {
     description = "Efficient, small, quality libc implementation";
     homepage = "https://musl.libc.org/";

pkgs/by-name/ne/networkmanager/package.nix

@@ -112,9 +112,6 @@ stdenv.mkDerivation (finalAttrs: {
     (mesonOption "systemdsystemunitdir" (
       if withSystemd then "${placeholder "out"}/etc/systemd/system" else "no"
     ))
-    (mesonOption "systemdsystemgeneratordir" (
-      if withSystemd then "${placeholder "out"}/lib/systemd/system-generators" else "no"
-    ))
     # to enable link-local connections
     (mesonOption "udev_dir" "${placeholder "out"}/lib/udev")
     (mesonOption "dbus_conf_dir" "${placeholder "out"}/share/dbus-1/system.d")

pkgs/by-name/no/notesnook/package.nix

@@ -9,7 +9,7 @@
 
 let
   pname = "notesnook";
-  version = "3.4.5";
+  version = "3.4.6";
 
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
@@ -26,9 +26,9 @@ let
     url = "https://github.com/streetwriters/notesnook/releases/download/v${version}/notesnook_${suffix}";
     hash =
       {
-        x86_64-linux = "sha256-Zcx6TzmyInwE2+0RbBm6+1yAL85rhcFWbr2FOSmOT6Y=";
-        aarch64-linux = "sha256-ghxdb8TG4/uh1iuN5jaQ6aeYrXJh5+oX0ZpT/j8+5Ck=";
-        aarch64-darwin = "sha256-xw8oSGqTovCioRu6FVKZIrFraE72PwPvqZms5+K3S/M=";
+        x86_64-linux = "sha256-2XJAmJ6lqAs4BvTNZHqLkdpoZtl/kujloFfvgkSgVPs=";
+        aarch64-linux = "sha256-D2WkILFoeguKD7UuW/724ywvHrlbnHEr6A5vWnRvgto=";
+        aarch64-darwin = "sha256-GgXHOwiZV934f0HHwbgLfJVELytLnk5IpXX+KU5yN8I=";
       }
       .${system} or throwSystem;
   };

pkgs/by-name/np/npb/package.nix

@@ -0,0 +1,85 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  git,
+  nix-eval-jobs,
+  nix-output-monitor,
+  versionCheckHook,
+  nix-update-script,
+}:
+let
+  # Use the version of nix that came with nix-eval-jobs per the upstream npb
+  # packaging.  This (a) keeps closure sizes down, since it means this package
+  # doesn't pull in both Nixpkgs' nix and nix-eval-jobs' nix, (b) removes any
+  # risk of incompatibilities between calls to nix inside and outside
+  # nix-eval-jobs, and (c) means that -- at time of writing -- we automatically
+  # get at least version v2.35 of nix, which npb needs, even though the default
+  # Nixpkgs nix version is v2.34.
+  inherit (nix-eval-jobs) nix;
+
+  buildCanExecuteHost = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "npb";
+  version = "1.0.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "samestep";
+    repo = "npb";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pXatlxVJnrt8JFf+TPcUAL1U5mz4kWn8qfRtVHekYjA=";
+  };
+
+  cargoHash = "sha256-pZAaTweVR/JkTdtB4/FtXfSDPFTl1+cEdqx5finWMBk=";
+
+  nativeBuildInputs = lib.optional buildCanExecuteHost installShellFiles;
+
+  env = {
+    GIT_BIN = lib.getExe git;
+    NIX_BIN =
+      # nix must be at least v2.35, as npb depends on the lazy source copying
+      # added in that version.
+      assert lib.versionAtLeast nix.version "2.35";
+      lib.getExe nix;
+    NIX_STORE_BIN = lib.getExe' nix "nix-store";
+    NIX_INSTANTIATE_BIN = lib.getExe' nix "nix-instantiate";
+    NIX_EVAL_JOBS_BIN = lib.getExe nix-eval-jobs;
+    NOM_BIN = lib.getExe nix-output-monitor;
+  };
+
+  postInstall = lib.optionalString buildCanExecuteHost ''
+    completion_tmp_dir="$(mktemp -d --tmpdir)"
+    args=()
+    for shell in bash fish zsh; do
+        "$out"/bin/npb --completions "$shell" > "$completion_tmp_dir"/"$shell"
+        args+=("--$shell" "$completion_tmp_dir"/"$shell")
+    done
+    installShellCompletion --cmd npb "''${args[@]}"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Nixpkgs build comparison tool";
+    longDescription = ''
+      A CLI tool to generate reports on the differences in build outcomes
+      between a pair of Nixpkgs commits.
+    '';
+    mainProgram = "npb";
+    homepage = "https://github.com/samestep/npb";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      samestep
+      me-and
+    ];
+  };
+})

pkgs/by-name/on/oniguruma/package.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Note: do not use fetchpatch or fetchFromGitHub to keep this package available in __bootPackages
   src = fetchurl {
     url = "https://github.com/kkos/oniguruma/releases/download/v${finalAttrs.version}/onig-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Klz8WuJZ5Ol/hraN//wVLNr/6U4gYLdwy4JyONdp/AU=";
+    sha256 = "sha256-Klz8WuJZ5Ol/hraN//wVLNr/6U4gYLdwy4JyONdp/AU=";
   };
 
   outputs = [
@@ -23,13 +23,8 @@ stdenv.mkDerivation (finalAttrs: {
   outputBin = "dev"; # onig-config
 
   nativeBuildInputs = [ autoreconfHook ];
-
-  strictDeps = true;
-
   configureFlags = [ "--enable-posix-api=yes" ];
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "https://github.com/kkos/oniguruma";
     description = "Regular expressions library";

pkgs/by-name/op/opencloud/package.nix

@@ -28,13 +28,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opencloud";
-  version = "7.4.0";
+  version = "7.5.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/j3aXAzsIWPHNIRcHLlbi6Y53be5d5GBqrVIZCk0bEw=";
+    hash = "sha256-OMQuNfm9xqXaDexuoDRvvSEoEb7hXEMF7ynRU3CawbI=";
   };
 
   postPatch = ''

pkgs/by-name/op/opencloud/web.nix

@@ -10,20 +10,20 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "7.3.0";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v1VmX3q2YQUd3PvRVVEvDvpsgVcNklflXRXRvtHOuCU=";
+    hash = "sha256-idoR5R97k5ZfYBh7vboXzg2CdbVX5TBPrpL6s1k9qPA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-Y/Xz62ZS7pU6WB3dxewfhNI4POW/r/DGodpEy+xw/ww=";
+    hash = "sha256-h2QNq51GE8qnLsvPhDobzT/8am0jzbW6Mx6tnungY/k=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ov/ovito/package.nix

@@ -7,7 +7,7 @@
   cmake,
   boost,
   bzip2,
-  ffmpeg,
+  ffmpeg_8,
   fftwSinglePrec,
   hdf5,
   muparser,
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     boost
     bzip2
-    ffmpeg
+    ffmpeg_8
     fftwSinglePrec
     hdf5
     muparser

pkgs/by-name/p1/p11-kit/package.nix

@@ -14,14 +14,14 @@
   libintl,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "p11-kit";
   version = "0.26.2";
 
   src = fetchFromGitHub {
     owner = "p11-glue";
     repo = "p11-kit";
-    tag = finalAttrs.version;
+    tag = version;
     hash = "sha256-qFanbp0KPc6+CN4s5mMQNduzcxt/SrMcYWvIMZ0XnGY=";
     fetchSubmodules = true;
   };
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     # Install sample config files to $out/etc even though they will be loaded from /etc.
     substituteInPlace p11-kit/meson.build \
-      --replace-fail 'install_dir: prefix / p11_system_config' "install_dir: '$out/etc/pkcs11'"
+      --replace 'install_dir: prefix / p11_system_config' "install_dir: '$out/etc/pkcs11'"
   '';
 
   preCheck = ''
@@ -82,8 +82,6 @@ stdenv.mkDerivation (finalAttrs: {
     fi
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Library for loading and sharing PKCS#11 modules";
     longDescription = ''
@@ -93,8 +91,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://p11-glue.github.io/p11-glue/p11-kit.html";
     changelog = [
-      "https://github.com/p11-glue/p11-kit/raw/${finalAttrs.version}/NEWS"
-      "https://github.com/p11-glue/p11-kit/releases/tag/${finalAttrs.version}"
+      "https://github.com/p11-glue/p11-kit/raw/${version}/NEWS"
+      "https://github.com/p11-glue/p11-kit/releases/tag/${version}"
     ];
     platforms = lib.platforms.all;
     badPlatforms = [
@@ -103,6 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     license = lib.licenses.bsd3;
     mainProgram = "p11-kit";
-    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "p11-kit_project" finalAttrs.version;
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "p11-kit_project" version;
   };
-})
+}

pkgs/by-name/pk/pkg-config-unwrapped/package.nix

@@ -77,8 +77,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   postInstall = ''rm -f "$out"/bin/*-pkg-config''; # clean the duplicate file
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Tool that allows packages to find out information about other packages";
     homepage = "http://pkg-config.freedesktop.org/wiki/";

pkgs/by-name/qu/qui/package.nix

@@ -14,12 +14,12 @@
 }:
 buildGo126Module (finalAttrs: {
   pname = "qui";
-  version = "1.25.0";
+  version = "1.26.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "qui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nTFqN3dccCP/W8GN5pW8fkyxqvftiMudALYrq/43vME=";
+    hash = "sha256-sBtuOlNx0/qYqXTIdszrdVhhNoH/fWmt2QCRDGExHb0=";
   };
 
   qui-web = stdenvNoCC.mkDerivation (finalAttrs': {
@@ -44,7 +44,7 @@ buildGo126Module (finalAttrs: {
         ;
       pnpm = pnpm_11;
       fetcherVersion = 4;
-      hash = "sha256-HpH65G6tzADVLXSa/BNbJCMTEbzJTeormf+r1fsjd/g=";
+      hash = "sha256-bizOVrot/FrZ+NDefXJkll9YxjxbRut5tdPqGd3u5kE=";
     };
 
     postBuild = ''
@@ -56,7 +56,7 @@ buildGo126Module (finalAttrs: {
     '';
   });
 
-  vendorHash = "sha256-baNthuhGi0VvNQ+sXIO/FHDX+h+Ca/96PZbX0dYwWQU=";
+  vendorHash = "sha256-Zam5xkJUsGbzvX5q9NKNiN0n7UxhCUk9e43GMzE4M18=";
 
   preBuild = ''
     cp -r ${finalAttrs.qui-web}/* web/dist
@@ -75,6 +75,11 @@ buildGo126Module (finalAttrs: {
     export TMPDIR=/tmp
   '';
 
+  checkFlags = [
+    # broken in sandbox for some reason
+    "-skip=TestRollback"
+  ];
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

pkgs/by-name/re/re2c/package.nix

@@ -28,8 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
     python3
   ];
 
-  strictDeps = true;
-
   doCheck = true;
   enableParallelBuilding = true;
 
@@ -50,8 +48,6 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Tool for writing very fast and very flexible scanners";
     homepage = "https://re2c.org";

pkgs/by-name/rm/rmw/package.nix

@@ -8,17 +8,22 @@
   canfigger,
   ncurses,
   gettext,
+  glib,
+  linuxHeaders,
 }:
 
+let
+  version = "0.10.0";
+in
 stdenv.mkDerivation (finalAttrs: {
+  inherit version;
   pname = "rmw";
-  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "theimpossibleastronaut";
     repo = "rmw";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-JWNLSilZjmcAKfNe4ydVjYkcxKxf6Wby0GTV7lvFnW4=";
+    tag = "v${version}";
+    hash = "sha256-NT6P0/pPYyAlno+w0DZoZUepm8cbwlc3+Ety15CKV+g=";
     fetchSubmodules = true;
   };
 
@@ -26,20 +31,24 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     meson
     ninja
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux linuxHeaders;
 
   buildInputs = [
     canfigger
     ncurses
+    glib
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin gettext;
 
   meta = {
-    description = "Trashcan/ recycle bin utility for the command line";
+    description = "trashcan/recycle bin utility for the command line";
     homepage = "https://github.com/theimpossibleastronaut/rmw";
-    changelog = "https://github.com/theimpossibleastronaut/rmw/blob/${finalAttrs.src.rev}/ChangeLog";
+    changelog = "https://github.com/theimpossibleastronaut/rmw/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      _0k4r1m
+    ];
     mainProgram = "rmw";
   };
 })

pkgs/by-name/s2/s2n-tls/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s2n-tls";
-  version = "1.7.8";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "s2n-tls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ib0f8dQiajTghfmPmeQe2Mkymc+AMDcZBWLgxgxnxv4=";
+    hash = "sha256-ujKVtVioQP7RNyQ3hGVCNGanOpYlzTecerTdrsVtlUo=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/si/simdutf/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simdutf";
-  version = "9.1.0";
+  version = "9.0.0";
 
   src = fetchFromGitHub {
     owner = "simdutf";
     repo = "simdutf";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PKL495sfkRKjHfN4RroW1dwudJV2JWN7ogB8hyDxj5Y=";
+    hash = "sha256-psMMF26+nTwdbtPfFFE3fXkatrh9Bp9qMsrdI/FmrDg=";
   };
 
   cmakeFlags = [

pkgs/by-name/ta/talhelper/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.1.16";
+  version = "3.1.17";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E2cJFl0jZuR6dtxMWUxwpmtxN/3Qyzh9nEgLCLXxfJk=";
+    hash = "sha256-y3rYIzGBYq02bS/C43PSDKOrOLFbcrEe079fQpEAR0Q=";
   };
 
-  vendorHash = "sha256-bBjeLyqX3t2msjiAXWnkII8yyg2x8oQ5zdWNlpV4NXc=";
+  vendorHash = "sha256-mczxEYnlhY0MVtuust/ymRzTpLeJHH68CpQDVvgpYPU=";
 
   ldflags = [
     "-s"

pkgs/by-name/un/unbound/package.nix

@@ -7,7 +7,6 @@
   expat,
   flex,
   libevent,
-  bashNonInteractive,
   libsodium,
   protobufc,
   hiredis,
@@ -94,15 +93,12 @@ stdenv.mkDerivation (finalAttrs: {
     nettle
     expat
     libevent
-    bashNonInteractive
   ]
   ++ lib.optionals withSystemd [ systemd ]
   ++ lib.optionals withDoH [ libnghttp2 ]
   ++ lib.optionals withDoQ [ ngtcp2 ]
   ++ lib.optionals withPythonModule [ python ];
 
-  strictDeps = true;
-
   enableParallelBuilding = true;
 
   configureFlags = [
@@ -236,8 +232,6 @@ stdenv.mkDerivation (finalAttrs: {
     };
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "Validating, recursive, and caching DNS resolver";
     license = lib.licenses.bsd3;

pkgs/by-name/un/unzip/package.nix

@@ -3,18 +3,17 @@
   stdenv,
   fetchurl,
   bzip2,
-  bashNonInteractive,
   enableNLS ? false,
   libnatspec,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "unzip";
   version = "6.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/infozip/unzip${lib.replaceString "." "" finalAttrs.version}.tar.gz";
-    hash = "sha256-A22WmRZG0ESe0KqVLk++IbR2zplKvCduSdMOaGcIvTc=";
+    url = "mirror://sourceforge/infozip/unzip${lib.replaceStrings [ "." ] [ "" ] version}.tar.gz";
+    sha256 = "0dxx11knh3nk95p2gg2ak777dd11pr7jx5das2g49l262scrcv83";
   };
 
   hardeningDisable = [
@@ -72,13 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   nativeBuildInputs = [ bzip2 ];
-  buildInputs = [
-    bashNonInteractive # for zipgrep shebang
-    bzip2
-  ]
-  ++ lib.optional enableNLS libnatspec;
-
-  strictDeps = true;
+  buildInputs = [ bzip2 ] ++ lib.optional enableNLS libnatspec;
 
   makefile = "unix/Makefile";
 
@@ -112,8 +105,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   setupHook = ./setup-hook.sh;
 
-  __structuredAttrs = true;
-
   meta = {
     homepage = "http://www.info-zip.org";
     description = "Extraction utility for archives compressed in .zip format";
@@ -122,4 +113,4 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ RossComputerGuy ];
     mainProgram = "unzip";
   };
-})
+}

pkgs/by-name/ut/utf8cpp/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "utf8cpp";
-  version = "4.2.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "nemtrif";
     repo = "utfcpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vc7nKVVZ/h6q+dQUNiuXnkcqX7L2CkG6WUiybLNXAjU=";
+    hash = "sha256-0NbbQMsucrbOGEWAVZGSFp7f4dp31XrurPVVjcYsH+I=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/wa/wapiti/package.nix

@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "wapiti";
-  version = "3.3.1";
+  version = "3.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wapiti-scanner";
     repo = "wapiti";
     tag = finalAttrs.version;
-    hash = "sha256-X5foczL2YX4WTYQfTbIN8dnLRoYgwIGv0JIbDY7XpPg=";
+    hash = "sha256-gnZdNm6XZ2QiSppFAyCqbnpMiy06+qofVnWyUIEwDMI=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/we/weasis/package.nix

@@ -32,12 +32,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "weasis";
-  version = "4.7.2";
+  version = "4.7.3";
 
   # Their build instructions indicate to use the packaging script
   src = fetchzip {
     url = "https://github.com/nroduit/Weasis/releases/download/v${finalAttrs.version}/weasis-native.zip";
-    hash = "sha256-PxU6la1zjLvk6ghLGru4hRYD/D+XsfiTjj00i5Gjzb4=";
+    hash = "sha256-VssbmzOEZVHfzkUS9zyKIgT8kn9JqEoelI8ns15GQD4=";
     stripRoot = false;
   };
 

pkgs/by-name/wp/wpprobe/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "wpprobe";
-  version = "0.12.7";
+  version = "0.12.11";
 
   src = fetchFromGitHub {
     owner = "Chocapikk";
     repo = "wpprobe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OPVu1Kxq/szv01VUKnkWfsxwy3Brz73pz4otkOTjwgk=";
+    hash = "sha256-DEDbLnQRAYex6OAHoXRHxE6SQ5C/uTznk7klTosiauk=";
   };
 
-  vendorHash = "sha256-pAKFrdja+rH0kiJH6hToZwLjE8lLBHFAUCjnCLbgxVo=";
+  vendorHash = "sha256-0l7n6u2iODxoVR1fIMyUBaQj7cYk0Q5VnXUePaqOHXc=";
 
   nativeCheckInputs = [
     versionCheckHook

pkgs/by-name/wr/wrangler/package.nix

@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wrangler";
-  version = "4.94.0";
+  version = "4.125.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-sdk";
     rev = "wrangler@${finalAttrs.version}";
-    hash = "sha256-GW/esuGs7EdIDAUfx4ieTyZ8I84MnnZFW04LucGmbDI=";
+    hash = "sha256-4waGrQngRu4YTufvGJDoxP5pqXFwtJJ2IRSru3+R82w=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-FLbECanDqNZ05K2JHXv8lIgNM6oUtYxWrUw54IeEf5A=";
+    hash = "sha256-3Ma7zMlFtOKYgEKCS0eZM9+lKiVH7tnTsbjzQIJN7OI=";
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''
@@ -72,27 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
     autoPatchelfHook
   ];
 
-  # @cloudflare/vitest-pool-workers wanted to run a server as part of the build process
-  # so I simply removed it
-  postBuild =
-    let
-      extraDeps = [
-        "unenv-preset"
-        "workers-utils"
-        "local-explorer-ui"
-        "codemod"
-        "cli-shared-helpers"
-        "miniflare"
-        "wrangler"
-      ];
-    in
-    ''
-      mv packages/vitest-pool-workers packages/~vitest-pool-workers
+  # Avoid V8 heap exhaustion on aarch64-darwin.
+  env.NODE_OPTIONS = "--max-old-space-size=4096";
 
-      for pkg in ${toString extraDeps}; do
-        NODE_ENV="production" pnpm --filter "$pkg" run build
-      done
-    '';
+  postBuild = ''
+    NODE_ENV="production" pnpm --filter wrangler... run build
+  '';
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/wy/wyoming-piper/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "wyoming-piper";
-  version = "2.3.1";
+  version = "2.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "OHF-Voice";
     repo = "wyoming-piper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LKt1BNa9jrZIDUZxZvniZcPrAuUkwOs85uIiA5mFWyY=";
+    hash = "sha256-5jYV2DZcUe6RzigRMId8DybvhRnOhHcwN32aVKgEZDo=";
   };
 
   build-system = with python3Packages; [
@@ -37,22 +37,27 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ]
     ++ wyoming.optional-dependencies.zeroconf;
 
+  optional-dependencies = with python3Packages; {
+    http = wyoming.optional-dependencies.http;
+    # We do not follow the dependency dance upstream does as that would require overrideAttrs.
+    # omnivoice = [ omnivoice ]; # not packaged, yet
+    web = [ flask ];
+    zeroconf = wyoming.optional-dependencies.zeroconf;
+    zh = piper-tts.optional-dependencies.zh;
+  };
+
   pythonImportsCheck = [
     "wyoming_piper"
   ];
 
-  doCheck = false; # only test requires network
-
   nativeCheckInputs = with python3Packages; [
-    numpy
     pytest-asyncio
     pytestCheckHook
-    python-speech-features
   ];
 
-  disabledTests = [
-    # network access
-    "test_piper"
+  disabledTestPaths = [
+    # requires network access
+    "tests/test_piper.py"
   ];
 
   meta = {

pkgs/by-name/x2/x264/package.nix

@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation {
   pname = "x264";
-  version = "0-unstable-2025-09-10";
+  version = "0-unstable-2025-01-03";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = "x264";
-    rev = "0480cb05fa188d37ae87e8f4fd8f1aea3711f7ee";
-    hash = "sha256-yV/uN0Bgx+GbwGBnr/P0w9bnu9UXaa3YRPa7TICq24w=";
+    rev = "373697b467f7cd0af88f1e9e32d4f10540df4687";
+    hash = "sha256-WWtS/UfKA4i1yakHErUnyT/3/+Wy2H5F0U0CmxW4ick=";
   };
 
   patches = [

pkgs/by-name/xo/xorg-server/package.nix

@@ -176,6 +176,9 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by XQUARTZ_APP "$out/Applications/XQuartz.app"
   '';
 
+  # avoid linux rebuilds
+  ${if stdenv.hostPlatform.isDarwin then "hardeningDisable" else null} = [ "strictflexarrays1" ];
+
   # default X install symlinks this to Xorg, we want XQuartz
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     ln -sf $out/bin/Xquartz $out/bin/X

pkgs/by-name/xs/xssearch/package.nix

@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xssearch";
-  version = "0.1.9";
+  version = "0.2.0";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "affolter-engineering";
     repo = "xssearch";
     tag = finalAttrs.version;
-    hash = "sha256-09knkYBnIjZsdAlczYIeqtn0XGAvCD+RF3o9sGSUorw=";
+    hash = "sha256-b0pS8iu6iIO1VwmHWp7yhZiP7ngbdrUz5PCz5NjHZTo=";
   };
 
-  cargoHash = "sha256-t+IcNrjHlVVKrYuLiRrlteT4jQLRiWUsj9RTTTflTiA=";
+  cargoHash = "sha256-uS4PJhBRUuvbRFafO7HSG7+b5cb8k0YDRWgy4Iz8JMU=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

pkgs/by-name/xt/xtrans/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   pkg-config,
   writeScript,
   testers,
@@ -16,14 +15,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+q/qFmvyRRoXPZ1ZM1KUDsZAQUXF0dpcITQjzk01npI=";
   };
 
-  patches = [
-    # fix darwin crashes with fortify when using launchctl socket activation
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/xorg/lib/libxtrans/-/commit/79f6b0bfe2170496e8c37626043d009f4cd3f1e1.patch";
-      hash = "sha256-Y8QY1yAiOI/rSNi71/Qhsn6UEql556/pS2av7+vmGQA=";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [ pkg-config ];

pkgs/data/sgml+xml/schemas/xml-dtd/docbook/generic.nix

@@ -20,24 +20,17 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ unzip ];
   propagatedNativeBuildInputs = [ findXMLCatalogs ];
 
-  strictDeps = true;
-
   unpackPhase = ''
-    runHook preUnpack
     mkdir -p $out/xml/dtd/docbook
     cd $out/xml/dtd/docbook
     unpackFile $src
-    runHook postUnpack
   '';
 
   installPhase = ''
-    runHook preInstall
     find . -type f -exec chmod -x {} \;
     runHook postInstall
   '';
 
-  __structuredAttrs = true;
-
   meta = {
     branch = version;
     platforms = lib.platforms.unix;

pkgs/data/sgml+xml/stylesheets/xslt/docbook-xsl/default.nix

@@ -21,12 +21,12 @@ let
     }:
     let
       legacySuffix = lib.optionalString (suffix != "-nons") "-ns";
-      self = stdenv.mkDerivation (finalAttrs: {
+      self = stdenv.mkDerivation rec {
         inherit pname;
         version = "1.79.2";
 
         src = fetchurl {
-          url = "https://github.com/docbook/xslt10-stylesheets/releases/download/release%2F${finalAttrs.version}/docbook-xsl${suffix}-${finalAttrs.version}.tar.bz2";
+          url = "https://github.com/docbook/xslt10-stylesheets/releases/download/release%2F${version}/docbook-xsl${suffix}-${version}.tar.bz2";
           inherit sha256;
         };
 
@@ -50,8 +50,7 @@ let
 
           # Add legacy sourceforge.net URIs to the catalog
           (replaceVars ./catalog-legacy-uris.patch {
-            inherit legacySuffix suffix;
-            inherit (finalAttrs) version;
+            inherit legacySuffix suffix version;
           })
         ]
         ++ lib.optionals withManOptDedupPatch [
@@ -62,12 +61,10 @@ let
 
         propagatedBuildInputs = [ findXMLCatalogs ];
 
-        strictDeps = true;
-
         dontBuild = true;
 
         installPhase = ''
-          dst=$out/share/xml/${finalAttrs.pname}
+          dst=$out/share/xml/${pname}
           mkdir -p $dst
           rm -rf RELEASE* README* INSTALL TODO NEWS* BUGS install.sh tools Makefile tests extensions webhelp
           mv * $dst/
@@ -82,11 +79,9 @@ let
 
         passthru.dbtoepub = writeScriptBin "dbtoepub" ''
           #!${bash}/bin/bash
-          exec -a dbtoepub ${ruby}/bin/ruby ${self}/share/xml/${finalAttrs.pname}/epub/bin/dbtoepub "$@"
+          exec -a dbtoepub ${ruby}/bin/ruby ${self}/share/xml/${pname}/epub/bin/dbtoepub "$@"
         '';
 
-        __structuredAttrs = true;
-
         meta = {
           homepage = "https://github.com/docbook/wiki/wiki/DocBookXslStylesheets";
           description = "XSL stylesheets for transforming DocBook documents into HTML and various other formats";
@@ -94,7 +89,7 @@ let
           maintainers = [ ];
           platforms = lib.platforms.all;
         };
-      });
+      };
     in
     self;
 

pkgs/development/compilers/gcc/default.nix

@@ -320,8 +320,6 @@ pipe
         depsTargetTarget
         ;
 
-      strictDeps = true;
-
       preConfigure = (callFile ./common/pre-configure.nix { }) + ''
         ln -sf ${libxcrypt}/include/crypt.h libsanitizer/sanitizer_common/crypt.h
       '';

pkgs/development/compilers/llvm/18/llvm/backport-darwin-triple-parsing.patch

@@ -1,34 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Tue, 11 Aug 2026 20:12:42 -0400
-Subject: [PATCH] backport-darwin-triple-parsing
-
----
- lib/TargetParser/Triple.cpp | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/lib/TargetParser/Triple.cpp b/lib/TargetParser/Triple.cpp
-index 0bbe8a3cedfd..4143c3eac05d 100644
---- a/lib/TargetParser/Triple.cpp
-+++ b/lib/TargetParser/Triple.cpp
-@@ -1253,9 +1253,15 @@ bool Triple::getMacOSXVersion(VersionTuple &Version) const {
-     }
-     if (Version.getMajor() <= 19) {
-       Version = VersionTuple(10, Version.getMajor() - 4);
--    } else {
--      // darwin20+ corresponds to macOS 11+.
-+    } else if (Version.getMajor() < 25) {
-+      // darwin20-24 corresponds to macOS 11-15.
-       Version = VersionTuple(11 + Version.getMajor() - 20);
-+    } else if ((Version.getMajor() == 25) || (Version.getMajor() == 26)) {
-+      // darwin25-26 corresponds to macOS 26-27.
-+      Version = VersionTuple(Version.getMajor() + 1);
-+    } else {
-+      // Starting with darwin27, it naturally corresponds to the same macOS
-+      // version.
-     }
-     break;
-   case MacOSX:
--- 
-2.54.0
-

pkgs/development/compilers/llvm/21/llvm/backport-darwin-triple-parsing.patch

@@ -1,31 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Randy Eckenrode <randy@largeandhighquality.com>
-Date: Tue, 11 Aug 2026 20:19:29 -0400
-Subject: [PATCH] backport-darwin-triple-parsing
-
----
- lib/TargetParser/Triple.cpp | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/lib/TargetParser/Triple.cpp b/lib/TargetParser/Triple.cpp
-index 0584c941d2e6..30cf78dbaabc 100644
---- a/lib/TargetParser/Triple.cpp
-+++ b/lib/TargetParser/Triple.cpp
-@@ -1449,9 +1449,12 @@ bool Triple::getMacOSXVersion(VersionTuple &Version) const {
-     } else if (Version.getMajor() < 25) {
-       // darwin20-24 corresponds to macOS 11-15.
-       Version = VersionTuple(11 + Version.getMajor() - 20);
--    } else {
--      // darwin25 corresponds with macOS26+.
-+    } else if ((Version.getMajor() == 25) || (Version.getMajor() == 26)) {
-+      // darwin25-26 corresponds to macOS 26-27.
-       Version = VersionTuple(Version.getMajor() + 1);
-+    } else {
-+      // Starting with darwin27, it naturally corresponds to the same macOS
-+      // version.
-     }
-     break;
-   case MacOSX:
--- 
-2.54.0
-

pkgs/development/compilers/llvm/common/bolt/default.nix

@@ -58,8 +58,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxml2
   ];
 
-  strictDeps = true;
-
   cmakeFlags = [
     (lib.cmakeFeature "LLVM_TABLEGEN_EXE" "${buildLlvmPackages.tblgen}/bin/llvm-tblgen")
   ]
@@ -87,8 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  __structuredAttrs = true;
-
   meta = llvm_meta // {
     homepage = "https://github.com/llvm/llvm-project/tree/main/bolt";
     description = "LLVM post-link optimizer";

pkgs/development/compilers/llvm/common/clang-tools/default.nix

@@ -16,9 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "clang-tools";
   version = lib.getVersion clang-unwrapped;
   dontUnpack = true;
-
-  strictDeps = true;
-  __structuredAttrs = true;
+  clang = if enableLibcxx then libcxxClang else clang;
 
   installPhase = ''
     runHook preInstall
@@ -40,9 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
       fi
 
       cp $toolPath $out/bin/$toolName-unwrapped
-      substitute ${./wrapper} $out/bin/$toolName \
-        --replace-fail "@clang@" "${if enableLibcxx then libcxxClang else clang}" \
-        --replace-fail "@out@" "$out"
+      substituteAll ${./wrapper} $out/bin/$toolName
       chmod +x $out/bin/$toolName
     done