maintainers/github-teams.json: Automated sync

Diff: https://github.com/vaultwarden/vw_web_builds/compare/v2026.7.0+0...v2026.10.1+0

doc/languages-frameworks/cuda.section.md

@@ -165,6 +165,75 @@ To illustrate: support for Blackwell (e.g., `sm_100`) was added in CUDA 12.8. As
 
 The `pkgsForCudaArch` attribute set makes it possible to access packages built for a specific architecture without needing to manually call `pkgs.extend` and supply a new `config`. As an example, `pkgsForCudaArch.sm_89.python3Packages.torch` provides PyTorch built for Ada Lovelace GPUs.
 
+### Unlocking GeForce tensor core throughput {#cuda-gpu-unlock}
+
+[gpu-unlock](https://github.com/Zagitta/gpu-unlock) removes the tensor core
+throughput cap for FP16, BF16 and TF32 operations with FP32 accumulation on
+supported GeForce GPUs. Upstream considers Ampere (RTX 30) support stable and
+Turing (RTX 20) and Ada (RTX 40) support experimental; Blackwell (RTX 50) is
+unsupported. Check the upstream supported GPU list for your exact model.
+This does not improve gaming or ordinary FP32 CUDA performance.
+
+The kernel module is available as `config.boot.kernelPackages.gpu-unlock`, with
+its firmware in the package's `firmware` attribute. The firmware is unfree; allow
+`gpu-unlock-firmware` in your `nixpkgs.config.allowUnfreePredicate`, or enable
+`nixpkgs.config.allowUnfree`. The pinned firmware version is independent of your
+installed NVIDIA driver version.
+
+Add the following to a NixOS configuration that already enables the NVIDIA driver:
+
+```nix
+{ config, ... }:
+{
+  boot.extraModulePackages = [ config.boot.kernelPackages.gpu-unlock ];
+  hardware.firmware = [ config.boot.kernelPackages.gpu-unlock.firmware ];
+  boot.initrd.availableKernelModules = [ "gpu_unlock" ];
+  boot.kernelParams = [ "gpu_unlock.targets=all" ];
+
+  boot.initrd.systemd.services.gpu-unlock = {
+    description = "Unlock NVIDIA GPU tensor core throughput";
+    wantedBy = [ "sysinit.target" ];
+    before = [
+      "sysinit.target"
+      "systemd-modules-load.service"
+      "systemd-udevd.service"
+      "systemd-udev-trigger.service"
+    ];
+    unitConfig.DefaultDependencies = false;
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "/bin/modprobe gpu_unlock";
+    };
+  };
+}
+```
+
+The initrd service must finish before udev or the normal module loader can load
+NVIDIA or another GPU driver. Merely adding `gpu_unlock` to
+`boot.initrd.kernelModules` does not ensure this ordering. The module's firmware
+declarations cause NixOS to include the required assets in the initrd.
+
+To select individual GPUs, replace `all` with full PCI addresses from `lspci -D`,
+for example `gpu_unlock.targets=0000:01:00.0,0000:02:00.0`. Already bound or
+powered-down cards are skipped. Loading the module after the NVIDIA driver has
+bound the card is too late.
+
+Apply the configuration with `sudo nixos-rebuild boot`, then reboot. Check
+`journalctl -k -b --grep=gpu_unlock` for an `unlocked` message for each selected
+GPU. `journalctl -b -u gpu-unlock.service` shows initrd service failures; a
+successful service exit alone does not mean a GPU was unlocked.
+
+The unlock is lost when a GPU loses power. Upstream attempts to reapply it after
+suspend to RAM before NVIDIA resumes the GPU; hibernation is not covered.
+Laptop runtime power management can also reset the unlock. See upstream's
+power-management guidance and check the kernel log after resume.
+
+To disable unlocking, remove `gpu_unlock.targets=...` from `boot.kernelParams`,
+rebuild the boot configuration, and reboot. For a single boot, remove the
+parameter in the bootloader editor. To uninstall, also remove the module,
+firmware, and initrd service settings above, rebuild, and reboot.
+
 ### Running Docker or Podman containers with CUDA support {#cuda-docker-podman}
 
 It is possible to run Docker or Podman containers with CUDA support. The recommended mechanism to perform this task is to use the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/index.html).

doc/languages-frameworks/ocaml.section.md

@@ -31,7 +31,7 @@ pkgs.mkShell {
 
 ## Packaging guide {#sec-language-ocaml-packaging}
 
-OCaml libraries are installed in `$out/lib/ocaml/${ocaml.version}/site-lib/`, or in the same directory of the `dev` output (see `buildDunePackage` below). Such directories are automatically added to the `$OCAMLPATH` environment variable when building another package that depends on them or when opening a `nix-shell`.
+OCaml libraries should be installed in `$(out)/lib/ocaml/${ocaml.version}/site-lib/`. Such directories are automatically added to the `$OCAMLPATH` environment variable when building another package that depends on them or when opening a `nix-shell`.
 
 Given that most of the OCaml ecosystem is now built with dune, nixpkgs includes a convenience build support function called `buildDunePackage` that will build an OCaml package using dune, OCaml and findlib and any additional dependencies provided as `buildInputs` or `propagatedBuildInputs`.
 
@@ -139,29 +139,6 @@ buildDunePackage (finalAttrs: {
 })
 ```
 
-Unless the package sets `outputs`, `buildDunePackage` builds separate outputs,
-and points `$OCAMLFIND_DESTDIR` to `dev`:
-
-- `out` contains what the package produces for use at runtime, such as
-  executables.
-- `dev` contains the OCaml libraries and the propagated dependencies needed to
-  build other packages against them. It is selected automatically when the
-  package is used as a build input.
-- `man` contains the man pages. Like `out`, it is installed by default.
-- `doc` contains the documentation, such as the README and license files.
-
-This keeps build-time only OCaml dependencies out of the runtime closure of
-executables. Code that refers to the library directory of such a package must
-use its `dev` output, for example `${lib.getDev menhirLib}/lib/ocaml` or
-`lib.makeSearchPathOutput "dev" "lib/ocaml/${ocaml.version}/site-lib"`.
-Likewise, installing the library into a profile or environment requires its
-`dev` output, e.g. `ocamlPackages.menhirLib.dev`.
-
-Toplevels and programs that load plugins need their own OCaml library at
-runtime, and the two outputs would refer to each other. Set
-`outputs = [ "out" ];` for such packages, and for packages whose custom
-`installPhase` installs everything into `$out`.
-
 The build will automatically fail if two distinct versions of the same library
 are added to `buildInputs` (which usually happens transitively because of
 `propagatedBuildInputs`). Set `dontDetectOcamlConflicts` to true to disable this

doc/languages-frameworks/swift.section.md

@@ -246,46 +246,6 @@ To disable the SwiftPM install phase, include the following in your derivation:
 { dontUseSwiftpmInstall = true; }
 ```
 
-## Swift Macros {#ssec-swift-macros}
-
-Nixpkgs includes the stdlib macros (ObservationMacros and SwiftMacros) and FoundationMacros in the toolchain.
-Packages that need macros for Apple frameworks on Darwin have two options:
-- `open-apple-macros` provides open-source implementations of FoundationModelsMacros and SwiftUIMacros; or
-- `darwin.xcode-macros` provides macro libraries from Xcode not otherwise included in the toolchain, but they are unfree.
-
-Add the appropriate package to `depsBuildBuild` (because they are compiler plugins that run on the build platform).
-If you need to manually specify the path for a package because it or its build system invokes `swiftc` directly:
-
-### `open-apple-macros` {#ssec-swift-macros-open-apple-macros}
-```nix
-{
-  buildPhase = ''
-    runHook preBuild
-    swiftc \
-      -external-plugin-path ${open-apple-macros}/lib/swift/host/plugins#${open-apple-macros}/libexec/swift/plugins/OpenAppleMacrosServer \
-      -disable-sandbox \
-      *.swift \
-      -o the_binary
-    runHook postBuild
-  '';
-}
-```
-
-### `darwin.xcode-macros` {#ssec-swift-macros-xcode-macros}
-```nix
-{
-  # For `darwin.xcode-macros`
-  buildPhase = ''
-    runHook preBuild
-    swiftc \
-      -plugin-path ${darwin.xcode-macros}/lib/swift/host/plugins \
-      *.swift \
-      -o the_binary
-    runHook postBuild
-  '';
-}
-```
-
 ## Hooks {#ssec-swift-hooks}
 
 Swift provides the following hooks to automate builds and unpack dependencies:

doc/redirects.json

@@ -47,6 +47,9 @@
   "cuda-extending-cuda-package-sets": [
     "index.html#cuda-extending-cuda-package-sets"
   ],
+  "cuda-gpu-unlock": [
+    "index.html#cuda-gpu-unlock"
+  ],
   "cuda-modifying-cuda-package-sets": [
     "index.html#cuda-modifying-cuda-package-sets",
     "index.html#cuda-configuring-cuda-package-sets"
@@ -4636,15 +4639,6 @@
   "ssec-swiftpm-install-phase": [
     "index.html#ssec-swiftpm-install-phase"
   ],
-  "ssec-swift-macros": [
-    "index.html#ssec-swift-macros"
-  ],
-  "ssec-swift-macros-open-apple-macros": [
-    "index.html#ssec-swift-macros-open-apple-macros"
-  ],
-  "ssec-swift-macros-xcode-macros": [
-    "index.html#ssec-swift-macros-xcode-macros"
-  ],
   "ssec-swift-hooks": [
     "index.html#ssec-swift-hooks"
   ],

doc/release-notes/rl-2611.section.md

@@ -56,11 +56,6 @@
 
 - `paperless-manage` now uses `runuser` instead of automatically calling `sudo` to set user/group before running. Invoke the script with `sudo paperless-manage` or an equivalent elevation tool of your choice
 
-- OpenSSL now prefers the system CA bundle at `/etc/ssl/certs/ca-certificates.crt` on both Linux and Darwin, falling back to `/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt` only when the system bundle is absent.
-  Previously, Darwin used the default Nix profile bundle directly.
-  An existing but unreadable or invalid system bundle does not trigger the fallback.
-  Explicit `NIX_SSL_CERT_FILE` and `SSL_CERT_FILE` overrides still take precedence.
-
 - `hyperfine` has been updated from 1.21.0 to 2.0.0, which contains several breaking changes:
   - Benchmarked commands are now executed directly instead of through an intermediate shell. Pass `-S`/`--shell=default` to restore the previous behavior.
   - The `--export-json` format has changed (schema version 2); tools consuming the exported JSON must be updated.
@@ -103,13 +98,6 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
-- `ocamlPackages.buildDunePackage` now builds packages with `out`, `dev`, `man` and `doc` outputs by default, unless they set `outputs`.
-  The OCaml libraries are installed into `dev`, man pages into `man`, documentation into `doc`, and `out` only contains what is needed at runtime, such as executables. This removes build-time only OCaml dependencies from the closure of tools like `patdiff`.
-  Code that refers to `${ocamlPackages.foo}/lib/ocaml` must use `${lib.getDev ocamlPackages.foo}/lib/ocaml` instead.
-  Installing such a library into a profile or environment (for example with `home.packages`, `environment.systemPackages` or `nix profile add`) no longer provides its `lib/ocaml` directory; install `ocamlPackages.foo.dev` instead.
-
-- The `bin` and `lib` outputs of `ocamlPackages.odoc`, `ocamlPackages.crunch`, `ocamlPackages.mdx` and `ocamlPackages.tw` were removed. Use the package itself for the executables, and its `dev` output for the OCaml library.
-
 - `bundlerApp` now sets `__structuredAttrs = true` for its result package.
   Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
 
@@ -211,10 +199,6 @@
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
-- `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now warn in the presence of `unittestFlagsArray`.
-  Please use [`unittestFlags`](#using-unittestcheckhook) instead.
-  If modifying the Nix expression is not feasible, users can remediate the warning by overriding `unittestFlagsArray` with `null` or `[ ]`.
-
 - `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
 
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
@@ -274,8 +258,6 @@
 
 - `tcl.mkTclDerivation` now enables `strictDeps` and `__structuredAttrs`.
 
-- `rustPlatform.cargoSetupHook` now forces several common C libraries to be linked to the Nixpkgs library rather than the vendored library. These include: aws-lc, openssl, libz, libsqlite3, zstd, libgit2, sodium, rustonig, libssh2, nginx, duckdb, and jemalloc. Set `dontCargoUseSystemLibs = true;` to opt out.
-
 - `rssguard` 5.x uses a new database layer. Regenerate your database after upgrading, following the [RSS Guard migration notes](https://rssguard.readthedocs.io/en/stable/contrib/migrate.html).
 
 - `pdns` has been updated from `5.0.x` to `5.1.x`. Please be sure to review the [Upgrade Notes](https://doc.powerdns.com/authoritative/upgrading.html#to-5-1-0) before upgrading. Namely LUA record updates are no longer allowed by default, and the embedded webserver no longer includes a `access-control-allow-origin: *` header by default.
@@ -486,7 +468,7 @@
 
 - Firefox wrapper now accepts an optional `appDataDir` argument, which sets `MOZ_APP_DATA` to relocate Firefox application data. This is especially useful on macOS 27 and later, where wrapped Firefox applications may be denied access to profiles in traditional application data directory.
 
-- Swift has been upgraded to Swift 6.4.0 from Swift 5.10.1.
+- Swift has been upgraded to Swift 6.3.3 from Swift 5.10.1.
   The Swift packaging has been rewritten.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-26.11-lib}

doc/stdenv/stdenv.chapter.md

@@ -1198,9 +1198,6 @@ They cannot be overridden without rebuilding the package.
 
 If dependencies should be resolved at runtime, use `--suffix` to append fallback values to `PATH`.
 
-`makeBinaryWrapper` refuses a `--prefix` or `--suffix` value that would introduce an empty segment (an empty value, or a leading, trailing or doubled separator), because many `PATH`-like variables interpret an empty segment as the current directory.
-For variables where an empty segment is useful and safe, such as `LUA_PATH` where `;;` stands for the default search path, use `--prefix-unchecked` or `--suffix-unchecked` instead.
-
 There’s many more kinds of arguments, they are documented in `nixpkgs/pkgs/build-support/setup-hooks/make-wrapper.sh` for the `makeWrapper` implementation and in `nixpkgs/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh` for the `makeBinaryWrapper` implementation.
 
 `wrapProgram` is a convenience function you probably want to use most of the time, implemented by both `makeWrapper` and `makeBinaryWrapper`.

maintainers/github-teams.json

@@ -809,13 +809,15 @@
     "name": "nixpkgs-merge-bot"
   },
   "node": {
-    "description": "Maintains Node.js runtimes and build tooling.\r\n\r\n\"JS is hecked, thanks for coming to my TED Talk\" - @lilyinstarlight",
+    "description": "Maintains Node.js runtimes and build tooling.",
     "id": 7309872,
     "maintainers": {
-      "lilyinstarlight": 298109,
       "winterqt": 78392041
     },
-    "members": {},
+    "members": {
+      "Scrumplex": 11587657,
+      "aduh95": 14309773
+    },
     "name": "Node"
   },
   "ocaml": {

maintainers/team-list.nix

@@ -433,6 +433,7 @@ with lib.maintainers;
   libretro = {
     members = [
       aanderse
+      iedame
       igorcafe
       thiagokokada
     ];

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -18,8 +18,6 @@
   +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
   ```
 
-- GNOME has been updated to version 51. Refer to the [GNOME release notes](https://release.gnome.org/51/) for more details.
-
 - `sing-box` now supports NaïveProxy outbounds.
 
 ## New Modules {#sec-release-26.11-new-modules}

nixos/lib/make-system-tarball.sh

@@ -41,8 +41,7 @@ mkdir -p $out/tarball
 
 rm env-vars
 
-# Store optimization can change hardlink topology without changing input NARs.
-time tar --hard-dereference --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner -c * $extraArgs | $compressCommand > $out/tarball/$fileName.tar${extension}
+time tar --sort=name --mtime='@1' --owner=0 --group=0 --numeric-owner -c * $extraArgs | $compressCommand > $out/tarball/$fileName.tar${extension}
 
 mkdir -p $out/nix-support
 echo $system > $out/nix-support/system

nixos/modules/config/fonts/fontconfig.nix

@@ -30,6 +30,7 @@ let
   cfg = config.fonts.fontconfig;
 
   fcBool = x: "<bool>" + (lib.boolToString x) + "</bool>";
+  pkg = pkgs.fontconfig;
 
   # configuration file to read fontconfig cache
   # priority 0
@@ -48,7 +49,7 @@ let
           inherit fontconfig;
           fontDirectories = config.fonts.packages;
         };
-      cache = makeCache cfg.package;
+      cache = makeCache pkgs.fontconfig;
       cache32 = makeCache pkgs.pkgsi686Linux.fontconfig;
     in
     pkgs.writeText "fc-00-nixos-cache.conf" ''
@@ -208,7 +209,7 @@ let
   # Replace default linked config with a different variant
   replaceDefaultConfig = defaultConfig: newConfig: ''
     rm $dst/${defaultConfig}
-    ln -s ${cfg.package.out}/share/fontconfig/conf.avail/${newConfig} \
+    ln -s ${pkg.out}/share/fontconfig/conf.avail/${newConfig} \
           $dst/
   '';
 
@@ -223,7 +224,7 @@ let
         mkdir -p $dst
 
         # fonts.conf
-        ln -s ${cfg.package.out}/etc/fonts/fonts.conf \
+        ln -s ${pkg.out}/etc/fonts/fonts.conf \
               $dst/../fonts.conf
         # TODO: remove this legacy symlink once people stop using packages built before #95358 was merged
         mkdir -p $out/etc/fonts/2.11
@@ -231,7 +232,7 @@ let
               $out/etc/fonts/2.11/fonts.conf
 
         # fontconfig default config files
-        ln -s ${cfg.package.out}/etc/fonts/conf.d/*.conf \
+        ln -s ${pkg.out}/etc/fonts/conf.d/*.conf \
               $dst/
 
         ${lib.optionalString (!cfg.antialias) (
@@ -351,8 +352,6 @@ in
           '';
         };
 
-        package = lib.mkPackageOption pkgs "fontconfig" { };
-
         confPackages = lib.mkOption {
           internal = true;
           type = with lib.types; listOf path;
@@ -628,14 +627,14 @@ in
   };
   config = lib.mkMerge [
     (lib.mkIf cfg.enable {
-      environment.systemPackages = [ cfg.package ];
+      environment.systemPackages = [ pkgs.fontconfig ];
       environment.etc.fonts.source = "${fontconfigEtc}/etc/fonts/";
       security.apparmor.includes."abstractions/fonts" = ''
         # fonts.conf
-        r ${cfg.package.out}/etc/fonts/fonts.conf,
+        r ${pkg.out}/etc/fonts/fonts.conf,
 
         # fontconfig default config files
-        r ${cfg.package.out}/etc/fonts/conf.d/*.conf,
+        r ${pkg.out}/etc/fonts/conf.d/*.conf,
 
         # 00-nixos-cache.conf
         r ${cacheConf},
@@ -645,7 +644,7 @@ in
 
         # 50-user.conf
         ${lib.optionalString cfg.includeUserConf ''
-          r ${cfg.package.out}/etc/fonts/conf.d.bak/50-user.conf,
+          r ${pkg.out}/etc/fonts/conf.d.bak/50-user.conf,
         ''}
 
         # local.conf (indirect priority 51)

nixos/modules/services/desktop-managers/gnome.nix

@@ -461,38 +461,35 @@ in
             pkgs.gtk3.out # for gtk-launch program
             pkgs.xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
             pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks
-            pkgs.gnome-extensions-app
-            pkgs.gnome-tecla
           ];
         in
         mandatoryPackages ++ removeExcluded optionalPackages;
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-51/elements/core/meta-gnome-core-apps.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-apps.bst
     (lib.mkIf serviceCfg.core-apps.enable {
       environment.systemPackages = removeExcluded [
         pkgs.baobab
         pkgs.decibels
         pkgs.epiphany
+        pkgs.gnome-text-editor
         pkgs.gnome-calculator
         pkgs.gnome-calendar
         pkgs.gnome-characters
         pkgs.gnome-clocks
-        pkgs.gnome-connections
         pkgs.gnome-console
         pkgs.gnome-contacts
-        # gnome-disk-utility is controlled below via `programs.gnome-disks`
         pkgs.gnome-font-viewer
         pkgs.gnome-logs
         pkgs.gnome-maps
         pkgs.gnome-music
-        # gnome-software is controlled below via `services.gnome.gnome-software`
         pkgs.gnome-system-monitor
-        pkgs.gnome-text-editor
+        pkgs.gnome-tecla
         pkgs.gnome-weather
         pkgs.loupe
         pkgs.nautilus
         pkgs.papers
+        pkgs.gnome-connections
         pkgs.showtime
         pkgs.simple-scan
         pkgs.snapshot
@@ -529,7 +526,6 @@ in
       ];
     })
 
-    # Note: This is an arbitrary list of packages, there is no "official" list of GNOME games.
     (lib.mkIf serviceCfg.games.enable {
       environment.systemPackages = removeExcluded [
         pkgs.aisleriot
@@ -555,13 +551,18 @@ in
       ];
     })
 
-    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-51/elements/core/meta-gnome-core-developer-tools.bst
+    # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/-/blob/gnome-48/elements/core/meta-gnome-core-developer-tools.bst
     (lib.mkIf serviceCfg.core-developer-tools.enable {
       environment.systemPackages = removeExcluded [
         pkgs.dconf-editor
         pkgs.devhelp
         pkgs.d-spy
         pkgs.gnome-builder
+        # boxes would make sense in this option, however
+        # it doesn't function well enough to be included
+        # in default configurations.
+        # https://github.com/NixOS/nixpkgs/issues/60908
+        # pkgs.gnome-boxes
         pkgs.sysprof
       ];
 

nixos/modules/services/display-managers/gdm.nix

@@ -353,26 +353,8 @@ in
           };
         }
       ]
-      ++ lib.optionals (!config.security.pam.p11.enable) [
-        {
-          settings."org/gnome/login-screen" = {
-            enable-smartcard-authentication = false;
-          };
-        }
-      ]
       ++ [ "${gdm}/share/gdm/greeter-dconf-defaults" ];
 
-    programs.dconf.profiles.user.databases = [
-      {
-        settings."org/gnome/login-screen" = {
-          enable-smartcard-authentication = config.security.pam.p11.enable;
-
-          # We currently don't provide a `gdm-switchable-auth` PAM service.
-          enable-switchable-authentication = false;
-        };
-      }
-    ];
-
     # Use AutomaticLogin if delay is zero, because it's immediate.
     # Otherwise with TimedLogin with zero seconds the prompt is still
     # presented and there's a little delay.
@@ -689,85 +671,6 @@ in
           ];
         };
       };
-
-      # Do not attempt to authenticate via smartcard when the login option
-      # "Password" is selected (gdm-password).
-      login.p11Auth = lib.mkIf config.security.pam.p11.enable false;
-
-      gdm-smartcard = lib.mkIf config.security.pam.p11.enable {
-        useDefaultRules = false;
-        rules = {
-          auth = utils.pam.autoOrderRules [
-            {
-              name = "nologin";
-              control = "requisite";
-              modulePath = "${config.security.pam.package}/lib/security/pam_nologin.so";
-            }
-            {
-              name = "faillock";
-              control = "requisite";
-              modulePath = "${config.security.pam.package}/lib/security/pam_faillock.so";
-              settings.preauth = true;
-            }
-            {
-              name = "p11";
-              control = "required";
-              modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so";
-              args = [
-                "${pkgs.opensc}/lib/opensc-pkcs11.so"
-              ];
-            }
-            {
-              name = "shells";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_shells.so";
-            }
-            {
-              name = "env";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
-              settings.conffile = "/etc/pam/environment";
-              settings.readenv = 0;
-            }
-            {
-              name = "gdm";
-              enable = pamLogin.enable && pamLogin.enableGnomeKeyring;
-              control = "[success=ok default=1]";
-              modulePath = "${gdm}/lib/security/pam_gdm.so";
-            }
-            {
-              name = "gnome_keyring";
-              enable = pamLogin.enable && pamLogin.enableGnomeKeyring;
-              control = "optional";
-              modulePath = "${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so";
-            }
-          ];
-
-          account = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-
-          password = utils.pam.autoOrderRules [
-            {
-              name = "deny";
-              control = "required";
-              modulePath = "${config.security.pam.package}/lib/security/pam_deny.so";
-            }
-          ];
-
-          session = utils.pam.autoOrderRules [
-            {
-              name = "login";
-              control = "include";
-              modulePath = "login";
-            }
-          ];
-        };
-      };
     };
 
   };

nixos/modules/services/misc/tabby.nix

@@ -98,7 +98,7 @@ in
 
           - nixpkgs.config.cudaSupport
           - nixpkgs.config.rocmSupport
-          - if stdenv.hostPlatform.isDarwin
+          - if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
 
           IFF multiple acceleration methods are found to be enabled or if you
           haven't set either `cudaSupport or rocmSupport` you will have to

nixos/modules/services/monitoring/kener.nix

@@ -115,6 +115,7 @@ in
         StateDirectoryMode = "750";
         DynamicUser = true;
         ExecStart = "${cfg.package}/bin/kener-server";
+        EnvironmentFile = cfg.environmentFile;
         Restart = "on-failure";
         AmbientCapabilities = "";
         CapabilityBoundingSet = "";

nixos/modules/services/web-apps/immich.nix

@@ -455,8 +455,7 @@ in
 
     systemd.services.immich-machine-learning = mkIf cfg.machine-learning.enable {
       description = "immich machine learning";
-      requires = lib.mkIf cfg.database.enable [ "postgresql.target" ];
-      after = [ "network.target" ] ++ lib.optionals cfg.database.enable [ "postgresql.target" ];
+      after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       inherit (cfg.machine-learning) environment;
       serviceConfig = commonServiceConfig // {

nixos/modules/system/boot/systemd.nix

@@ -89,7 +89,6 @@ let
     "systemd-fsck-root.service"
     "systemd-growfs@.service"
     "systemd-growfs-root.service"
-    "systemd-loop@.service"
     "systemd-remount-fs.service"
     "systemd-pstore.service"
     "local-fs.target"

nixos/modules/system/boot/systemd/initrd.nix

@@ -97,7 +97,6 @@ let
     "systemd-factory-reset-complete.service"
     "factory-reset-now.target"
     "systemd-fsck@.service"
-    "systemd-loop@.service"
     "systemd-halt.service"
     "systemd-hibernate-resume.service"
     "systemd-journald-audit.socket"
@@ -614,7 +613,6 @@ in
         "${cfg.package}/lib/systemd/systemd-bsod"
         "${cfg.package}/lib/systemd/systemd-sysroot-fstab-check"
         "${cfg.package}/lib/systemd/systemd-factory-reset"
-        "${cfg.package}/bin/systemd-dissect"
 
         # generators
         "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"

nixos/tests/e57inspector.nix

@@ -44,9 +44,9 @@ in
     name = "e57inspector-screenshot-analysis";
     screenshot = "${vmTest}/screen.png";
     question = ''
-      Look at this screenshot of a desktop application.
+      Look at this screenshot of the e57inspector application.
       Answer: Does the application show that a file was loaded into it successfully?
-      For this, only scans matter, as there are no images in the file.
+      For this, only scans matter, as there are no images in the file, so an image count of 0 is fine.
       The inspector on the left should show child elements below 'Data 3D'.
     '';
   };

nixos/tests/kanidm-provisioning.nix

@@ -18,7 +18,7 @@ in
   name = "kanidm-provisioning-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_11;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_12;
 
   nodes.provision =
     { pkgs, lib, ... }:

nixos/tests/kanidm.nix

@@ -22,7 +22,7 @@ in
     oddlama
   ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_11;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_12;
 
   nodes.server =
     { pkgs, ... }:

nixos/tests/terminal-emulators.nix

@@ -41,11 +41,6 @@ let
     ghostty.pkg = p: p.ghostty;
     ghostty.cmd = "ghostty -e $command";
 
-    gnome-console.pkg = p: p.gnome-console;
-    gnome-console.executable = "kgx";
-    gnome-console.cmd = "kgx -e $command";
-    gnome-console.kill = true;
-
     gnome-terminal.pkg = p: p.gnome-terminal;
 
     guake.pkg = p: p.guake;
@@ -56,6 +51,10 @@ let
 
     kermit.pkg = p: p.kermit-terminal;
 
+    kgx.pkg = p: p.kgx;
+    kgx.cmd = "kgx -e $command";
+    kgx.kill = true;
+
     kitty.pkg = p: p.kitty;
     kitty.cmd = "kitty $command";
 

nixos/tests/vaultwarden.nix

@@ -94,7 +94,7 @@ let
               # Skip the tour on first login
               click_when_unobstructed((By.XPATH, "//button[contains(., 'Skip')]"))
 
-              click_when_unobstructed((By.XPATH, "//button[contains(., 'New item')]"))
+              click_when_unobstructed((By.XPATH, "//button[contains(., 'Add item')]"))
 
               driver.find_element(By.XPATH, '//input[@formcontrolname="name"]').send_keys(
                   'secrets'

nixos/tests/vlm-screenshot-question.nix

@@ -3,7 +3,7 @@
 # Similar to `wait_for_text()` in NixOS VM tests.
 #
 # Runs a VLM (Vision Language Model) on a screenshot and asserts that the
-# model's answer to a yes/no question ends with "YES".
+# model's answer to a yes/no question contains a bool response in a JSON field.
 #
 # This is useful to automatically test software that is otherwise
 # hard to test, e.g. "does this 3D program render the bunny correctly?".
@@ -23,6 +23,7 @@
       hash = "sha256-nEwdSKRi9/iDsomErE9C02bJxXNDTqtoVT4POL9+tQw=";
     }
   ),
+  # mmproj = "multimodal projector"
   mmproj ? (
     fetchurl {
       url = "https://huggingface.co/unsloth/gemma-4-E2B-it-GGUF/resolve/90f9618340396838ee7ff5b0ba2da27da62953d3/mmproj-F16.gguf";
@@ -35,28 +36,30 @@
   question,
 }:
 let
-
   analysisScript =
     writers.writePython3 "${name}-script" { flakeIgnore = [ "E501" ]; } # allow long lines
       ''
+        import json
         import os
-        import re
         import subprocess
+        import sys
         import time
 
+        SYSTEM_PROMPT = (
+            'Answer the user question, outputting valid JSON only.'
+            ' Schema: { "bool_answer": true | false, "explanation": "..." }'
+        )
+
         out = os.environ["out"]
-        screenshot = "${screenshot}"
-        # Using JSON here even permits preserving multi-line ASCII art questions and so on.
+        # Using JSON here safely escapes arbitrary strings into Python literals
+        # (and even permits preserving multi-line ASCII art questions and so on).
+        screenshot = ${builtins.toJSON "${screenshot}"}
         question = ${builtins.toJSON question}
 
-        # Build the full prompt with output markers for reliable extraction.
-        prompt = (
-            "Start your output with [output-start]."
-            f" {question}"
-            " Explain what you see, and your judgment."
-            " On the final line, output exactly YES or NO."
-            " Then immediately output [output-end] with nothing else after it."
-        )
+
+        def fail(message):
+            sys.exit(message)
+
 
         vlm_start = time.time()
         result = subprocess.run(
@@ -66,52 +69,87 @@ let
                 "--simple-io",  # disables the spinner whose backspace chars would corrupt captured output
                 "--reasoning", "off", "--temp", "0",
                 "--threads", "1",  # for determinism
-                "--n-gpu-layers", "0",  # force CPU-only (results on GPUs might be different and nondeterministic, see https://github.com/ggml-org/llama.cpp/pull/16016#issuecomment-3293505238)
+
+                # Force CPU-only, for both the text model and the multimodal projector
+                # (results on GPUs might be different and nondeterministic, see
+                # https://github.com/ggml-org/llama.cpp/pull/16016#issuecomment-3293505238).
+                "--device", "none",
+                "--n-gpu-layers", "0",
+                "--no-mmproj-offload",
+
                 "--model", "${model}",
                 "--mmproj", "${mmproj}",
                 "--image", screenshot,
-                "-p", prompt,
+                "-sys", SYSTEM_PROMPT,
+                "-p", question,
             ],
             capture_output=True,
             text=True,
-            # `OMP_NUM_THREADS=1` prevents OpenMP from spawning extra threads in the BLAS backend
-            # (OpenBLAS), which causes nondeterminism with `--image`; without `--image`, `--threads 1`
-            # alone is already deterministic (BLAS is not used for short text prompts).
+            # Limiting the BLAS backend (OpenBLAS) to one thread prevents nondeterminism with `--image`;
+            # without `--image`, `--threads 1` alone is already deterministic (BLAS is not used for short text prompts).
+            # Depending on how OpenBLAS is built, it spawns threads via OpenMP (`OMP_NUM_THREADS`)
+            # or its own pthreads pool (`OPENBLAS_NUM_THREADS`, legacy `GOTO_NUM_THREADS`),
+            # so set all of them.
             # Relevant code: https://github.com/ggml-org/llama.cpp/blob/80afa33aadcc4f71212b17e5e52904491c76b63e/ggml/src/ggml-blas/ggml-blas.cpp#L30-L148
             # PR to fix it in OpenBLAS: https://github.com/OpenMathLib/OpenBLAS/pull/5808
-            env={**os.environ, "OMP_NUM_THREADS": "1"},
+            env={
+                **os.environ,
+                "OMP_NUM_THREADS": "1",
+                "OPENBLAS_NUM_THREADS": "1",
+                "GOTO_NUM_THREADS": "1",
+            },
         )
         vlm_elapsed = time.time() - vlm_start
         output = result.stdout
         print(f"VLM inference took {vlm_elapsed:.1f}s")
-        print(f"VLM raw output: {repr(output)}")
+        print(f"VLM raw output: {output!r}")
         if result.returncode != 0:
             print(f"VLM stderr: {result.stderr}")
-        assert result.returncode == 0, f"llama-cli failed with exit code {result.returncode}"
+            fail(f"llama-cli failed with exit code {result.returncode}")
 
         print()
 
-        # Post-process: extract the answer between `[output-start]` and `[output-end]` markers.
-        # This is needed because llama-cli prints UI noise (banner,
-        # spinner, stats) to stdout alongside the model's response.
-        # TODO: Replace with `--quiet` once https://github.com/ggml-org/llama.cpp/pull/22848 is merged;
-        #       then also remove the markers from the prompt and the extraction below.
-        matches = re.findall(r"\[output-start\](.*?)\[output-end\]", output, re.DOTALL)
-        assert matches, (
-            f"VLM output did not contain [output-start]...[output-end] markers."
-            f" Raw output: {repr(output)}"
-        )
-        answer = matches[-1].strip()  # use last match (first may be prompt echo)
-        print("VLM answer:")
-        print(answer)
-        assert answer.upper().endswith("YES"), (
-            f"VLM did not confirm expected answer. Answer: {answer}"
-        )
+        # Post-process: extract the first JSON object that has a `bool_answer` key.
+        # This is needed because llama-cli prints UI noise (banner, stats) to stdout
+        # around the model's response, and the model may output its own decorations
+        # such as putting JSON in a Markdown code fence.
+        # `raw_decode()` ignores any trailing text after the JSON object.
+        # TODO: Simplify with `--quiet` once https://github.com/ggml-org/llama.cpp/pull/22848 is merged.
+        decoder = json.JSONDecoder()
+        j = None
+        index = output.find("{")
+        while index != -1:
+            try:
+                candidate, _ = decoder.raw_decode(output, index)
+            except json.JSONDecodeError:
+                candidate = None
+            if isinstance(candidate, dict) and "bool_answer" in candidate:
+                j = candidate
+                break
+            index = output.find("{", index + 1)
+
+        # On unexpected outputs, include the raw output in the error message on stderr
+        # (it's already included on stdout above in all cases).
+        if j is None:
+            fail(f"VLM output did not contain a valid JSON object with key 'bool_answer'. Raw output: {output!r}")
+
+        bool_answer = j.get("bool_answer")
+        explanation = j.get("explanation")
+        if not (isinstance(bool_answer, bool) and isinstance(explanation, str)):
+            fail(f'VLM output JSON was not of schema {{ "bool_answer": true | false, "explanation": "..." }}. Raw output: {output!r}')
+
+        print(f"Answer: {bool_answer}")
+        print(f"Explanation: {explanation}")
+        if not bool_answer:
+            fail(f"VLM did not confirm expected answer. Answer: {bool_answer}\nExplanation: {explanation}")
 
         os.makedirs(out, exist_ok=True)
-        with open(os.path.join(out, "vlm-answer.txt"), "w") as f:
-            f.write(answer + "\n")
-        os.symlink(screenshot, os.path.join(out, "screen.png"))
+        with open(os.path.join(out, "vlm-answer.json"), "w") as f:
+            json.dump(j, f, indent=2)
+            f.write("\n")
+        # Keep the original file extension, as the screenshot is not necessarily a PNG.
+        _, screenshot_ext = os.path.splitext(screenshot)
+        os.symlink(screenshot, os.path.join(out, f"screen{screenshot_ext}"))
       '';
 in
 runCommand name { } ''

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.1252";
+  version = "9.2.1164";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-k5Na69KYXb7kxajpJFv9+vBymApaio7TwHrETudAGrk=";
+    hash = "sha256-Ymtq7+egq8OydTdzHP/q14MK6p+crKlQwduJ27oDbNU=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/emulators/kega-fusion/default.nix

@@ -1,111 +0,0 @@
-{
-  stdenv,
-  lib,
-  writeText,
-  fetchurl,
-  upx,
-  libGL,
-  libGLU,
-  glib,
-  gtk2,
-  alsa-lib,
-  libsm,
-  libx11,
-  gdk-pixbuf,
-  pango,
-  libxinerama,
-  mpg123,
-  runtimeShell,
-}:
-
-let
-  libPath = lib.makeLibraryPath [
-    stdenv.cc.cc
-    libGL
-    libGLU
-    glib
-    gtk2
-    alsa-lib
-    libsm
-    libx11
-    gdk-pixbuf
-    pango
-    libxinerama
-  ];
-
-in
-stdenv.mkDerivation {
-  pname = "kega-fusion";
-  version = "3.63x";
-
-  src = fetchurl {
-    url = "https://www.carpeludum.com/download/Fusion363x.tar.gz";
-    sha256 = "14s6czy20h5khyy7q95hd7k77v17ssafv9l6lafkiysvj2nmw94g";
-  };
-
-  plugins = fetchurl {
-    url = "https://www.carpeludum.com/download/PluginsLinux.tar.gz";
-    sha256 = "0d623cvh6n5ijj3wb64g93mxx2xbichsn7hj7brbb0ndw5cs70qj";
-  };
-
-  runner = writeText "kega-fusion" ''
-    #!${runtimeShell} -ex
-
-    kega_libdir="@out@/lib/kega-fusion"
-    kega_localdir="$HOME/.Kega Fusion"
-
-    # create local plugins directory if not present
-    mkdir -p "$kega_localdir/Plugins"
-
-    # create links for every included plugin
-    if [ $(ls -1A $kega_libdir/plugins | wc -l) -gt 0 ]; then
-      for i in $kega_libdir/plugins/*; do
-        if [ ! -e "$kega_localdir/Plugins/$(basename "$i")" ]; then
-          ln -sf "$i" "$kega_localdir/Plugins/"
-        fi
-      done
-    fi
-
-    # copy configuration file if not present
-    if ! [ -f "$kega_localdir/Fusion.ini" ]; then
-      cat > "$kega_localdir/Fusion.ini" <<EOF
-    ALSADeviceName=default
-    libmpg123path=${lib.getLib mpg123}/lib/libmpg123.so.0
-    EOF
-    else
-      sed -i 's,^\(libmpg123path=\).*,\1${lib.getLib mpg123}/lib/libmpg123.so.0,' "$kega_localdir/Fusion.ini"
-    fi
-
-    # here we go!
-    exec "$kega_libdir/Fusion" "$@"
-  '';
-
-  dontStrip = true;
-  dontPatchELF = true;
-
-  nativeBuildInputs = [ upx ];
-
-  installPhase = ''
-    upx -d Fusion
-    install -Dm755 Fusion "$out/lib/kega-fusion/Fusion"
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "${libPath}" "$out/lib/kega-fusion/Fusion"
-
-    tar -xaf $plugins
-    mkdir -p "$out/lib/kega-fusion/plugins"
-    cp -r Plugins/*.rpi "$out/lib/kega-fusion/plugins"
-
-    mkdir -p "$out/bin"
-    substitute "$runner" "$out/bin/kega-fusion" --subst-var out
-    chmod +x "$out/bin/kega-fusion"
-  '';
-
-  meta = {
-    description = "Sega SG1000, SC3000, SF7000, Master System, Game Gear, Genesis/Megadrive, SVP, Pico, SegaCD/MegaCD and 32X emulator";
-    homepage = "https://www.carpeludum.com/kega-fusion/";
-    maintainers = [ ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfreeRedistributable;
-    platforms = [ "i686-linux" ];
-    mainProgram = "kega-fusion";
-  };
-}

pkgs/applications/misc/zathura/cb/default.nix

@@ -1,18 +1,16 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
   meson,
   ninja,
   pkg-config,
-  zathura_core,
-  girara,
-  gtk4,
-  gettext,
-  libarchive,
   desktop-file-utils,
   appstream,
-  appstream-glib,
+  zathura_core,
+  libarchive,
+  girara,
+  gtk4,
   gitUpdater,
 }:
 
@@ -20,6 +18,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-cb";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-cb";
@@ -31,17 +32,15 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    gettext
     desktop-file-utils
     appstream
-    appstream-glib
   ];
 
   buildInputs = [
-    gtk4
-    libarchive
     zathura_core
+    libarchive
     girara
+    gtk4
   ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";

pkgs/applications/misc/zathura/core/default.nix

@@ -4,34 +4,31 @@
   fetchFromGitHub,
   meson,
   ninja,
-  wrapGAppsHook4,
-  pkg-config,
-  gitUpdater,
-  appstream-glib,
-  json-glib,
-  desktop-file-utils,
-  python3,
-  gtk4,
-  girara,
   gettext,
+  pkg-config,
+  librsvg,
+  sphinx,
+  desktop-file-utils,
+  appstream,
+  gtk4,
+  glib,
+  girara,
+  file, # libmagic
+  json-glib,
+  sqlite,
+  xxhash,
+  texlive, # synctex
+  libseccomp,
+  xvfb-run,
+  weston,
+  wrapGAppsHook4,
+  versionCheckHook,
+  gitUpdater,
+  zathura,
   gnome,
   libheif,
   libjxl,
-  libxml2,
-  xxhash,
-  check,
-  sqlite,
-  glib,
-  texlive,
-  libintl,
-  libseccomp,
-  file,
-  librsvg,
-  gtk-mac-integration,
   webp-pixbuf-loader,
-  xvfb-run,
-  weston,
-  versionCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -65,35 +62,33 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dsysconfdir=/etc"
     (lib.mesonEnable "seccomp" stdenv.hostPlatform.isLinux)
     (lib.mesonEnable "landlock" stdenv.hostPlatform.isLinux)
+    (lib.mesonEnable "tests-x11" finalAttrs.doCheck)
+    (lib.mesonEnable "tests-wayland" finalAttrs.doCheck)
   ];
 
   nativeBuildInputs = [
     meson
     ninja
-    pkg-config
-    desktop-file-utils
-    python3.pythonOnBuildForHost.pkgs.sphinx
     gettext
+    pkg-config
+    librsvg
+    sphinx
+    desktop-file-utils
+    appstream
     wrapGAppsHook4
-    libxml2
-    appstream-glib
   ];
 
   buildInputs = [
     gtk4
-    girara
-    libintl
-    sqlite
     glib
-    file
-    librsvg
-    check
+    girara
+    file # libmagic
     json-glib
-    texlive.bin.core
+    sqlite
     xxhash
+    texlive.bin.core # synctex
   ]
-  ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
-  ++ lib.optional stdenv.hostPlatform.isDarwin gtk-mac-integration;
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ libseccomp ];
 
   # add support for more image formats
   env.GDK_PIXBUF_MODULE_FILE = gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
@@ -115,11 +110,22 @@ stdenv.mkDerivation (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
-  passthru.updateScript = gitUpdater { };
+  passthru = {
+    updateScript = gitUpdater { };
+    tests = {
+      inherit zathura;
+    };
+  };
 
   meta = {
     homepage = "https://pwmt.org/projects/zathura";
     description = "Core component for zathura PDF viewer";
+    longDescription = ''
+      Zathura is a highly customizable and functional PDF viewer based on the
+      poppler rendering library and the GTK toolkit. The idea behind zathura
+      is an application that provides a minimalistic and space saving interface
+      as well as an easy usage that mainly focuses on keyboard interaction.
+    '';
     license = lib.licenses.zlib;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ mithicspirit ];

pkgs/applications/misc/zathura/djvu/default.nix

@@ -5,14 +5,12 @@
   meson,
   ninja,
   pkg-config,
-  gtk3,
-  zathura_core,
-  girara,
-  djvulibre,
-  gettext,
   desktop-file-utils,
   appstream,
-  appstream-glib,
+  zathura_core,
+  girara,
+  cairo,
+  djvulibre, # ddjvuapi
   gitUpdater,
 }:
 
@@ -20,6 +18,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-djvu";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-djvu";
@@ -33,15 +34,13 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     desktop-file-utils
     appstream
-    appstream-glib
   ];
 
   buildInputs = [
-    djvulibre
-    gettext
     zathura_core
-    gtk3
     girara
+    cairo
+    djvulibre
   ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";

pkgs/applications/misc/zathura/pdf-mupdf/default.nix

@@ -1,25 +1,17 @@
 {
-  stdenv,
   lib,
+  stdenv,
+  fetchFromGitHub,
   meson,
   ninja,
-  fetchFromGitHub,
-  cairo,
-  girara,
-  gtk-mac-integration,
-  gumbo,
-  jbig2dec,
-  libjpeg,
-  mupdf,
-  openjpeg,
   pkg-config,
-  zathura_core,
-  tesseract,
-  leptonica,
-  mujs,
   desktop-file-utils,
   appstream,
-  appstream-glib,
+  zathura_core,
+  girara,
+  mupdf,
+  glib,
+  cairo,
   gitUpdater,
 }:
 
@@ -27,6 +19,9 @@ stdenv.mkDerivation (finalAttrs: {
   version = "2026.07.18";
   pname = "zathura-pdf-mupdf";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-pdf-mupdf";
@@ -40,30 +35,18 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     desktop-file-utils
     appstream
-    appstream-glib
   ];
 
   buildInputs = [
-    cairo
-    girara
-    gumbo
-    jbig2dec
-    libjpeg
-    mupdf
-    openjpeg
     zathura_core
-    tesseract
-    leptonica
-    mujs
-  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin gtk-mac-integration;
+    girara
+    mupdf
+    glib
+    cairo
+  ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";
 
-  postPatch = ''
-    sed -i -e '/^mupdfthird =/d' -e 's/, mupdfthird//g' meson.build
-  '';
-
   passthru.updateScript = gitUpdater { };
 
   meta = {

pkgs/applications/misc/zathura/pdf-poppler/default.nix

@@ -1,16 +1,15 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
   meson,
   ninja,
   pkg-config,
+  desktop-file-utils,
+  appstream,
   zathura_core,
   girara,
   poppler,
-  desktop-file-utils,
-  appstream,
-  appstream-glib,
   gitUpdater,
 }:
 
@@ -18,6 +17,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-pdf-poppler";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-pdf-poppler";
@@ -31,13 +33,12 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     desktop-file-utils
     appstream
-    appstream-glib
-    zathura_core
   ];
 
   buildInputs = [
-    poppler
+    zathura_core
     girara
+    poppler
   ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";

pkgs/applications/misc/zathura/ps/default.nix

@@ -1,17 +1,17 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
   meson,
   ninja,
   pkg-config,
-  zathura_core,
-  girara,
-  libspectre,
-  gettext,
   desktop-file-utils,
   appstream,
-  appstream-glib,
+  zathura_core,
+  girara,
+  glib,
+  cairo,
+  libspectre,
   gitUpdater,
 }:
 
@@ -19,6 +19,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-ps";
   version = "2026.07.18";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-ps";
@@ -30,16 +33,16 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    gettext
     desktop-file-utils
     appstream
-    appstream-glib
   ];
 
   buildInputs = [
-    libspectre
     zathura_core
     girara
+    glib
+    cairo
+    libspectre
   ];
 
   env.PKG_CONFIG_ZATHURA_PLUGINDIR = "lib/zathura";

pkgs/applications/misc/zathura/wrapper.nix

@@ -22,6 +22,9 @@ symlinkJoin {
   inherit (zathura_core) version;
   pname = "zathura-with-plugins";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   paths =
     with zathura_core;
     [
@@ -56,20 +59,17 @@ symlinkJoin {
     '';
 
   meta = {
-    homepage = "https://pwmt.org/projects/zathura";
-    description = "Highly customizable and functional PDF viewer";
-    longDescription = ''
-      Zathura is a highly customizable and functional PDF viewer based on the
-      poppler rendering library and the GTK toolkit. The idea behind zathura
-      is an application that provides a minimalistic and space saving interface
-      as well as an easy usage that mainly focuses on keyboard interaction.
-    '';
-    license = lib.licenses.zlib;
-    platforms = lib.platforms.unix;
+    inherit (zathura_core.meta)
+      homepage
+      description
+      longDescription
+      license
+      platforms
+      mainProgram
+      ;
     maintainers = with lib.maintainers; [
       TethysSvensson
       mithicspirit
     ];
-    mainProgram = "zathura";
   };
 }

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -54,13 +54,13 @@
     "vendorHash": "sha256-/9AxZkWEXGtlEQ+p1utMhkC5z81XOkS1SCfp4ZgPT3g="
   },
   "aminueza_minio": {
-    "hash": "sha256-57IhDRu6YrJgXl2bkCeIeRIs4702wb0z/52eJoTAp70=",
+    "hash": "sha256-f8li8rvdRd6UDDqemerI0+nH+OtDCW3stT1H/fLDnDk=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.45.0",
+    "rev": "v3.45.1",
     "spdx": "AGPL-3.0",
-    "vendorHash": "sha256-hKSqgc+Gf0vzQuXKlErWVC/EbHatu/9oTW25PnRMyxQ="
+    "vendorHash": "sha256-ov+YA8Y9bl8oaeobh5m4ISba624h2lzlb7BtzcALIyI="
   },
   "archessmn_powerdns": {
     "hash": "sha256-gQRB8tnFHhXNId9J8947ffizIWTKEetOnc+QMnjaB48=",
@@ -227,13 +227,13 @@
     "vendorHash": "sha256-KS76AlIyquah/b/uwM4qotBgEbpGwF54gx2u6mQpJ4E="
   },
   "cloudamqp_cloudamqp": {
-    "hash": "sha256-adpGr2j0jBFW+0QxtSgTiEyxlKoBp/fw6oINxefhCl4=",
+    "hash": "sha256-Ih26RaGdJKt9jeeCegcMZWnoxUv4vrzr1Pdx84BEcFA=",
     "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
     "owner": "cloudamqp",
     "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.51.0",
+    "rev": "v1.52.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-scHNFyHn4VYm8wtuBdVCpgKCzwPhzrC3KBs1YHXPwos="
+    "vendorHash": "sha256-oXzgbhm+343BuItU9J/QvsMegncG3sjNXPZbdkt9SxQ="
   },
   "cloudflare_cloudflare": {
     "hash": "sha256-9uq4ebmGmwxOj5tTLgxapEbTvWjjByUNAIHLfcZfREA=",
@@ -310,11 +310,11 @@
     "vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
   },
   "datadog_datadog": {
-    "hash": "sha256-Sv/mzOMSerwMFiBFFcj+4bVaJvpAbHVj/MXXclhYpHA=",
+    "hash": "sha256-mWHyJtKODTnBcWCA0PKt6Dd7AJdyxONoVdA/ET63yrk=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v4.26.0",
+    "rev": "v4.27.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-dTbDKR03Inol1G4okCNDso5tZ45BEiUmkXOAmIrRcX0="
   },
@@ -391,13 +391,13 @@
     "vendorHash": "sha256-B8mYLd4VdADWoQLWiCM85VQrBfDdlYQ0wkCp9eUBQ4U="
   },
   "drfaust92_bitbucket": {
-    "hash": "sha256-m5Ya99ulMesUwl54sbHuvOYumbPcAhWMESVGbXIOJpE=",
+    "hash": "sha256-5clib4KME7L/wk5ptrKLXiY1/NZ9/+cajrHwNMkD00I=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.52.0",
+    "rev": "v2.54.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-uokHd4hDvWl6mrBa062F/uZmYPnW3TIZZKZwKBVq+Lo="
+    "vendorHash": "sha256-gUKREx3NORuYAFqR/hUCuU1OXQw5NYn2LzcpeunEagE="
   },
   "e-breuninger_netbox": {
     "hash": "sha256-tbBCGOcbDhiOjdgyS9lSw6IbMgzZwnbM40/InvhUKCA=",
@@ -706,13 +706,13 @@
     "vendorHash": "sha256-t20uPPaKr43Al7ExOPD+cw1hVwaVwxljHHR0tVPmrYw="
   },
   "hashicorp_tls": {
-    "hash": "sha256-4XHSPKszjMjt62fYDsgB+/43AY6Ixk8nTGUQBShcNgA=",
+    "hash": "sha256-PhRtfxTJ9pKfGilXlWkYi2rr9T5jTQySCT1l0ySAGhI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tls",
     "owner": "hashicorp",
     "repo": "terraform-provider-tls",
-    "rev": "v4.4.1",
+    "rev": "v4.4.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-QuRWNrwfBOk9V5IrvSaT5Qtl98HjBJvSX/0BmZiYTh4="
+    "vendorHash": "sha256-4iv5WwD1qX7Hq/JLNkFrouAVC3dQ75glJhvVz74CN7E="
   },
   "hashicorp_vault": {
     "hash": "sha256-Bd9ZALCqHcM4cn1knLXLyD3fpnBlw992xFeZCCREqk8=",
@@ -733,22 +733,22 @@
     "vendorHash": "sha256-47xWjlzpQ/EYzjbuuMKQiu5cfYAXdYkXRl+AOEP+sA4="
   },
   "heroku_heroku": {
-    "hash": "sha256-FnJn/kFnTOOcnJtVdlSFpZh9S+BZodhk6IcvG0DFaLg=",
+    "hash": "sha256-KipVqV1OT5tINSuNbbGzt6JaKVsc9pSkQhUCo3KspCs=",
     "homepage": "https://registry.terraform.io/providers/heroku/heroku",
     "owner": "heroku",
     "repo": "terraform-provider-heroku",
-    "rev": "v5.4.1",
+    "rev": "v5.4.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
   "hetznercloud_hcloud": {
-    "hash": "sha256-bK6oSiNa6W04IqsWYfgntpyTn1C/k1TpD+vmPWlsDFA=",
+    "hash": "sha256-aniX/TEZyZLE3F5hHWnlp2S+gbvVaNbf2QTcYgkutg8=",
     "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
     "owner": "hetznercloud",
     "repo": "terraform-provider-hcloud",
-    "rev": "v1.70.0",
+    "rev": "v1.70.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-PVoHdzP8gtGobxDyB9g5Zi7pNoATgeQFrPEWki2y8TE="
+    "vendorHash": "sha256-BpcXnBC8Li53taP3dt9AlwivQ5nMSaUSgzVj365Lzz8="
   },
   "huaweicloud_huaweicloud": {
     "hash": "sha256-e9osIGnur2QtVByW4X93X4pqPxhbqNUPn8CSIZAo6Vk=",
@@ -1445,11 +1445,11 @@
     "vendorHash": "sha256-6ivj3olSo9t75jVnow2GvzVGE5JeVtTjWxYDirvSyFc="
   },
   "trozz_pocketid": {
-    "hash": "sha256-jRjM8uMpa5FBRqAJY8eM+Sjo72E1et/HyIGEIoK/rXg=",
+    "hash": "sha256-JZAUncvrj42sArGYQP2CSGxU48IBIsrgbzTl8BbrqB4=",
     "homepage": "https://registry.terraform.io/providers/Trozz/pocketid",
     "owner": "Trozz",
     "repo": "terraform-provider-pocketid",
-    "rev": "v2.4.2",
+    "rev": "v2.5.0",
     "spdx": "MIT",
     "vendorHash": "sha256-Xro8lh5wNsAyYQrM8zIbzcPPTIGE1x99jA3ZMXZXwyk="
   },

pkgs/applications/science/logic/coq/with-packages.nix

@@ -24,9 +24,9 @@ let
 
   coqPath = lib.makeSearchPath "/lib/coq/${rocq-version}/user-contrib" allPackages;
 
-  ocamlPath =
-    lib.makeSearchPathOutput "dev" "/lib/ocaml/${coq.ocamlPackages.ocaml.version}/site-lib"
-      ([ coq.ocamlPackages.findlib ] ++ allPackages);
+  ocamlPath = lib.makeSearchPath "/lib/ocaml/${coq.ocamlPackages.ocaml.version}/site-lib" (
+    [ coq.ocamlPackages.findlib ] ++ allPackages
+  );
 
   pathEnvVar = if isRocq then "ROCQPATH" else "COQPATH";
 in

pkgs/applications/virtualization/docker/default.nix

@@ -64,6 +64,8 @@ let
       versionCheckHook,
     }:
     let
+      systemdLibs' = systemdLibs.override { withCompression = true; };
+
       docker-meta = {
         license = lib.licenses.asl20;
         maintainers = with lib.maintainers; [
@@ -190,7 +192,7 @@ let
           ++ lib.optionals (lib.versionAtLeast version "29.0.0") [ nftables ]
           ++ lib.optionals withLvm [ lvm2 ]
           ++ lib.optionals withBtrfs [ btrfs-progs ]
-          ++ lib.optionals withSystemd [ systemdLibs ]
+          ++ lib.optionals withSystemd [ systemdLibs' ]
           ++ lib.optionals withSeccomp [ libseccomp ];
 
           postPatch = ''

pkgs/applications/virtualization/singularity/generic.nix

@@ -306,6 +306,10 @@ in
               hello
               cowsay
             ];
+            # mksquashfs scales its memory requirement with the number of
+            # processors (all host CPUs by default). Give the build VM enough
+            # memory to cope with high core-count builders.
+            memSize = 4096;
             singularity = finalAttrs.finalPackage;
           };
         };

pkgs/applications/virtualization/singularity/packages.nix

@@ -9,14 +9,14 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "apptainer";
-        version = "1.5.4";
+        version = "1.5.5";
         projectName = "apptainer";
 
         src = fetchFromGitHub {
           owner = "apptainer";
           repo = "apptainer";
           tag = "v${version}";
-          hash = "sha256-ru0dAuR6Q6NoYnLtEGm9/SiXPk6u1Lw3dcckkuqB7Cs=";
+          hash = "sha256-oV1LzCBYbMFbKGhli6eCbpMoyB1KeccnaEi+xHJ431g=";
         };
 
         # Override vendorHash with overrideAttrs.

pkgs/build-support/bintools-wrapper/ld-wrapper.sh

@@ -200,30 +200,37 @@ if [[ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 && "$linkType" != static-pie ]]; t
     # so, add the directory to the rpath.
     # It's important to add the rpath in the order of -L..., so
     # the link time chosen objects will be those of runtime linking.
-    declare -A rpaths seenLibDirs
+    declare -A rpaths
     for dir in ${libDirs+"${libDirs[@]}"}; do
-        # The same directory is often passed many times, such as from
-        # NIX_LDFLAGS; it would give the same result each time.
-        if [ -n "${seenLibDirs[$dir]:-}" ]; then
+        # If the path is in the store, do not resolve any symlinks and add it to the rpath.
+        # Resolving symlinks in the store breaks bootstrapping, see issue #454199.
+        # If it is outside the store, resolve symlinks step by step until it falls
+        # into the store or it becomes not a symlink.
+        # Always canonicalize the path before checking it is in the store or not.
+        if dir2=$(realpath -s "$dir"); then
+            dir="$dir2"
+        else
             continue
         fi
-        seenLibDirs["$dir"]=1
-        # Find where the directory is, following symlinks outside the store,
-        # and in it only where needed; see resolveLibDir.  Skip directories
-        # that do not exist, in which the linker cannot find libraries either.
-        if ! [ -d "$dir" ] || ! resolveLibDir "$dir"; then
-            continue
-        fi
-        dir="$resolvedPath"
+        while [ -z "${rpaths[$dir]:-}" ] && [[ "$dir" != "${NIX_STORE:-}"/* ]] && [ -L "$dir" ]; do
+            if dir2=$(readlink "$dir"); then
+                dir="dir2"
+            else
+                break
+            fi
+            if dir2=$(realpath -s "$dir"); then
+                dir="dir2"
+            else
+                break
+            fi
+        done
         # If the path turns out to be outside the store, we do not add it to rpath.
         # This typically happens for libraries in /tmp that are later
         # copied to $out/lib. If not, we're screwed.
         if [ -n "${rpaths[$dir]:-}" ] || [[ "$dir" != "${NIX_STORE:-}"/* ]]; then
             continue
         fi
-        # Every name in libs is that of a shared library, ending in .so or
-        # containing .so., so the rest of the directory can be skipped.
-        for path in "$dir"/*.so*; do
+        for path in "$dir"/*; do
             file="${path##*/}"
             if [ "${libs[$file]:-}" ]; then
                 # This library may have been provided by a previous directory,

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -129,8 +129,6 @@ lib.makeOverridable (
               "pki"
               # Custom dconf profiles
               "dconf"
-              # EGL platform definitions (required by nvidia-x11)
-              "egl"
             ];
           in
           map (path: "/etc/${path}") files;

pkgs/build-support/go/module.nix

@@ -302,7 +302,7 @@ lib.extendMkDerivation {
 
                 if [ "$cmd" = "test" ]; then
                   flags+=(-vet=off)
-                  concatTo flags checkFlags
+                  flags+=($checkFlags)
                 fi
 
                 local OUT

pkgs/build-support/node/prefetch-npm-deps/default.nix

@@ -20,8 +20,6 @@
     pname = "prefetch-npm-deps";
     version = (lib.importTOML ./Cargo.toml).package.version;
 
-    __structuredAttrs = true;
-
     src = lib.cleanSourceWith {
       src = ./.;
       filter =

pkgs/build-support/ocaml/dune.nix

@@ -45,26 +45,6 @@ lib.extendMkDerivation {
 
         strictDeps = true;
 
-        # OCaml libraries, and the dependencies they propagate, are only needed
-        # to build other packages. Unless the package chooses its outputs,
-        # those are installed into "dev", rather than "out", to minimize the
-        # "out" runtime closure. Man pages and documentation go to "man" and
-        # "doc".
-        outputs =
-          args.outputs or [
-            "out"
-            "dev"
-            "man"
-            "doc"
-          ];
-
-        # The findlib setup hook always points OCAMLFIND_DESTDIR at $out, so
-        # override it after all setup hooks have run.
-        postHook = ''
-          export OCAMLFIND_DESTDIR="''${!outputDev}/lib/ocaml/${ocaml.version}/site-lib/"
-        ''
-        + args.postHook or "";
-
         inherit enableParallelBuilding;
         dontAddStaticConfigureFlags = true;
         configurePlatforms = [ ];
@@ -87,15 +67,12 @@ lib.extendMkDerivation {
           args.installPhase or ''
             runHook preInstall
             dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${lib.concatStringsSep " " dunePackages} \
-             ${lib.optionalString (lib.versionAtLeast Dune.version "2.9") ''
-               --docdir "''${!outputDoc}/share/doc" --mandir "''${!outputMan}/share/man" --etcdir "$out/etc" \
-             ''} ${lib.optionalString (lib.versionAtLeast Dune.version "3.0") ''
-               --bindir "''${!outputBin}/bin" --datadir "$out/share"
-             ''}
-            # Not every package installs something into each output.
-            for output in $(getAllOutputNames); do
-              mkdir -p "''${!output}"
-            done
+             ${
+               if lib.versionAtLeast Dune.version "2.9" then
+                 "--docdir $out/share/doc --mandir $out/share/man"
+               else
+                 ""
+             }
             runHook postInstall
           '';
 
@@ -106,22 +83,8 @@ lib.extendMkDerivation {
             runHook postCheck
           '';
 
-        # With several outputs, multiple-outputs.sh passes autoconf-style
-        # --bindir/--libdir/--mandir/... flags to ./configure. The configure
-        # scripts shipped by dune packages are hand-written and reject them.
-        setOutputFlags = args.setOutputFlags or false;
-
-        meta =
-          let
-            meta = args.meta or { };
-            # meta is often copied from another package, which may have other
-            # outputs. Keep the default if none of them are left.
-            outputsToInstall = lib.intersectLists finalAttrs.outputs (meta.outputsToInstall or [ ]);
-          in
-          removeAttrs meta [ "outputsToInstall" ]
-          // {
-            platforms = meta.platforms or ocaml.meta.platforms;
-          }
-          // lib.optionalAttrs (outputsToInstall != [ ]) { inherit outputsToInstall; };
+        meta = (args.meta or { }) // {
+          platforms = args.meta.platforms or ocaml.meta.platforms;
+        };
       };
 }

pkgs/build-support/rust/fetch-cargo-vendor-util.py

@@ -1,223 +1,57 @@
 import functools
 import hashlib
 import json
-import os
+import multiprocessing as mp
 import re
 import shutil
 import subprocess
 import sys
-import tempfile
-import threading
 import tomllib
-from concurrent.futures import FIRST_EXCEPTION, Future, ThreadPoolExecutor, wait
-from dataclasses import dataclass, field
 from os.path import islink, realpath
 from pathlib import Path
-from typing import Any, cast
+from typing import Any, TypedDict, cast
 from urllib.parse import unquote
 
+import requests
 import tomli_w
-from requests import Session
 from requests.adapters import HTTPAdapter, Retry
 
-# Constants for controlling how the crates are downloaded from the registries via `requests`
-# These do not affect the fetching of git dependencies
-MAX_WORKERS = min(5, os.cpu_count() or 1)  # number of workers in the ThreadPoolExecutor
-CONNECT_TIMEOUT = 2  # max seconds for establishing initial connection
-READ_TIMEOUT = 10  # max seconds between receiving data packets
-TIMEOUT = (CONNECT_TIMEOUT, READ_TIMEOUT)
-RETRY_COUNT = 3  # number of retries for fetching an url
-BACKOFF_FACTOR = 0.5  # seconds to wait between retries (gets multiplied by 2 after every retry)
-
-# If for some reason our custom User-Agent value starts getting rejected, we could
-# set the User-Agent to the value that cargo uses, e.g.: "cargo/1.95.0 (f2d3ce0bd 2026-03-21)"
-USER_AGENT = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
-
 eprint = functools.partial(print, file=sys.stderr)
 
 
-@dataclass
-class RegistrySource:
-    raw: str
-    url: str
-    is_sparse: bool
-    ind: int = field(init=False)
+def load_toml(path: Path) -> dict[str, Any]:
+    with open(path, "rb") as f:
+        return tomllib.load(f)
 
 
-@dataclass
-class RegistryPackage:
-    name: str
-    version: str
-    source: RegistrySource
-    checksum: str
+def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
+    # lockfile v1 and v2 don't have the `version` key, so assume v2
+    version = cargo_lock_toml.get("version", 2)
+
+    # TODO: add logic for differentiating between v1 and v2
+
+    return version
 
 
-GIT_SOURCE_REGEX = re.compile(r"git\+(?P<url>[^?]+)(\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
-
-
-@dataclass
-class GitSource:
-    raw: str
-    url: str
-    type: str | None
-    value: str | None
-    git_sha_rev: str
-    ind: int = field(init=False)
-
-
-@dataclass
-class GitPackage:
-    name: str
-    version: str
-    source: GitSource
-
-
-Source = RegistrySource | GitSource
-Package = RegistryPackage | GitPackage
-
-
-@dataclass
-class Lockfile:
-    version: int
-    sources: list[Source]
-    packages: list[Package]
-
-
-def parse_git_source(raw_source: str, lockfile_version: int) -> GitSource:
-    match = GIT_SOURCE_REGEX.match(raw_source)
-    if match is None:
-        raise Exception(f"Unable to process git source: {raw_source}.")
-
-    parsed_dict = match.groupdict(default=None)
-    url = cast(str, parsed_dict["url"])
-    git_sha_rev = cast(str, parsed_dict["git_sha_rev"])
-
-    source = GitSource(raw_source, url, parsed_dict["type"], parsed_dict["value"], git_sha_rev)
-
-    # the source URL is URL-encoded in lockfile_version >=4
-    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
-    if lockfile_version >= 4 and source.value is not None:
-        source.value = unquote(source.value)
-
-    return source
-
-
-def parse_source(raw_source: str, lockfile_version: int) -> Source:
-    if raw_source.startswith("git+"):
-        return parse_git_source(raw_source, lockfile_version)
-    elif raw_source.startswith("registry+"):
-        return RegistrySource(raw=raw_source, url=raw_source[9:], is_sparse=False)
-    elif raw_source.startswith("sparse+"):
-        return RegistrySource(raw=raw_source, url=raw_source[7:].rstrip("/"), is_sparse=True)
-    raise Exception(f"Cannot process source: {raw_source}")
-
-
-def load_lockfile(path: Path) -> Lockfile:
-    with path.open("rb") as f:
-        cargo_lock_toml = tomllib.load(f)
-
-    # The `version` key missing means either lockfile v1 or v2. We assume v2 for now.
-    lockfile_version = cargo_lock_toml.get("version", 2)
-
-    raw_packages: list[dict[str, str]] = cargo_lock_toml["package"]
-
-    sources: list[Source] = []
-    raw_source_to_source: dict[str, Source] = {}
-
-    # we'll mark every source with an index in order of appearance
-    # both git and registry sources have a different incrementing index
-    # we reserve registry index 0 for both of the default crates-io registries
-
-    for raw_source in ["registry+https://github.com/rust-lang/crates.io-index", "sparse+https://index.crates.io/"]:
-        source = parse_source(raw_source, lockfile_version)
-        source.ind = 0
-        sources.append(source)
-        raw_source_to_source[source.raw] = source
-
-    next_registry_ind = 1
-    next_git_ind = 0
-
-    git_selector_tuple_to_git_ind: dict[tuple[str, str | None, str | None], int] = {}
-
-    for raw_pkg in raw_packages:
-        raw_source = raw_pkg.get("source", None)
-        if raw_source is None:  # Skip local dependencies
-            continue
-        if raw_source in raw_source_to_source:
-            continue
-
-        source = parse_source(raw_source, lockfile_version)
-        match source:
-            case RegistrySource():
-                source.ind = next_registry_ind
-                next_registry_ind += 1
-            case GitSource():
-                # git sources may get the same `ind` value if their selectors match
-                tup = (source.url, source.type, source.value)
-                if tup not in git_selector_tuple_to_git_ind:
-                    git_selector_tuple_to_git_ind[tup] = next_git_ind
-                    next_git_ind += 1
-                source.ind = git_selector_tuple_to_git_ind[tup]
-
-        sources.append(source)
-        raw_source_to_source[source.raw] = source
-
-    packages: list[Package] = []
-
-    for raw_pkg in raw_packages:
-        name = raw_pkg["name"]
-        version = raw_pkg["version"]
-        raw_source = raw_pkg.get("source", None)
-        if raw_source is None:  # Skip local dependencies
-            continue
-        source = raw_source_to_source[raw_source]
-
-        match source:
-            case RegistrySource():
-                checksum = raw_pkg.get("checksum", None)
-
-                # lockfile v1 has the checksum values in a separate metadata table
-                if checksum is None:
-                    lockfile_version = 1
-                    checksum_key = f"checksum {name} {version} ({source.raw})"
-                    checksum = cargo_lock_toml["metadata"][checksum_key]
-
-                pkg = RegistryPackage(name, version, source, checksum)
-            case GitSource():
-                pkg = GitPackage(name, version, source)
-
-        packages.append(pkg)
-
-    return Lockfile(lockfile_version, sources, packages)
-
-
-_local = threading.local()
-
-
-def get_session() -> Session:
-    if hasattr(_local, "session"):
-        return _local.session
-
+def create_http_session() -> requests.Session:
     retries = Retry(
-        total=RETRY_COUNT,
-        backoff_factor=BACKOFF_FACTOR,
+        total=5,
+        backoff_factor=0.5,
         status_forcelist=[500, 502, 503, 504]
     )
-    session = Session()
-    session.headers["User-Agent"] = USER_AGENT
+    session = requests.Session()
+    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
     session.mount('http://', HTTPAdapter(max_retries=retries))
     session.mount('https://', HTTPAdapter(max_retries=retries))
-
-    _local.session = session
     return session
 
 
-def download_file_with_checksum(url: str, destination_path: Path) -> str:
-    session = get_session()
+def download_file_with_checksum(session: requests.Session, url: str, destination_path: Path) -> str:
     sha256_hash = hashlib.sha256()
-    with session.get(url, stream=True, timeout=TIMEOUT) as response:
-        response.raise_for_status()
-        with destination_path.open("wb") as file:
+    with session.get(url, stream=True) as response:
+        if not response.ok:
+            raise Exception(f"Failed to fetch file from {url}. Status code: {response.status_code}")
+        with open(destination_path, "wb") as file:
             for chunk in response.iter_content(1024):  # Download in chunks
                 if chunk:  # Filter out keep-alive chunks
                     file.write(chunk)
@@ -228,157 +62,117 @@ def download_file_with_checksum(url: str, destination_path: Path) -> str:
     return checksum
 
 
-# Fetch the config.json file and get the .dl key from it
-# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-def fetch_dl_for_registry_source(source: RegistrySource) -> str:
-    # We hardcode the .dl value for crates-io registries to avoid having to clone the git repo, saving a few seconds
-    if source.ind == 0:
-        return "https://static.crates.io/crates"
+def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
+    # TODO: support other registries
+    #       maybe fetch config.json from the registry root and get the dl key
+    #       See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
+    if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
+        raise Exception("Only the default crates.io registry is supported.")
 
-    eprint(f'Fetching .dl value for registry "{source.url}"')
-    if source.is_sparse:
-        url = source.url + "/config.json"
-
-        # https://doc.rust-lang.org/cargo/reference/registry-web-api.html#web-api
-        headers = {
-            "Content-Type": "application/json",
-            "Accept": "application/json",
-        }
-
-        session = get_session()
-        with session.get(url, headers=headers, timeout=TIMEOUT) as response:
-            response.raise_for_status()
-            registry_config: dict[str, str] = response.json()
-    else:
-        tmp_dir = Path(tempfile.mkdtemp())
-        # use spare-checkout to only get the config.json file from the registry's git repo
-        # --quiet is deliberately not used to be able to debug if something goes wrong
-        cmd = ["nix-prefetch-git", "--builder", "--url", source.url, "--rev", "HEAD", "--sparse-checkout", "config.json", "--out", str(tmp_dir)]
-        subprocess.check_output(cmd)
-        with (tmp_dir / "config.json").open("rb") as f:
-            registry_config: dict[str, str] = json.load(f)
-
-    dl = registry_config["dl"]
-
-    auth_required = registry_config.get("auth-required", False)
-    if auth_required:
-        raise Exception(f'Registry "{source.url}" requires authentication, but it is not yet implemented!')
-
-    return dl
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers.
+    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
 
 
-# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-files
-def name_to_prefix(name: str) -> str:
-    nl = len(name)
-    if nl <= 2:
-        return str(nl)
-    if nl == 3:
-        return "3/" + name[0]
-    return name[0:2] + "/" + name[2:4]
+def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
 
+    url = get_download_url_for_tarball(pkg)
+    filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
 
-# See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-def make_download_url_for_tarball(pkg: RegistryPackage, dl: str) -> str:
-    # Assume default substitutions if no substitutions are specified
-    url = dl if "}" in dl else dl + "/{crate}/{version}/download"
+    # TODO: allow legacy checksum specification, see importCargoLock for example
+    #       also, don't forget about the other usage of the checksum
+    expected_checksum = pkg["checksum"]
 
-    prefix = name_to_prefix(pkg.name)
-    url = url.replace("{crate}", pkg.name)
-    url = url.replace("{version}", pkg.version)
-    url = url.replace("{prefix}", prefix)
-    url = url.replace("{lowerprefix}", prefix.lower())
-    url = url.replace("{sha256-checksum}", pkg.checksum)
-    return url
+    tarball_out_dir = out_dir / "tarballs" / filename
+    eprint(f"Fetching {url} -> tarballs/{filename}")
 
-
-def download_crate_tarball(url: str, out_path: Path, expected_checksum: str) -> None:
-    out_path.parent.mkdir(parents=True, exist_ok=True)
-
-    eprint(f"Fetching {url} -> {out_path}")
-    calculated_checksum = download_file_with_checksum(url, out_path)
+    calculated_checksum = download_file_with_checksum(session, url, tarball_out_dir)
 
     if calculated_checksum != expected_checksum:
         raise Exception(f"Hash mismatch! File fetched from {url} had checksum {calculated_checksum}, expected {expected_checksum}.")
 
 
 def download_git_tree(url: str, git_sha_rev: str, out_dir: Path) -> None:
+
     tree_out_dir = out_dir / "git" / git_sha_rev
-
-    # This could happen if different selectors point to the same git_sha_rev
-    if tree_out_dir.exists():
-        eprint(f"Skipping fetching {url}#{git_sha_rev} as it has already been downloaded")
-        return
-
-    tree_out_dir.mkdir(parents=True)
-
     eprint(f"Fetching {url}#{git_sha_rev} -> git/{git_sha_rev}")
 
     cmd = ["nix-prefetch-git", "--builder", "--quiet", "--fetch-submodules", "--url", url, "--rev", git_sha_rev, "--out", str(tree_out_dir)]
     subprocess.check_output(cmd)
 
 
-def make_tarball_relpath(pkg: RegistryPackage) -> Path:
-    # Instead of .tar.gz we could have used the .crate extension
-    # But we keep using .tar.gz for backwards compat
-    filename = f'{pkg.name}-{pkg.version}.tar.gz'
+GIT_SOURCE_REGEX = re.compile("git\\+(?P<url>[^?]+)(\\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
 
-    # For backwards compat, all crates.io crates (where source.ind == 0)
-    # are stored directly in tarballs/
-    # Crates from other registries are stored in tarballs/registry-{ind}/
-    if pkg.source.ind == 0:
-        reldir = Path("tarballs")
-    else:
-        reldir = Path("tarballs") / f"registry-{pkg.source.ind}"
 
-    return reldir / filename
+class GitSourceInfo(TypedDict):
+    url: str
+    type: str | None
+    value: str | None
+    git_sha_rev: str
+
+
+def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
+    match = GIT_SOURCE_REGEX.match(source)
+    if match is None:
+        raise Exception(f"Unable to process git source: {source}.")
+
+    source_info = cast(GitSourceInfo, match.groupdict(default=None))
+
+    # the source URL is URL-encoded in lockfile_version >=4
+    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
+    if lockfile_version >= 4 and source_info["value"] is not None:
+        source_info["value"] = unquote(source_info["value"])
+
+    return source_info
 
 
 def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    lockfile = load_lockfile(lockfile_path)
+    cargo_lock_toml = load_toml(lockfile_path)
+    lockfile_version = get_lockfile_version(cargo_lock_toml)
+
+    git_packages: list[dict[str, Any]] = []
+    registry_packages: list[dict[str, Any]] = []
+
+    for pkg in cargo_lock_toml["package"]:
+        # ignore local dependenices
+        if "source" not in pkg.keys():
+            eprint(f"Skipping local dependency: {pkg["name"]}")
+            continue
+        source = pkg["source"]
+
+        if source.startswith("git+"):
+            git_packages.append(pkg)
+        elif source.startswith("registry+"):
+            registry_packages.append(pkg)
+        else:
+            raise Exception(f"Can't process source: {source}.")
+
+    git_sha_rev_to_url: dict[str, str] = {}
+    for pkg in git_packages:
+        source_info = parse_git_source(pkg["source"], lockfile_version)
+        git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
 
     out_dir.mkdir(exist_ok=True)
     shutil.copy(lockfile_path, out_dir / "Cargo.lock")
 
-    git_sources = [source for source in lockfile.sources if isinstance(source, GitSource)]
-    registry_sources = [source for source in lockfile.sources if isinstance(source, RegistrySource)]
-    registry_packages = [pkg for pkg in lockfile.packages if isinstance(pkg, RegistryPackage)]
+    # fetch git trees sequentially, since fetching concurrently leads to flaky behaviour
+    if len(git_packages) != 0:
+        (out_dir / "git").mkdir()
+        for git_sha_rev, url in git_sha_rev_to_url.items():
+            download_git_tree(url, git_sha_rev, out_dir)
 
-    # We fetch git trees sequentially because fetching concurrently seemed to cause flaky behaviour
-    for source in git_sources:
-        download_git_tree(source.url, source.git_sha_rev, out_dir)
-
-    raw_registry_source_to_dl: dict[str, str] = {}
-    for source in registry_sources:
-        dl = fetch_dl_for_registry_source(source)
-        eprint(f'Using .dl value of "{dl}" for registry "{source.raw}"')
-        raw_registry_source_to_dl[source.raw] = dl
-
-    eprint(f"Downloading crate tarballs with {MAX_WORKERS} workers...")
-    with ThreadPoolExecutor(max_workers=MAX_WORKERS) as executor:
-        futures: list[Future[None]] = []
-
-        for pkg in registry_packages:
-            dl = raw_registry_source_to_dl[pkg.source.raw]
-            url = make_download_url_for_tarball(pkg, dl)
-
-            out_path = out_dir / make_tarball_relpath(pkg)
-
-            future = executor.submit(download_crate_tarball, url, out_path, pkg.checksum)
-            futures.append(future)
-
-        # fail early if a worker raises an exception
-        done, _ = wait(futures, return_when=FIRST_EXCEPTION)
-        for f in done:
-            e = f.exception()
-            if e is None:
-                continue
-            executor.shutdown(cancel_futures=True)
-            raise Exception(f"Failed to download tarball: {e}")
+    # run tarball download jobs in parallel, with at most 5 concurrent download jobs
+    with mp.Pool(min(5, mp.cpu_count())) as pool:
+        if len(registry_packages) != 0:
+            (out_dir / "tarballs").mkdir()
+            session = create_http_session()
+            tarball_args_gen = ((session, pkg, out_dir) for pkg in registry_packages)
+            pool.starmap(download_tarball, tarball_args_gen)
 
 
 def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
     cmd = ["cargo", "metadata", "--format-version", "1", "--no-deps", "--manifest-path", str(manifest_path)]
-    output = subprocess.check_output(cmd, cwd=manifest_path.parent)
+    output = subprocess.check_output(cmd)
     return json.loads(output)
 
 
@@ -450,7 +244,8 @@ def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_
     shutil.copytree(crate_tree, crate_out_dir, ignore=ignore_func)
     crate_out_dir.chmod(0o755)
 
-    manifest_data = crate_manifest_path.read_text()
+    with open(crate_manifest_path, "r") as f:
+        manifest_data = f.read()
 
     if "workspace" in manifest_data:
         crate_manifest_metadata = get_manifest_metadata(crate_manifest_path)
@@ -473,16 +268,16 @@ def extract_crate_tarball_contents(tarball_path: Path, crate_out_dir: Path) -> N
     subprocess.check_output(cmd)
 
 
-def make_git_source_selector(source: GitSource) -> dict[str, str]:
+def make_git_source_selector(source_info: GitSourceInfo) -> dict[str, str]:
     selector = {}
-    selector["git"] = source.url
-    if source.type is not None:
-        selector[source.type] = source.value
+    selector["git"] = source_info["url"]
+    if source_info["type"] is not None:
+        selector[source_info["type"]] = source_info["value"]
     return selector
 
 
-def make_registry_source_selector(source: RegistrySource) -> dict[str, str]:
-    registry = source.raw if source.is_sparse else source.url
+def make_registry_source_selector(source: str) -> dict[str, str]:
+    registry = source[9:] if source.startswith("registry+") else source
     selector = {}
     selector["registry"] = registry
     return selector
@@ -493,9 +288,14 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
     out_dir.mkdir(exist_ok=True)
     shutil.copy(lockfile_path, out_dir / "Cargo.lock")
 
-    lockfile = load_lockfile(lockfile_path)
+    cargo_lock_toml = load_toml(lockfile_path)
+    lockfile_version = get_lockfile_version(cargo_lock_toml)
 
+    source_to_ind: dict[str, str] = {}
+    selector_to_ind: dict[tuple, str] = {}
     source_config = {}
+    next_registry_ind = 0
+    next_git_ind = 0
 
     def add_source_replacement(
         orig_key: str,
@@ -508,96 +308,112 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
         source_config[orig_key] = orig_selector
         source_config[orig_key]["replace-with"] = vendored_key
 
+    # we reserve registry index 0 for crates-io
+    source_to_ind["registry+https://github.com/rust-lang/crates.io-index"] = "registry-0"
+    source_to_ind["sparse+https://index.crates.io/"] = "registry-0"
     add_source_replacement(
         orig_key="crates-io",
         orig_selector={},  # there is an internal selector defined for the `crates-io` source
         vendored_key="vendored-source-registry-0",
         vendored_dir="@vendor@/source-registry-0"
     )
+    next_registry_ind += 1
 
-    processed_git_inds = set()
+    for pkg in cargo_lock_toml["package"]:
+        # ignore local dependencies
+        if "source" not in pkg.keys():
+            continue
+        source: str = pkg["source"]
+        if source in source_to_ind:
+            continue
 
-    for source in lockfile.sources:
-        match source:
-            case RegistrySource():
-                if source.ind == 0:  # crates-io already handled separately above
-                    continue
+        if source.startswith("git+"):
+            source_info = parse_git_source(source, lockfile_version)
+            selector = make_git_source_selector(source_info)
+            selector_key = (source_info["url"], source_info["type"], source_info["value"])
+            if selector_key in selector_to_ind:
+                ind = selector_to_ind[selector_key]
+            else:
+                ind = f"git-{next_git_ind}"
+                next_git_ind += 1
+                selector_to_ind[selector_key] = ind
                 add_source_replacement(
-                    orig_key=f"original-source-registry-{source.ind}",
-                    orig_selector=make_registry_source_selector(source),
-                    vendored_key=f"vendored-source-registry-{source.ind}",
-                    vendored_dir=f"@vendor@/source-registry-{source.ind}"
+                    orig_key=f"original-source-{ind}",
+                    orig_selector=selector,
+                    vendored_key=f"vendored-source-{ind}",
+                    vendored_dir=f"@vendor@/source-{ind}"
                 )
-            case GitSource():
-                # In some cases multiple git sources can have the same selector, thus the same git ind
-                # but source replacements can't be made for the same selector multiple times
-                if source.ind in processed_git_inds:
-                    continue
-                processed_git_inds.add(source.ind)
+        elif source.startswith("registry+") or source.startswith("sparse+"):
+            ind = f"registry-{next_registry_ind}"
+            next_registry_ind += 1
+            selector = make_registry_source_selector(source)
+            add_source_replacement(
+                orig_key=f"original-source-{ind}",
+                orig_selector=selector,
+                vendored_key=f"vendored-source-{ind}",
+                vendored_dir=f"@vendor@/source-{ind}"
+            )
+        else:
+            raise Exception(f"Can't process source: {source}.")
 
-                add_source_replacement(
-                    orig_key=f"original-source-git-{source.ind}",
-                    orig_selector=make_git_source_selector(source),
-                    vendored_key=f"vendored-source-git-{source.ind}",
-                    vendored_dir=f"@vendor@/source-git-{source.ind}"
-                )
+        source_to_ind[source] = ind
 
     config_path = out_dir / ".cargo" / "config.toml"
     config_path.parent.mkdir()
 
-    with config_path.open("wb") as config_file:
+    with open(config_path, "wb") as config_file:
         tomli_w.dump({"source": source_config}, config_file)
 
-    for pkg in lockfile.packages:
-        match pkg:
-            case RegistryPackage():
-                crate_out_dir = out_dir / f"source-registry-{pkg.source.ind}" / f"{pkg.name}-{pkg.version}"
-                crate_out_dir.parent.mkdir(exist_ok=True)
+    for pkg in cargo_lock_toml["package"]:
 
-                tarball_path = vendor_staging_dir / make_tarball_relpath(pkg)
+        # ignore local dependenices
+        if "source" not in pkg.keys():
+            continue
 
-                extract_crate_tarball_contents(tarball_path, crate_out_dir)
+        source: str = pkg["source"]
+        source_ind = source_to_ind[source]
+        crate_dir_name = f"{pkg["name"]}-{pkg["version"]}"
+        source_dir_name = f"source-{source_ind}"
+        crate_out_dir = out_dir / source_dir_name / crate_dir_name
+        crate_out_dir.parent.mkdir(exist_ok=True)
 
-                # non-git based crates need the package checksum at minimum
-                with (crate_out_dir / ".cargo-checksum.json").open("w") as f:
-                    json.dump({"files": {}, "package": pkg.checksum}, f)
+        if source.startswith("git+"):
 
-            case GitPackage():
-                crate_out_dir = out_dir / f"source-git-{pkg.source.ind}" / f"{pkg.name}-{pkg.version}"
-                crate_out_dir.parent.mkdir(exist_ok=True)
+            source_info = parse_git_source(source, lockfile_version)
 
-                if crate_out_dir.exists():
-                    raise Exception(
-                        f"{crate_out_dir} already exists!\n"
-                        "This likely due to multiple packages having the same name, version and git selector, but not the same locked git revision\n"
-                        "As a workaround, change all conflicting packages to have different git selectors\n"
-                        "e.g. specifying an exact rev=<hash> selector for each affected package in both Cargo.toml and Cargo.lock\n"
-                        "If it is not possible or difficult to do so (e.g. it's a transient dependency), as a hack, you could also consider keeping\n"
-                        "the package with the most up-to-date revision and removing all other duplicated entries from Cargo.lock"
-                    )
+            git_sha_rev = source_info["git_sha_rev"]
+            git_tree = vendor_staging_dir / "git" / git_sha_rev
 
-                git_sha_rev = pkg.source.git_sha_rev
-                git_tree = vendor_staging_dir / "git" / git_sha_rev
+            copy_and_patch_git_crate_subtree(git_tree, pkg["name"], crate_out_dir)
 
-                copy_and_patch_git_crate_subtree(git_tree, pkg.name, crate_out_dir)
+            # git based crates allow having no checksum information
+            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
+                json.dump({"files": {}}, f)
 
-                # git based crates allow having no checksum information
-                with (crate_out_dir / ".cargo-checksum.json").open("w") as f:
-                    json.dump({"files": {}}, f)
+        elif source.startswith("registry+") or source.startswith("sparse+"):
+            filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
+
+            # TODO: change this when non-crates-io registries are supported
+            dir_name = "tarballs"
+
+            tarball_path = vendor_staging_dir / dir_name / filename
+
+            extract_crate_tarball_contents(tarball_path, crate_out_dir)
+
+            # non-git based crates need the package checksum at minimum
+            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
+                json.dump({"files": {}, "package": pkg["checksum"]}, f)
+
+        else:
+            raise Exception(f"Can't process source: {source}.")
 
 
 def main() -> None:
     subcommand = sys.argv[1]
 
     subcommand_func_dict = {
-        "create-vendor-staging": lambda: create_vendor_staging(
-            lockfile_path=Path(sys.argv[2]),
-            out_dir=Path(sys.argv[3])
-        ),
-        "create-vendor": lambda: create_vendor(
-            vendor_staging_dir=Path(sys.argv[2]),
-            out_dir=Path(sys.argv[3])
-        )
+        "create-vendor-staging": lambda: create_vendor_staging(lockfile_path=Path(sys.argv[2]), out_dir=Path(sys.argv[3])),
+        "create-vendor": lambda: create_vendor(vendor_staging_dir=Path(sys.argv[2]), out_dir=Path(sys.argv[3]))
     }
 
     subcommand_func = subcommand_func_dict.get(subcommand)

pkgs/build-support/rust/hooks/cargo-setup-hook.sh

@@ -8,11 +8,6 @@ cargoSetupPostUnpackHook() {
     # it writable. If we're using a tarball, the unpackFile hook already handles
     # this for us automatically.
     if [ -z $cargoVendorDir ]; then
-        if [ -z "$cargoDeps" ]; then
-            echo "ERROR: Missing cargoDeps"
-            exit 1
-        fi
-
         if [ -d "$cargoDeps" ]; then
             local dest=$(stripHash "$cargoDeps")
             cp -Lr --reflink=auto -- "$cargoDeps" "$dest"
@@ -91,77 +86,6 @@ cargoSetupPostPatchHook() {
     echo "Finished cargoSetupPostPatchHook"
 }
 
-cargoUseSystemLibs() {
-  # Sentinel directory that doesn't exist. For packages
-  # Where you tell it directories, but can't force it to only
-  # use system libraries
-  #
-  # Note that this isn't perfect, as some have fallbacks if their probing fails.
-  local -r sentinel_dir="$(mktemp -du nixpkgs.XXXX)/use/system/library"
-
-  # https://docs.rs/system-deps/8.0.0/system_deps/#internally-build-system-libraries
-  export SYSTEM_DEPS_BUILD_INTERNAL="never"
-
-  # https://github.com/aws/aws-lc-rs/blob/741dbf573a64b6a1e1e6b7c1131a0f8153a28441/aws-lc-sys/README.md#automatic-detection
-  export AWS_LC_SYS_USE_SYSTEM="1"
-
-  # https://github.com/rust-openssl/rust-openssl/blob/b46d5ec06144795e8f9e118c44bebd392956917a/openssl-sys/build/main.rs#L53
-  export OPENSSL_NO_VENDOR="1"
-
-  # 1 = Links statically to the vendored one
-  # 0 = Use pkg-config
-  # https://github.com/rust-lang/libz-sys/blob/2ce3271849d85329b668e0bac9f21427ecf8aef9/build.rs#L256
-  export LIBZ_SYS_STATIC="0"
-
-  # https://github.com/rusqlite/rusqlite/blob/db83b9b08d9cab73f912501eefb8df7b100acd7d/libsqlite3-sys/build.rs#L53
-  export LIBSQLITE3_SYS_USE_PKG_CONFIG="1"
-
-  # https://github.com/gyscos/zstd-rs/blob/ad18ca4e275aed9acc3087d7c1c65d03ab67ad6e/zstd-safe/zstd-sys/build.rs#L279
-  export ZSTD_SYS_USE_PKG_CONFIG="1"
-
-  # https://github.com/rust-lang/git2-rs/blob/a00922bcdf0f78419aa5dd0d3643e73ce01672a8/libgit2-sys/build.rs#L95
-  export LIBGIT2_NO_VENDOR="1"
-
-  # https://github.com/sodiumoxide/sodiumoxide/blob/3057acb1a030ad86ed8892a223d64036ab5e8523/libsodium-sys/build.rs#L34
-  export SODIUM_USE_PKG_CONFIG="1"
-
-  # https://github.com/rust-onig/rust-onig/blob/73e63eb3eea6d93d24a4aadf7fea580287750c7d/onig_sys/build.rs#L250
-  export RUSTONIG_SYSTEM_LIBONIG="1"
-
-  # https://github.com/rust-lang/ssh2-rs/blob/0a11bdd4eecf4525e540c30f14b15ab1c07194b7/libssh2-sys/build.rs#L23
-  export LIBSSH2_SYS_USE_PKG_CONFIG="1"
-
-  # We can only supply the src dir.
-  # https://github.com/nginx/ngx-rust/tree/main/nginx-sys#input-variables
-  # Since we don't want to pull it in for every build, we set it to a dummy value
-  # in all builds, but lets the user set it via `env.NGINX_SOURCE_DIR = nginx.src`
-  export NGINX_SOURCE_DIR="${NGINX_SOURCE_DIR:-"$sentinel_dir/nginx/src"}"
-
-  # We can only supply the lib and include dirs
-  # https://github.com/duckdb/duckdb-rs/blob/ea700a79534c8e8c22a9ac685135f15c31de91d3/crates/libduckdb-sys/build.rs#L203
-  # Set to sentinel by default again
-  # There is also a DUCKDB_LIB_DIR var, but I think only one needs to be set.
-  export DUCKDB_DOWNLOAD_LIB="0"
-  export DUCKDB_INCLUDE_DIR="${DUCKDB_INCLUDE_DIR:-"$sentinel_dir/duckdb/include"}"
-
-  # https://github.com/tikv/jemallocator/blob/a181911517adff5331e43dfd9804086f7c392a25/jemalloc-sys/build.rs#L132
-  export JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE:-"$sentinel_dir/lib/libjemalloc"}"
-}
-
-# Cargo defaults to one job per host CPU. Limit builds that invoke Cargo
-# directly (e.g. through Meson or Make) to NIX_BUILD_CORES, like cargoBuildHook.
-# This runs in a phase because stdenv normalizes NIX_BUILD_CORES after
-# sourcing setup hooks.
-cargoSetupBuildJobs() {
-  export CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-$NIX_BUILD_CORES}"
-}
-
-postUnpackHooks+=(cargoSetupBuildJobs)
-
-if [[ -z "${dontCargoUseSystemLibs-}" ]]; then
-  preConfigureHooks+=(cargoUseSystemLibs)
-fi
-
 if [ -z "${dontCargoSetupPostUnpack-}" ]; then
   postUnpackHooks+=(cargoSetupPostUnpackHook)
 fi

pkgs/build-support/rust/import-cargo-lock.nix

@@ -187,18 +187,13 @@ let
       let
         crateTarball = fetchCrate pkg registries.${registryIndexUrl};
       in
-      runCommand "${pkg.name}-${pkg.version}"
-        {
-          strictDeps = true;
-          __structuredAttrs = true;
-        }
-        ''
-          mkdir $out
-          tar xf "${crateTarball}" -C $out --strip-components=1
+      runCommand "${pkg.name}-${pkg.version}" { } ''
+        mkdir $out
+        tar xf "${crateTarball}" -C $out --strip-components=1
 
-          # Cargo is happy with largely empty metadata.
-          printf '{"files":{},"package":"${crateTarball.outputHash}"}' > "$out/.cargo-checksum.json"
-        ''
+        # Cargo is happy with largely empty metadata.
+        printf '{"files":{},"package":"${crateTarball.outputHash}"}' > "$out/.cargo-checksum.json"
+      ''
     else if gitParts != null then
       let
         missingHash = throw ''
@@ -229,71 +224,66 @@ let
           else
             missingHash;
       in
-      runCommand "${pkg.name}-${pkg.version}"
-        {
-          strictDeps = true;
-          __structuredAttrs = true;
-        }
-        ''
-          tree=${tree}
+      runCommand "${pkg.name}-${pkg.version}" { } ''
+        tree=${tree}
 
-          # If the target package is in a workspace, or if it's the top-level
-          # crate, we should find the crate path using `cargo metadata`.
-          # Some packages do not have a Cargo.toml at the top-level,
-          # but only in nested directories.
-          # Only check the top-level Cargo.toml, if it actually exists
-          if [[ -f $tree/Cargo.toml ]]; then
-            crateCargoTOML=$(cd "$tree" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $tree/Cargo.toml | \
-            ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path')
-          fi
+        # If the target package is in a workspace, or if it's the top-level
+        # crate, we should find the crate path using `cargo metadata`.
+        # Some packages do not have a Cargo.toml at the top-level,
+        # but only in nested directories.
+        # Only check the top-level Cargo.toml, if it actually exists
+        if [[ -f $tree/Cargo.toml ]]; then
+          crateCargoTOML=$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $tree/Cargo.toml | \
+          ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path')
+        fi
 
-          # If the repository is not a workspace the package might be in a subdirectory.
-          if [[ -z $crateCargoTOML ]]; then
-            for manifest in $(find $tree -name "Cargo.toml"); do
-              echo Looking at $manifest
-              crateCargoTOML=$(cd "$(dirname "$manifest")" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path "$manifest" | ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path' || :)
-              if [[ ! -z $crateCargoTOML ]]; then
-                break
-              fi
-            done
-
-            if [[ -z $crateCargoTOML ]]; then
-              >&2 echo "Cannot find path for crate '${pkg.name}-${pkg.version}' in the tree in: $tree"
-              exit 1
+        # If the repository is not a workspace the package might be in a subdirectory.
+        if [[ -z $crateCargoTOML ]]; then
+          for manifest in $(find $tree -name "Cargo.toml"); do
+            echo Looking at $manifest
+            crateCargoTOML=$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path "$manifest" | ${jq}/bin/jq -r '.packages[] | select(.name == "${pkg.name}") | .manifest_path' || :)
+            if [[ ! -z $crateCargoTOML ]]; then
+              break
             fi
+          done
+
+          if [[ -z $crateCargoTOML ]]; then
+            >&2 echo "Cannot find path for crate '${pkg.name}-${pkg.version}' in the tree in: $tree"
+            exit 1
           fi
+        fi
 
-          echo Found crate ${pkg.name} at $crateCargoTOML
-          tree=$(dirname $crateCargoTOML)
+        echo Found crate ${pkg.name} at $crateCargoTOML
+        tree=$(dirname $crateCargoTOML)
 
-          cp -prvL "$tree" "$out" || echo "Warning: certain files couldn't be copied!" >&2
-          chmod u+w $out
+        cp -prvL "$tree" "$out" || echo "Warning: certain files couldn't be copied!" >&2
+        chmod u+w $out
 
-          if grep -q workspace "$out/Cargo.toml"; then
-            chmod u+w "$out/Cargo.toml"
-            ${replaceWorkspaceValues} "$out/Cargo.toml" "$(cd "$tree" && ${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $crateCargoTOML | ${jq}/bin/jq -r .workspace_root)/Cargo.toml"
-          fi
+        if grep -q workspace "$out/Cargo.toml"; then
+          chmod u+w "$out/Cargo.toml"
+          ${replaceWorkspaceValues} "$out/Cargo.toml" "$(${cargo}/bin/cargo metadata --format-version 1 --no-deps --manifest-path $crateCargoTOML | ${jq}/bin/jq -r .workspace_root)/Cargo.toml"
+        fi
 
-          # Cargo is happy with empty metadata.
-          printf '{"files":{},"package":null}' > "$out/.cargo-checksum.json"
+        # Cargo is happy with empty metadata.
+        printf '{"files":{},"package":null}' > "$out/.cargo-checksum.json"
 
-          ${optionalString (gitParts ? type) ''
-            gitPartsValue=${escapeShellArg gitParts.value}
-            # starting with lockfile version v4 the git source url contains encoded query parameters
-            # our regex parser does not know how to unescape them to get the actual value, so we do it here
-            ${optionalString (lockFileVersion >= 4) ''
-              gitPartsValue=$(${getExe python3Packages.python} -c "import sys, urllib.parse; print(urllib.parse.unquote(sys.argv[1]))" "$gitPartsValue")
-            ''}
+        ${optionalString (gitParts ? type) ''
+          gitPartsValue=${escapeShellArg gitParts.value}
+          # starting with lockfile version v4 the git source url contains encoded query parameters
+          # our regex parser does not know how to unescape them to get the actual value, so we do it here
+          ${optionalString (lockFileVersion >= 4) ''
+            gitPartsValue=$(${getExe python3Packages.python} -c "import sys, urllib.parse; print(urllib.parse.unquote(sys.argv[1]))" "$gitPartsValue")
           ''}
+        ''}
 
-          # Set up configuration for the vendor directory.
-          cat > $out/.cargo-config <<EOF
-          [source."${pkg.source}"]
-          git = "${gitParts.url}"
-          ${optionalString (gitParts ? type) "${gitParts.type} = \"$gitPartsValue\""}
-          replace-with = "vendored-sources"
-          EOF
-        ''
+        # Set up configuration for the vendor directory.
+        cat > $out/.cargo-config <<EOF
+        [source."${pkg.source}"]
+        git = "${gitParts.url}"
+        ${optionalString (gitParts ? type) "${gitParts.type} = \"$gitPartsValue\""}
+        replace-with = "vendored-sources"
+        EOF
+      ''
     else
       throw "Cannot handle crate source: ${pkg.source}";
 
@@ -301,7 +291,6 @@ let
     runCommand "cargo-vendor-dir"
       (
         {
-          strictDeps = true;
           __structuredAttrs = true;
         }
         // (

pkgs/build-support/rust/test/fetch-cargo-vendor/default.nix

@@ -1,4 +0,0 @@
-{ callPackage }:
-{
-  gitDependencyCargoConfig = callPackage ./git-dependency-cargo-config { };
-}

pkgs/build-support/rust/test/fetch-cargo-vendor/git-dependency-cargo-config/default.nix

@@ -1,6 +0,0 @@
-{ rustPlatform }:
-rustPlatform.fetchCargoVendor {
-  name = "git-dependency-cargo-config";
-  src = ../../import-cargo-lock/git-dependency-cargo-config;
-  hash = "sha256-rUQQ4Xrk+rW5Vgm7GK8xrK9zcwazsmBO6Q6qTCUniWc=";
-}

pkgs/build-support/rust/test/import-cargo-lock/default.nix

@@ -17,7 +17,6 @@
       { };
   gitDependencyTag = callPackage ./git-dependency-tag { };
   gitDependencyBranch = callPackage ./git-dependency-branch { };
-  gitDependencyCargoConfig = callPackage ./git-dependency-cargo-config { };
   maturin = maturin.tests.pyo3;
   v1 = callPackage ./v1 { };
   gitDependencyWorkspaceInheritance = callPackage ./git-dependency-workspace-inheritance {

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-cargo-config/Cargo.lock

@@ -1,13 +0,0 @@
-version = 3
-
-[[package]]
-name = "fixture"
-version = "0.1.0"
-dependencies = [
- "bootloader",
-]
-
-[[package]]
-name = "bootloader"
-version = "0.11.17"
-source = "git+https://github.com/rust-osdev/bootloader.git?rev=3d7f72e36d4101ecf78b70cef2475d700bb01721#3d7f72e36d4101ecf78b70cef2475d700bb01721"

pkgs/build-support/rust/test/import-cargo-lock/git-dependency-cargo-config/default.nix

@@ -1,8 +0,0 @@
-{ rustPlatform }:
-rustPlatform.importCargoLock {
-  lockFile = ./Cargo.lock;
-  outputHashes = {
-    # Bootloader's .cargo/config.toml enables bindeps, which are required to parse its manifest.
-    "bootloader-0.11.17" = "sha256-mLm5M1HLipN1EzS1zbDgMxMOqNySivGsK8+i0uOmoFM=";
-  };
-}

pkgs/build-support/setup-hooks/make-wrapper.sh

@@ -33,8 +33,6 @@ assertExecutable() {
 
 # --prefix          ENV SEP VAL   : suffix/prefix ENV with VAL, separated by SEP
 # --suffix
-# --prefix-unchecked ENV SEP VAL  : same as --prefix/--suffix, accepted for compatibility
-# --suffix-unchecked                with makeBinaryWrapper
 # --prefix-each     ENV SEP VALS  : like --prefix, but VALS is a list
 # --suffix-each     ENV SEP VALS  : like --suffix, but VALS is a list
 # --prefix-contents ENV SEP FILES : like --suffix-each, but contents of FILES
@@ -147,7 +145,7 @@ makeShellWrapper() {
             command="${params[$((n + 1))]}"
             n=$((n + 1))
             echo "$command" >> "$wrapper"
-        elif [[ ("$p" == "--suffix") || ("$p" == "--prefix") || ("$p" == "--suffix-unchecked") || ("$p" == "--prefix-unchecked") ]]; then
+        elif [[ ("$p" == "--suffix") || ("$p" == "--prefix") ]]; then
             varName="${params[$((n + 1))]}"
             separator="${params[$((n + 2))]}"
             value="${params[$((n + 3))]}"

pkgs/build-support/wrapper-common/utils.bash

@@ -150,67 +150,6 @@ expandResponseParams() {
     done
 }
 
-# Resolve the path $1 of a library directory, which like the linker
-# takes a relative path from the working directory, to the directory the
-# linker searches, as far as needed to tell whether it is in the store,
-# and where.  Like the kernel, follow each symlink before going on to the
-# next component, so that symlinks in ancestor directories count, and `..`
-# applies to the target of a symlink rather than removing it.  But in the
-# store, keep symlinks that are not followed by `..` as they are, since
-# resolving symlinks between store paths would refer to their targets
-# instead (see issue #454199).  The result is stored in resolvedPath.
-# Fails if there are too many symlinks.
-resolveLibDir() {
-    local rest="$1/" component link target links=0
-    # The common case: a path in the store with no `.`, `..` or empty
-    # components is already resolved, since it has no symlink to follow.
-    if [[ "$1" == "${NIX_STORE:-}"/* && "$1/" != */./* && "$1/" != */../* && "$1/" != *//* ]]; then
-        resolvedPath="$1"
-        return
-    fi
-    if [[ "$rest" != /* ]]; then
-        rest="$PWD/$rest"
-    fi
-    resolvedPath=
-    while [[ -n "$rest" ]]; do
-        component="${rest%%/*}"
-        rest="${rest#*/}"
-        case "$component" in
-            "" | .) continue ;;
-            ..)
-                if [[ -L "$resolvedPath" ]]; then
-                    # Follow it, then apply this `..` to its target.
-                    link="$resolvedPath"
-                    resolvedPath="${resolvedPath%/*}"
-                    rest="../$rest"
-                else
-                    resolvedPath="${resolvedPath%/*}"
-                    continue
-                fi
-                ;;
-            *)
-                link="$resolvedPath/$component"
-                # Keep a symlink in the store unless `..` follows it, and
-                # never resolve the store or its ancestors, which may be
-                # symlinks (NIX_IGNORE_SYMLINK_STORE).
-                if [[ "$link" == "${NIX_STORE:-}"/* || "${NIX_STORE:-}/" == "$link"/* || ! -L "$link" ]]; then
-                    resolvedPath="$link"
-                    continue
-                fi
-                ;;
-        esac
-        (( ++links <= 40 )) || return 1
-        target=$(readlink "$link") || return 1
-        # A relative target is relative to the directory containing the
-        # link, which is now resolvedPath.
-        if [[ "$target" == /* ]]; then
-            resolvedPath=
-        fi
-        rest="$target/$rest"
-    done
-    resolvedPath="${resolvedPath:-/}"
-}
-
 checkLinkType() {
     local arg
     type="dynamic"

pkgs/by-name/_7/_7kaa/package.nix

@@ -66,7 +66,7 @@ gccStdenv.mkDerivation (finalAttrs: {
     autoupdate
   '';
 
-  hardeningDisable = lib.optionals stdenv.hostPlatform.isDarwin [
+  hardeningDisable = lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin) [
     "stackprotector"
   ];
 

pkgs/by-name/_9/_9base/package.nix

@@ -92,6 +92,6 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     # needs additional work to support aarch64-darwin
     # due to usage of _DARWIN_NO_64_BIT_INODE
-    broken = stdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/by-name/ab/abseil-cpp_202608/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  fixDarwinDylibNames,
   gtest,
   static ? stdenv.hostPlatform.isStatic,
   cxxStandard ? null,
@@ -23,8 +22,6 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
-    # Test helper libraries linking against GoogleTest
-    "testing"
   ];
 
   cmakeFlags = [
@@ -38,22 +35,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ cmake ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+  nativeBuildInputs = [ cmake ];
 
   buildInputs = [ gtest ];
 
-  postInstall = ''
-    for lib in scoped_mock_log status_matchers; do
-      moveToOutput "lib/libabsl_$lib.*" "$testing"
-      substituteInPlace $out/lib/cmake/absl/abslTargets-*.cmake \
-        --replace-fail "$out/lib/libabsl_$lib." "$testing/lib/libabsl_$lib."
-      substituteInPlace "$out/lib/pkgconfig/absl_$lib.pc" \
-        --replace-fail "libdir=$out/lib" "libdir=$testing/lib"
-    done
-  '';
-
-  outputChecks.out.disallowedRequisites = [ gtest ];
-
   __structuredAttrs = true;
 
   meta = {

pkgs/by-name/ac/aclpubcheck/package.nix

@@ -17,6 +17,8 @@ python3Packages.buildPythonApplication {
     hash = "sha256-s9kegTZOZEgGx0Yj8jOfzAyjyy1EuabOybMDBoodRvo=";
   };
 
+  __structuredAttrs = true;
+
   build-system = with python3Packages; [
     setuptools
   ];

pkgs/by-name/ac/acpica-tools/package.nix

@@ -45,7 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
     # ACPICA emits packed structs that produce unaligned pointers. Apple's
     # arm64 linker rejects these under chained fixups; opt back into the
     # legacy fixup format so the link succeeds.
-    NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-no_fixup_chains";
+    NIX_LDFLAGS = lib.optionalString (
+      stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
+    ) "-no_fixup_chains";
 
     # i686 builds fail with hardening enabled (due to -Wformat-overflow). Disable
     # -Werror altogether to make this derivation less fragile to toolchain

pkgs/by-name/ad/adguardian/package.nix

@@ -2,8 +2,6 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  pkg-config,
-  aws-lc,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -20,14 +18,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-uch2JKnskO5W8EPK877qL0aQQ+iInHJoCrrhZbmoVRs=";
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    aws-lc
-  ];
-
   meta = {
     description = "Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance";
     mainProgram = "adguardian";

pkgs/by-name/ad/adpathfinder/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.2.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "NetSPI";
     repo = "AD-PathFinder";

pkgs/by-name/ad/adscan/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "13.2.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "ADScanPro";
     repo = "adscan";

pkgs/by-name/ad/advi/package.nix

@@ -16,9 +16,9 @@ let
     case "$1 $2" in
       "config var")
         case "$3" in
-          man) echo "''${man:-$out}/share/man";;
+          man) echo "$out/share/man";;
           etc) echo "$out/etc";;
-          doc) echo "''${doc:-$out}/share/doc";;
+          doc) echo "$out/share/doc";;
           share) echo "$out/share";;
           prefix) echo "$out";;
           *) echo "fake-opam does not understand arguments: $@" ; exit 1 ;;
@@ -46,7 +46,7 @@ ocamlPackages.buildDunePackage rec {
   postPatch = ''
     substituteInPlace ./Makefile \
       --replace "\$(DUNE) install \$(DUNEROOT) --display=short" \
-      "\$(DUNE) install \$(DUNEROOT) --prefix $out --docdir ''${!outputDoc}/share/doc --mandir ''${!outputMan}/share/man"
+      "\$(DUNE) install \$(DUNEROOT) --prefix $out --docdir $out/share/doc --mandir $out/share/man"
     substituteInPlace ./src/discover.sh \
       --replace 'gs_path=$(which gs)' 'gs_path=${ghostscriptX}/bin/gs'
   '';

pkgs/by-name/ad/adwaita-fonts/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adwaita-fonts";
-  version = "51.0";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-fonts/${lib.versions.major finalAttrs.version}/adwaita-fonts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+hBK4sG5ZYDTIvVj/+iy38pSlrDspJce/S2AEUBRI9I=";
+    hash = "sha256-TJJ/v+7BxQOAG6UQwslOAFTILFIs97oNO+XU1B/PXIY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adwaita-icon-theme/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "adwaita-icon-theme";
-  version = "51.0";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major finalAttrs.version}/adwaita-icon-theme-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ulYc88ljBaRxefpWBYVq1pXJI46gf3CTrr2bqAxOMjs=";
+    hash = "sha256-+sbgQB/KcUeAVhoIG49+J8O8HbNOvaTaF1CB8msk1GA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/af/afew/package.nix

@@ -25,6 +25,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     python3Packages.sphinxHook
   ];
 
+  sphinxRoot = "docs";
   sphinxBuilders = [
     "html"
     "man"
@@ -58,6 +59,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "man"
   ];
 
+  # Workaround for upstream packaging paths, can be removed once #573479 is resolved
+  postInstall = ''
+    sphinx-build -b man docs docs/build/man
+    install -Dm644 docs/build/man/*.1 -t $man/share/man/man1/
+  '';
+
   meta = {
     homepage = "https://github.com/afewmail/afew";
     description = "Initial tagging script for notmuch mail";

pkgs/by-name/ag/agentsploit/package.nix

@@ -11,6 +11,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.7.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "agentsploit";
     repo = "agentsploit";
@@ -50,7 +52,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   disabledTestPaths = [
     # Tests need network access
-    "tests/unit/test_openai_adapter.py"
     "tests/integration/"
   ];
 

pkgs/by-name/al/albyhub/ldk-node/default.nix

@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   llvmPackages,
-  sqlite,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -31,8 +30,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rustPlatform.bindgenHook
   ];
 
-  buildInputs = [ sqlite ];
-
   # Add CFLAGS to suppress the stringop-overflow error during aws-lc-sys compilation.
   NIX_CFLAGS_COMPILE = "-Wno-error=stringop-overflow";
 

pkgs/by-name/an/antares/package.nix

@@ -3,7 +3,7 @@
   lib,
   buildNpmPackage,
   electron,
-  nodejs_22,
+  nodejs_26,
   makeDesktopItem,
   copyDesktopItems,
   icoutils,
@@ -21,22 +21,22 @@ buildNpmPackage rec {
     hash = "sha256-A/ievIKXfFGu90aijxhmEWvfg2RqDtd7AtU+iyma3lU=";
   };
 
-  npmDepsHash = "sha256-X2dG75fpeXeU40wb22KAI7tDBybFwWUpKVj0Mlo3xhc=";
+  npmDepsHash = "sha256-fx/qwz3znXkLi81VLW2tB7TAZGO4M1dkzjzKcj3M4NA=";
 
   patches = [
     # Since version 0.7.28, package-lock is not updated properly so this patch update it to be able to build the package
     # This patch will probably be removed in the next version
     # If it does not build without it, you just need to do a npm update in the antares project and copy the patch
-    # https://github.com/antares-sql/antares/pull/1005
+    # https://github.com/antares-sql/antares/pull/1050
     (fetchpatch2 {
-      url = "https://github.com/antares-sql/antares/commit/6b2a45d93cf7fefdc92e0d87f390cd21a069b9a4.patch?full_index=1";
-      hash = "sha256-2dOGY0K6jMxSLNLDhwy/+ysTRB24XRXSoDu1AVxi4w4=";
+      url = "https://github.com/antares-sql/antares/commit/8fda56b28892dbaab2cbab0fee2db096bc4930c4.patch?full_index=1";
+      hash = "sha256-uDOEcakBuhbznb7eonJW2NC8QQX4HYR+6+Xa3TO6kFU=";
     })
   ];
 
-  nodejs = nodejs_22;
+  nodejs = nodejs_26;
 
-  buildInputs = [ nodejs_22 ];
+  buildInputs = [ nodejs_26 ];
 
   nativeBuildInputs = [
     copyDesktopItems
@@ -44,6 +44,7 @@ buildNpmPackage rec {
   ];
 
   npmBuildScript = "compile";
+  npmRebuildFlags = [ "--ignore-scripts" ];
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/ap/apache-airflow/python-package.nix

@@ -397,6 +397,8 @@ buildPythonPackage (
     pname = "apache-airflow";
     version = "3.3.2";
 
+    __structuredAttrs = true;
+
     src = fetchFromGitHub {
       owner = "apache";
       repo = "airflow";

pkgs/by-name/ap/apm-cli/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "0.35.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "apm";

pkgs/by-name/ap/apngopt/package.nix

@@ -32,9 +32,11 @@ stdenv.mkDerivation (finalAttrs: {
     zopfli
   ];
 
-  preBuild = ''
-    buildFlagsArray+=("LIBS=-lzopfli -lstdc++ -lpng -lz")
-  '';
+  strictDeps = true;
+
+  buildFlags = [
+    "LIBS=-lzopfli -lstdc++ -lpng -lz"
+  ];
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}c++" ];
 
@@ -44,6 +46,8 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://sourceforge.net/projects/apng/";
     description = "Optimizes APNG animations";

pkgs/by-name/ap/apt-swarm/package.nix

@@ -2,16 +2,12 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
-  pkg-config,
-  aws-lc,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "apt-swarm";
   version = "0.6.1";
 
-  __structuredAttrs = true;
-
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = "apt-swarm";
@@ -21,10 +17,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-Fo/+UbdfDhbAsoWjoko4tAmyDZK6tPn/0d2CjPKyaaQ=";
 
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [ aws-lc ];
-
   meta = {
     description = "Experimental p2p gossip network for OpenPGP signature transparency";
     homepage = "https://github.com/kpcyrd/apt-swarm";

pkgs/by-name/aq/aqtinstall/package.nix

@@ -9,6 +9,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "aqtinstall";
   version = "3.3.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "miurahr";

pkgs/by-name/ar/arrow-cpp/package.nix

@@ -172,6 +172,10 @@ stdenv.mkDerivation (finalAttrs: {
               "TestS3FS.*"
               "TestS3FSGeneric.*"
               "TestS3FSHTTPS.*" # Needs Minio
+            ]
+            ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+              # https://github.com/apache/arrow/issues/41505
+              "TestAzuriteGeneric.Empty"
             ];
         in
         "-${lib.concatStringsSep ":" filteredTests}";
@@ -348,6 +352,8 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
+    # https://hydra.nixos.org/job/nixpkgs/unstable/arrow-cpp.x86_64-darwin/all
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64;
     description = "Cross-language development platform for in-memory data";
     homepage = "https://arrow.apache.org/docs/cpp/";
     changelog = "https://arrow.apache.org/release/${finalAttrs.version}.html";

pkgs/by-name/ar/arti/package.nix

@@ -6,7 +6,6 @@
   pkg-config,
   sqlite,
   openssl,
-  zstd,
   versionCheckHook,
   nix-update-script,
   nixosTests,
@@ -37,13 +36,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildAndTestSubdir = "crates/arti";
   cargoHash = "sha256-g+t5X1t0koUzqoHpY8+lncqRobdDuZggXtD3HRk9ryE=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
-  buildInputs = [
-    sqlite
-    zstd
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
+  buildInputs = [ sqlite ] ++ lib.optionals stdenv.hostPlatform.isLinux [ openssl ];
 
   # `full` includes all stable and non-conflicting feature flags. the primary
   # downsides are increased binary size and memory usage for building, but

pkgs/by-name/as/asciidoc/package.nix

@@ -7,7 +7,7 @@
   autoreconfHook,
   installShellFiles,
   enableStandardFeatures ? false,
-  source-highlight,
+  sourceHighlight,
   highlight,
   graphviz,
   texliveMinimal,
@@ -246,7 +246,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
             -e "s|run('convert|run('${lib.getExe' imagemagick "convert"}|g" \
             -i "asciidoc/resources/filters/music/music2png.py"
 
-        sed -e 's|filter="source-highlight|filter="${source-highlight}/bin/source-highlight|' \
+        sed -e 's|filter="source-highlight|filter="${sourceHighlight}/bin/source-highlight|' \
             -e 's|filter="highlight|filter="${highlight}/bin/highlight|' \
             -e 's|filter="pygmentize|filter="${pygments}/bin/pygmentize|' \
             -i "asciidoc/resources/filters/source/source-highlight-filter.conf"
@@ -283,10 +283,10 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   )
   + ''
     # Fix tests
-    substituteInPlace $(grep -R --files-with-matches "2002-11-25" tests/data) \
-      --replace-fail "2002-11-25" "1980-01-02"
-    substituteInPlace $(grep -R --files-with-matches "00:37:42" tests/data) \
-      --replace-fail "00:37:42" "00:00:00"
+    for f in $(grep -R --files-with-matches "2002-11-25") ; do
+      substituteInPlace $f --replace "2002-11-25" "1980-01-02"
+      substituteInPlace $f --replace "00:37:42" "00:00:00"
+    done
   ''
   + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
     # We want to use asciidoc from the build platform to build the documentation.
@@ -317,6 +317,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     runHook postCheck
   '';
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Text-based document generation system";
     longDescription = ''

pkgs/by-name/as/asciimol/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.2.7";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchPypi {
     inherit (finalAttrs) pname version;
     hash = "sha256-SqwViOnVx1TcpY8Kd5VQCg1A8KQnBhL8aq9Gsrwer3k=";

pkgs/by-name/as/asl/package.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionalString (!buildDocs) ''
       substituteInPlace Makefile --replace "all: binaries docs" "all: binaries"
     ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
       substituteInPlace sysdefs.h --replace "x86_64" "aarch64"
     '';
 

pkgs/by-name/at/at-spi2-core/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.62.0";
+  version = "2.60.6";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-A6lPe/NfMA2vKEOjfN82R5qRvFP1mo6kN8eeJdldHeM=";
+    hash = "sha256-qJtkqLIXqAQr3w41y/q2Kc7uNWQNunXfV4r96ap4nVc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/autogen/package.nix

@@ -8,7 +8,7 @@
   which,
   pkg-config,
   perl,
-  guile,
+  guile_2_2,
   libxml2,
 }:
 
@@ -101,7 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildPackages.texinfo
   ];
   buildInputs = [
-    guile
+    guile_2_2
     libxml2
   ];
 

pkgs/by-name/au/autopush-rs/package.nix

@@ -24,6 +24,8 @@ let
       pname = "fernet_key";
       inherit version src;
 
+      __structuredAttrs = true;
+
       format = "other";
 
       # this would run the upstream docker makefile

pkgs/by-name/av/avalonia-ilspy/package.nix

@@ -51,7 +51,7 @@ buildDotnetModule rec {
     bintools
     fixDarwinDylibNames
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     autoSignDarwinBinariesHook
   ];
 

pkgs/by-name/aw/aw-watcher-steam/package.nix

@@ -9,6 +9,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "aw-watcher-steam";
   version = "0-unstable-2025-06-16";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Edwardsoen";

pkgs/by-name/aw/aws-lc/fix-dynamic-loading-test.patch

@@ -1,94 +0,0 @@
-diff --git i/crypto/CMakeLists.txt w/crypto/CMakeLists.txt
-index 7bac21b..da56759 100644
---- i/crypto/CMakeLists.txt
-+++ w/crypto/CMakeLists.txt
-@@ -895,20 +895,23 @@ if(BUILD_TESTING)
-   add_dependencies(${DYNAMIC_LOADING_TEST_EXEC} crypto)
-   set_test_location(${DYNAMIC_LOADING_TEST_EXEC})
- 
-   set(DYNAMIC_LINKER_LIB "")
-   if(CMAKE_SYSTEM_NAME STREQUAL "Linux" OR APPLE OR ANDROID)
-     set(DYNAMIC_LINKER_LIB "dl")
-   endif()
- 
-   if (BUILD_SHARED_LIBS AND NOT WIN32)
-     target_compile_options(${DYNAMIC_LOADING_TEST_EXEC} PUBLIC "-DLIBCRYPTO_PATH=\"$<TARGET_FILE:crypto>\"")
-+    if(BORINGSSL_PREFIX)
-+      target_compile_options(${DYNAMIC_LOADING_TEST_EXEC} PUBLIC "-DSYMBOL_PREFIX=\"${BORINGSSL_PREFIX}_\"")
-+    endif()
-     # Do not link to boringssl_gtest_main or any library that might be linked to libcrypto.so.
-     if(ANDROID)
-       target_link_libraries(${DYNAMIC_LOADING_TEST_EXEC} PUBLIC boringssl_gtest ${DYNAMIC_LINKER_LIB})
-     else()
-       target_link_libraries(${DYNAMIC_LOADING_TEST_EXEC} PUBLIC boringssl_gtest pthread ${DYNAMIC_LINKER_LIB})
-     endif()
-   endif()
- 
-   add_dependencies(all_tests ${DYNAMIC_LOADING_TEST_EXEC})
- 
-diff --git i/crypto/dynamic_loading_test.c w/crypto/dynamic_loading_test.c
-index 4c37c28..88002dc 100644
---- i/crypto/dynamic_loading_test.c
-+++ w/crypto/dynamic_loading_test.c
-@@ -20,53 +20,57 @@
- 
- #include <stdio.h>
- 
- #ifdef LIBCRYPTO_PATH
- 
- #include <stdint.h>
- #include <stdlib.h>
- #include <dlfcn.h>
- #include <pthread.h>
- 
-+#ifndef SYMBOL_PREFIX
-+#define SYMBOL_PREFIX ""
-+#endif
-+
- typedef void (*fp_lc_clear_error_t)(void);
- typedef int (*fp_lc_tl_func_t)(void);
- typedef int (*fp_rand_bytes_t)(uint8_t *buf, size_t len);
- 
- #define BUFFER_SIZE 16
- #define TEST_ITERS 10
- #define THREAD_COUNT 10
- 
- static void *cycle_thread_local_setup(void *lc_so) {
-   uint8_t buffer[BUFFER_SIZE];
--  fp_lc_clear_error_t lc_clear_error = dlsym(lc_so, "ERR_clear_error");
--  fp_rand_bytes_t lc_rand_bytes = dlsym(lc_so, "RAND_bytes");
--  fp_lc_tl_func_t lc_tl_clear = dlsym(lc_so, "AWSLC_thread_local_clear");
-+  fp_lc_clear_error_t lc_clear_error = dlsym(lc_so, SYMBOL_PREFIX "ERR_clear_error");
-+  fp_rand_bytes_t lc_rand_bytes = dlsym(lc_so, SYMBOL_PREFIX "RAND_bytes");
-+  fp_lc_tl_func_t lc_tl_clear = dlsym(lc_so, SYMBOL_PREFIX "AWSLC_thread_local_clear");
- 
-   for (int i = 0; i < TEST_ITERS; i++) {
-     (*lc_clear_error)();
-     if (1 != (*lc_rand_bytes)(buffer, BUFFER_SIZE)) {
-       fprintf(stderr, "Call to RAND_bytes failed.");
-       exit(1);
-     }
-     if (1 != (*lc_tl_clear)()) {
-       fprintf(stderr, "Call to AWSLC_thread_local_clear failed.");
-       exit(1);
-     }
-   }
- 
-   return NULL;
- }
- 
- static void *load_unload(void *ctx) {
-   const char* path = ctx;
-   void *lc_so = dlopen(path, RTLD_NOW);
--  fp_lc_tl_func_t lc_tl_shutdown = dlsym(lc_so, "AWSLC_thread_local_shutdown");
-+  fp_lc_tl_func_t lc_tl_shutdown = dlsym(lc_so, SYMBOL_PREFIX "AWSLC_thread_local_shutdown");
- 
-   pthread_t thread_id[THREAD_COUNT];
-   for (int i = 0; i < THREAD_COUNT; i++) {
-     if (pthread_create(&thread_id[i], NULL, cycle_thread_local_setup, lc_so)) {
-       fprintf(stderr, "Call to pthread_create in load_unload failed.");
-       exit(1);
-     }
-   }
- 
-   // Also cycle on the current thread

pkgs/by-name/aw/aws-lc/fix-openssl-shim-symlinks.patch

@@ -1,50 +0,0 @@
-Commit ID: eaef466931b704cbded48be8c51f7a8fa75ca6e0
-Change ID: yxsyyzwrzkrtqvksxqsurozmktvqsssw
-Author   : Marie Ramlow <marie@marie.cologne> (2026-11-01 13:28:50)
-Committer: Marie Ramlow <marie@marie.cologne> (2026-11-01 13:29:10)
-
-    Fix OpenSSL-compat shim symlinks
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index aa64e1aa22..005dc11c58 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1844,12 +1844,12 @@
-     endif()
-     install(CODE "
-       execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
--        lib${CRYPTO_LIB_NAME}.${SHIM_LIB_EXT} \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}/libcrypto.${SHIM_LIB_EXT}\")
-+        lib${CRYPTO_LIB_NAME}.${SHIM_LIB_EXT} \"\$ENV{DESTDIR}${CMAKE_INSTALL_FULL_LIBDIR}/libcrypto.${SHIM_LIB_EXT}\")
-     " ${SHIM_LINK_COMPONENT})
-     if(BUILD_LIBSSL)
-       install(CODE "
-         execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
--          lib${SSL_LIB_NAME}.${SHIM_LIB_EXT} \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}/libssl.${SHIM_LIB_EXT}\")
-+          lib${SSL_LIB_NAME}.${SHIM_LIB_EXT} \"\$ENV{DESTDIR}/${CMAKE_INSTALL_FULL_LIBDIR}/libssl.${SHIM_LIB_EXT}\")
-       " ${SHIM_LINK_COMPONENT})
-     endif()
-   endif()
-@@ -1858,7 +1858,7 @@
-     # Always create the include directory symlink for OpenSSL compatibility
-     install(CODE "
-       execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
--        aws-lc/openssl \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_INCLUDEDIR}/openssl\")
-+        aws-lc/openssl \"\$ENV{DESTDIR}/${CMAKE_INSTALL_FULL_INCLUDEDIR}/openssl\")
-     " COMPONENT Development)
-   endif()
- endif()
-diff --git a/tool-openssl/CMakeLists.txt b/tool-openssl/CMakeLists.txt
-index 262b42aa00..6f16cfa198 100644
---- a/tool-openssl/CMakeLists.txt
-+++ b/tool-openssl/CMakeLists.txt
-@@ -191,8 +191,8 @@
- if(INSTALL_OPENSSL_SHIM AND COHABITANT_BINARIES)
-   install(CODE "
-     execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
--      \"${AWSLC_BIN_PREFIX}openssl\" \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/openssl\")
-+      \"${AWSLC_BIN_PREFIX}openssl\" \"\$ENV{DESTDIR}/${CMAKE_INSTALL_FULL_BINDIR}/openssl\")
-     execute_process(COMMAND \${CMAKE_COMMAND} -E create_symlink
--      \"${AWSLC_BIN_PREFIX}c_rehash\" \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/c_rehash\")
-+      \"${AWSLC_BIN_PREFIX}c_rehash\" \"\$ENV{DESTDIR}/${CMAKE_INSTALL_FULL_BINDIR}/c_rehash\")
-   ")
- endif()

pkgs/by-name/aw/aws-lc/package.nix

@@ -2,58 +2,18 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  buildGoModule,
   cmake,
   ninja,
-  go,
-  perl,
   rust-bindgen,
   testers,
   nix-update-script,
-  aws-lc,
-  writableTmpDirAsHomeHook,
-  runCommand,
   useSharedLibraries ? !stdenv.hostPlatform.isStatic,
   withRustBindings ? true,
-  symbolPrefix ? "AWS_LC",
-  # This option might lead to OpenSSL being silently swapped to AWS-LC. Only use it if you know what you are doing.
-  withOpenSSLShim ? false,
 }:
-
-let
-  aws-lc' = aws-lc.override {
-    useSharedLibraries = false;
-    symbolPrefix = null;
-  };
-  symbols =
-    runCommand "aws-lc-symbols"
-      {
-        inherit (aws-lc) src;
-        nativeBuildInputs = [
-          writableTmpDirAsHomeHook
-          go
-        ];
-      }
-      ''
-        cd "$src"
-        go run ./util/read_symbols.go -out "$TMPDIR/symbols_crypto.txt" ${aws-lc'}/lib/libcrypto-awslc.a
-        go run ./util/read_symbols.go -out "$TMPDIR/symbols_ssl.txt" ${aws-lc'}/lib/libssl-awslc.a
-        cat "$TMPDIR"/symbols_{crypto,ssl}.txt > $out
-      '';
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
   version = "5.12.0";
 
-  patches = [
-    ./fix-dynamic-loading-test.patch
-    ./fix-openssl-shim-symlinks.patch
-  ];
-
-  __structuredAttrs = true;
-  strictDeps = true;
-
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
@@ -68,51 +28,26 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    writableTmpDirAsHomeHook
     cmake
     ninja
-    go
-    perl
   ]
   ++ lib.optionals withRustBindings [
     rust-bindgen
   ];
 
-  goDeps =
-    (buildGoModule {
-      inherit (finalAttrs) pname version src;
-      vendorHash = "sha256-495bUr3Cuo7kuhuNLMVhrVg9NXTAXyFmnXRmBrCHovA=";
-    }).goModules;
-
-  # it seems that ENABLE_DIST_PKG rejects apple because of symbol versioning,
-  # but we disable symbol versioning ourselves.
-  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail "if(NOT UNIX OR APPLE)" "if(NOT UNIX)"
-  '';
-
-  preConfigure = ''
-    ln -s ${finalAttrs.goDeps} vendor
-  '';
-
   cmakeFlags = [
     (lib.cmakeBool "BUILD_SHARED_LIBS" useSharedLibraries)
+    (lib.cmakeBool "DISABLE_GO" true)
+    (lib.cmakeBool "DISABLE_PERL" true)
     (lib.cmakeBool "GENERATE_RUST_BINDINGS" withRustBindings)
-    (lib.cmakeBool "ENABLE_DIST_PKG" true)
-    (lib.cmakeBool "ENABLE_DIST_PKG_OPENSSL_SHIM" withOpenSSLShim)
-    (lib.cmakeBool "ENABLE_SYMBOL_VERSIONING" false)
   ]
   ++ lib.optionals stdenv.cc.isGNU [
     # Needed with gcc but breaks with clang
     (lib.cmakeFeature "CMAKE_C_FLAGS" "-Wno-error=stringop-overflow")
-  ]
-  ++ lib.optionals (symbolPrefix != null) [
-    (lib.cmakeFeature "BORINGSSL_PREFIX" symbolPrefix)
-    (lib.cmakeFeature "BORINGSSL_PREFIX_SYMBOLS" (toString symbols))
   ];
 
   doCheck = true;
-  checkTarget = "run_tests";
+  checkTarget = "run_minimal_tests";
 
   postInstall = ''
     moveToOutput lib/crypto/cmake "$dev"
@@ -142,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       version = testers.testVersion {
         package = finalAttrs.finalPackage;
-        command = "aws-lc-bssl version";
+        command = "bssl version";
       };
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
     };
@@ -162,14 +97,15 @@ stdenv.mkDerivation (finalAttrs: {
         asl20
         isc
       ];
-    mainProgram = "aws-lc-bssl";
+    mainProgram = "bssl";
     maintainers = with lib.maintainers; [
       whispersofthedawn
     ];
     pkgConfigModules = [
       "aws-lc"
-      "libcrypto-awslc"
-      "libssl-awslc"
+      "libcrypto"
+      "libssl"
+      "openssl"
     ];
     platforms = lib.platforms.unix;
   };

pkgs/by-name/aw/awscurl/package.nix

@@ -8,6 +8,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "awscurl";
   version = "0.44";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "okigan";

pkgs/by-name/az/azurefox/package.nix

@@ -10,6 +10,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "1.5.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "TacoRocket";
     repo = "AzureFox";

pkgs/by-name/az/azurite/package.nix

@@ -32,10 +32,6 @@ buildNpmPackage (finalAttrs: {
     libsecret
   ];
 
-  # @vscode/vsce-sign's postinstall script fails on exotic architectures.
-  # We ignore the scripts, and this does not change the output.
-  npmFlags = [ "--ignore-scripts" ];
-
   meta = {
     description = "Lightweight server clone of Azure Storage that simulates most of the commands supported by it with minimal dependencies";
     homepage = "https://github.com/Azure/Azurite";

pkgs/by-name/ba/babeldoc/package.nix

@@ -12,6 +12,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pname = "babeldoc";
   version = "0.6.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "funstory-ai";

pkgs/by-name/ba/bandcampsync/package.nix

@@ -9,6 +9,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   version = "0.8.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "meeb";
     repo = "bandcampsync";

pkgs/by-name/ba/bat/package.nix

@@ -6,7 +6,6 @@
   less,
   installShellFiles,
   makeWrapper,
-  oniguruma,
   libgit2,
   zlib,
   versionCheckHook,
@@ -36,7 +35,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   buildInputs = [
-    oniguruma
     libgit2
     zlib
   ];

pkgs/by-name/ba/batmon/package.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     mainProgram = "batmon";
     platforms = with lib.platforms; unix ++ windows;
-    broken = stdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
     maintainers = with lib.maintainers; [ _6543 ];
   };
 })

pkgs/by-name/ba/bazaar/package.nix

@@ -1,15 +1,13 @@
 {
   lib,
   stdenv,
-  fetchFromGitLab,
+  fetchFromGitHub,
   blueprint-compiler,
   desktop-file-utils,
-  dbus,
   meson,
   python3,
   ninja,
   pkg-config,
-  vala,
   wrapGAppsHook4,
   appstream,
   flatpak,
@@ -31,13 +29,12 @@
   md4c,
   webkitgtk_6_0,
   libsecret,
-  systemdLibs,
   nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.9.9";
+  version = "0.9.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -49,12 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "World";
+  src = fetchFromGitHub {
+    owner = "bazaar-org";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qmMwlvB8DXNP0SHip1mQoktYFeH/DwfvVtVIny16Ryo=";
+    hash = "sha256-9J+XI5JnV8Yfk3xRI/VM5RSG4eMafbw2rBRpPMIu5yA=";
   };
 
   nativeBuildInputs = [
@@ -64,7 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-    vala
     wrapGAppsHook4
     (python3.withPackages (p: [
       p.babel
@@ -74,7 +69,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     appstream
-    dbus
     flatpak
     glib-networking
     gtk4
@@ -93,7 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
     md4c
     webkitgtk_6_0
     libsecret
-    systemdLibs
   ];
 
   postInstall = ''
@@ -119,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "FlatHub-first app store for GNOME";
-    homepage = "https://gitlab.gnome.org/World/bazaar";
+    homepage = "https://github.com/kolunmi/bazaar";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       dtomvan

pkgs/by-name/ba/bazarr/package.nix

@@ -31,6 +31,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     webrtcvad
   ];
 
+  __structuredAttrs = true;
   dontBuild = true;
   dontWrapPythonPrograms = true;
   pyproject = false;

pkgs/by-name/ba/bazel_7/package.nix

@@ -118,6 +118,11 @@ let
           url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-arm64";
           hash = "sha256-wfuZLSHa77wr0A4ZLF5DqH7qyOljYNXM2a5imoS+nGQ";
         }
+      else if stdenv.hostPlatform.system == "x86_64-darwin" then
+        fetchurl {
+          url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-darwin-x86_64";
+          hash = "sha256-qAb9s6R5+EbqVfWHUT7sk1sOrbDEPv4EhgXH7nC46Zw=";
+        }
       else
         fetchurl {
           # stdenv.hostPlatform.system == "aarch64-darwin"
@@ -279,12 +284,12 @@ let
 
   platforms = lib.platforms.linux ++ lib.platforms.darwin;
 
-  inherit (stdenv.hostPlatform) isDarwin;
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
 
   system = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  arch = if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
+  arch = with stdenv.hostPlatform; if isDarwin && isAarch64 then "arm64" else parsed.cpu.name;
 
   bazelRC = writeTextFile {
     name = "bazel-rc";

pkgs/by-name/ba/bazel_8/package.nix

@@ -36,13 +36,12 @@
 
 let
   inherit (callPackage ./build-support/patching.nix { }) addFilePatch;
-  inherit (stdenv.hostPlatform) isDarwin;
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
 
   bazelSystem = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  bazelArch =
-    if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
+  bazelArch = if isDarwin && isAarch64 then "arm64" else stdenv.hostPlatform.parsed.cpu.name;
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";

pkgs/by-name/ba/bazel_9/package.nix

@@ -34,7 +34,7 @@
 
 let
   inherit (callPackage ./build-support/patching.nix { }) addFilePatch;
-  inherit (stdenv.hostPlatform) isDarwin;
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
 
   defaultShellUtils =
     # Keep this list conservative. For more exotic tools, prefer to use
@@ -85,8 +85,7 @@ let
   bazelSystem = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
-  bazelArch =
-    if isDarwin then stdenv.hostPlatform.darwinArch else stdenv.hostPlatform.parsed.cpu.name;
+  bazelArch = if isDarwin && isAarch64 then "arm64" else stdenv.hostPlatform.parsed.cpu.name;
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";

pkgs/by-name/bc/bcachefs-tools/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   pkg-config,
   libuuid,
   libsodium,
@@ -42,14 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-H8uzTohV30NU1wYhr/WXN76g1zDqGEzRE5QZcmcM7Jc=";
   };
 
-  # Fix build with linux-headers 7.3
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/koverstreet/bcachefs-tools/commit/adef3bf68249ac674ddc2cbdfe8c7d0d153e15a8.diff";
-      hash = "sha256-nQsL+1fTQ4ltVyTIwIpO9z9nS66Dtr6WTepBZQ0phL8=";
-    })
-  ];
-
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     hash = "sha256-4ZStyYaT+6Suup1ue2wFFCTAlnsnEO9WaUJHe47BKXY=";

pkgs/by-name/bi/bic/package.nix

@@ -59,6 +59,6 @@ stdenv.mkDerivation {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ hexagonal-sun ];
     # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
   };
 }