python3Packages.pytest-cases: 3.9.1 -> 3.10.1

https://github.com/smarie/python-pytest-cases/releases/tag/3.10.1

.github/workflows/check.yml

@@ -92,8 +92,8 @@ jobs:
     if: inputs.baseBranch && inputs.headBranch
     permissions:
       pull-requests: write
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 8
+    runs-on: ubuntu-slim
+    timeout-minutes: 3
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

.github/workflows/lint.yml

@@ -131,8 +131,8 @@ jobs:
     # Luckily there's no need to lint commit messages in the Merge Queue, because
     # changes to the target branch can't change commit messages on the base branch.
     if: ${{ github.event.pull_request.number }}
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 8
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -0,0 +1,24 @@
+# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
+
+This hook defaults a variety of environment variables known
+to control thread counts to 1. Many of these otherwise default
+to `$(nproc)`, which causes massive overloads on build machines
+if nix build jobs and build cores are already tuned to fully utilize
+compute capacity of a builder without additional parallelism.
+
+Currently sets the following environment variables:
+- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
+- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
+- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
+- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
+- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
+- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
+- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
+
+The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
+can be used to override the default thread count limit.
+`dontLimitCheckPhaseThreads = true;` can be used to disable
+thread limiting on an individual package.
+
+This hook will not attempt to override already existing
+definitions for thread count environment variables.

doc/hooks/index.md

@@ -13,6 +13,7 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
+check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -34,7 +35,6 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
-openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md

doc/hooks/openmp-check-hook.section.md

@@ -1,10 +0,0 @@
-# openmpCheckPhaseHook {#setup-hook-omp-check}
-
-
-This hook can be used to setup a check phase that
-requires running a OpenMP application. It mostly
-serves to limit `OMP_NUM_THREADS` to avoid overloading
-build machines.
-
-This hook will not attempt to override an already existing
-definition of `OMP_NUM_THREADS` in the environment.

doc/languages-frameworks/javascript.section.md

@@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they
 
 ### pnpm {#javascript-pnpm}
 
-pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
+pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 

doc/redirects.json

@@ -2920,7 +2920,8 @@
   "setup-hook-mpi-check": [
     "index.html#setup-hook-mpi-check"
   ],
-  "setup-hook-omp-check": [
+  "setup-hook-check-phase-thread-limit": [
+    "index.html#setup-hook-check-phase-thread-limit",
     "index.html#setup-hook-omp-check"
   ],
   "ninja": [

doc/release-notes/rl-2611.section.md

@@ -31,6 +31,9 @@
   By the time of this release, Homebrew will offer only limited [Tier 3](https://docs.brew.sh/Support-Tiers#tier-3) support for the platform, but MacPorts will likely continue to support it for a long time.
   We also recommend users consider installing NixOS, which should continue to run on essentially all Intel Macs, especially after Apple stops security support for macOS 26 in 2028.
 
+- `bundlerApp` now sets `__structuredAttrs = true` for its result package.
+  Out-of-tree packages passing `postBuild` to `bundlerApp` should examine if their `postBuild` commands are compatible with structured attributes.
+
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.

doc/style.css

@@ -114,7 +114,7 @@ html {
 body {
   font-size: 1rem;
   font-family: "Roboto", sans-serif;
-  font-weight: 400;
+  font-weight: 300;
   color: var(--main-text-color);
   background-color: var(--background);
   min-height: 100vh;
@@ -184,52 +184,59 @@ hr {
   margin-bottom: 1rem;
 }
 
-h1,
-h2,
-h3,
-h4,
-h5,
-h6 {
-  font-weight: 800;
-  line-height: 1.1;
-  margin: 1.5rem 0 0.5rem;
-}
-
-/*
-  Major-second scale see: https://typescale.com/
-  rounded to .025rem (0.4px)
-*/
 h1 {
-  font-size: 2rem;
+  font-weight: 800;
+  line-height: 110%;
+  font-size: 200%;
+  margin-bottom: 1rem;
   color: var(--heading-color);
 }
 
 h2 {
-  font-size: 1.8rem;
+  font-weight: 800;
+  line-height: 110%;
+  font-size: 170%;
+  margin-bottom: 0.625rem;
   color: var(--heading-color);
 }
 
+h2:not(:first-child) {
+  margin-top: 1rem;
+}
+
 h3 {
-  font-size: 1.6rem;
+  font-weight: 800;
+  line-height: 110%;
+  margin-bottom: 1rem;
+  font-size: 150%;
   color: var(--heading-color);
 }
 
+:is(.note, .tip, .warning, .caution, .important) h3 {
+  font-size: 120%;
+}
+
 h4 {
-  font-size: 1.425rem;
+  font-weight: 800;
+  line-height: 110%;
+  margin-bottom: 1rem;
+  font-size: 140%;
   color: var(--heading-color);
 }
 
 h5 {
-  font-size: 1.275rem;
+  font-weight: 800;
+  line-height: 110%;
+  margin-bottom: 1rem;
+  font-size: 130%;
   color: var(--small-heading-color);
 }
 
 h6 {
-  font-size: 1.125rem;
-}
-
-:is(.note, .tip, .warning, .caution, .important) h3 {
-  font-size: 1.425rem;
+  font-weight: 800;
+  line-height: 110%;
+  margin-bottom: 1rem;
+  font-size: 120%;
 }
 
 strong {
@@ -257,9 +264,13 @@ code {
 }
 
 code {
-  padding: 0.2em 0.4em;
-  background: var(--inline-code-background);
-  border-radius: 0.375rem;
+  color: #ff8657;
+  background: #f4f4f4;
+  display: inline-block;
+  padding: 0 0.5rem;
+  border: 1px solid #d8d8d8;
+  border-radius: 0.5rem;
+  line-height: 1.57777778;
 }
 
 div.book .programlisting,
@@ -319,6 +330,11 @@ div.appendix .programlisting {
   background: var(--caution-background);
 }
 
+div.book .section,
+div.appendix .section {
+  margin-top: 2em;
+}
+
 div.book div.example,
 div.appendix div.example {
   margin-top: 1.5em;
@@ -362,6 +378,11 @@ div.appendix dt {
 
 div.book code,
 div.appendix code {
+  padding: 0;
+  border: 0;
+  background-color: inherit;
+  color: inherit;
+  font-size: 100%;
   -webkit-hyphens: none;
   -moz-hyphens: none;
   hyphens: none;
@@ -420,7 +441,6 @@ div.appendix .variablelist .term {
   --caution-background: #ffebe8;
   --codeblock-background: #f2f8fd;
   --codeblock-text-color: #000;
-  --inline-code-background: #818b981f;
 }
 
 @media (prefers-color-scheme: dark) {
@@ -446,7 +466,6 @@ div.appendix .variablelist .term {
     --caution-background: #422522;
     --codeblock-background: #393939;
     --codeblock-text-color: #fff;
-    --inline-code-background: #656c7633;
   }
 
   :is(.note, .tip, .warning, .caution, .important) {
@@ -457,12 +476,7 @@ div.appendix .variablelist .term {
 
 @font-face {
   font-family: Roboto;
-  src:
-    url(Roboto.ttf) format("truetype") tech(variations),
-    url(Roboto.ttf) format("truetype-variations");
-  font-weight: 100 900;
-  font-style: normal;
-  font-display: swap;
+  src: url(Roboto.ttf);
 }
 
 .chapter {

lib/licenses/licenses.nix

@@ -1052,11 +1052,6 @@ lib.mapAttrs mkLicense (
       fullName = "MIT License";
     };
 
-    mit-click = {
-      spdxId = "MIT-Click";
-      fullName = "MIT Click License";
-    };
-
     mit-cmu = {
       spdxId = "MIT-CMU";
       fullName = "CMU License";

lib/services/service.nix

@@ -6,7 +6,6 @@
 # The module
 {
   lib,
-  config,
   ...
 }:
 let
@@ -50,53 +49,6 @@ in
           a shell script or `importas` from `pkgs.execline`.
         '';
       };
-
-      reloadSignal = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "HUP";
-        description = ''
-          Configures the reload signal to send to the service manager.
-        '';
-      };
-
-      reloadCommand = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = lib.literalExpression ''"''${pkgs.coreutils}/bin/kill -HUP $MAINPID"'';
-
-        description = ''
-          Command used for reloading in the underlying service manager to reload.
-        '';
-      };
     };
-
-    notificationProtocol = mkOption {
-      type = types.listOf (
-        types.enum [
-          "systemd"
-          "s6"
-        ]
-      );
-
-      default = [ ];
-      apply = v: lib.unique v;
-      description = ''
-        Notification protocol that this service supports with the underlying service manager.
-      '';
-    };
-  };
-
-  config = {
-    assertions = [
-      {
-        assertion = config.process.reloadSignal != null && config.process.reloadCommand != null;
-        message = "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand.";
-      }
-    ];
-
-    process.reloadCommand = (lib.mkIf config.process.reloadSignal != null) (
-      lib.mkForce "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
-    );
   };
 }

maintainers/maintainer-list.nix

@@ -209,12 +209,6 @@
     github = "2hexed";
     githubId = 54501296;
   };
-  _2zqa = {
-    name = "Marijn Kok";
-    email = "hkju4b4ds@mozmail.com";
-    github = "2zqa";
-    githubId = 25235249;
-  };
   _30350n = {
     name = "Max Schlecht";
     github = "30350n";
@@ -263,10 +257,11 @@
     name = "Eske Nielsen";
   };
   _4evy = {
-    name = "4evy";
-    email = "git@evy.pink";
-    github = "4evy";
+    name = "_4evy";
+    email = "git@ps1.sh";
+    github = "_4evy";
     githubId = 57304299;
+    matrix = "@donteatoreo:matrix.org";
   };
   _4r7if3x = {
     email = "the.artifex@proton.me";
@@ -7036,6 +7031,12 @@
     github = "DimitarNestorov";
     githubId = 8790386;
   };
+  diniamo = {
+    name = "diniamo";
+    email = "diniamo53@gmail.com";
+    github = "diniamo";
+    githubId = 55629891;
+  };
   diogomdp = {
     email = "me@diogodp.dev";
     github = "diogomdp";
@@ -7741,7 +7742,6 @@
     name = "EarthGman";
     github = "EarthGman";
     githubId = 117403037;
-    keys = [ { fingerprint = "A06C 1E72 4626 7B4C EE16  CC2E 4862 31CD BCE3 AA32"; } ];
   };
   EBADBEEF = {
     name = "EBADBEEF";
@@ -15381,7 +15381,7 @@
   };
   lactose = {
     name = "lactose";
-    email = "mail@lactose.dev";
+    email = "lactose@allthingslinux.com";
     github = "juuyokka";
     githubId = 15185244;
   };
@@ -17820,12 +17820,6 @@
       { fingerprint = "838A FE0D 55DC 074E 360F  943A 84B6 9CE6 F3F6 B767"; }
     ];
   };
-  mcuste = {
-    email = "github@muratcanuste.com";
-    github = "mcuste";
-    githubId = 10829864;
-    name = "Murat Can Üste";
-  };
   mcwitt = {
     email = "mcwitt@gmail.com";
     github = "mcwitt";
@@ -18808,12 +18802,6 @@
     githubId = 830082;
     name = "Nathan Moos";
   };
-  mootfrost = {
-    email = "hello@mootfrost.dev";
-    github = "mootfrost";
-    githubId = 75925945;
-    name = "Andrew Semeykin";
-  };
   moraxyc = {
     name = "Moraxyc Xu";
     email = "i@qaq.li";
@@ -25608,6 +25596,12 @@
     githubId = 106669955;
     name = "Léon Gessner";
   };
+  shardy = {
+    email = "shardul@baral.ca";
+    github = "shardulbee";
+    githubId = 16765155;
+    name = "Shardul Baral";
+  };
   sharpchen = {
     github = "sharpchen";
     githubId = 77432836;
@@ -27272,11 +27266,6 @@
     githubId = 203195;
     name = "Szczyp";
   };
-  szhekpisov = {
-    github = "szhekpisov";
-    githubId = 87662520;
-    name = "Sergei Zhekpisov";
-  };
   szkiba = {
     email = "iszkiba@gmail.com";
     github = "szkiba";

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -81,8 +81,6 @@
 
 - When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
 
-- String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
-
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.
@@ -101,9 +99,6 @@
 
 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).
 
-- `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade
-  notes](https://docs.temporal.io/self-hosted-guide/upgrade-server) before upgrading between versions.
-
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.
 
 - [services.netbox](#opt-services.netbox.enable) has received a number of updates:
@@ -139,10 +134,3 @@
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.
 
 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.
-
-- The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:
-  - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
-  - If `system.stateVersion` is >=26.11, `pkgs.nextcloud34` will be installed by default.
-  - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
-  - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
-  - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.

nixos/modules/misc/locate.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  utils,
   pkgs,
   ...
 }:
@@ -60,7 +59,7 @@ in
     };
 
     output = lib.mkOption {
-      type = lib.types.externalPath;
+      type = lib.types.path;
       default = "/var/cache/locatedb";
       description = ''
         The database file to build.
@@ -250,35 +249,27 @@ in
     systemd.services.update-locatedb = {
       description = "Update Locate Database";
 
-      serviceConfig = {
-        # mlocate's updatedb takes flags via a configuration file or
-        # on the command line, but not by environment variable.
-        ExecStart =
-          let
-            toFlags =
-              x:
-              lib.optionals (cfg.${x} != [ ]) [
-                "--${lib.toLower x}"
-                (lib.concatStringsSep " " cfg.${x})
-              ];
-            args = lib.concatMap toFlags [
+      # mlocate's updatedb takes flags via a configuration file or
+      # on the command line, but not by environment variable.
+      script =
+        let
+          toFlags =
+            x: lib.optional (cfg.${x} != [ ]) "--${lib.toLower x} '${lib.concatStringsSep " " cfg.${x}}'";
+          args = lib.concatLists (
+            map toFlags [
               "pruneFS"
               "pruneNames"
               "prunePaths"
-            ];
-          in
-          utils.escapeSystemdExecArgs (
-            [
-              (lib.getExe' cfg.package "updatedb")
-              "--output"
-              cfg.output
-              "--prune-bind-mounts"
-              (lib.boolToYesNo cfg.pruneBindMounts)
             ]
-            ++ args
-            ++ cfg.extraFlags
           );
-
+        in
+        ''
+          exec ${cfg.package}/bin/updatedb \
+            --output ${toString cfg.output} ${lib.concatStringsSep " " args} \
+            --prune-bind-mounts ${lib.boolToYesNo cfg.pruneBindMounts} \
+            ${lib.concatStringsSep " " cfg.extraFlags}
+        '';
+      serviceConfig = {
         CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";
         Nice = 19;
         IOSchedulingClass = "idle";

nixos/modules/module-list.nix

@@ -821,7 +821,6 @@
   ./services/matrix/mautrix-whatsapp.nix
   ./services/matrix/mjolnir.nix
   ./services/matrix/pantalaimon.nix
-  ./services/matrix/rust-federation-tester.nix
   ./services/matrix/synapse-auto-compressor.nix
   ./services/matrix/synapse.nix
   ./services/matrix/tuwunel.nix

nixos/modules/services/desktops/oo7.nix

@@ -10,32 +10,32 @@ in
 {
   options.services.oo7 = {
     enable = lib.mkEnableOption ''
-      oo7, a service providing the Secret Service D-Bus API
+      oo7, a service providing the Secret Service D-Bus API.
     '';
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.oo7 ];
     services.dbus.packages = [ pkgs.oo7-server ];
 
-    systemd = {
-      packages = [ pkgs.oo7-server ];
-      user.services.oo7-daemon.wantedBy = [ "default.target" ];
-    };
+    systemd.packages = [ pkgs.oo7-server ];
 
-    security = {
-      pam.services.login.oo7.enable = true;
-
-      wrappers.oo7-daemon = {
-        owner = "root";
-        group = "root";
-        capabilities = "cap_ipc_lock=ep";
-        source = "${pkgs.oo7-server}/libexec/oo7-daemon";
-      };
-    };
+    systemd.user.services.oo7-daemon.wantedBy = [ "default.target" ];
 
     xdg.portal.extraPortals = [ pkgs.oo7-portal ];
+
+    security.pam.services.login.oo7.enable = true;
+
+    security.wrappers.oo7-daemon = {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_ipc_lock=ep";
+      source = "${pkgs.oo7-server}/libexec/oo7-daemon";
+    };
   };
 
-  meta = { inherit (pkgs.oo7.meta) maintainers; };
+  meta = {
+    inherit (pkgs.oo7.meta)
+      maintainers
+      ;
+  };
 }

nixos/modules/services/mail/postsrsd.nix

@@ -281,7 +281,7 @@ in
       environment.etc."postsrsd.conf".source = configFile;
 
       systemd.services.postsrsd = {
-        description = "Sender Rewriting Scheme daemon for Postfix";
+        description = "PostSRSd SRS rewriting server";
         after = [
           "network.target"
           "postsrsd-generate-secrets.service"
@@ -289,20 +289,14 @@ in
         before = [ "postfix.service" ];
         wantedBy = [ "multi-user.target" ];
         requires = [ "postsrsd-generate-secrets.service" ];
-        reloadTriggers = [ configFile ];
+        restartTriggers = [ configFile ];
 
         serviceConfig = {
-          Type = "notify-reload";
           ExecStart = utils.escapeSystemdExecArgs [
             (lib.getExe cfg.package)
             "-C"
             "/etc/postsrsd.conf"
           ];
-          ExecReload = toString [
-            (lib.getExe' pkgs.coreutils "kill")
-            "-SIGHUP"
-            "$MAINPID"
-          ];
           User = cfg.user;
           Group = cfg.group;
           RuntimeDirectory = "postsrsd";
@@ -325,7 +319,7 @@ in
           ProtectKernelModules = true;
           ProtectKernelTunables = true;
           ProtectSystem = "strict";
-          ProtectProc = "noaccess";
+          ProtectProc = "invisible";
           ProcSubset = "pid";
           RemoveIPC = true;
           RestrictAddressFamilies =

nixos/modules/services/matrix/rust-federation-tester.nix

@@ -1,153 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  utils,
-  ...
-}:
-
-let
-  cfg = config.services.rust-federation-tester;
-
-  configFile = "/run/rust-federation-tester/config.yaml";
-  commonServiceConfig = {
-    DynamicUser = true;
-    RuntimeDirectory = "rust-federation-tester";
-    RuntimeDirectoryPreserve = true;
-    StateDirectory = "rust-federation-tester";
-    User = "rust-federation-tester";
-    WorkingDirectory = "%t/rust-federation-tester";
-
-    # Hardening
-    UMask = "0077";
-    CapabilityBoundingSet = [ "" ];
-    DevicePolicy = "closed";
-    PrivateTmp = true;
-    ProtectHome = true;
-    ProtectSystem = "strict";
-    MemoryDenyWriteExecute = true;
-    NoNewPrivileges = true;
-    LockPersonality = true;
-    PrivateDevices = true;
-    PrivateMounts = true;
-    ProcSubset = "pid";
-    ProtectClock = true;
-    ProtectControlGroups = true;
-    ProtectHostname = true;
-    ProtectKernelLogs = true;
-    ProtectKernelModules = true;
-    ProtectKernelTunables = true;
-    ProtectProc = "invisible";
-    RemoveIPC = true;
-    RestrictAddressFamilies = [
-      "AF_INET"
-      "AF_INET6"
-      "AF_UNIX"
-    ];
-    RestrictNamespaces = true;
-    RestrictRealtime = true;
-    RestrictSUIDSGID = true;
-    SystemCallArchitectures = "native";
-    SystemCallFilter = [
-      "@system-service"
-    ];
-  };
-
-  secretsInjection = utils.genJqSecretsReplacement {
-    loadCredential = true;
-  } cfg.settings configFile;
-in
-{
-  options.services.rust-federation-tester = {
-    enable = lib.mkEnableOption "rust-federation-tester";
-
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = lib.types.json;
-        options = {
-          frontend_url = lib.mkOption {
-            type = lib.types.str;
-            example = "federation-tester.example.org";
-            description = ''
-              URL of the service's frontend.
-            '';
-          };
-
-          database_url = lib.mkOption {
-            type = lib.types.str;
-            default = "sqlite:///var/lib/rust-federation-tester/db?mode=rwc";
-            example = "postgres://localhost/db?currentSchema=schema";
-            description = ''
-              The database to store accounts and statistics.
-            '';
-          };
-
-          smtp = {
-            enabled = lib.mkEnableOption "mail delivery for configured alerts";
-          };
-
-          listen_addr = lib.mkOption {
-            type = lib.types.str;
-            default = "[::]:8080";
-            example = "unix:/run/rust-federation-tester/rust-federation-tester.sock";
-            description = ''
-              Address the API server should listen on.
-            '';
-          };
-        };
-      };
-
-      description = ''
-        Settings representing the values in {file}`config.yaml` of the service.
-
-        Refer to [`config.yaml.example`] for supported values.
-
-        [`config.yaml.example`]: https://github.com/MTRNord/rust-federation-tester/blob/main/config.yaml.example
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.sockets.rust-federation-tester = {
-      description = "Matrix-Federation-Tester in Rust socket";
-      wantedBy = [ "sockets.target" ];
-      listenStreams = [ (lib.removePrefix "unix:" cfg.settings.listen_addr) ];
-    };
-
-    systemd.services.rust-federation-tester-setup = {
-      description = "Matrix-Federation-Tester in Rust";
-      path = [ pkgs.rust-federation-tester ];
-
-      serviceConfig = lib.mkMerge [
-        commonServiceConfig
-        {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          LoadCredential = secretsInjection.credentials;
-          ExecStart = "${pkgs.writeShellScript "rust-federation-tester-setup" ''
-            ${secretsInjection.script}
-
-            migration up
-          ''}";
-        }
-      ];
-    };
-
-    systemd.services.rust-federation-tester = {
-      description = "Matrix-Federation-Tester in Rust";
-      wantedBy = [ "multi-user.target" ];
-      documentation = [ "https://github.com/MTRNord/rust-federation-tester" ];
-      after = [ "rust-federation-tester-setup.service" ];
-      requires = [ "rust-federation-tester-setup.service" ];
-
-      serviceConfig = lib.mkMerge [
-        commonServiceConfig
-        {
-          ExecSearchPath = lib.makeBinPath [ pkgs.rust-federation-tester ];
-          ExecStart = "rust-federation-tester";
-          Restart = "on-failure";
-        }
-      ];
-    };
-  };
-}

nixos/modules/services/misc/redmine.nix

@@ -245,19 +245,19 @@ in
       };
 
       components = {
-        subversion = lib.mkEnableOption "Subversion integration";
+        subversion = lib.mkEnableOption "Subversion integration.";
 
-        mercurial = lib.mkEnableOption "Mercurial integration";
+        mercurial = lib.mkEnableOption "Mercurial integration.";
 
-        git = lib.mkEnableOption "git integration";
+        git = lib.mkEnableOption "git integration.";
 
-        cvs = lib.mkEnableOption "cvs integration";
+        cvs = lib.mkEnableOption "cvs integration.";
 
-        breezy = lib.mkEnableOption "bazaar integration";
+        breezy = lib.mkEnableOption "bazaar integration.";
 
-        imagemagick = lib.mkEnableOption "exporting Gant diagrams as PNG";
+        imagemagick = lib.mkEnableOption "exporting Gant diagrams as PNG.";
 
-        ghostscript = lib.mkEnableOption "exporting Gant diagrams as PDF";
+        ghostscript = lib.mkEnableOption "exporting Gant diagrams as PDF.";
 
         minimagick_font_path = lib.mkOption {
           type = lib.types.str;
@@ -265,8 +265,6 @@ in
           description = "MiniMagick font path";
           example = "/run/current-system/sw/share/X11/fonts/LiberationSans-Regular.ttf";
         };
-
-        pandoc = lib.mkEnableOption "pandoc integration for previewing LibreOffice and Microsoft Office documents";
       };
     };
   };
@@ -312,7 +310,6 @@ in
         imagemagick_convert_command = lib.optionalString cfg.components.imagemagick "${pkgs.imagemagick}/bin/convert";
         gs_command = lib.optionalString cfg.components.ghostscript "${pkgs.ghostscript}/bin/gs";
         minimagick_font_path = "${cfg.components.minimagick_font_path}";
-        pandoc_command = lib.optionalString cfg.components.pandoc "${pkgs.pandoc}/bin/pandoc";
       };
     };
 

nixos/modules/services/misc/shoko.nix

@@ -90,5 +90,8 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ nanoyaki ];
+  meta.maintainers = with lib.maintainers; [
+    diniamo
+    nanoyaki
+  ];
 }

nixos/modules/services/network-filesystems/nfsd.nix

@@ -6,14 +6,6 @@
 }:
 let
 
-  attrsToExports = lib.concatMapAttrsStringSep "\n" (
-    exportPoint: clientsAndOptions:
-    exportPoint
-    + lib.concatMapAttrsStringSep "" (
-      client: options: " ${client}(${lib.concatStringsSep "," options})"
-    ) clientsAndOptions
-  );
-
   cfg = config.services.nfs.server;
 
   exports = pkgs.writeText "exports" cfg.exports;
@@ -56,26 +48,12 @@ in
         };
 
         exports = lib.mkOption {
-          type = with lib.types; coercedTo (attrsOf (attrsOf (listOf str))) attrsToExports lines;
+          type = lib.types.lines;
           default = "";
           description = ''
             Contents of the /etc/exports file.  See
             {manpage}`exports(5)` for the format.
           '';
-          example = {
-            "/usr" = {
-              "*.local.domain" = [ "ro" ];
-              "@trusted" = [ "rw" ];
-            };
-            "/home/joe" = {
-              "pc001" = [
-                "rw"
-                "all_squash"
-                "anonuid=150"
-                "anongid=100"
-              ];
-            };
-          };
         };
 
         hostName = lib.mkOption {

nixos/modules/services/networking/syncthing.nix

@@ -25,10 +25,10 @@ let
     if
       isUnixGui
     # if cfg.guiAddress is a unix socket, tell curl explicitly about it
-    # note that the syncthing.local in front of `${path}` is the hostname, which is
+    # note that the dot in front of `${path}` is the hostname, which is
     # required.
     then
-      "--unix-socket ${lib.strings.removePrefix "unix://" cfg.guiAddress} http://syncthing.local${path}"
+      "--unix-socket ${lib.strings.removePrefix "unix://" cfg.guiAddress} http://.${path}"
     # no adjustments are needed if cfg.guiAddress is a network address
     else
       "${cfg.guiAddress}${path}";

nixos/modules/services/ttys/getty.nix

@@ -76,24 +76,6 @@ in
         '';
       };
 
-      enable = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Include getty in the system.
-
-          getty is quiescent until called into action and does not have
-          runtime costs if it is not used. The benefit of disabling it is
-          in reducing closure size.
-
-          Disabling getty means that console login may not be possible,
-          `machinectl shell` and `login` may not work, and other ills.
-          It is only recommended for lights-out, headless containers,
-          appliances, and similar configurations not meant for any human
-          interaction ever.
-        '';
-      };
-
       loginProgram = mkOption {
         type = types.path;
         default = "${pkgs.shadow}/bin/login";
@@ -151,7 +133,7 @@ in
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = {
     # Note: this is set here rather than up there so that changing
     # nixos.label would not rebuild manual pages
     services.getty.greetingLine = mkDefault ''<<< Welcome to ${config.system.nixos.distroName} ${config.system.nixos.label} (\m) - \l >>>'';

nixos/modules/services/web-apps/lasuite-meet.nix

@@ -50,6 +50,7 @@ let
     environment = pythonEnvironment;
 
     serviceConfig = {
+      RuntimeDirectory = "lasuite-meet";
       StateDirectory = "lasuite-meet";
       WorkingDirectory = "/var/lib/lasuite-meet";
 
@@ -381,8 +382,6 @@ in
         '';
 
         serviceConfig = {
-          # needs to be here so that cronjobs don't nuke it
-          RuntimeDirectory = "lasuite-meet";
           BindReadOnlyPaths = "${cfg.package}/share/static:/var/lib/lasuite-meet/static";
 
           ExecStart = utils.escapeSystemdExecArgs (

nixos/modules/services/web-apps/nextcloud.md

@@ -5,7 +5,7 @@ self-hostable cloud platform. The server setup can be automated using
 [services.nextcloud](#opt-services.nextcloud.enable). A
 desktop client is packaged at `pkgs.nextcloud-client`.
 
-The current default by NixOS is `nextcloud34` which is also the latest
+The current default by NixOS is `nextcloud33` which is also the latest
 major version available.
 
 ## Basic usage {#module-services-nextcloud-basic-usage}

nixos/modules/services/web-apps/nextcloud.nix

@@ -467,7 +467,6 @@ in
       relatedPackages = [
         "nextcloud32"
         "nextcloud33"
-        "nextcloud34"
       ];
     };
     phpPackage = lib.mkPackageOption pkgs "php" {
@@ -1196,7 +1195,7 @@ in
       {
         warnings =
           let
-            latest = 34;
+            latest = 33;
             upgradeWarning = major: nixos: ''
               A legacy Nextcloud install (from before NixOS ${nixos}) may be installed.
 
@@ -1229,8 +1228,7 @@ in
           ++ (lib.optional (lib.versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
           ++ (lib.optional (lib.versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"))
           ++ (lib.optional (lib.versionOlder cfg.package.version "32") (upgradeWarning 31 "25.11"))
-          ++ (lib.optional (lib.versionOlder cfg.package.version "33") (upgradeWarning 32 "26.05"))
-          ++ (lib.optional (lib.versionOlder cfg.package.version "34") (upgradeWarning 33 "26.11"));
+          ++ (lib.optional (lib.versionOlder cfg.package.version "33") (upgradeWarning 32 "26.05"));
 
         services.nextcloud.package = lib.mkDefault (
           if pkgs ? nextcloud then
@@ -1243,10 +1241,8 @@ in
             pkgs.nextcloud31
           else if lib.versionOlder stateVersion "26.05" then
             pkgs.nextcloud32
-          else if lib.versionOlder stateVersion "26.11" then
-            pkgs.nextcloud33
           else
-            pkgs.nextcloud34
+            pkgs.nextcloud33
         );
 
         services.nextcloud.phpOptions = lib.mkMerge [

nixos/modules/services/web-servers/nginx/default.nix

@@ -1617,7 +1617,6 @@ in
           MemoryDenyWriteExecute =
             !(
               (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
-              || cfg.lua.enable
               || (cfg.package == pkgs.openresty)
             );
           RestrictRealtime = true;

nixos/modules/services/web-servers/phpfpm/default.nix

@@ -18,15 +18,6 @@ let
       "yes"
     else if false == value then
       "no"
-    else if isString value then
-      # Escape according to https://www.php.net/manual/en/function.parse-ini-file.php
-      # Not escaping `$` since users might want to use that to interpolate environment variables.
-      # Additionally, php-fpm applies post-processing to env values that start with `$` and replaces
-      # them with the respective env variable, with no way to escape: https://github.com/php/php-src/blob/631c366f9f58c8ba4078a48d1f56187cfbf8e549/sapi/fpm/fpm/fpm_env.c#L171-L180
-      # In all platforms except for Windows, PHP_EOL is the line feed `\n` character,
-      # which we use here as an escape value since php-fpm parses the config line-by-line.
-      # See https://github.com/NixOS/nixpkgs/pull/516530#issuecomment-4878738511 for more information.
-      ''"${replaceString "\n" ''" PHP_EOL "'' (escape [ "\"" "\\" ] value)}"''
     else
       toString value;
 

nixos/modules/services/x11/desktop-managers/mate.nix

@@ -141,10 +141,6 @@ in
       services.libinput.enable = mkDefault true;
 
       security.pam.services.mate-screensaver.unixAuth = true;
-      security.polkit = {
-        enable = true;
-        enablePkexecWrapper = mkDefault true;
-      };
 
       xdg.portal.configPackages = mkDefault [ pkgs.mate-desktop ];
 

nixos/modules/system/service/systemd/service.nix

@@ -113,48 +113,6 @@ in
       defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.argv";
     };
 
-    systemd.mainExecReload = mkOption {
-      description = ''
-        Main command line for systemd's ExecReload with systemd's specifier and
-        environment variable substitution enabled.
-
-        This option sets the primary ExecRestart entry. Additional ExecReload entries
-        can be added via `systemd.service.serviceConfig.ExecReload` with `lib.mkBefore`
-        or `lib.mkAfter`.
-
-        This option allows you to use systemd specifiers like `%n` (unit name),
-        `%i` (instance), `%t` (runtime directory), and environment variables using
-        `''${VAR}` syntax in your command line.
-
-        By default, it is either set to null or this is set to the escaped version of {option}`process.reloadCommand`
-        when specified to prevent systemd substitution. Set this option explicitly to enable
-        systemd's substitution features.
-
-        To extend {option}`process.reloadCommand` with systemd specifiers, you can append
-        to the escaped arguments:
-
-        ```nix
-        systemd.mainExecReload =
-          config.systemd.lib.escapeSystemdExecArgs config.process.reload + " --systemd-unit %n";
-        ```
-
-        This pattern allows you to pass the unit name (or other systemd specifiers)
-        as additional arguments while keeping the base command from {option}`process.argv`
-        properly escaped.
-
-        See {manpage}`systemd.service(5)` (section "COMMAND LINES") for details on
-        variable substitution and {manpage}`systemd.unit(5)` (section "SPECIFIERS")
-        for available specifiers like `%n`, `%i`, `%t`.
-      '';
-      type = types.nullOr types.str;
-      default =
-        if config.process.reloadCommand then
-          config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand
-        else
-          "";
-      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand";
-    };
-
     systemd.services = mkOption {
       description = ''
         This module configures systemd services, with the notable difference that their unit names will be prefixed with the abstract service name.
@@ -212,10 +170,7 @@ in
       # TODO description;
       wantedBy = lib.mkDefault [ "multi-user.target" ];
       serviceConfig = {
-        ExecReload = config.systemd.mainExecReload;
-        Type = lib.mkDefault (
-          if (config.serviceManager.notificationProtocol == "systemd") then "notify" else "simple"
-        );
+        Type = lib.mkDefault "simple";
         Restart = lib.mkDefault "always";
         RestartSec = lib.mkDefault "5";
         ExecStart = [

nixos/tests/all-tests.nix

@@ -1005,6 +1005,7 @@ in
   matrix-conduit = runTest ./matrix/conduit.nix;
   matrix-continuwuity = runTest ./matrix/continuwuity.nix;
   matrix-synapse = runTest ./matrix/synapse.nix;
+  matrix-synapse-workers = runTest ./matrix/synapse-workers.nix;
   matrix-tuwunel = runTest ./matrix/tuwunel.nix;
   matter-server = runTest ./matter-server.nix;
   matterjs-server = runTest ./matterjs-server.nix;

nixos/tests/matrix/continuwuity.nix

@@ -20,66 +20,61 @@ in
       };
       networking.firewall.allowedTCPPorts = [ 6167 ];
     };
-
     client =
       { pkgs, ... }:
       {
         environment.systemPackages = [
-          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.mautrix ]; } ''
+          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
             import asyncio
-
-            from mautrix.client import Client
-            from mautrix.types import EventType, RoomFilter
+            import nio
 
 
             async def main() -> None:
                 # Connect to continuwuity
-                client = Client(
-                    mxid="@${user}:${name}",
-                    base_url="http://continuwuity:6167",
-                )
+                client = nio.AsyncClient("http://continuwuity:6167", "${user}")
 
                 # Log in as user alice
-                await client.login(password="${pass}")
+                response = await client.login("${pass}")
 
                 # Create a new room
-                room_id = await client.create_room()
-                print("Created room:", room_id)
+                response = await client.room_create(federate=False)
+                print("Matrix room create response:", response)
+                assert isinstance(response, nio.RoomCreateResponse)
+                room_id = response.room_id
 
                 # Join the room
-                await client.join_room_by_id(room_id)
-                print("Joined room")
+                response = await client.join(room_id)
+                print("Matrix join response:", response)
+                assert isinstance(response, nio.JoinResponse)
 
                 # Send a message to the room
-                received = asyncio.Event()
-                msg = "Hello continuwuity!"
+                response = await client.room_send(
+                    room_id=room_id,
+                    message_type="m.room.message",
+                    content={
+                        "msgtype": "m.text",
+                        "body": "Hello continuwuity!"
+                    }
+                )
+                print("Matrix room send response:", response)
+                assert isinstance(response, nio.RoomSendResponse)
 
-                async def on_message(evt):
-                    if (
-                        evt.room_id != room_id
-                        or evt.sender != client.mxid
-                        or evt.type != EventType.ROOM_MESSAGE
-                    ):
-                        return
+                # Sync responses
+                response = await client.sync(timeout=30000)
+                print("Matrix sync response:", response)
+                assert isinstance(response, nio.SyncResponse)
 
-                    assert evt.content.body == msg
-                    received.set()
-
-                client.add_event_handler(EventType.ROOM_MESSAGE, on_message)
-                sync_task = client.start(RoomFilter(rooms=[room_id]))
-
-                await client.send_text(room_id, msg)
-
-                # Sync until message is received
-                await asyncio.wait_for(received.wait(), timeout=30)
+                # Check the message was received by continuwuity
+                last_message = response.rooms.join[room_id].timeline.events[-1].body
+                assert last_message == "Hello continuwuity!"
 
                 # Leave the room
-                await client.leave_room(room_id)
-                print("Left room")
+                response = await client.room_leave(room_id)
+                print("Matrix room leave response:", response)
+                assert isinstance(response, nio.RoomLeaveResponse)
 
                 # Close the client
-                client.stop()
-                await sync_task
+                await client.close()
 
 
             if __name__ == "__main__":
@@ -101,7 +96,6 @@ in
   '';
 
   meta.maintainers = with lib.maintainers; [
-    bartoostveen
     nyabinary
     snaki
   ];

nixos/tests/matrix/synapse-workers.nix

@@ -0,0 +1,53 @@
+{ pkgs, ... }:
+{
+  name = "matrix-synapse-workers";
+  meta = {
+    inherit (pkgs.matrix-synapse.meta) maintainers;
+  };
+
+  nodes = {
+    homeserver =
+      {
+        pkgs,
+        nodes,
+        ...
+      }:
+      {
+        services.postgresql = {
+          enable = true;
+          initialScript = pkgs.writeText "synapse-init.sql" ''
+            CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
+            CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
+            TEMPLATE template0
+            LC_COLLATE = "C"
+            LC_CTYPE = "C";
+          '';
+        };
+
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            database = {
+              name = "psycopg2";
+              args.password = "synapse";
+            };
+            enable_registration = true;
+            enable_registration_without_verification = true;
+
+            federation_sender_instances = [ "federation_sender" ];
+          };
+          configureRedisLocally = true;
+          workers = {
+            "federation_sender" = { };
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    homeserver.wait_for_unit("matrix-synapse.service");
+    homeserver.wait_for_unit("matrix-synapse-worker-federation_sender.service");
+  '';
+}

nixos/tests/matrix/synapse.nix

@@ -1,194 +1,101 @@
 { pkgs, ... }:
 let
+
   ca_key = mailerCerts.ca.key;
   ca_pem = mailerCerts.ca.cert;
 
-  aliceName = "alice";
-  alicePassword = "alicealice";
-  aliceEmail = "alice@example.com";
-
-  bobName = "bob";
-  bobPassword = "hunter2";
-
-  mkBundle =
-    domain:
-    pkgs.runCommand "bundle-${domain}"
+  bundle =
+    pkgs.runCommand "bundle"
       {
         nativeBuildInputs = [ pkgs.minica ];
       }
       ''
         minica -ca-cert ${ca_pem} -ca-key ${ca_key} \
-          -domains ${domain}
-        install -Dm444 -t $out ${domain}/{key,cert}.pem
+          -domains localhost
+        install -Dm444 -t $out localhost/{key,cert}.pem
       '';
 
   mailerCerts = import ../common/acme/server/snakeoil-certs.nix;
   mailerDomain = mailerCerts.domain;
   registrationSharedSecret = "unsecure123";
+  testUser = "alice";
+  testPassword = "alicealice";
+  testEmail = "alice@example.com";
 
-  anonHash = "hunter2hunter2hunter2";
-  anonHashF = pkgs.writeText "hash" anonHash;
-
-  mkHomeserverBase =
-    domain: nodes:
-    let
-      bundle = mkBundle domain;
-    in
-    { lib, ... }:
+  listeners = [
     {
-      security.pki.certificateFiles = [
-        mailerCerts.ca.cert
+      port = 8448;
+      bind_addresses = [
+        "127.0.0.1"
+        "::1"
       ];
+      type = "http";
+      tls = true;
+      x_forwarded = false;
+      resources = [
+        {
+          names = [
+            "client"
+          ];
+          compress = true;
+        }
+        {
+          names = [
+            "federation"
+          ];
+          compress = false;
+        }
+      ];
+    }
+  ];
 
-      networking = {
-        hostName = lib.head (lib.strings.splitString "." domain);
-        domain = lib.last (lib.strings.splitString "." domain);
-        firewall.allowedTCPPorts = [
-          80
-          443
-          8448
-        ];
-      };
-
-      services.nginx = {
-        enable = true;
-        virtualHosts."${domain}" = {
-          sslCertificate = "${bundle}/cert.pem";
-          sslCertificateKey = "${bundle}/key.pem";
-          addSSL = true;
-          locations."/.well-known/matrix/server".extraConfig = ''
-            default_type application/json;
-            return 200 '${
-              builtins.toJSON {
-                "m.server" = "${domain}:8448";
-              }
-            }';
-          '';
-        };
-      };
-    };
-
-  mkSynapseConfig =
-    domain: primaryIP:
-    let
-      bundle = mkBundle domain;
-    in
-    {
-      enable = true;
-      settings = {
-        # We're in a test environment with local machines, so
-        # we actually _want_ to use RFC1918 addresses.
-        ip_range_blacklist = [ ];
-
-        trusted_key_servers = [
-          { server_name = "hs1.test"; }
-          { server_name = "hs2.test"; }
-        ];
-
-        registration_shared_secret = registrationSharedSecret;
-        public_baseurl = "https://${domain}";
-        tls_certificate_path = "${bundle}/cert.pem";
-        tls_private_key_path = "${bundle}/key.pem";
-        listeners = [
-          # Using a local listener, otherwise matrix-synapse-register_new_matrix_user will
-          # fail because it'll try to connect to the first bind address, but via TLS resulting
-          # in a signature verification failure.
-          {
-            port = 8008;
-            type = "http";
-            tls = false;
-            resources = [
-              {
-                names = [ "client" ];
-                compress = true;
-              }
-            ];
-            bind_addresses = [ "::1" ];
-          }
-          {
-            port = 8448;
-            bind_addresses = [
-              primaryIP
-            ];
-            type = "http";
-            tls = true;
-            x_forwarded = false;
-            resources = [
-              {
-                names = [
-                  "client"
-                ];
-                compress = true;
-              }
-              {
-                names = [
-                  "federation"
-                ];
-                compress = false;
-              }
-            ];
-          }
-        ];
-      };
-    };
 in
 {
+
   name = "matrix-synapse";
   meta = {
     inherit (pkgs.matrix-synapse.meta) maintainers;
   };
 
   nodes = {
-    synapse-with-workers =
+    # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
+    serverpostgres =
       {
-        lib,
-        config,
         pkgs,
         nodes,
+        config,
         ...
       }:
+      let
+        mailserverIP = nodes.mailserver.networking.primaryIPAddress;
+      in
       {
-        imports = [
-          (mkHomeserverBase "hs1.test" nodes)
-        ];
-
-        services.matrix-synapse = lib.mkMerge [
-          (mkSynapseConfig "hs1.test" config.networking.primaryIPAddress)
-          {
-            settings = {
-              server_name = "hs1.test";
-              email = {
-                smtp_host = mailerDomain;
-                smtp_port = 25;
-                require_transport_security = true;
-                notif_from = "matrix <matrix@${mailerDomain}>";
-                app_name = "Matrix";
-              };
-              listeners = [
-                {
-                  path = "/run/matrix-synapse/main_replication.sock";
-                  type = "http";
-                  resources = [
-                    {
-                      names = [ "replication" ];
-                      compress = false;
-                    }
-                  ];
-                }
-              ];
-              database = {
-                name = "psycopg2";
-                args.password = "synapse";
-              };
-              federation_sender_instances = [ "federation_sender" ];
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            inherit listeners;
+            database = {
+              name = "psycopg2";
+              args.password = "synapse";
             };
-            configureRedisLocally = true;
-            workers = {
-              "federation_sender" = { };
+            redis = {
+              enabled = true;
+              host = "localhost";
+              port = config.services.redis.servers.matrix-synapse.port;
             };
-          }
-        ];
-
+            tls_certificate_path = "${bundle}/cert.pem";
+            tls_private_key_path = "${bundle}/key.pem";
+            registration_shared_secret = registrationSharedSecret;
+            public_baseurl = "https://example.com";
+            email = {
+              smtp_host = mailerDomain;
+              smtp_port = 25;
+              require_transport_security = true;
+              notif_from = "matrix <matrix@${mailerDomain}>";
+              app_name = "Matrix";
+            };
+          };
+        };
         services.postgresql = {
           enable = true;
 
@@ -206,6 +113,20 @@ in
           '';
         };
 
+        services.redis.servers.matrix-synapse = {
+          enable = true;
+          port = 6380;
+        };
+
+        networking.extraHosts = ''
+          ${mailserverIP} ${mailerDomain}
+        '';
+
+        security.pki.certificateFiles = [
+          mailerCerts.ca.cert
+          ca_pem
+        ];
+
         environment.systemPackages =
           let
             sendTestMailStarttls = pkgs.writeScriptBin "send-testmail-starttls" ''
@@ -219,7 +140,7 @@ in
                 smtp.ehlo()
                 smtp.starttls(context=ctx)
                 smtp.ehlo()
-                smtp.sendmail('matrix@${mailerDomain}', '${aliceEmail}', 'Subject: Test STARTTLS\n\nTest data.')
+                smtp.sendmail('matrix@${mailerDomain}', '${testEmail}', 'Subject: Test STARTTLS\n\nTest data.')
                 smtp.quit()
             '';
 
@@ -228,14 +149,16 @@ in
                 # adding the email through the API is quite complicated as it involves more than one step and some
                 # client-side calculation
                 insertEmailForAlice = pkgs.writeText "alice-email.sql" ''
-                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${aliceName}@serverpostgres', 'email', '${aliceEmail}', '1629149927271', '1629149927270');
+                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${testUser}@serverpostgres', 'email', '${testEmail}', '1629149927271', '1629149927270');
                 '';
               in
               pkgs.writeScriptBin "obtain-token-and-register-email" ''
                 #!${pkgs.runtimeShell}
-                set -euxo pipefail
+                set -o errexit
+                set -o pipefail
+                set -o nounset
                 su postgres -c "psql -d matrix-synapse -f ${insertEmailForAlice}"
-                curl --fail -XPOST 'https://hs1.test:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${aliceEmail}","client_secret":"foobar","send_attempt":1}' -v
+                curl --fail -XPOST 'https://localhost:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${testEmail}","client_secret":"foobar","send_attempt":1}' -v
               '';
           in
           [
@@ -245,189 +168,74 @@ in
           ];
       };
 
-    mailserver =
-      { lib, ... }:
-      {
-        security.pki.certificateFiles = [
-          mailerCerts.ca.cert
-        ];
+    # test mail delivery
+    mailserver = args: {
+      security.pki.certificateFiles = [
+        mailerCerts.ca.cert
+      ];
 
-        networking = {
-          hostName = lib.head (lib.strings.splitString "." mailerDomain);
-          domain = lib.last (lib.strings.splitString "." mailerDomain);
-          firewall.enable = false;
-        };
+      networking.firewall.enable = false;
 
-        services.postfix = {
-          enable = true;
-          enableSubmission = true;
+      services.postfix = {
+        enable = true;
+        enableSubmission = true;
 
-          # blackhole transport
-          transport = "example.com discard:silently";
+        # blackhole transport
+        transport = "example.com discard:silently";
 
-          settings.main = {
-            myhostname = "${mailerDomain}";
-            # open relay for subnet
-            mynetworks_style = "subnet";
-            debug_peer_level = "10";
-            smtpd_relay_restrictions = [
-              "permit_mynetworks"
-              "reject_unauth_destination"
-            ];
+        settings.main = {
+          myhostname = "${mailerDomain}";
+          # open relay for subnet
+          mynetworks_style = "subnet";
+          debug_peer_level = "10";
+          smtpd_relay_restrictions = [
+            "permit_mynetworks"
+            "reject_unauth_destination"
+          ];
 
-            # disable obsolete protocols, something old versions of twisted are still using
-            smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtpd_tls_chain_files = [
-              "${mailerCerts.${mailerDomain}.key}"
-              "${mailerCerts.${mailerDomain}.cert}"
-            ];
-          };
+          # disable obsolete protocols, something old versions of twisted are still using
+          smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+          smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+          smtpd_tls_chain_files = [
+            "${mailerCerts.${mailerDomain}.key}"
+            "${mailerCerts.${mailerDomain}.cert}"
+          ];
         };
       };
+    };
 
-    synapse-minimal =
-      {
-        nodes,
-        config,
-        lib,
-        ...
-      }:
-      {
-        imports = [
-          (mkHomeserverBase "hs2.test" nodes)
-        ];
-
-        services.matrix-synapse = lib.mkMerge [
-          (mkSynapseConfig "hs2.test" config.networking.primaryIPAddress)
-          {
-            settings = {
-              database.name = "sqlite3";
-              server_name = "hs2.test";
-            };
-          }
-        ];
-      };
-
-    client =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [
-          # `pkgs.olm` is cached on c.n.o, even if this test isn't built due
-          # to it being allow-listed in `pkgs/top-level/release.nix`.
-          (import pkgs.path {
-            config = pkgs.config // {
-              permittedInsecurePackages = [ "olm-3.2.16" ];
-            };
-          }).matrix-commander
-          pkgs.jq
-        ];
-
-        security.pki.certificateFiles = [ mailerCerts.ca.cert ];
-
-        users.users = {
-          alice.isNormalUser = true;
-          bob.isNormalUser = true;
-        };
-
-        networking.useNetworkd = true;
-        services.rust-federation-tester = {
-          enable = true;
-          settings = {
-            listen_addr = "unix:/run/rust-federation-tester/rust-federation-tester.sock";
-            frontend_url = "http://localhost:8080";
-            database_url = "sqlite:///var/lib/rust-federation-tester/db?mode=rwc";
-            magic_token_secret = "foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar";
-            statistics = {
-              enabled = true;
-              prometheus_enabled = true;
-              anonymization_salt._secret = "${anonHashF}";
-              raw_retention_days = 30;
-            };
-          };
+    serversqlite = args: {
+      services.matrix-synapse = {
+        enable = true;
+        settings = {
+          inherit listeners;
+          database.name = "sqlite3";
+          tls_certificate_path = "${bundle}/cert.pem";
+          tls_private_key_path = "${bundle}/key.pem";
         };
       };
+    };
   };
 
   testScript = ''
-    import json
-    from pprint import pprint
-
     start_all()
-
-    synapse_with_workers.wait_for_unit("multi-user.target")
-    synapse_minimal.wait_for_unit("multi-user.target")
-    mailserver.wait_for_unit("multi-user.target")
-
-    synapse_with_workers.wait_until_succeeds(
+    mailserver.wait_for_unit("postfix.service")
+    serverpostgres.succeed("send-testmail-starttls")
+    serverpostgres.wait_for_unit("matrix-synapse.service")
+    serverpostgres.wait_until_succeeds(
+        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
+    )
+    serverpostgres.wait_until_succeeds(
         "journalctl -u matrix-synapse.service | grep -q 'Connected to redis'"
     )
-    synapse_with_workers.wait_for_unit("matrix-synapse-worker-federation_sender.service");
-
-    with subtest("register user with email confirmation"):
-        synapse_with_workers.succeed("send-testmail-starttls")
-        synapse_with_workers.succeed("REQUESTS_CA_BUNDLE=${mailerCerts.ca.cert} register_new_matrix_user -u ${aliceName} -p ${alicePassword} -a -k ${registrationSharedSecret} https://hs1.test:8448/")
-        synapse_with_workers.succeed("obtain-token-and-register-email")
-
-    with subtest("matrix-synapse-register_new_matrix_user"):
-        synapse_minimal.succeed("matrix-synapse-register_new_matrix_user -u ${bobName} -p ${bobPassword} --no-admin")
-        synapse_minimal.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
-
-    with subtest("Federation tester"):
-        expected_anonymization_hashes = {
-            "hs1.test": "0558582846d6e2d90612900d449871dfcbf9878ba78de4a8469d8aba2d9c037b",
-            "hs2.test": "d3d88c2033c03b74ec1e086e15c0251514de060de5e51cb381e896f892a5b0cd",
-        }
-
-        # /metrics are cached for up to 30 seconds
-        for n, domain in enumerate(["hs2.test", "hs1.test"], start=3):
-            result = json.loads(
-                client.succeed(
-                    f"curl --fail --unix-socket /run/rust-federation-tester/rust-federation-tester.sock 'http://localhost:8080/api/federation/report?server_name={domain}&stats_opt_in=true'"
-                )
-            )
-            pprint(result)
-            t.assertTrue(result["FederationOK"])
-            t.assertTrue(result["ConnectionReports"][f"192.168.1.{n}:8448"]["Checks"]["AllChecksOK"])
-            t.assertEqual(f"{domain}:8448", result["WellKnownResult"][f"192.168.1.{n}:443"]["m.server"])
-
-        client.sleep(30)
-        # /metrics are cached for up to 30 seconds
-        for domain in ["hs2.test", "hs1.test"]:
-            metrics = client.succeed("curl --unix-socket /run/rust-federation-tester/rust-federation-tester.sock http://localhost:8080/metrics --fail")
-            t.assertRegex(
-                metrics,
-                f'federation_request_total\\{{server=\\"{expected_anonymization_hashes[domain]}\\",result=\\"success\\",[^}}]+\\}} 1'
-            )
-
-    def run_as_alice(cmd):
-        return client.succeed(f"sudo -u alice matrix-commander -c /home/alice/credentials.json -s /home/alice/matrix {cmd}")
-
-    def run_as_bob(cmd):
-        return client.succeed(f"sudo -u bob matrix-commander -c /home/bob/credentials.json -s /home/bob/matrix {cmd}")
-
-    with subtest("Login"):
-        run_as_alice("--login password --homeserver https://hs1.test:8448 --user-login @${aliceName}:hs1.test --password ${alicePassword} --device commander --room-default '#welcome:hs1.test'")
-        run_as_bob("--login password --homeserver https://hs2.test:8448 --user-login @${bobName}:hs2.test --password ${bobPassword} --device commander --room-default '#welcome:hs1.test'")
-
-    with subtest("Create/Invite/Join"):
-        run_as_alice("--room-create '#welcome:hs1.test'")
-
-        run_as_alice("--room-invite '#welcome:hs1.test' -u @${bobName}:hs2.test")
-        run_as_bob("--listen once --room-invites 'list+join'")
-
-    with subtest("Send/receive messages"):
-        senders = {
-            "alice": ("hs1", run_as_alice),
-            "bob": ("hs2", run_as_bob),
-        }
-
-        for name, (hs, fn) in senders.items():
-            fn(f"-m 'hello, I am {name}'")
-            for _, run in senders.values():
-                msg_data = json.loads(run("--listen once --listen-self --output json"))
-                pprint(msg_data)
-                t.assertEqual(msg_data["source"]["content"]["body"], f"hello, I am {name}")
-                t.assertEqual(msg_data["source"]["sender"], f"@{name}:{hs}.test")
+    serverpostgres.require_unit_state("postgresql.target")
+    serverpostgres.succeed("REQUESTS_CA_BUNDLE=${ca_pem} register_new_matrix_user -u ${testUser} -p ${testPassword} -a -k ${registrationSharedSecret} https://localhost:8448/")
+    serverpostgres.succeed("obtain-token-and-register-email")
+    serversqlite.wait_for_unit("matrix-synapse.service")
+    serversqlite.wait_until_succeeds(
+        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
+    )
+    serversqlite.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
   '';
+
 }

nixos/tests/nextcloud/default.nix

@@ -149,6 +149,5 @@ listToAttrs (
   concatMap genTests [
     32
     33
-    34
   ]
 )

nixos/tests/nfs/kerberos.nix

@@ -83,16 +83,9 @@ import ../make-test-python.nix (
 
           services.nfs.server.enable = true;
           services.nfs.server.createMountPoints = true;
-          services.nfs.server.exports = {
-            "/data" = {
-              "*" = [
-                "rw"
-                "no_root_squash"
-                "fsid=0"
-                "sec=krb5p"
-              ];
-            };
-          };
+          services.nfs.server.exports = ''
+            /data *(rw,no_root_squash,fsid=0,sec=krb5p)
+          '';
         };
     };
 

nixos/tests/nfs/simple.nix

@@ -37,16 +37,9 @@ import ../make-test-python.nix (
         { ... }:
         {
           services.nfs.server.enable = true;
-          services.nfs.server.exports = {
-            "/data" = {
-              "192.168.1.0/255.255.255.0" = [
-                "rw"
-                "no_root_squash"
-                "no_subtree_check"
-                "fsid=0"
-              ];
-            };
-          };
+          services.nfs.server.exports = ''
+            /data 192.168.1.0/255.255.255.0(rw,no_root_squash,no_subtree_check,fsid=0)
+          '';
           services.nfs.server.createMountPoints = true;
           networking.firewall.enable = false; # FIXME: figure out what ports need to be allowed
         };

nixos/tests/php/fpm.nix

@@ -44,13 +44,6 @@
           "pm.min_spare_servers" = 1;
           "pm.start_servers" = 2;
         };
-        phpEnv = {
-          # check that keywords and special characters are escaped properly
-          keyword = "false";
-          characters = "^ = \\";
-          quoted = "\"'";
-          newline = "hello\nworld";
-        };
       };
     };
   testScript =
@@ -63,15 +56,6 @@
       response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
       t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
-      expected_env = {
-        "keyword": "false",
-        "characters": "^ = \\",
-        "quoted": ""'",
-        "newline": "hello\nworld",
-      }
-      for env, value in expected_env.items():
-        assert f'<tr><td class="e">{env} </td><td class="v">{value} </td></tr>' in response, f"phpEnv.{env} not detected"
-
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
           assert ext in response, f"Missing {ext} extension"

nixos/tests/shoko.nix

@@ -17,7 +17,10 @@
         machine.succeed("curl --fail http://localhost:8111")
       '';
 
-      meta.maintainers = with lib.maintainers; [ nanoyaki ];
+      meta.maintainers = with lib.maintainers; [
+        diniamo
+        nanoyaki
+      ];
     }
   );
 

pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix

@@ -47,6 +47,7 @@ melpaBuild (finalAttrs: {
     platforms = [
       "aarch64-darwin"
       "aarch64-linux"
+      "x86_64-darwin"
       "x86_64-linux"
       "x86_64-windows"
     ];

pkgs/applications/editors/jetbrains/ides/clion.nix

@@ -28,6 +28,10 @@ let
       url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.tar.gz";
       hash = "sha256-I6IKQng4lNtRlQIq08K5bueqgKI/q1awX4EuRnyAnOk=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/cpp/CLion-2026.1.4.dmg";
+      hash = "sha256-AJt+K1zv4eyjdzubUeFGwB9mqzvOeb3ffA2k0MajPBs=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/cpp/CLion-2026.1.4-aarch64.dmg";
       hash = "sha256-i3stX7dyRgSOJkFTMD9/hkw6e2mGNqn13S7X/vJ66RQ=";

pkgs/applications/editors/jetbrains/ides/datagrip.nix

@@ -19,6 +19,10 @@ let
       url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.tar.gz";
       hash = "sha256-G+tinD/+qM5HVR4u2E0cNXtdVsbwgK8/PdZ3ic6hf4M=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3.dmg";
+      hash = "sha256-vW2LEonl0D9S0VxbeJX4jRrwhELGBwlOXwiHslvh06E=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/datagrip/datagrip-2026.1.3-aarch64.dmg";
       hash = "sha256-Kyt3fYPXzwTVxPFVKd+atiHWb/i7gjGahz1MJ4iXxy8=";

pkgs/applications/editors/jetbrains/ides/dataspell.nix

@@ -21,6 +21,10 @@ let
       url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.tar.gz";
       hash = "sha256-SSmIPF0pDMolxeXL21UaHMbZdtYbChWVxTKZOsPhH+I=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/python/dataspell-2026.1.2.dmg";
+      hash = "sha256-2qzwzGMYuy1qEuTprxwNa5gOPgCZq2MadSKN8FT8w8c=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/python/dataspell-2026.1.2-aarch64.dmg";
       hash = "sha256-MGWufS0nlswdqhACNQWtlXJwfPiYw8wUx7olIxPS15k=";

pkgs/applications/editors/jetbrains/ides/gateway.nix

@@ -19,6 +19,10 @@ let
       url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.tar.gz";
       hash = "sha256-CSe04BBo4jS1cIhu4NfZqaSHMaNue2eFUPa+1gOxuoo=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3.dmg";
+      hash = "sha256-WKwIP19y5EKO98JgEm468ofaRp/JO5z8lqNhtpsH4tY=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-2026.1.3-aarch64.dmg";
       hash = "sha256-AHY/lY0ARkW0VoSgy0t7LLNXA965PLooWBSWxBKBV5M=";

pkgs/applications/editors/jetbrains/ides/goland.nix

@@ -19,6 +19,10 @@ let
       url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.tar.gz";
       hash = "sha256-7s98kY08aKjdRGQLDkffeVhgj1FWurLmTTYmtb5Qx6c=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/go/goland-2026.1.4.dmg";
+      hash = "sha256-RbvcLpLVyeL4B1DJ2/9Ub/6Cz6fJGXMPCHsJ705GsAo=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/go/goland-2026.1.4-aarch64.dmg";
       hash = "sha256-y7mEke0z0MvQs+kMtrmrq7EeAtJUbgo6sGZrOB0MraM=";

pkgs/applications/editors/jetbrains/ides/idea.nix

@@ -22,6 +22,10 @@ let
       url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.tar.gz";
       hash = "sha256-MDZFuLrUxcCIc0Zhi4QhgKPeU7Pgs9oJ/FxQH1n3gBM=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4.dmg";
+      hash = "sha256-8K+LiewiINP4S9eqV0kGWtfy2Ff/zvBwX89iX7mYZ78=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/idea/ideaIU-2026.1.4-aarch64.dmg";
       hash = "sha256-XIBK/+Lxaz9dX+Lxl7HXsl+Z3Z7GBzSuDxNssb/4A2s=";

pkgs/applications/editors/jetbrains/ides/mps.nix

@@ -19,6 +19,10 @@ let
       url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3.tar.gz";
       hash = "sha256-xAI+UrTheCTWHSdoI4YZvhTlrlc121M+OVFkfzd7a3k=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos.dmg";
+      hash = "sha256-whYAjKkF79mrknHflZnvOOy2bLosYUguelZDSuPt3uY=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/mps/2025.3/MPS-2025.3-macos-aarch64.dmg";
       hash = "sha256-3HnEHOhRRI9IYjBhc5FO7h5j4jBBDtZTVkmO/S1fBEQ=";

pkgs/applications/editors/jetbrains/ides/phpstorm.nix

@@ -19,6 +19,10 @@ let
       url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-T9q3/nxv/AA6y7CHWtOhUibR7bnKN8OZmfN3NWYTsIQ=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4.dmg";
+      hash = "sha256-W7EwYu7S3hs1564tXq8H1Uok/Gwx/8QJO4brUGOfFY4=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/webide/PhpStorm-2026.1.4-aarch64.dmg";
       hash = "sha256-XGcfEWHHeLugvkT/WlQDsVRN33F46b1PCNhINQitqSY=";

pkgs/applications/editors/jetbrains/ides/pycharm.nix

@@ -20,6 +20,10 @@ let
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.tar.gz";
       hash = "sha256-71FbYpN0seJ5k/yZA7aoXgU4W/N1BhjtKl7W7Hic9UE=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/python/pycharm-2026.1.4.dmg";
+      hash = "sha256-Q5hTcYoNUzmAxwcsXJNS4medQjFKWc/Sgkybt4PQPfg=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/python/pycharm-2026.1.4-aarch64.dmg";
       hash = "sha256-qxSgp8r4S0KXjCCTIoAiEZFCn3uBE/0pWLLA6td0Fq0=";

pkgs/applications/editors/jetbrains/ides/rider.nix

@@ -31,6 +31,10 @@ let
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.tar.gz";
       hash = "sha256-GXmyBrqxUpwK4djjwllvK+pnfktDrDHpLJKoe4D2xFo=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4.dmg";
+      hash = "sha256-GfQ5WpKunJ+JhE1VcArm3UxZ5udCbfnS1Kw3D4gZorA=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-2026.1.4-aarch64.dmg";
       hash = "sha256-cfwT22BN1jzKZzrZHMQqYFJPGuRwta/sqoOJOp+PfBE=";

pkgs/applications/editors/jetbrains/ides/ruby-mine.nix

@@ -19,6 +19,10 @@ let
       url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.tar.gz";
       hash = "sha256-oSu19pkGVWt31vWBdAffSZsu4QzsUznVbUSwDy98nug=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4.dmg";
+      hash = "sha256-BLo2weIJK8gQAcMtAiETM7FMdhw9aoFIGh5Yqjv3k7s=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/ruby/RubyMine-2026.1.4-aarch64.dmg";
       hash = "sha256-4wEnwcPRtwp0wxePUMiLow6sMxirwndRMdmJL8LBh9k=";

pkgs/applications/editors/jetbrains/ides/rust-rover.nix

@@ -25,6 +25,10 @@ let
       url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.tar.gz";
       hash = "sha256-KpF3jCnLKCEeEXkBdB8ZsPPqP9FOVRTwRV/FQLKyh1Q=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4.dmg";
+      hash = "sha256-2BwgAD0xF9IxRJh+gW4vLzBW13rFQSzQPbEwdmQGvLU=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/rustrover/RustRover-2026.1.4-aarch64.dmg";
       hash = "sha256-Hly4NBv9mg/RMmxCM6m9w5eS/CQ7ycxp7V2VQZwyGQE=";

pkgs/applications/editors/jetbrains/ides/webstorm.nix

@@ -19,6 +19,10 @@ let
       url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz";
       hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE=";
     };
+    x86_64-darwin = {
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg";
+      hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI=";
+    };
     aarch64-darwin = {
       url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg";
       hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI=";

pkgs/applications/editors/jetbrains/updater/updateInfo.json

@@ -4,6 +4,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg"
     }
   },
@@ -12,6 +13,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/datagrip/datagrip-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/datagrip/datagrip-{version}-aarch64.dmg"
     }
   },
@@ -20,6 +22,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/dataspell-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/python/dataspell-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/python/dataspell-{version}-aarch64.dmg"
     }
   },
@@ -28,6 +31,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/idea/gateway/JetBrainsGateway-{version}-aarch64.dmg"
     }
   },
@@ -36,6 +40,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/go/goland-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/go/goland-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/go/goland-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/go/goland-{version}-aarch64.dmg"
     }
   },
@@ -44,6 +49,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/idea/ideaIU-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/idea/ideaIU-{version}-aarch64.dmg"
     }
   },
@@ -56,6 +62,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/mps/{versionMajorMinor}/MPS-{version}-macos-aarch64.dmg"
     }
   },
@@ -64,6 +71,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/webide/PhpStorm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/webide/PhpStorm-{version}-aarch64.dmg"
     }
   },
@@ -72,6 +80,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/python/pycharm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/python/pycharm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/python/pycharm-{version}-aarch64.dmg"
     }
   },
@@ -84,6 +93,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/rider/JetBrains.Rider-{version}-aarch64.dmg"
     }
   },
@@ -92,6 +102,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/ruby/RubyMine-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/ruby/RubyMine-{version}-aarch64.dmg"
     }
   },
@@ -100,6 +111,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/rustrover/RustRover-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/rustrover/RustRover-{version}-aarch64.dmg"
     }
   },
@@ -108,6 +120,7 @@
     "urls": {
       "x86_64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}.tar.gz",
       "aarch64-linux": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.tar.gz",
+      "x86_64-darwin": "https://download.jetbrains.com/webstorm/WebStorm-{version}.dmg",
       "aarch64-darwin": "https://download.jetbrains.com/webstorm/WebStorm-{version}-aarch64.dmg"
     }
   }

pkgs/applications/editors/vim/plugins/non-generated/windsurf-nvim/default.nix

@@ -14,6 +14,7 @@ let
   codeiumHashes = {
     x86_64-linux = "sha256-IeNK7UQtOhqC/eQv7MAya4jB1WIGykSR7IgutZatmHM=";
     aarch64-linux = "sha256-ujTFki/3V79El2WCkG0PJhbaMT0knC9mrS9E7Uv9HD4=";
+    x86_64-darwin = "sha256-r2KloEQsUku9sk8h76kwyQuMTHcq/vwfTSK2dkiXDzE=";
     aarch64-darwin = "sha256-1jNH0Up8mAahDgvPF6g42LV+RVDVsPqDM54lE2KYY48=";
   };
 
@@ -29,6 +30,7 @@ let
           {
             x86_64-linux = "linux_x64";
             aarch64-linux = "linux_arm";
+            x86_64-darwin = "macos_x64";
             aarch64-darwin = "macos_arm";
           }
           .${system} or throwSystem;

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -3316,7 +3316,6 @@ assertNoAdditions {
   };
 
   nvim-jdtls = super.nvim-jdtls.overrideAttrs (old: {
-    runtimeDeps = [ python3 ];
     meta = old.meta // {
       license = lib.licenses.gpl3Only;
     };

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -27,6 +27,10 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
           arch = "linux-arm64";
           hash = "sha256-A8CrNx6GfFmaFWe1Awck/2B0VuJhNX6HHI5YNSG1qVo=";
         };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-egXg308OJWvMyMqLHiANNEIGCSza/yKPFIqWq1X6JdE=";
+        };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
           hash = "sha256-BmI7NTlKUVMnTBS8nf2jqYYSA+LT3qP9Yu5gQIv7Mxo=";
@@ -56,6 +60,7 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -14,6 +14,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-lhDt8XEF90y4pj8RLUZgfZNmHkV1XlmHsYuT6sGJMRc=";
         };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-SqFRn5FVQ+LcpmYT7/AIdIKTOxbapaKvPi+I360dVW8=";
+        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-iuYVCG4YWPFI8o4GmuNjkbXvzJsAre0gSSEWq6CUk2E=";
@@ -53,6 +57,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
+      "x86_64-darwin"
     ];
     maintainers = [ lib.maintainers.azd325 ];
   };

pkgs/applications/editors/vscode/extensions/continue.continue/default.nix

@@ -13,6 +13,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-4GiTNT+UPdTth9VDhHTXfqhQ5gM6vfLAaU5Cy3VMTCI=";
         };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-XJfDXWYpxYV5YHIBINqNJdyVho7Xd9OGMu11WE0LENM=";
+        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-QngCharrjiDKrY7RgWtKzIJxjXazuRvpuHVUAxknWfA=";
@@ -40,6 +44,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     maintainers = with lib.maintainers; [ flacks ];
     platforms = [
       "x86_64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
       "aarch64-linux"
     ];

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1950,8 +1950,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "codespaces";
-          version = "1.18.15";
-          hash = "sha256-NcW2XVQ6F7s6k4mIesEXhCkVVRfudwFr3glqB+TjrqM=";
+          version = "1.18.14";
+          hash = "sha256-i/J5inu6iJ3CPgoBf+pMFuM33Ex/0KqhfzfRl/BIe7Y=";
         };
 
         meta = {
@@ -3190,6 +3190,10 @@ let
                 arch = "linux-x64";
                 hash = "sha256-pmA7BNwyHiaU93j61/MyrBV5kH0DlW+7BA6HNlKGnso=";
               };
+              "x86_64-darwin" = {
+                arch = "darwin-x64";
+                hash = "sha256-E2KRzjIxLFmwArzEKittjejacrCOFFNNzphWw8v5CpE=";
+              };
               "aarch64-linux" = {
                 arch = "linux-arm64";
                 hash = "sha256-pnQP1OKr3NJgUuXzO1InYqGA49OuMFn2iEf8wpl4PqM=";
@@ -3220,6 +3224,7 @@ let
           maintainers = [ lib.maintainers.magnouvean ];
           platforms = [
             "x86_64-linux"
+            "x86_64-darwin"
             "aarch64-darwin"
             "aarch64-linux"
           ];

pkgs/applications/editors/vscode/extensions/docker.docker/default.nix

@@ -10,6 +10,10 @@ let
       hash = "sha256-jfjd2V7IJ4GQlz/pXmrY/LlBjQ2qtlsQV4ZRD8RiWTg=";
       arch = "linux-x64";
     };
+    x86_64-darwin = {
+      hash = "sha256-aOFoTLVaaMFsdGoWV0OC31/nmOHXUhr2Y8K4SWcNil8=";
+      arch = "darwin-x64";
+    };
     aarch64-linux = {
       hash = "sha256-ugluaghNNZ/VrQORVIhc0Fuv3rHo++LO3Uwg2ujmsQc=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix

@@ -45,6 +45,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix

@@ -14,6 +14,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-uPmJyEq7X6uJzE1M5Xywax1mrnTcg6jOb9MlpKZ0WRk=";
         };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-oEVt3VbRUPD4tfQs0EU7RX6671fCJiMi38wF+76RzZI=";
+        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-b46f0f99rjBivewC9jUbAFiKK+DS1XKv+AynUlKHliw=";
@@ -48,6 +52,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
+      "x86_64-darwin"
     ];
     maintainers = with lib.maintainers; [ xiaoxiangmoe ];
   };

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix

@@ -22,6 +22,10 @@ let
         arch = "linux-arm64";
         hash = "sha256-1zz9xrMALIOXzMpArWSwO12WmRE+0ldbIwUFH1G2GQI=";
       };
+      x86_64-darwin = {
+        arch = "darwin-x64";
+        hash = "sha256-3PoSbp8M2X4bhSQyxvNC7jtNDVNEuEKeYRZQMFOmbtQ=";
+      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-F4CsyiX46SpjilJNV+qYps1JAw09pVruLmW+muN9/B4=";
@@ -134,6 +138,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix

@@ -24,6 +24,10 @@ let
         arch = "linux-arm64";
         hash = "sha256-EV3745OXbwrRmc8P5e13DZbomyJGcYQUF07WflRWU1Q=";
       };
+      x86_64-darwin = {
+        arch = "darwin-x64";
+        hash = "sha256-i2cALeaSXfwIdfXNeWfND99nFYIiOFwsxbqU7/Effx8=";
+      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-KCIkjBmYZPiuFmQ3/aDycARYIHPyDTmMkoGcuG5DQX8=";
@@ -155,6 +159,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix

@@ -18,6 +18,10 @@ let
       hash = "sha256-HQfmDV6rJX6l1pGybe8//2QrTSwE+rlEJOi4/iW69lY=";
       arch = "linux-x64";
     };
+    x86_64-darwin = {
+      hash = "sha256-tAZyt2fwB/GOhffY5lhHJTmbXG8UloynPtjoMtWRHok=";
+      arch = "darwin-x64";
+    };
     aarch64-linux = {
       hash = "sha256-v7fatW/LMJ8CeSRrE/5b7dLqOrhNhwzUySUxtAMuBUE=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/ms-vscode.vscode-speech/default.nix

@@ -16,6 +16,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-dZwOBehoYEqaYskvcPB55IKnG1CMToioyUJXlndqorA=";
         };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-b6LobvVngC0TFuWTC9JBQrECkoX7ewLNCpCROkXHk20=";
+        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-/EaOfoubfq1ufwB7TTQ2hqmh1ZJiZ1+B6QeYu3MoFPI=";
@@ -64,6 +68,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     license = lib.licenses.unfree;
     platforms = [
       "x86_64-linux"
+      "x86_64-darwin"
       "aarch64-linux"
       "aarch64-darwin"
     ];

pkgs/applications/editors/vscode/extensions/redhat.vscode-xml/default.nix

@@ -13,6 +13,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-cP/oFn19CZ/G3kjdHNZGqXvoDE1qUtg6xrg/2MO14Lo=";
         };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-wtk8SasxXEQ3pCJpVTWR8wcY/bNaIZmImbAtrFWYWOo=";
+        };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
           hash = "sha256-XYdwVoDqK+88ZYUm6APyamFNx6XlYjy0R4CIhSMuRmU=";
@@ -38,6 +42,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     platforms = [
       "x86_64-linux"
       "aarch64-darwin"
+      "x86_64-darwin"
     ];
   };
 }

pkgs/applications/editors/vscode/extensions/sourcery.sourcery/default.nix

@@ -15,6 +15,10 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       arch = "linux-x64";
       hash = "sha256-Oz4Buraof4yXIxGeKXIsDkvEQQ0Gzf/b5mdses1nHlo=";
     };
+    "x86_64-darwin" = {
+      arch = "darwin-x64";
+      hash = "sha256-Iqe4KZXQHenKAypXK/qzG2BCXbk2cZ0i/0xhWhlfQxo=";
+    };
     "aarch64-darwin" = {
       arch = "darwin-arm64";
       hash = "sha256-vMDB5zmdBNt3R5AkeuCYhxzW/rSGwM+wtU5K4v3ZU/U=";

pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix

@@ -20,6 +20,10 @@ let
         arch = "linux-arm64";
         hash = "sha256-Z3cRojI4mCCS2t3aLojgImULQOobq5liDwoeHuzKEhY=";
       };
+      x86_64-darwin = {
+        arch = "darwin-x64";
+        hash = "sha256-Th0cseTJk+CD3BO/99t0VMD7zcF6nxAfmHFhfN8j5sw=";
+      };
       aarch64-darwin = {
         arch = "darwin-arm64";
         hash = "sha256-rHgMl71YCs9ea0nFnx+E2U8isL4zQzIvvE9tgxM7IiA=";
@@ -62,6 +66,7 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
+      "x86_64-darwin"
     ];
     maintainers = [ ];
   };

pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix

@@ -10,6 +10,10 @@ let
       hash = "sha256-DWrKvjWpUYvyqgZCShqwBKw33MHW31cxb4ERV65O+uc=";
       arch = "linux-x64";
     };
+    x86_64-darwin = {
+      hash = "sha256-CYDutYtU0+AAn6PYO/EQ/Suv8BNuMtvePpFdKRtiqAs=";
+      arch = "darwin-x64";
+    };
     aarch64-linux = {
       hash = "sha256-iFHeZiTubXA/t2Gib9hP42d7yjq/WRyywp+l8VhGfmo=";
       arch = "linux-arm64";

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -15,6 +15,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
           arch = "linux-x64";
           hash = "sha256-htZGjy7ZnQLGZUncokGaGHyLpvPM5jzWUvCdnfN1vbM=";
         };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-OFdrXunh63xBZW/HwDDjj17TTiOLGY1Enb6ARxNc4bI=";
+        };
         "aarch64-linux" = {
           arch = "linux-arm64";
           hash = "sha256-rgeNJbl6G2yKAWYW7NarQwVLmd3oZ4YTOVeCUat6ZqQ=";
@@ -52,6 +56,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-linux"
       "aarch64-darwin"
       "x86_64-linux"
+      "x86_64-darwin"
     ];
     maintainers = with lib.maintainers; [ sandarukasa ];
   };

pkgs/applications/editors/vscode/generic.nix

@@ -429,6 +429,7 @@ stdenv.mkDerivation (
           # see https://www.npmjs.com/package/@vscode/ripgrep-universal?activeTab=code
           ripgrepSystem =
             {
+              x86_64-darwin = "darwin-x64";
               aarch64-darwin = "darwin-arm64";
               armv7l-linux = "linux-arm";
               aarch64-linux = "linux-arm64";

pkgs/applications/editors/vscode/vscode.nix

@@ -24,6 +24,7 @@ let
   plat =
     {
       x86_64-linux = "linux-x64";
+      x86_64-darwin = "darwin";
       aarch64-linux = "linux-arm64";
       aarch64-darwin = "darwin-arm64";
       armv7l-linux = "linux-armhf";
@@ -35,6 +36,7 @@ let
   hash =
     {
       x86_64-linux = "sha256-4G+zZ5HJuvdJXUt9wPWqqCVOfRpgpe5D5sfevAXJYrU=";
+      x86_64-darwin = "sha256-+o+UZwmJMeGyf2n1VZcm0zl4dzuC/0UBV5jyUANKsEQ=";
       aarch64-linux = "sha256-UEkpGlTV/KZ8Qcw/OBOCNDQHblD7gHHloSzM62FvDnw=";
       aarch64-darwin = "sha256-IHu9EwW9/oS2FTr/mB7ugMss5Pku3IyslqFYr4riZyk=";
       armv7l-linux = "sha256-Rfp2H6L7bXXhdxf2yphW9YXDGW1+Ea0nKdyTFS8Y/tU=";
@@ -126,6 +128,7 @@ buildVscode {
     ];
     platforms = [
       "x86_64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
       "aarch64-linux"
       "armv7l-linux"

pkgs/applications/editors/vscode/vscodium.nix

@@ -15,6 +15,7 @@ let
   plat =
     {
       x86_64-linux = "linux-x64";
+      x86_64-darwin = "darwin-x64";
       aarch64-linux = "linux-arm64";
       aarch64-darwin = "darwin-arm64";
       armv7l-linux = "linux-armhf";
@@ -27,6 +28,7 @@ let
   hash =
     {
       x86_64-linux = "sha256-LJsGc11MH6zlcJNfSWjTWPn2Jp9dkjeBPQuCXH1woUM=";
+      x86_64-darwin = "sha256-bC7AfH2eKmmsWIOHifNGKD/kVQCYyuMfU3SUil0DXkM=";
       aarch64-linux = "sha256-mT5dvw8GOZ0GnZaKRS/TAzQDEEYDOgcj6w6lNLy5kQ0=";
       aarch64-darwin = "sha256-c8K17XKpRG1ji2mUfoyg2+cRF+qc1KVMYVkaQoUIz7Y=";
       armv7l-linux = "sha256-91ZHhEUDVoDiRBLwMHVLhzKmb9gWcPBUsVRZVLhCA4M=";
@@ -86,6 +88,7 @@ buildVscode rec {
     mainProgram = "codium";
     platforms = [
       "x86_64-linux"
+      "x86_64-darwin"
       "aarch64-linux"
       "aarch64-darwin"
       "armv7l-linux"

pkgs/applications/emulators/libretro/cores/atari800.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "atari800";
-  version = "0-unstable-2026-07-10";
+  version = "0-unstable-2026-05-28";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-atari800";
-    rev = "3f036fd69a0f0948d32a9a7cd97af3e0dd7ec434";
-    hash = "sha256-WnozEFNpW6qmSsQGTKzflitG6TVaozyOMcnAka+E1fE=";
+    rev = "b6638e72b9d7770144837b0b63c637dd7ab2b39c";
+    hash = "sha256-G1RJXhgMq8txotriK0Xy8HdDDCzeDbEQ+3LQ5sUt8G0=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-07-11";
+  version = "0-unstable-2026-07-01";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "004268513bb56655fff358b8caee88503a141776";
-    hash = "sha256-47US8cQ0efhlTao8aW31yOdK/aGtWikYAtsAjQi83y4=";
+    rev = "b84c0c11677ea76fcad1e8958b9d25863c43a88f";
+    hash = "sha256-oKdM++ZH9FCGLVEkkbWGvyjk80HDOraU2rdPG7Mcle0=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/fceumm.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2026-07-06";
+  version = "0-unstable-2026-06-30";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "0d610d9a6401697157f693a5407adf450a0e52fb";
-    hash = "sha256-4QroyuhQrH5FhK86nuUztvrIwG4Ibj2zltPhhdLuJm0=";
+    rev = "6e00afac498903586330492cdd81354a6c4c0d4c";
+    hash = "sha256-0WPMqXj/hNtFxUAIL16B80SxZ8FW31M4g/8wVMZLv/w=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-07-10";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "f09d1f22ef8d199b8b7a2395d0b46774e08a58c2";
-    hash = "sha256-labl5MPpBNkg/M95WzJgiKVdvHJDN6jeFSLsHg5+G78=";
+    rev = "7ec978e8521f75427ad38eb8f8f4f3cabaa891d0";
+    hash = "sha256-3ChQnJP6xI/Wd3BOlkauTYCNQz1MjSHk0lDmjX+Iugg=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-07-10";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "fa4dca561e08d5be9077419f7b255e1da213ed21";
-    hash = "sha256-FfO5LzCH0hYqiVpE2qPJhX4gOrXqqYCoW4XRbz93La4=";
+    rev = "f33876ca3e4f021f4b273aeabed42b551243b71c";
+    hash = "sha256-cmA4aBzR33Df3SNyB3e/reQnQmF0alT6RIeXK+ew+us=";
   };
 
   meta = {

pkgs/applications/emulators/wine/packages.nix

@@ -84,6 +84,7 @@ in
         if pkgs.stdenv.hostPlatform.isAarch64 then [ "--enable-archs=aarch64" ] else [ "--enable-win64" ];
       platforms = [
         "x86_64-linux"
+        "x86_64-darwin"
         "aarch64-linux"
       ];
       mainProgram = "wine";
@@ -144,6 +145,7 @@ in
           [ "--enable-archs=x86_64,i386" ];
       platforms = [
         "x86_64-linux"
+        "x86_64-darwin"
         "aarch64-linux"
       ];
       mainProgram = "wine";

pkgs/applications/misc/sweethome3d/default.nix

@@ -29,6 +29,7 @@ let
     ];
     platforms = [
       "i686-linux"
+      "x86_64-darwin"
       "x86_64-linux"
       "aarch64-darwin"
     ];

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -41,6 +41,7 @@ let
     aarch64-linux = "linux-aarch64";
     # bundles are universal and can be re-used for both darwin architectures
     aarch64-darwin = "mac";
+    x86_64-darwin = "mac";
   };
 
   arch = mozillaPlatforms.${stdenv.hostPlatform.system};

pkgs/applications/networking/cluster/docker-machine/hyperkit.nix

@@ -30,6 +30,6 @@ buildGoModule rec {
     description = "HyperKit driver for docker-machine";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ atkinschang ];
-    platforms = [ ];
+    platforms = [ "x86_64-darwin" ];
   };
 }

pkgs/applications/networking/cluster/hadoop/default.nix

@@ -26,6 +26,7 @@
 
 assert lib.elem stdenv.system [
   "x86_64-linux"
+  "x86_64-darwin"
   "aarch64-linux"
   "aarch64-darwin"
 ];
@@ -177,6 +178,7 @@ in
         srcHash = "sha256-AkZjpHk57S3pYiZambxgRHR7PD51HSI4H1HHW9ICah4=";
         variant = "lean";
       };
+      x86_64-darwin = x86_64-linux;
       aarch64-linux = {
         version = "3.4.0";
         hash = "sha256-QWxzKtNyw/AzcHMv0v7kj91pw1HO7VAN9MHO84caFk8=";
@@ -197,6 +199,7 @@ in
         hash = "sha256-9RlQWcDUECrap//xf3sqhd+Qa8tuGZSHFjGfmXhkGgQ=";
         srcHash = "sha256-4OEsVhBNV9CJ+PN4FgCduUCVA9/el5yezSCZ6ko3+bU=";
       };
+      x86_64-darwin = x86_64-linux;
       aarch64-linux = x86_64-linux // {
         hash = "sha256-5Lv2uA72BJEva5v2yncyPe5gKNCNOPNsoHffVt6KXQ0=";
       };

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -27,20 +27,16 @@
   srtp,
   libnice,
   gnutls,
-  gst_all_1,
+  gstreamer,
+  gst-plugins-base,
+  gst-plugins-good,
   webrtc-audio-processing,
 }:
 
 # Upstream is very deliberate about which features are enabled per default or are automatically enabled.
 # Everything that is disabled per default has to been seen experimental and should not be enabled without strong reasoning.
 # see https://github.com/NixOS/nixpkgs/issues/469614#issuecomment-3649662176
-let
-  inherit (gst_all_1)
-    gstreamer
-    gst-plugins-base
-    ;
-  gst-plugins-good = gst_all_1.gst-plugins-good.override { gtkSupport = true; };
-in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "dino";
   version = "0.5.1";

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -35,7 +35,7 @@ let
         self = discord-development;
       };
     };
-    aarch64-darwin = {
+    x86_64-darwin = {
       discord = rec {
         branch = "stable";
         binaryName = desktopName;
@@ -62,6 +62,7 @@ let
       };
     };
 
+    aarch64-darwin = x86_64-darwin;
     default = x86_64-linux; # Used for unsupported platforms, so we can return *something* there.
   };
 
@@ -80,6 +81,7 @@ let
     ];
     platforms = [
       "x86_64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

pkgs/applications/networking/instant-messengers/discord/linux.nix

@@ -222,7 +222,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontUnpack = true;
 
-  inherit libPath stageModules;
+  inherit libPath;
 
   autoPatchelfIgnoreMissingDeps = [
     "libssl.so.1.1"
@@ -262,7 +262,7 @@ stdenv.mkDerivation (finalAttrs: {
         --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/${binaryName}:${addDriverRunpath.driverLink}/lib \
         --suffix VK_ADD_DRIVER_FILES : "${addDriverRunpath.driverLink}/share/vulkan/icd.d" \
         ${lib.strings.optionalString disableUpdates "--run ${lib.getExe disableBreakingUpdates}"} \
-        --run "${finalAttrs.stageModules} $out/opt/${binaryName}/modules" \
+        --run "${stageModules} $out/opt/${binaryName}/modules" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
 
     ln -s $out/opt/${binaryName}/${binaryName} $out/bin/

pkgs/applications/networking/instant-messengers/ripcord/darwin.nix

@@ -33,6 +33,6 @@ stdenvNoCC.mkDerivation rec {
     # See: https://cancel.fm/ripcord/shareware-redistribution/
     license = lib.licenses.unfreeRedistributable;
     maintainers = with lib.maintainers; [ mikroskeem ];
-    platforms = [ ];
+    platforms = [ "x86_64-darwin" ];
   };
 }

pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix

@@ -41,6 +41,7 @@ let
     x86_64-linux = "linux-x86_64";
     # bundles are universal and can be re-used for both darwin architectures
     aarch64-darwin = "mac";
+    x86_64-darwin = "mac";
   };
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

pkgs/applications/office/libreoffice/darwin/default.nix

@@ -18,6 +18,13 @@ let
       url = "https://download.documentfoundation.org/libreoffice/stable/${version}/mac/${arch}/LibreOffice_${version}_MacOS_${archSuffix}.dmg";
       sha256 = "64e0ad05564554eeee639d49b08b20908a38d4722ec95f1620d05c99bcbe9fb1";
     };
+
+    x86_64-darwin = rec {
+      arch = "x86_64";
+      archSuffix = "x86-64";
+      url = "https://download.documentfoundation.org/libreoffice/stable/${version}/mac/${arch}/LibreOffice_${version}_MacOS_${archSuffix}.dmg";
+      sha256 = "f92ba40fdada173232fe929bf77973a1ffcccec55ae7971957a6de84d33f0f1e";
+    };
   };
 in
 stdenvNoCC.mkDerivation {
@@ -71,6 +78,7 @@ stdenvNoCC.mkDerivation {
     maintainers = with lib.maintainers; [ tricktron ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = [
+      "x86_64-darwin"
       "aarch64-darwin"
     ];
   };

pkgs/applications/science/biology/hh-suite/default.nix

@@ -7,22 +7,19 @@
   xxd,
   enableMpi ? false,
   mpi,
-  llvmPackages,
+  openmp,
 }:
-stdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation rec {
   pname = "hh-suite";
   version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "soedinglab";
     repo = "hh-suite";
-    tag = "v${finalAttrs.version}";
+    rev = "v${version}";
     hash = "sha256-kjNqJddioCZoh/cZL3YNplweIGopWIGzCYQOnKDqZmw=";
   };
 
-  strictDeps = true;
-  __structuredAttrs = true;
-
   patches = [
     # Should be removable as soon as this upstream PR is merged: https://github.com/soedinglab/hh-suite/pull/357
     (fetchpatch {
@@ -42,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional stdenv.hostPlatform.avx2Support "-DHAVE_AVX2=1"
     ++ lib.optional stdenv.hostPlatform.sse4_1Support "-DHAVE_SSE4_1=1";
 
-  buildInputs = lib.optional stdenv.cc.isClang llvmPackages.openmp ++ lib.optional enableMpi mpi;
+  buildInputs = lib.optional stdenv.cc.isClang openmp ++ lib.optional enableMpi mpi;
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
@@ -58,4 +55,4 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ natsukium ];
     platforms = lib.platforms.unix;
   };
-})
+}

pkgs/applications/science/chemistry/quantum-espresso/default.nix

@@ -134,6 +134,7 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     platforms = [
       "x86_64-linux"
+      "x86_64-darwin"
     ];
     maintainers = [ lib.maintainers.costrouc ];
   };

pkgs/applications/science/math/R/default.nix

@@ -27,7 +27,6 @@
   pkg-config,
   bison,
   which,
-  llvmPackages,
   jdk,
   blas,
   lapack,
@@ -69,10 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     tzdata
     which
-  ]
-  # TODO: Remove once #536365 reaches this branch
-  ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.lld;
-
+  ];
   buildInputs = [
     bzip2
     gfortran
@@ -130,11 +126,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontDisableStatic = static;
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # TODO: Remove once #536365 reaches this branch
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
   preConfigure = ''
     configureFlagsArray=(
       --disable-lto

pkgs/applications/video/mplayer/default.nix

@@ -300,6 +300,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [
       "i686-linux"
       "x86_64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
       "aarch64-linux"
     ];

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -348,8 +348,6 @@ runCommandLocal name
     // {
       inherit nativeBuildInputs;
 
-      __structuredAttrs = true;
-
       passthru = passthru // {
         env =
           runCommandLocal "${name}-shell-env"

pkgs/build-support/build-typst-package.nix

@@ -40,6 +40,9 @@ lib.extendMkDerivation {
     {
       name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       dontBuild = true;
 
       installPhase =

pkgs/build-support/go/module.nix

@@ -320,10 +320,15 @@ lib.extendMkDerivation {
               }
 
               getGoDirs() {
-                local type;
-                type="$1"
-                if [ -n "$subPackages" ]; then
-                  echo "$subPackages" | sed "s,\(^\| \),\1./,g"
+                local -r type="$1"
+
+                # Support strucuredAttrs, they are not space seperated
+                local -a subPackagesArray
+                concatTo subPackagesArray subPackages
+
+                # Outputs each element prefixed with './' if the array is not empty
+                if [[ ''${#subPackagesArray[@]} -gt 0 ]]; then
+                  echo "''${subPackagesArray[*]/#/./}"
                 else
                   find . -type f -name \*$type.go -exec dirname {} \; | grep -v "/vendor/" | sort --unique | grep -v "$exclude"
                 fi

pkgs/build-support/lake/default.nix

@@ -43,8 +43,6 @@ lib.extendMkDerivation {
   extendDrvArgs =
     finalAttrs:
     {
-      pname,
-      version,
       nativeBuildInputs ? [ ],
       passthru ? { },
 
@@ -68,6 +66,12 @@ lib.extendMkDerivation {
       ...
     }@args:
     let
+      lakeDeps' = args.lakeDeps or null;
+      lakeHash = args.lakeHash or null;
+      leanDeps = args.leanDeps or [ ];
+      overrideLakeDepsAttrs = args.overrideLakeDepsAttrs or (_: _: { });
+      buildTargets = args.buildTargets or [ ];
+      isLibrary = args.isLibrary or true;
       leanPackageName = args.leanPackageName or finalAttrs.pname;
 
       allLeanDeps = lib.unique (
@@ -75,13 +79,14 @@ lib.extendMkDerivation {
       );
 
       computedLakeDeps =
-        if lakeDeps != null then
-          lakeDeps
+        if lakeDeps' != null then
+          lakeDeps'
         else if lakeHash == null then
           null
         else
           (fetchLakeDeps {
-            inherit (finalAttrs) src pname version;
+            name = finalAttrs.name or "${finalAttrs.pname}-${finalAttrs.version}";
+            inherit (finalAttrs) src;
             hash = lakeHash;
             sourceRoot = finalAttrs.sourceRoot or "";
             patches = finalAttrs.patches or [ ];
@@ -228,8 +233,6 @@ lib.extendMkDerivation {
       };
 
       meta = meta // {
-        # Note: This conflates the platforms that the Lean compiler can run on (a package build system) and the platforms the Lean compiler
-        # can target (build host)
         platforms = meta.platforms or lean4.meta.platforms;
       };
     };