Merge master into staging-next

pkgs/by-name/bo/bomly/package.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  grype,
+  makeBinaryWrapper,
+  nix-update-script,
+  syft,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "bomly";
+  version = "0.16.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bomly-dev";
+    repo = "bomly-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-y4FJCOzgEUprIBy/RuWVIlco4bI0XNUNabRr+2VebgM=";
+  };
+
+  vendorHash = "sha256-qptl09fBZigImxr0ReWIqdmvyeHqr372pZqDnyMHe5A=";
+
+  # .gitattributes excludes all testdata from the GitHub tarball
+  postPatch = ''
+    mkdir -p internal/benchmark/testdata
+    cp ${./scan_targets.json} internal/benchmark/testdata/scan_targets.json
+  '';
+
+  buildInputs = [ makeBinaryWrapper ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  # testdata directories are excluded from the GitHub tarball via .gitattributes
+  doCheck = false;
+
+  ldflags = [
+    "-s"
+    "-X=main.version=${finalAttrs.version}"
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/bomly --prefix PATH : "${
+      lib.makeBinPath [
+        grype
+        syft
+      ]
+    }"
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates";
+    homepage = "https://github.com/bomly-dev/bomly-cli";
+    changelog = "https://github.com/bomly-dev/bomly-cli/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "bomly";
+  };
+})

pkgs/by-name/bo/bomly/scan_targets.json

@@ -0,0 +1,160 @@
+[
+  {
+    "name": "scan-go",
+    "url": "https://github.com/bomly-dev/example-go-gomod",
+    "ref": "v1.0.0",
+    "ecosystem": "go",
+    "tools": ["go"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-npm",
+    "url": "https://github.com/bomly-dev/example-javascript-npm",
+    "ref": "v1.0.0",
+    "ecosystem": "npm",
+    "tools": ["npm"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-maven",
+    "url": "https://github.com/bomly-dev/example-java-maven",
+    "ref": "v1.0.0",
+    "ecosystem": "maven",
+    "tools": ["mvn"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-python-pip",
+    "url": "https://github.com/bomly-dev/example-python-pip",
+    "ref": "fe04c758134b95dab102e1fce10275f7d18c0cf2",
+    "ecosystem": "python",
+    "tools": ["pip"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-composer",
+    "url": "https://github.com/bomly-dev/example-php-composer",
+    "ref": "v1.0.0",
+    "ecosystem": "php",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-bundler",
+    "url": "https://github.com/bomly-dev/example-ruby-bundler",
+    "ref": "v1.0.0",
+    "ecosystem": "ruby",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-github-actions",
+    "url": "https://github.com/bomly-dev/example-github-actions",
+    "ref": "v1.0.0",
+    "ecosystem": "github-actions",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-nuget",
+    "url": "https://github.com/bomly-dev/example-dotnet-nuget",
+    "ref": "v1.0.0",
+    "ecosystem": "dotnet",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-cargo",
+    "url": "https://github.com/bomly-dev/example-rust-cargo",
+    "ref": "v1.0.0",
+    "ecosystem": "rust",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-pub",
+    "url": "https://github.com/bomly-dev/example-dart-pub",
+    "ref": "v1.0.0",
+    "ecosystem": "dart",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-cocoapods",
+    "url": "https://github.com/bomly-dev/example-swift-cocoapods",
+    "ref": "v1.0.0",
+    "ecosystem": "swift",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-mix",
+    "url": "https://github.com/bomly-dev/example-elixir-mix",
+    "ref": "v1.0.0",
+    "ecosystem": "elixir",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-swiftpm",
+    "url": "https://github.com/bomly-dev/example-swift-swiftpm",
+    "ref": "v1.0.0",
+    "ecosystem": "swift",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-sbt",
+    "url": "https://github.com/bomly-dev/example-scala-sbt",
+    "ref": "v1.0.0",
+    "ecosystem": "scala",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-yarn",
+    "url": "https://github.com/bomly-dev/example-javascript-yarn",
+    "ref": "v1.0.0",
+    "ecosystem": "npm",
+    "tools": ["npm"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-pnpm",
+    "url": "https://github.com/bomly-dev/example-javascript-pnpm",
+    "ref": "v1.0.0",
+    "ecosystem": "npm",
+    "tools": ["npm"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-gradle",
+    "url": "https://github.com/bomly-dev/example-java-gradle",
+    "ref": "v1.0.0",
+    "ecosystem": "maven",
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-python-pipenv",
+    "url": "https://github.com/bomly-dev/example-python-pipenv",
+    "ref": "v1.0.0",
+    "ecosystem": "python",
+    "args": ["--install-first"],
+    "tools": ["pipenv"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-python-poetry",
+    "url": "https://github.com/bomly-dev/example-python-poetry",
+    "ref": "v1.0.0",
+    "ecosystem": "python",
+    "tools": ["poetry"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-python-uv",
+    "url": "https://github.com/bomly-dev/example-python-uv",
+    "ref": "v1.0.0",
+    "ecosystem": "python",
+    "args": ["--install-first"],
+    "tools": ["uv"],
+    "benchmark_enabled": true
+  },
+  {
+    "name": "scan-cpp-conan",
+    "url": "https://github.com/bomly-dev/example-cpp-conan",
+    "ref": "v1.0.0",
+    "ecosystem": "cpp",
+    "benchmark_enabled": true
+  }
+]

pkgs/by-name/ki/kingfisher/package.nix

@@ -0,0 +1,67 @@
+{
+  lib,
+  boost,
+  cmake,
+  fetchFromGitHub,
+  libgit2,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rust-jemalloc-sys,
+  rustPlatform,
+  sqlite,
+  versionCheckHook,
+  zlib,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "kingfisher";
+  version = "1.102.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mongodb";
+    repo = "kingfisher";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ksTpxjBGYfZIFx93O0Wa+Z4qbLdur+5oETWHiH6BiNM=";
+  };
+
+  cargoHash = "sha256-+m7rDZvR1nJmNj1IPydQdMq+/Xl7yVdrUO42BxRmkQY=";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    libgit2
+    openssl
+    rust-jemalloc-sys
+    sqlite
+    zlib
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  env = {
+    LIBSQLITE3_SYS_USE_PKG_CONFIG = true;
+  };
+
+  doInstallCheck = true;
+
+  # Integration tests exceed memory limits and can crash
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool to detect leaked secrets and perform live validation";
+    homepage = "https://github.com/mongodb/kingfisher";
+    changelog = "https://github.com/mongodb/kingfisher/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "kingfisher";
+  };
+})

pkgs/by-name/pu/puredns/package.nix

@@ -0,0 +1,63 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  fetchpatch2,
+  makeWrapper,
+  massdns,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "puredns";
+  version = "2.1.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "d3mondev";
+    repo = "puredns";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3I4ZRj0bM6VfdnaG7pG9E4Qw4dpxlX4xJbsOIZu01i0=";
+  };
+
+  vendorHash = "sha256-JB0Xojjh2STXwrpZxCvTgvp80ZLtL0jhhzTsiYOWtIM=";
+
+  overrideModAttrs = _: { patches = finalAttrs.patches; };
+
+  patches = [
+    # https://github.com/d3mondev/puredns/pull/71
+    (fetchpatch2 {
+      name = "bump-go.patch";
+      url = "https://github.com/d3mondev/puredns/commit/4c58955c5d9450b9aecad2213c253a6eb2670c33.patch?full_index=1";
+      hash = "sha256-CzlfN4ld065O7OVI5vILeyvv+jWBbAeweVgkeL80UDY=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    massdns
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  ldflags = [ "-s" ];
+
+  postFixup = ''
+    wrapProgram $out/bin/puredns --prefix PATH : "${lib.makeBinPath [ massdns ]}"
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Domain resolver and subdomain bruteforcing tool";
+    homepage = "https://github.com/d3mondev/puredns";
+    changelog = "https://github.com/d3mondev/puredns/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "puredns";
+  };
+})

pkgs/by-name/sk/skewrun/package.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  fetchFromGitHub,
+  libfaketime,
+  makeBinaryWrapper,
+  nix-update-script,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "skewrun";
+  version = "1.1.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "JVBotelho";
+    repo = "skewrun";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-C4LF2am3gnQb+k9cdfB2xcszZ5imRBwz0ldP0gjfXRs=";
+  };
+
+  cargoHash = "sha256-hGJvirVLtP1ondLxJuyfiV7Y0+pGt8Pu3lzLAhRYtoo=";
+
+  buildInputs = [
+    libfaketime
+    makeBinaryWrapper
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/skewrun --prefix PATH : "${
+      lib.makeBinPath [
+        libfaketime
+      ]
+    }"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Active Directory time discovery toolkit";
+    homepage = "https://github.com/JVBotelho/skewrun";
+    changelog = "https://github.com/JVBotelho/skewrun/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "skewrun";
+  };
+})

pkgs/by-name/su/subcat/package.nix

@@ -6,21 +6,26 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "subcat";
-  version = "1.4.0-unstable-2025-05-13";
+  version = "1.6.0-unstable-2026-06-28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "duty1g";
     repo = "subcat";
-    rev = "1b3d015b064f244bfbc05114e4d30ab17861fb46";
-    hash = "sha256-Jft+3ZM9+luvRwO/pL3iTYkz+322TQ/HTD38MttJjQU=";
+    # https://github.com/duty1g/subcat/issues/10
+    rev = "19535a896f60573a234d5b266d08cc6e78d8a525";
+    hash = "sha256-E6gK5CHuFyu3GPyofHErlu92RAgl6jBPfWbTTX3aNtA=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
 
   dependencies = with python3.pkgs; [
+    aiohttp
+    dnspython
+    playwright
     pyyaml
     requests
+    rich
     urllib3
   ];
 

pkgs/by-name/tl/tldfinder/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "tldfinder";
+  version = "0.0.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "projectdiscovery";
+    repo = "tldfinder";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GUhhZK9jNGRQKDL6PIUmbVwhcFIUSI92YRnx0UcL680=";
+  };
+
+  vendorHash = "sha256-lY9AouIIj2OFBRLeaE/8KdF2siiBTuD8ieWdPZVNI9I=";
+
+  ldflags = [ "-s" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for discovering private TLDs";
+    homepage = "https://github.com/projectdiscovery/tldfinder";
+    changelog = "https://github.com/projectdiscovery/tldfinder/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "tldfinder";
+  };
+})

pkgs/by-name/wh/whale/package.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  gitMinimal,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "whale";
+  version = "0.1.62";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "usewhale";
+    repo = "Whale";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EvuNdgpW5M+i33tGLurQDq0z+Ht/z5agIsaWWapXqpY=";
+  };
+
+  vendorHash = "sha256-YBY5b2SLcWeiCQDZELJdsi+mJ+YEuo+yTbotUlLgqEA=";
+
+  nativeCheckInputs = [
+    gitMinimal
+    writableTmpDirAsHomeHook
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  ldflags = [
+    "-s"
+    "-X=github.com/usewhale/whale/internal/build.Version=${finalAttrs.version}"
+  ];
+
+  excludedPackages = [ "cmd/dev" ];
+
+  checkFlags = [
+    # Fails in the sandbox
+    "-skip=TestRulePolicyMCPPathOutsideWorkspaceRequiresExternalDirectoryApproval"
+  ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal-first AI coding agent for DeepSeek";
+    homepage = "https://github.com/usewhale/Whale";
+    changelog = "https://github.com/usewhale/Whale/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "whale";
+  };
+})

pkgs/development/compilers/go/1.27.nix

@@ -0,0 +1,204 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  tzdata,
+  replaceVars,
+  iana-etc,
+  mailcap,
+  buildPackages,
+  pkgsBuildTarget,
+  targetPackages,
+  # for testing
+  buildGo127Module,
+  callPackage,
+}:
+
+let
+  goBootstrap = buildPackages.callPackage ./bootstrap124.nix { };
+
+  # We need a target compiler which is still runnable at build time,
+  # to handle the cross-building case where build != host == target
+  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+
+  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "go";
+  version = "1.27rc1";
+
+  src = fetchurl {
+    url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
+    hash = "sha256-M49R9VfG2xI1o+64mgk2r29ODUEWKR7zuOQRhrxlUzQ=";
+  };
+
+  strictDeps = true;
+  buildInputs =
+    [ ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.libc.out ]
+    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
+
+  depsBuildTarget = lib.optional isCross targetCC;
+
+  depsTargetTarget = lib.optional stdenv.targetPlatform.isMinGW targetPackages.threads.package;
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  patches = [
+    (replaceVars ./iana-etc-1.25.patch {
+      iana = iana-etc;
+    })
+    # Patch the mimetype database location which is missing on NixOS.
+    # but also allow static binaries built with NixOS to run outside nix
+    (replaceVars ./mailcap-1.17.patch {
+      inherit mailcap;
+    })
+    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
+    # that run outside a nix server
+    (replaceVars ./tzdata-1.19.patch {
+      inherit tzdata;
+    })
+    ./remove-tools-1.11.patch
+    ./go_no_vendor_checks-1.27.patch
+    ./go-env-go_ldso.patch
+  ];
+
+  env = {
+    inherit (stdenv.targetPlatform.go) GOOS GOARCH GOARM;
+    # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+    # Go will nevertheless build a for host system that we will copy over in
+    # the install phase.
+    GOHOSTOS = stdenv.buildPlatform.go.GOOS;
+    GOHOSTARCH = stdenv.buildPlatform.go.GOARCH;
+
+    GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+    # Wasi does not support CGO
+    # ppc64/linux CGO is incomplete/borked, and will likely not receive any further improvements
+    # https://github.com/golang/go/issues/8912
+    # https://github.com/golang/go/issues/13192
+    CGO_ENABLED =
+      if
+        (
+          stdenv.targetPlatform.isWasi
+          || (stdenv.targetPlatform.isPower64 && stdenv.targetPlatform.isBigEndian)
+        )
+      then
+        0
+      else
+        1;
+
+    GOROOT_BOOTSTRAP = "${goBootstrap}/share/go";
+  }
+  // lib.optionalAttrs isCross {
+    # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+    # to be different from CC/CXX
+    CC_FOR_TARGET = "${targetCC}/bin/${targetCC.targetPrefix}cc";
+    CXX_FOR_TARGET = "${targetCC}/bin/${targetCC.targetPrefix}c++";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    export GOCACHE=$TMPDIR/go-cache
+    if [ -f "$NIX_CC/nix-support/dynamic-linker" ]; then
+      export GO_LDSO=$(cat $NIX_CC/nix-support/dynamic-linker)
+    fi
+
+    export PATH=$(pwd)/bin:$PATH
+
+    ${lib.optionalString isCross ''
+      # Independent from host/target, CC should produce code for the building system.
+      # We only set it when cross-compiling.
+      export CC=${buildPackages.stdenv.cc}/bin/cc
+      # Prefer external linker for cross when CGO is supported, since
+      # we haven't taught go's internal linker to pick the correct ELF
+      # interpreter for cross
+      # When CGO is not supported we rely on static binaries being built
+      # since they don't need an ELF interpreter
+      export GO_EXTLINK_ENABLED=${toString finalAttrs.env.CGO_ENABLED}
+    ''}
+    ulimit -a
+
+    pushd src
+    ./make.bash
+    popd
+    runHook postBuild
+  '';
+
+  preInstall = ''
+    # Contains the wrong perl shebang when cross compiling,
+    # since it is not used for anything we can deleted as well.
+    rm src/regexp/syntax/make_perl_groups.pl
+  ''
+  + (
+    if (stdenv.buildPlatform.system != stdenv.hostPlatform.system) then
+      ''
+        mv bin/*_*/* bin
+        rmdir bin/*_*
+        ${lib.optionalString
+          (
+            !(
+              finalAttrs.env.GOHOSTARCH == finalAttrs.env.GOARCH && finalAttrs.env.GOOS == finalAttrs.env.GOHOSTOS
+            )
+          )
+          ''
+            rm -rf pkg/${finalAttrs.env.GOHOSTOS}_${finalAttrs.env.GOHOSTARCH} pkg/tool/${finalAttrs.env.GOHOSTOS}_${finalAttrs.env.GOHOSTARCH}
+          ''
+        }
+      ''
+    else
+      lib.optionalString (stdenv.hostPlatform.system != stdenv.targetPlatform.system) ''
+        rm -rf bin/*_*
+        ${lib.optionalString
+          (
+            !(
+              finalAttrs.env.GOHOSTARCH == finalAttrs.env.GOARCH && finalAttrs.env.GOOS == finalAttrs.env.GOHOSTOS
+            )
+          )
+          ''
+            rm -rf pkg/${finalAttrs.env.GOOS}_${finalAttrs.env.GOARCH} pkg/tool/${finalAttrs.env.GOOS}_${finalAttrs.env.GOARCH}
+          ''
+        }
+      ''
+  );
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/go
+    cp -a bin pkg src lib misc api doc go.env VERSION $out/share/go
+    mkdir -p $out/bin
+    ln -s $out/share/go/bin/* $out/bin
+    runHook postInstall
+  '';
+
+  disallowedReferences = [ goBootstrap ];
+
+  passthru = {
+    inherit goBootstrap;
+    tests = callPackage ./tests.nix {
+      go = finalAttrs.finalPackage;
+      buildGoModule = buildGo127Module;
+    };
+  };
+
+  __structuredAttrs = true;
+
+  meta = {
+    changelog = "https://go.dev/doc/devel/release#go${lib.versions.majorMinor finalAttrs.version}";
+    description = "Go Programming language";
+    homepage = "https://go.dev/";
+    license = lib.licenses.bsd3;
+    teams = [ lib.teams.golang ];
+    platforms =
+      lib.platforms.darwin ++ lib.platforms.linux ++ lib.platforms.wasi ++ lib.platforms.freebsd;
+    badPlatforms = [
+      # Support for big-endian POWER < 8 was dropped in 1.9, but POWER8 users have less of a reason to run in big-endian mode than pre-POWER8 ones
+      # So non-LE ppc64 is effectively unsupported, and Go SIGILLs on affordable ppc64 hardware
+      # https://github.com/golang/go/issues/19074 - Dropped support for big-endian POWER < 8, with community pushback
+      # https://github.com/golang/go/issues/73349 - upstream will not accept submissions to fix this
+      "powerpc64-linux"
+    ];
+    mainProgram = "go";
+  };
+})

pkgs/development/compilers/go/go_no_vendor_checks-1.27.patch

@@ -0,0 +1,26 @@
+diff --git a/src/cmd/go/internal/modload/import.go b/src/cmd/go/internal/modload/import.go
+index 98f17ccff15b3378c44350615e19226b5b8ee68f..964f86a6dd25ed0c25a923ae4e946da8a2eff713 100644
+--- a/src/cmd/go/internal/modload/import.go
++++ b/src/cmd/go/internal/modload/import.go
+@@ -350,7 +350,7 @@ func importFromModules(ld *Loader, ctx context.Context, path string, rs *Require
+ 				// vendor/modules.txt does not exist or the user manually added directories to the vendor directory.
+ 				// Go 1.23 and later require vendored packages to be present in modules.txt to be imported.
+ 				_, ok := vendorPkgModule[path]
+-				if ok || (gover.Compare(ld.MainModules.GoVersion(ld), gover.ExplicitModulesTxtImportVersion) < 0) {
++				if ok || (gover.Compare(ld.MainModules.GoVersion(ld), gover.ExplicitModulesTxtImportVersion) < 0) || os.Getenv("GO_NO_VENDOR_CHECKS") == "1" {
+ 					mods = append(mods, vendorPkgModule[path])
+ 					dirs = append(dirs, dir)
+ 					roots = append(roots, vendorDir)
+diff --git a/src/cmd/go/internal/modload/vendor.go b/src/cmd/go/internal/modload/vendor.go
+index 577e8f67769e0e92958ebcb684b3afa124014b64..ea7a45d90bcfb1dade2178e222b85ff52dee75b5 100644
+--- a/src/cmd/go/internal/modload/vendor.go
++++ b/src/cmd/go/internal/modload/vendor.go
+@@ -159,7 +159,7 @@ func checkVendorConsistency(ld *Loader, indexes []*modFileIndex, modFiles []*mod
+ 			panic(fmt.Errorf("not in workspace mode but number of indexes is %v, not 1", len(indexes)))
+ 		}
+ 		index := indexes[0]
+-		if gover.Compare(index.goVersion, "1.14") < 0 {
++		if gover.Compare(index.goVersion, "1.14") < 0 || (os.Getenv("GO_NO_VENDOR_CHECKS") == "1" && len(vendorMeta) == 0) {
+ 			// Go versions before 1.14 did not include enough information in
+ 			// vendor/modules.txt to check for consistency.
+ 			// If we know that we're on an earlier version, relax the consistency check.

pkgs/development/python-modules/moyopy/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "moyopy";
-  version = "0.13.0";
+  version = "0.14.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "spglib";
     repo = "moyo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-obGrnXu1ldYAR5SL6ghaQAUFsNX68kXQJwGpskAriX4=";
+    hash = "sha256-xDgkKwWZovHgkJH3Jcp7/Yz8oAySdDVEbrOCGIpdI4c=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/moyopy";
@@ -47,7 +47,7 @@ buildPythonPackage (finalAttrs: {
       sourceRoot
       cargoRoot
       ;
-    hash = "sha256-7tdPpQ/BL5j1M+sAEyVBeIobto8csEO6lUmEhbQdZK8=";
+    hash = "sha256-xivPb07t7MPK09SCeXQqyycrI0WB+LgOB15pIA6cAkE=";
   };
 
   build-system = [

pkgs/top-level/all-packages.nix

@@ -7007,6 +7007,11 @@ with pkgs;
     go = buildPackages.go_1_26;
   };
 
+  inherit ({ go_1_27 = callPackage ../development/compilers/go/1.27.nix { }; }) go_1_27;
+  buildGo127Module = callPackage ../build-support/go/module.nix {
+    go = buildPackages.go_1_27;
+  };
+
   ### DEVELOPMENT / HARE
 
   hareHook = callPackage ../by-name/ha/hare/hook.nix { };