Merge staging-next into haskell-updates

doc/languages-frameworks/javascript.section.md

@@ -348,6 +348,48 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
+It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnpm_10`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version. To do so, you can pass the `pnpm` argument to `fetchPnpmDeps` and override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
+
+<!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
+
+```diff
+ {
+   fetchPnpmDeps,
+   nodejs,
+-  pnpm,
++  pnpm_10,
+   pnpmConfigHook,
+   stdenv,
+ }:
++let
++  # Optionally override pnpm to use a custom nodejs version
++  # Make sure that the same nodejs version is referenced in nativeBuildInputs
++  # pnpm = pnpm_10.override { nodejs = nodejs-slim_22; };
++in
+ stdenv.mkDerivation (finalAttrs: {
+   pname = "foo";
+   version = "0-unstable-1980-01-01";
+
+   src = {
+     #...
+   };
+
+   nativeBuildInputs = [
+     nodejs # in case scripts are run outside of a pnpm call
+     pnpmConfigHook
+-    pnpm # At least required by pnpmConfigHook, if not other (custom) phases
++    pnpm_10 # At least required by pnpmConfigHook, if not other (custom) phases
+   ];
+
+   pnpmDeps = fetchPnpmDeps {
+     inherit (finalAttrs) pname version src;
++    pnpm = pnpm_10;
+     fetcherVersion = 3;
+     hash = "...";
+   };
+ })
+```
+
 In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`.
 
 `pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:

doc/release-notes/rl-2605.section.md

@@ -251,6 +251,8 @@
 
 - Ethercalc and its associated module have been removed, as the package is unmaintained and cannot be installed from source with npm now.
 
+- The `services.avahi.wideArea` option now defaults to `false` as a mitigation against [`CVE-2024-52615`/`GHSA-x6vp-f33h-h32g`](https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g).
+
 - `coreth` has been removed, as upstream has moved it into `avalanchego`.
 
 - `nodePackages.prebuild-install` was removed because it appeared to be unmaintained upstream.
@@ -388,7 +390,7 @@ gnuradioMinimal.override {
 
 ### Breaking changes {#sec-nixpkgs-release-26.05-lib-breaking}
 
-- The `nodejs_latest` alias now points to `nodejs_25` instead of `nodejs_24`.
+- The `nodejs_latest` alias now points to `nodejs_26` instead of `nodejs_24`.
 
 - `nodejs-slim` no longer exposes a `corepack` executable, it has been moved to an ad-hoc output; to restore the previous behavior, `nodejs-slim.corepack` must be explicitely included.
 

maintainers/maintainer-list.nix

@@ -1803,6 +1803,12 @@
     matrix = "@andrewzah:matrix.abare.party";
     keys = [ { fingerprint = "D87B D9DC F11B ACD6 CDB4 0CB2 1373 2FB1 3E61 E0BE"; } ];
   };
+  andrinoff = {
+    name = "Drew Smirnoff";
+    email = "me@andrinoff.com";
+    github = "andrinoff";
+    githubId = 175145001;
+  };
   Andy3153 = {
     name = "Andrei Dobrete";
     email = "andy3153@protonmail.com";
@@ -9510,6 +9516,11 @@
     name = "Faye Chun";
     keys = [ { fingerprint = "ACB8 DB1F E88D A908 6332  BDB1 5A71 B010 2FD7 3FC0"; } ];
   };
+  fxai = {
+    github = "fxai";
+    githubId = 44463990;
+    name = "fxai";
+  };
   fxfactorial = {
     email = "edgar.factorial@gmail.com";
     github = "fxfactorial";
@@ -29763,7 +29774,7 @@
   wolfram444 = {
     name = "Xabibulloh To'xtayev";
     email = "kamiltox2006@gmail.com";
-    github = "woolfram444";
+    github = "wolfram444";
     githubId = 109225370;
   };
   womeier = {
@@ -30052,6 +30063,12 @@
     githubId = 5629059;
     name = "Xavier Lambein";
   };
+  xmnlz = {
+    name = "xmnlz";
+    github = "xmnlz";
+    githubId = 63904972;
+    email = "lemmeq9+nixos@gmail.com";
+  };
   xnaveira = {
     email = "xnaveira@gmail.com";
     github = "xnaveira";

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -187,6 +187,17 @@
 
 - `services.pyload` has been removed because the package it relies on does not exist anymore in nixpkgs due to vulnerabilities and being unmaintained.
 
+- Removed the ability from systemd to start units installed via `nix-env -i`.
+  This feature is hardly used and most units do not work without NixOS specific
+  changes anyways. Removing this allows us to drop a custom systemd patch
+  improving systemd maintainability and update speed.
+
+- Removed the ability from systemd to depend on open-yet-unformatted dm-crypt
+  devices as systemd device units. For example you cannot call systemd-makefs
+  on such devices. This was never implemented upstream but patched into
+  Nixpkgs's systemd. Removing this allows us to drop a custom systemd patch
+  improving systemd maintainability and update speed.
+
 - `linux_hardened` kernel has been removed due to a lack of maintenance.
 
 - `services.tandoor-recipes` now uses a sub-directory for media files by default starting with `26.05`. Existing setups should move media files out of the data directory and adjust `services.tandoor-recipes.extraConfig.MEDIA_ROOT` accordingly. See [Migrating media files for pre 26.05 installations](#module-services-tandoor-recipes-migrating-media).

nixos/modules/config/console.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.console;
+  i18nCfg = config.i18n;
 
   makeColor = i: lib.concatMapStringsSep "," (x: "0x" + lib.substring (2 * i) 2 x);
 
@@ -162,8 +163,10 @@ in
           environment.systemPackages = [ pkgs.kbd ];
 
           # Let systemd-vconsole-setup.service do the work of setting up the
-          # virtual consoles.
-          environment.etc."vconsole.conf".source = vconsoleConf;
+          # virtual consoles. Skip when imperative so localectl can manage it.
+          environment.etc."vconsole.conf" = lib.mkIf (!i18nCfg.imperativeLocale) {
+            source = vconsoleConf;
+          };
           # Provide kbd with additional packages.
           environment.etc.kbd.source = "${consoleEnv pkgs.kbd}/share";
 
@@ -212,13 +215,22 @@ in
             "systemd-vconsole-setup.service"
           ];
 
+          # When imperative, seed /etc/vconsole.conf on first boot from declared
+          # defaults so the keymap isn't lost before localectl is ever used
+          systemd.tmpfiles.rules = lib.mkIf i18nCfg.imperativeLocale [
+            "C /etc/vconsole.conf - - - - ${vconsoleConf}"
+          ];
+
           systemd.services.reload-systemd-vconsole-setup = {
             description = "Reset console on configuration changes";
             wantedBy = [ "multi-user.target" ];
-            restartTriggers = [
-              vconsoleConf
-              (consoleEnv pkgs.kbd)
-            ];
+            restartTriggers =
+              lib.optionals (!i18nCfg.imperativeLocale) [
+                vconsoleConf
+              ]
+              ++ [
+                (consoleEnv pkgs.kbd)
+              ];
             reloadIfChanged = true;
             serviceConfig = {
               RemainAfterExit = true;

nixos/modules/config/i18n.nix

@@ -5,24 +5,29 @@
   ...
 }:
 let
+  cfg = config.i18n;
+  localeConf = pkgs.writeText "locale.conf" ''
+    LANG=${cfg.defaultLocale}
+    ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "${n}=${v}") cfg.extraLocaleSettings)}
+  '';
   sanitizeUTF8Capitalization =
     lang: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] lang);
   aggregatedLocales =
-    lib.optionals (config.i18n.defaultLocale != "C") [
-      "${config.i18n.defaultLocale}/${config.i18n.defaultCharset}"
+    lib.optionals (cfg.defaultLocale != "C") [
+      "${cfg.defaultLocale}/${cfg.defaultCharset}"
     ]
-    ++ lib.pipe config.i18n.extraLocaleSettings [
+    ++ lib.pipe cfg.extraLocaleSettings [
       # See description of extraLocaleSettings for why is this ignored here.
       (x: lib.removeAttrs x [ "LANGUAGE" ])
       (lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
       # C locales are always installed
       (lib.filterAttrs (n: v: v != "C"))
-      (lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
+      (lib.mapAttrsToList (LCRole: lang: lang + "/" + (cfg.localeCharsets.${LCRole} or "UTF-8")))
     ]
     ++ (map sanitizeUTF8Capitalization (
-      lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales
+      lib.optionals (builtins.isList cfg.extraLocales) cfg.extraLocales
     ))
-    ++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
+    ++ (lib.optional (builtins.isString cfg.extraLocales) cfg.extraLocales);
 in
 {
   ###### interface
@@ -33,8 +38,8 @@ in
       glibcLocales = lib.mkOption {
         type = lib.types.path;
         default = pkgs.glibcLocales.override {
-          allLocales = lib.elem "all" config.i18n.supportedLocales;
-          locales = config.i18n.supportedLocales;
+          allLocales = lib.elem "all" cfg.supportedLocales;
+          locales = cfg.supportedLocales;
         };
         defaultText = lib.literalExpression ''
           pkgs.glibcLocales.override {
@@ -143,6 +148,16 @@ in
         '';
       };
 
+      imperativeLocale = lib.mkEnableOption ''
+        imperative locale and keyboard management via localectl.
+
+        When enabled, locale and keyboard settings can be changed at runtime
+        using `localectl set-locale` and `localectl set-keymap`.
+        When disabled (the default), these settings are managed declaratively
+        through {option}`i18n.defaultLocale`, {option}`i18n.extraLocaleSettings`,
+        and {option}`console.keyMap`.
+      '';
+
     };
 
   };
@@ -154,8 +169,8 @@ in
       lib.optional
         (
           !(
-            (lib.subtractLists config.i18n.supportedLocales aggregatedLocales) == [ ]
-            || lib.elem "all" config.i18n.supportedLocales
+            (lib.subtractLists cfg.supportedLocales aggregatedLocales) == [ ]
+            || lib.elem "all" cfg.supportedLocales
           )
         )
         ''
@@ -171,25 +186,34 @@ in
 
     environment.systemPackages =
       # We increase the priority a little, so that plain glibc in systemPackages can't win.
-      lib.optional (config.i18n.supportedLocales != [ ]) (lib.setPrio (-1) config.i18n.glibcLocales);
+      lib.optional (cfg.supportedLocales != [ ]) (lib.setPrio (-1) cfg.glibcLocales);
 
     environment.sessionVariables = {
-      LANG = config.i18n.defaultLocale;
       LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
     }
-    // config.i18n.extraLocaleSettings;
+    # When imperative, leave LANG/LC_* to pam_systemd so /etc/set-environment
+    # does not override what localectl wrote to /etc/locale.conf.
+    // lib.optionalAttrs (!cfg.imperativeLocale) (
+      {
+        LANG = cfg.defaultLocale;
+      }
+      // cfg.extraLocaleSettings
+    );
 
-    systemd.globalEnvironment = lib.mkIf (config.i18n.supportedLocales != [ ]) {
-      LOCALE_ARCHIVE = "${config.i18n.glibcLocales}/lib/locale/locale-archive";
+    systemd.globalEnvironment = lib.mkIf (cfg.supportedLocales != [ ]) {
+      LOCALE_ARCHIVE = "${cfg.glibcLocales}/lib/locale/locale-archive";
     };
 
     # ‘/etc/locale.conf’ is used by systemd.
-    environment.etc."locale.conf".source = pkgs.writeText "locale.conf" ''
-      LANG=${config.i18n.defaultLocale}
-      ${lib.concatStringsSep "\n" (
-        lib.mapAttrsToList (n: v: "${n}=${v}") config.i18n.extraLocaleSettings
-      )}
-    '';
+    # If imperative, see below
+    environment.etc."locale.conf" = lib.mkIf (!cfg.imperativeLocale) {
+      source = localeConf;
+    };
 
+    # When imperative, seed /etc/locale.conf on first boot from declared defaults
+    # so the system doesn’t fall back to C.UTF-8
+    systemd.tmpfiles.rules = lib.mkIf cfg.imperativeLocale [
+      "C /etc/locale.conf - - - - ${localeConf}"
+    ];
   };
 }

nixos/modules/config/locale.nix

@@ -86,10 +86,6 @@ in
     # This way services are restarted when tzdata changes.
     systemd.globalEnvironment.TZDIR = tzdir;
 
-    systemd.services.systemd-timedated.environment = lib.optionalAttrs (config.time.timeZone != null) {
-      NIXOS_STATIC_TIMEZONE = "1";
-    };
-
     environment.etc = {
       zoneinfo.source = tzdir;
     }

nixos/modules/services/desktop-managers/gnome.nix

@@ -469,6 +469,7 @@ in
         pkgs.gnome-maps
         pkgs.gnome-music
         pkgs.gnome-system-monitor
+        pkgs.gnome-tecla
         pkgs.gnome-weather
         pkgs.loupe
         pkgs.nautilus

nixos/modules/services/display-managers/gdm.nix

@@ -44,6 +44,10 @@ let
   defaultSessionName = config.services.displayManager.defaultSession;
 
   setSessionScript = pkgs.callPackage ../x11/display-managers/account-service-util.nix { };
+
+  greeterEnvFile = pkgs.writeText "gdm-greeter-env" ''
+    DCONF_PROFILE=gdm
+  '';
 in
 
 {
@@ -103,6 +107,12 @@ in
       [ "services" "xserver" "displayManager" "gdm" "autoLogin" "delay" ]
       [ "services" "displayManager" "gdm" "autoLogin" "delay" ]
     )
+    (lib.mkRemovedOptionModule [
+      "services"
+      "displayManager"
+      "gdm"
+      "wayland"
+    ] "Disabling this option is no longer supported with GNOME 50.")
   ];
 
   meta = {
@@ -128,14 +138,6 @@ in
         '';
       };
 
-      wayland = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = ''
-          Allow GDM to run on Wayland instead of Xserver.
-        '';
-      };
-
       autoSuspend = lib.mkOption {
         default = true;
         description = ''
@@ -361,7 +363,6 @@ in
     # presented and there's a little delay.
     services.displayManager.gdm.settings = {
       daemon = lib.mkMerge [
-        { WaylandEnable = cfg.wayland; }
         # nested if else didn't work
         (lib.mkIf (config.services.displayManager.autoLogin.enable && cfg.autoLogin.delay != 0) {
           TimedLoginEnable = true;
@@ -455,6 +456,12 @@ in
               settings.conffile = "/etc/pam/environment";
               settings.readenv = 0;
             }
+            {
+              name = "env-greeter";
+              control = "required";
+              modulePath = "${config.security.pam.package}/lib/security/pam_env.so";
+              settings.envfile = greeterEnvFile;
+            }
             {
               name = "systemd";
               control = "optional";

nixos/modules/services/networking/avahi-daemon.nix

@@ -155,8 +155,12 @@ in
 
     wideArea = lib.mkOption {
       type = lib.types.bool;
-      default = true;
-      description = "Whether to enable wide-area service discovery.";
+      default = false;
+      description = ''
+        Whether to enable wide-area service discovery.
+
+        It is recommended to keep this options disabled as it exposes the system to `CVE-2024-52615`/`GHSA-x6vp-f33h-h32g`.
+      '';
     };
 
     reflector = lib.mkOption {
@@ -279,6 +283,10 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    warnings = [
+      (lib.mkIf cfg.wideArea "Enabling `services.avahi.wideArea` exposes this system to `CVE-2024-52615`.")
+    ];
+
     users.users.avahi = {
       description = "avahi-daemon privilege separation user";
       home = "/var/empty";

nixos/modules/system/activation/top-level.nix

@@ -42,7 +42,7 @@ let
 
     ${config.system.systemBuilderCommands}
 
-    cp "$extraDependenciesPath" "$out/extra-dependencies"
+    printf "%s" "$extraDependencies" > "$out/extra-dependencies"
 
     ${optionalString (!config.boot.isContainer && config.boot.bootspec.enable) ''
       ${config.boot.bootspec.writer}
@@ -60,7 +60,6 @@ let
       name = "nixos-system-${config.system.name}-${config.system.nixos.label}";
       preferLocalBuild = true;
       allowSubstitutes = false;
-      passAsFile = [ "extraDependencies" ];
       buildCommand = systemBuilder;
 
       systemd = config.systemd.package;
@@ -70,6 +69,9 @@ let
       inherit (config.system) extraDependencies;
     }
     // config.system.systemBuilderArgs
+    // {
+      __structuredAttrs = true;
+    }
   );
 
   # Handle assertions and warnings

nixos/modules/system/boot/systemd.nix

@@ -603,6 +603,10 @@ in
 
     environment.systemPackages = [ cfg.package ];
 
+    environment.variables = {
+      SYSTEMD_XKB_DIRECTORY = "/etc/X11/xkb";
+    };
+
     environment.etc =
       let
         # generate contents for /etc/systemd/${dir} from attrset of links and packages
@@ -800,7 +804,10 @@ in
     systemd.services.systemd-update-utmp.restartIfChanged = false;
     systemd.targets.local-fs.unitConfig.X-StopOnReconfiguration = true;
     systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
-    systemd.services.systemd-importd.environment = proxy_env;
+    systemd.services.systemd-importd = lib.mkIf cfg.package.withImportd {
+      environment = proxy_env;
+      path = [ pkgs.gnupg ];
+    };
     systemd.services.systemd-pstore.wantedBy = [ "sysinit.target" ]; # see #81138
 
     # NixOS has kernel modules in a different location, so override that here.
@@ -822,10 +829,12 @@ in
     # because either the overlay is mutable (and users can legitimately change
     # values without them being overridden) or it is immutable and systemd will
     # suggest to only make runtime changes.
-    systemd.services."systemd-localed".environment = lib.mkIf (!config.system.etc.overlay.enable) {
-      SYSTEMD_ETC_LOCALE_CONF = "/etc/static/locale.conf";
-      SYSTEMD_ETC_VCONSOLE_CONF = "/etc/static/vconsole.conf";
-    };
+    systemd.services."systemd-localed".environment =
+      lib.mkIf (!config.system.etc.overlay.enable && !config.i18n.imperativeLocale)
+        {
+          SYSTEMD_ETC_LOCALE_CONF = "/etc/static/locale.conf";
+          SYSTEMD_ETC_VCONSOLE_CONF = "/etc/static/vconsole.conf";
+        };
     systemd.services."systemd-timedated".environment =
       lib.mkIf (!config.system.etc.overlay.enable && config.time.timeZone != null)
         {

nixos/modules/system/boot/systemd/sysupdate.nix

@@ -136,7 +136,10 @@ in
       "systemd-sysupdated.service"
     ];
 
-    systemd.services.systemd-sysupdated.aliases = [ "dbus-org.freedesktop.sysupdate1.service" ];
+    systemd.services.systemd-sysupdated = {
+      aliases = [ "dbus-org.freedesktop.sysupdate1.service" ];
+      path = [ pkgs.gnupg ];
+    };
 
     systemd.timers = {
       "systemd-sysupdate" = {

nixos/tests/all-tests.nix

@@ -378,6 +378,7 @@ in
   collectd = runTest ./collectd.nix;
   commafeed = runTest ./commafeed.nix;
   connman = runTest ./connman.nix;
+  console = runTest ./console.nix;
   console-xkb-and-i18n = runTest ./console-xkb-and-i18n.nix;
   consul = runTest ./consul.nix;
   consul-template = runTest ./consul-template.nix;
@@ -912,6 +913,7 @@ in
   llama-swap = runTest ./web-servers/llama-swap.nix;
   lldap = runTest ./lldap.nix;
   local-content-share = runTest ./local-content-share.nix;
+  locale = runTest ./locale.nix;
   localsend = runTest ./localsend.nix;
   locate = runTest ./locate.nix;
   login = runTest ./login.nix;

nixos/tests/console.nix

@@ -0,0 +1,72 @@
+{ ... }:
+{
+  name = "console";
+  meta.maintainers = [ ];
+
+  nodes =
+    let
+      # Temporary dirty workaround for nixpkgs/issues/286283
+      # Point directly to pkgs.kbd (real files) rather than /etc/kbd/keymaps
+      # (which goes through consoleEnv's buildEnv and contains only symlinks).
+      # systemd-localed follows the directory symlink but not individual file
+      # symlinks inside it, so buildEnv-based paths yield no usable keymaps.
+      missingKeymapsWorkaround =
+        { pkgs, ... }:
+        {
+          systemd.tmpfiles.rules = [
+            "L /usr/share/keymaps - - - - ${pkgs.kbd}/share/keymaps"
+          ];
+        };
+    in
+    {
+      node_static =
+        { ... }:
+        {
+          imports = [ missingKeymapsWorkaround ];
+          console.keyMap = "lt";
+        };
+
+      node_imperative =
+        { ... }:
+        {
+          imports = [ missingKeymapsWorkaround ];
+          console.keyMap = "lt";
+          i18n.imperativeLocale = true;
+        };
+    };
+
+  testScript =
+    { ... }:
+    ''
+      node_static.wait_for_unit("dbus.socket")
+
+      with subtest("static - declared keymap is reported by localectl"):
+          node_static.succeed("localectl status | grep -q 'VC Keymap: lt'")
+
+      with subtest("static - keymap reverts to declared value after reboot"):
+          # Unlike localectl set-locale, vconsole_write_data() in systemd's
+          # localed-util.c writes to a hardcoded /etc/vconsole.conf path rather
+          # than respecting SYSTEMD_ETC_VCONSOLE_CONF, so the set-keymap call
+          # itself always succeeds. The static guarantee is that NixOS activation
+          # restores the symlink on reboot, reverting any runtime changes.
+          node_static.succeed("localectl set-keymap fr")
+          node_static.succeed("localectl status | grep -q 'VC Keymap: fr'")
+          node_static.shutdown()
+          node_static.wait_for_unit("dbus.socket")
+          node_static.succeed("localectl status | grep -q 'VC Keymap: lt'")
+
+      node_imperative.wait_for_unit("dbus.socket")
+
+      with subtest("imperative - declared keymap is reported by localectl on first boot"):
+          node_imperative.succeed("localectl status | grep -q 'VC Keymap: lt'")
+
+      with subtest("imperative - localectl set-keymap changes the keymap"):
+          node_imperative.succeed("localectl set-keymap --no-convert fr")
+          node_imperative.succeed("localectl status | grep -q 'VC Keymap: fr'")
+
+      with subtest("imperative - keymap change persists across reboot"):
+          node_imperative.shutdown()
+          node_imperative.wait_for_unit("dbus.socket")
+          node_imperative.succeed("localectl status | grep -q 'VC Keymap: fr'")
+    '';
+}

nixos/tests/gnome-extensions.nix

@@ -23,10 +23,9 @@
 
       # Configure GDM
       services.xserver.enable = true;
-      services.xserver.displayManager.gdm = {
+      services.displayManager.gdm = {
         enable = true;
         debug = true;
-        wayland = true;
       };
       services.displayManager.autoLogin = {
         enable = true;
@@ -38,7 +37,7 @@
       services.desktopManager.gnome.debug = true;
 
       systemd.user.services = {
-        "org.gnome.Shell@wayland" = {
+        "org.gnome.Shell@" = {
           serviceConfig = {
             ExecStart = [
               # Clear the list before overriding it.

nixos/tests/gnome.nix

@@ -9,8 +9,6 @@
     {
       imports = [ ./common/user-account.nix ];
 
-      services.xserver.enable = true;
-
       services.displayManager.gdm = {
         enable = true;
         debug = true;
@@ -25,7 +23,7 @@
       services.desktopManager.gnome.debug = true;
 
       systemd.user.services = {
-        "org.gnome.Shell@wayland" = {
+        "org.gnome.Shell@" = {
           serviceConfig = {
             ExecStart = [
               # Clear the list before overriding it.

nixos/tests/locale.nix

@@ -0,0 +1,53 @@
+{ ... }:
+{
+  name = "imperative-locale";
+  meta.maintainers = [ ];
+
+  nodes = {
+    node_static =
+      { ... }:
+      {
+        i18n = {
+          defaultLocale = "lt_LT.UTF-8";
+          extraLocales = [ "en_US.UTF-8/UTF-8" ];
+        };
+      };
+
+    node_imperative =
+      { ... }:
+      {
+        i18n = {
+          defaultLocale = "lt_LT.UTF-8";
+          imperativeLocale = true;
+          extraLocales = [ "en_US.UTF-8/UTF-8" ];
+        };
+      };
+  };
+
+  testScript =
+    { ... }:
+    ''
+      node_static.wait_for_unit("dbus.socket")
+
+      with subtest("static - declared locale is reported by localectl"):
+          node_static.succeed("localectl status | grep -q 'System Locale: LANG=lt_LT.UTF-8'")
+
+      with subtest("static - localectl set-locale is blocked"):
+          node_static.fail("localectl set-locale LANG=en_US.UTF-8")
+          node_static.succeed("localectl status | grep -q 'System Locale: LANG=lt_LT.UTF-8'")
+
+      node_imperative.wait_for_unit("dbus.socket")
+
+      with subtest("imperative - declared locale is reported by localectl on first boot"):
+          node_imperative.succeed("localectl status | grep -q 'System Locale: LANG=lt_LT.UTF-8'")
+
+      with subtest("imperative - localectl set-locale changes the locale"):
+          node_imperative.succeed("localectl set-locale LANG=en_US.UTF-8")
+          node_imperative.succeed("localectl status | grep -q 'System Locale: LANG=en_US.UTF-8'")
+
+      with subtest("imperative - locale change persists across reboot"):
+          node_imperative.shutdown()
+          node_imperative.wait_for_unit("dbus.socket")
+          node_imperative.succeed("localectl status | grep -q 'System Locale: LANG=en_US.UTF-8'")
+    '';
+}

nixos/tests/systemd.nix

@@ -125,17 +125,6 @@
       # wait for user services
       machine.wait_for_unit("default.target", "alice")
 
-      with subtest("systemctl edit suggests --runtime"):
-          # --runtime is suggested when using `systemctl edit`
-          ret, out = machine.execute("systemctl edit testservice1.service 2>&1")
-          assert ret == 1
-          assert out.rstrip("\n") == "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead."
-          # editing w/o `--runtime` is possible for user-services, however
-          # it's not possible because we're not in a tty when grepping
-          # (i.e. hacky way to ensure that the error from above doesn't appear here).
-          _, out = machine.execute("systemctl --user edit testservice2.service 2>&1")
-          assert out.rstrip("\n") == "Cannot edit units interactively if not on a tty."
-
       # Regression test for https://github.com/NixOS/nixpkgs/issues/105049
       with subtest("systemd reads timezone database in /etc/zoneinfo"):
           timer = machine.succeed("TZ=UTC systemctl show --property=TimersCalendar oncalendar-test.timer")
@@ -179,7 +168,6 @@
       # Regression test for https://github.com/NixOS/nixpkgs/pull/91232
       with subtest("setting transient hostnames works"):
           machine.succeed("hostnamectl set-hostname --transient machine-transient")
-          machine.fail("hostnamectl set-hostname machine-all")
 
       with subtest("systemd-shutdown works"):
           machine.shutdown()

nixos/tests/zfs.nix

@@ -226,8 +226,29 @@ in
     enableSystemdStage1 = true;
   };
 
-  installerBoot = (import ./installer.nix { inherit system; }).separateBootZfs;
-  installer = (import ./installer.nix { inherit system; }).zfsroot;
+  installerBoot =
+    (import ./installer.nix {
+      inherit system;
+      systemdStage1 = false;
+    }).separateBootZfs;
+
+  installer =
+    (import ./installer.nix {
+      inherit system;
+      systemdStage1 = false;
+    }).zfsroot;
+
+  installerBootWithSystemdStage1 =
+    (import ./installer.nix {
+      inherit system;
+      systemdStage1 = true;
+    }).separateBootZfs;
+
+  installerWithSystemdStage1 =
+    (import ./installer.nix {
+      inherit system;
+      systemdStage1 = true;
+    }).zfsroot;
 
   expand-partitions = makeTest {
     name = "multi-disk-zfs";

pkgs/applications/editors/vim/common.nix

@@ -4,7 +4,7 @@
   stdenv,
 }:
 rec {
-  version = "9.2.0340";
+  version = "9.2.0389";
 
   outputs = [
     "out"
@@ -15,7 +15,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-jCnOVIafx+0o1nlHv7QJQrmxs1IAxh9BBshDOFdZdCM=";
+    hash = "sha256-shhdJn1bPJ/68a54UZMn1fla7P4tjVUN4DGLbx3ohOg=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/networking/browsers/chromium/default.nix

@@ -204,7 +204,7 @@ stdenv.mkDerivation {
       ln -s "$out/bin/chromium" "$out/bin/chromium-browser"
 
       mkdir -p "$out/share"
-      for f in '${chromium.browser}'/share/*; do # hello emacs */
+      for f in '${chromium.browser}'/share/*; do
         ln -s -t "$out/share/" "$f"
       done
     '';

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = "firefox-beta";
-  version = "150.0b9";
+  version = "151.0b9";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "5afa7b27ee38e809717ca02fede9aa5ebe27f9aeb78d7953e7b0790e30edb663bf0053335e42e258b7bf01b8859e6b0a10c23851cf8b495217f954ac41a386d4";
+    sha512 = "2d50cbe82dd470ab94148ab57585324ff98950fa25b806065b61ab2f541c795d826f4d9a454225ec798cdcd77dfd453dc50d26f0ccf8bdb5fcdf010244aec45a";
   };
 
   meta = {

pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -49,7 +49,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evolution";
-  version = "3.58.3";
+  version = "3.60.1";
 
   outputs = [
     "out"
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor finalAttrs.version}/evolution-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XQG3mlvr3y06mHG2E1CTnPJQH26gPCQVQ/dEqShtTXk=";
+    hash = "sha256-jzM860wxzOfXdJXokBoA79xTdtpUKcHClNfj77xvcwg=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/sync/lsyncd/default.nix

@@ -11,23 +11,11 @@
   docbook_xml_dtd_45,
   docbook_xsl,
   libxslt,
-  pkgs,
+  darwin,
 }:
 
 let
-  f =
-    pkgs: prev:
-    if
-      !pkgs.stdenv.hostPlatform.isDarwin
-      || pkgs.stdenv.name == "bootstrap-stage0-stdenv-darwin"
-      || !(pkgs.stdenv ? __bootPackages)
-    then
-      prev.darwin.sourceRelease
-    else
-      f pkgs.stdenv.__bootPackages pkgs;
-  bootstrapSourceRelease = f pkgs pkgs;
-  # TODO(reckenrode): Use `sourceRelease` after migration has been merged and all releases updated to the same version.
-  xnu = bootstrapSourceRelease "xnu";
+  xnu = darwin.sourceRelease "xnu";
 in
 stdenv.mkDerivation rec {
   pname = "lsyncd";

pkgs/build-support/go/module.nix

@@ -283,7 +283,7 @@ lib.extendMkDerivation {
 
               exclude='\(/_\|examples\|Godeps\|testdata'
               if [[ -n "$excludedPackages" ]]; then
-                IFS=' ' read -r -a excludedArr <<<$excludedPackages
+                IFS=' ' read -r -a excludedArr <<<"''${excludedPackages[@]}"
                 printf -v excludedAlternates '%s\\|' "''${excludedArr[@]}"
                 excludedAlternates=''${excludedAlternates%\\|} # drop final \| added by printf
                 exclude+='\|'"$excludedAlternates"

pkgs/build-support/kernel/make-initrd-ng/src/main.rs

@@ -5,9 +5,7 @@ use std::fs;
 use std::hash::Hash;
 use std::iter::FromIterator;
 use std::os::unix;
-use std::os::unix::fs::PermissionsExt;
 use std::path::{Component, Path, PathBuf};
-use std::process::Command;
 
 use libc::umask;
 
@@ -159,13 +157,22 @@ fn add_dependencies<P: AsRef<Path> + AsRef<OsStr> + std::fmt::Debug>(
             }
         }
         if !found {
-            // glibc makes it tricky to make this an error because
-            // none of the files have a useful rpath.
-            println!(
-                "Warning: Couldn't satisfy dependency {} for {:?}",
-                line,
-                OsStr::new(&source)
-            );
+            // In Nix, glibc's own libraries lack rpath entries pointing to
+            // themselves, so the dynamic linker (ld-linux-*.so.*) and libc.so.*
+            // can never be resolved through rpath alone. They are always present
+            // in the initrd: the linker via elf.interpreter above, and libc via
+            // at least one binary's rpath. Suppress these known-benign cases.
+            // See also: the ld*.so.? skip in stage-1.nix findLibs.
+            let is_glibc_runtime = (line.starts_with("ld-") && line.contains(".so"))
+                || line.starts_with("libc.so");
+
+            if !is_glibc_runtime {
+                eprintln!(
+                    "Warning: Couldn't satisfy dependency {} for {:?}",
+                    line,
+                    OsStr::new(&source)
+                );
+            }
         }
     }
 

pkgs/build-support/node/build-npm-package/hooks/npm-build-hook.sh

@@ -16,7 +16,7 @@ npmBuildHook() {
 
     if ! npm run ${npmWorkspace+--workspace=$npmWorkspace} "$npmBuildScript" $npmBuildFlags "${npmBuildFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}"; then
         echo
-        echo 'ERROR: `npm build` failed'
+        echo "ERROR: \`npm run $npmBuildScript [...]\` failed"
         echo
         echo "Here are a few things you can try, depending on the error:"
         echo "1. Make sure your build script ($npmBuildScript) exists"

pkgs/build-support/trivial-builders/default.nix

@@ -97,72 +97,86 @@ rec {
 
   # Docs in doc/build-helpers/trivial-build-helpers.chapter.md
   # See https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-writeTextFile
-  writeTextFile =
-    {
-      name,
-      text,
-      executable ? false,
-      destination ? "",
-      checkPhase ? "",
-      meta ? { },
-      passthru ? { },
-      allowSubstitutes ? false,
-      preferLocalBuild ? true,
-      derivationArgs ? { },
-      pos ? builtins.unsafeGetAttrPos "name" args,
-    }@args:
-    assert lib.assertMsg (destination != "" -> (lib.hasPrefix "/" destination && destination != "/")) ''
-      destination must be an absolute path, relative to the derivation's out path,
-      got '${destination}' instead.
+  writeTextFile = lib.extendMkDerivation {
+    constructDrv = stdenvNoCC.mkDerivation;
 
-      Ensure that the path starts with a / and specifies at least the filename.
-    '';
+    excludeDrvArgNames = [
+      "derivationArgs"
+    ];
 
-    let
-      matches = builtins.match "/bin/([^/]+)" destination;
-    in
-    runCommand name
-      (
-        {
-          inherit
-            pos
-            text
-            executable
-            checkPhase
-            allowSubstitutes
-            preferLocalBuild
-            ;
-          passAsFile = [ "text" ] ++ derivationArgs.passAsFile or [ ];
-          meta =
-            lib.optionalAttrs (executable && matches != null) {
-              mainProgram = lib.head matches;
-            }
-            // meta
-            // derivationArgs.meta or { };
-          passthru = passthru // derivationArgs.passthru or { };
-        }
-        // removeAttrs derivationArgs [
-          "passAsFile"
-          "meta"
-          "passthru"
-        ]
-      )
-      ''
-        target=$out${lib.escapeShellArg destination}
-        mkdir -p "$(dirname "$target")"
+    extendDrvArgs =
+      finalAttrs:
+      {
+        name,
+        text,
+        executable ? false,
+        destination ? "",
+        checkPhase ? "",
+        meta ? { },
+        passthru ? { },
+        allowSubstitutes ? false,
+        preferLocalBuild ? true,
+        derivationArgs ? { },
+        pos ? builtins.unsafeGetAttrPos "name" args,
+      }@args:
+      {
+        inherit
+          pos
+          name
+          text
+          executable
+          checkPhase
+          allowSubstitutes
+          preferLocalBuild
+          ;
+        destination =
+          assert lib.assertMsg (destination != "" -> (lib.hasPrefix "/" destination && destination != "/")) ''
+            destination must be an absolute path, relative to the derivation's out path,
+            got '${destination}' instead.
 
-        if [ -e "$textPath" ]; then
-          mv "$textPath" "$target"
-        else
-          echo -n "$text" > "$target"
-        fi
+            Ensure that the path starts with a / and specifies at least the filename.
+          '';
+          destination;
+        passAsFile = [ "text" ] ++ derivationArgs.passAsFile or [ ];
 
-        if [ -n "$executable" ]; then
-          chmod +x "$target"
-        fi
+        buildCommand = ''
+          target=$out$destination
+          mkdir -p "$(dirname "$target")"
 
-        eval "$checkPhase"
-      '';
+          if [ -e "$textPath" ]; then
+            mv "$textPath" "$target"
+          else
+            printf "%s" "$text" > "$target"
+          fi
+
+          if [ -n "$executable" ]; then
+            chmod +x "$target"
+          fi
+
+          eval "$checkPhase"
+        '';
+
+        meta =
+          let
+            matches = builtins.match "/bin/([^/]+)" finalAttrs.destination;
+            isProgram = finalAttrs.executable && matches != null;
+          in
+          {
+            ${if isProgram then "mainProgram" else null} = lib.head matches;
+          }
+          // meta
+          // derivationArgs.meta or { };
+        passthru = passthru // derivationArgs.passthru or { };
+      }
+      // removeAttrs derivationArgs [
+        "passAsFile"
+        "meta"
+        "passthru"
+      ];
+
+    # `writeTextFile`'s set pattern doesn't have ellipses.
+    inheritFunctionArgs = false;
+  };
 
   # See doc/build-helpers/trivial-build-helpers.chapter.md
   # or https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-text-writing
@@ -333,10 +347,10 @@ rec {
       {
         inherit pname code;
         executable = true;
-        passAsFile = [ "code" ];
         # Pointless to do this on a remote machine.
         preferLocalBuild = true;
         allowSubstitutes = false;
+        __structuredAttrs = true;
         meta = {
           mainProgram = pname;
         };
@@ -344,7 +358,7 @@ rec {
       ''
         n=$out/bin/${pname}
         mkdir -p "$(dirname "$n")"
-        mv "$codePath" code.c
+        printf "%s" "$code" > code.c
         $CC -x c code.c -o "$n"
       '';
 
@@ -559,7 +573,10 @@ rec {
         paths = mapPaths (path: "${path}${stripPrefix}") paths;
         buildCommand = ''
           mkdir -p $out
-          for i in $(cat $pathsPath); do
+          if [ -n "''${pathsPath:-}" ] && [ -f "$pathsPath" ]; then
+            mapfile -d " " -t paths < "$pathsPath"
+          fi
+          for i in "''${paths[@]}"; do
             ${optionalString (!failOnMissing) "if test -d $i; then "}${lndir}/bin/lndir -silent $i $out${
               optionalString (!failOnMissing) "; fi"
             }

pkgs/build-support/trivial-builders/test/symlink-join.nix

@@ -55,6 +55,24 @@ in
     '';
   };
 
+  symlinkJoin-structured-attrs = testEqualContents {
+    assertion = "symlinkJoin-structured-attrs";
+    actual = symlinkJoin {
+      __structuredAttrs = true;
+      name = "symlinkJoin-structured-attrs";
+      paths = [
+        foo
+        bar
+        baz
+      ];
+    };
+    expected = runCommand "symlinkJoin-foo-bar-baz" { } ''
+      mkdir -p $out/{var/lib/arbitrary,etc/test.d}
+      ln -s {${foo},${bar}}/etc/test.d/* $out/etc/test.d
+      ln -s ${baz}/var/lib/arbitrary/baz $out/var/lib/arbitrary/
+    '';
+  };
+
   symlinkJoin-strip-paths = testEqualContents {
     assertion = "symlinkJoin-strip-paths";
     actual = symlinkJoin {

pkgs/by-name/ad/adwaita-fonts/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adwaita-fonts";
-  version = "49.0";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-fonts/${lib.versions.major finalAttrs.version}/adwaita-fonts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MVfGIOtbcrJasVbRlKpOsiP5hw1Uf+g/298G0+e+yzc=";
+    hash = "sha256-TJJ/v+7BxQOAG6UQwslOAFTILFIs97oNO+XU1B/PXIY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/adwaita-icon-theme/package.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "adwaita-icon-theme";
-  version = "49.0";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/adwaita-icon-theme/${lib.versions.major finalAttrs.version}/adwaita-icon-theme-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZRZkYdGyeKqUL1mqjQ/M8RCNccZfNyxiZuFyRJeRdVw=";
+    hash = "sha256-+sbgQB/KcUeAVhoIG49+J8O8HbNOvaTaF1CB8msk1GA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch

@@ -0,0 +1,15 @@
+diff --git a/electron/js/util.js b/electron/js/util.js
+index da18f41ad0..bb07ec9f21 100644
+--- a/electron/js/util.js
++++ b/electron/js/util.js
+@@ -314,7 +314,9 @@ class Util {
+ 		if (!is.linux) {
+ 			return;
+ 		};
+-
++		// NixOS: desktop entries are managed by the package, avoid 
++		// writing user-local anytype.desktop which goes stale on updates
++		return;
+ 		const { execFile } = require('child_process');
+ 		const home = process.env.HOME || '';
+ 		const dataHome = process.env.XDG_DATA_HOME || path.join(home, '.local', 'share');

pkgs/by-name/an/anytype/package.nix

@@ -57,6 +57,7 @@ buildNpmPackage (finalAttrs: {
   patches = [
     ./0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
     ./0002-remove-grpc-devtools.patch
+    ./0003-remove-desktop-entry.patch
   ];
 
   buildPhase = ''
@@ -137,6 +138,7 @@ buildNpmPackage (finalAttrs: {
       autrimpo
       adda
       kira-bruneau
+      xmnlz
     ];
     platforms = [
       "x86_64-linux"

pkgs/by-name/ap/apache-airflow/providers.nix

@@ -6,7 +6,7 @@
       "airflow.providers.airbyte"
       "airflow.providers.airbyte.get_provider_info"
     ];
-    version = "5.2.3";
+    version = "5.3.3";
   };
 
   alibaba = {
@@ -15,7 +15,7 @@
       "airflow.providers.alibaba"
       "airflow.providers.alibaba.get_provider_info"
     ];
-    version = "3.2.2";
+    version = "3.3.5";
   };
 
   amazon = {
@@ -29,17 +29,19 @@
       "jsonpath-ng"
       "lxml"
       "marshmallow"
+      "pandas"
       "pyathena"
       "python3-saml"
       "redshift-connector"
       "s3fs"
+      "sqlalchemy"
       "xmlsec"
     ];
     imports = [
       "airflow.providers.amazon"
       "airflow.providers.amazon.get_provider_info"
     ];
-    version = "9.13.0";
+    version = "9.23.0";
   };
 
   apache_beam = {
@@ -52,7 +54,7 @@
       "airflow.providers.apache.beam"
       "airflow.providers.apache.beam.get_provider_info"
     ];
-    version = "6.1.4";
+    version = "6.2.3";
   };
 
   apache_cassandra = {
@@ -61,7 +63,7 @@
       "airflow.providers.apache.cassandra"
       "airflow.providers.apache.cassandra.get_provider_info"
     ];
-    version = "3.8.2";
+    version = "3.9.2";
   };
 
   apache_drill = {
@@ -70,7 +72,7 @@
       "airflow.providers.apache.drill"
       "airflow.providers.apache.drill.get_provider_info"
     ];
-    version = "3.1.2";
+    version = "3.3.0";
   };
 
   apache_druid = {
@@ -79,7 +81,7 @@
       "airflow.providers.apache.druid"
       "airflow.providers.apache.druid.get_provider_info"
     ];
-    version = "4.3.0";
+    version = "4.5.0";
   };
 
   apache_flink = {
@@ -88,11 +90,12 @@
       "airflow.providers.apache.flink"
       "airflow.providers.apache.flink.get_provider_info"
     ];
-    version = "1.7.2";
+    version = "1.8.3";
   };
 
   apache_hdfs = {
     deps = [
+      "fastavro"
       "hdfs"
       "pandas"
     ];
@@ -100,20 +103,21 @@
       "airflow.providers.apache.hdfs"
       "airflow.providers.apache.hdfs.get_provider_info"
     ];
-    version = "4.10.2";
+    version = "4.11.3";
   };
 
   apache_hive = {
     deps = [
       "jmespath"
+      "kerberos"
       "pandas"
-      "thrift"
+      "sqlalchemy"
     ];
     imports = [
       "airflow.providers.apache.hive"
       "airflow.providers.apache.hive.get_provider_info"
     ];
-    version = "9.1.2";
+    version = "9.4.0";
   };
 
   apache_iceberg = {
@@ -122,16 +126,19 @@
       "airflow.providers.apache.iceberg"
       "airflow.providers.apache.iceberg.get_provider_info"
     ];
-    version = "1.3.2";
+    version = "2.0.0";
   };
 
   apache_impala = {
-    deps = [ "kerberos" ];
+    deps = [
+      "kerberos"
+      "sqlalchemy"
+    ];
     imports = [
       "airflow.providers.apache.impala"
       "airflow.providers.apache.impala.get_provider_info"
     ];
-    version = "1.7.2";
+    version = "1.9.0";
   };
 
   apache_kafka = {
@@ -143,7 +150,7 @@
       "airflow.providers.apache.kafka"
       "airflow.providers.apache.kafka.get_provider_info"
     ];
-    version = "1.10.3";
+    version = "1.13.0";
   };
 
   apache_kylin = {
@@ -152,19 +159,16 @@
       "airflow.providers.apache.kylin"
       "airflow.providers.apache.kylin.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.10.2";
   };
 
   apache_livy = {
-    deps = [
-      "aiohttp"
-      "asgiref"
-    ];
+    deps = [ "aiohttp" ];
     imports = [
       "airflow.providers.apache.livy"
       "airflow.providers.apache.livy.get_provider_info"
     ];
-    version = "4.4.2";
+    version = "4.5.3";
   };
 
   apache_pig = {
@@ -173,7 +177,7 @@
       "airflow.providers.apache.pig"
       "airflow.providers.apache.pig.get_provider_info"
     ];
-    version = "4.7.2";
+    version = "4.8.2";
   };
 
   apache_pinot = {
@@ -182,7 +186,7 @@
       "airflow.providers.apache.pinot"
       "airflow.providers.apache.pinot.get_provider_info"
     ];
-    version = "4.8.2";
+    version = "4.10.0";
   };
 
   apache_spark = {
@@ -194,7 +198,7 @@
       "airflow.providers.apache.spark"
       "airflow.providers.apache.spark.get_provider_info"
     ];
-    version = "5.3.2";
+    version = "5.6.0";
   };
 
   apache_tinkerpop = {
@@ -203,7 +207,7 @@
       "airflow.providers.apache.tinkerpop"
       "airflow.providers.apache.tinkerpop.get_provider_info"
     ];
-    version = "1.0.3";
+    version = "1.1.1";
   };
 
   apprise = {
@@ -212,7 +216,7 @@
       "airflow.providers.apprise"
       "airflow.providers.apprise.get_provider_info"
     ];
-    version = "2.1.2";
+    version = "2.3.1";
   };
 
   arangodb = {
@@ -221,7 +225,7 @@
       "airflow.providers.arangodb"
       "airflow.providers.arangodb.get_provider_info"
     ];
-    version = "2.8.2";
+    version = "2.9.2";
   };
 
   asana = {
@@ -230,7 +234,7 @@
       "airflow.providers.asana"
       "airflow.providers.asana.get_provider_info"
     ];
-    version = "2.10.2";
+    version = "2.11.1";
   };
 
   atlassian_jira = {
@@ -239,7 +243,7 @@
       "airflow.providers.atlassian.jira"
       "airflow.providers.atlassian.jira.get_provider_info"
     ];
-    version = "3.1.2";
+    version = "3.3.1";
   };
 
   celery = {
@@ -251,7 +255,7 @@
       "airflow.providers.celery"
       "airflow.providers.celery.get_provider_info"
     ];
-    version = "3.12.3";
+    version = "3.17.1";
   };
 
   cloudant = {
@@ -260,7 +264,7 @@
       "airflow.providers.cloudant"
       "airflow.providers.cloudant.get_provider_info"
     ];
-    version = "4.2.2";
+    version = "4.3.2";
   };
 
   cncf_kubernetes = {
@@ -276,25 +280,40 @@
       "airflow.providers.cncf.kubernetes"
       "airflow.providers.cncf.kubernetes.get_provider_info"
     ];
-    version = "10.8.0";
+    version = "10.14.0";
   };
 
   cohere = {
-    deps = [ "cohere" ];
+    deps = [
+      "cohere"
+      "fastavro"
+    ];
     imports = [
       "airflow.providers.cohere"
       "airflow.providers.cohere.get_provider_info"
     ];
-    version = "1.5.3";
+    version = "1.6.3";
+  };
+
+  common_ai = {
+    deps = [
+      "pydantic-ai-slim"
+      "sqlglot"
+    ];
+    imports = [
+      "airflow.providers.common.ai"
+      "airflow.providers.common.ai.get_provider_info"
+    ];
+    version = "0.0.1";
   };
 
   common_compat = {
-    deps = [ ];
+    deps = [ "asgiref" ];
     imports = [
       "airflow.providers.common.compat"
       "airflow.providers.common.compat.get_provider_info"
     ];
-    version = "1.7.4";
+    version = "1.14.1";
   };
 
   common_io = {
@@ -303,7 +322,7 @@
       "airflow.providers.common.io"
       "airflow.providers.common.io.get_provider_info"
     ];
-    version = "1.6.3";
+    version = "1.7.1";
   };
 
   common_messaging = {
@@ -312,22 +331,25 @@
       "airflow.providers.common.messaging"
       "airflow.providers.common.messaging.get_provider_info"
     ];
-    version = "2.0.0";
+    version = "2.0.2";
   };
 
   common_sql = {
     deps = [
+      "datafusion"
       "methodtools"
       "more-itertools"
       "pandas"
       "polars"
+      "pyiceberg-core"
+      "sqlalchemy"
       "sqlparse"
     ];
     imports = [
       "airflow.providers.common.sql"
       "airflow.providers.common.sql.get_provider_info"
     ];
-    version = "1.28.1";
+    version = "1.33.0";
   };
 
   databricks = {
@@ -336,6 +358,7 @@
       "azure-identity"
       "databricks-sdk"
       "databricks-sql-connector"
+      "fastavro"
       "mergedeep"
       "pandas"
       "pyarrow"
@@ -345,7 +368,7 @@
       "airflow.providers.databricks"
       "airflow.providers.databricks.get_provider_info"
     ];
-    version = "7.7.2";
+    version = "7.11.0";
   };
 
   datadog = {
@@ -354,19 +377,20 @@
       "airflow.providers.datadog"
       "airflow.providers.datadog.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.10.2";
   };
 
   dbt_cloud = {
     deps = [
       "aiohttp"
       "asgiref"
+      "tenacity"
     ];
     imports = [
       "airflow.providers.dbt.cloud"
       "airflow.providers.dbt.cloud.get_provider_info"
     ];
-    version = "4.4.3";
+    version = "4.7.0";
   };
 
   dingding = {
@@ -375,7 +399,7 @@
       "airflow.providers.dingding"
       "airflow.providers.dingding.get_provider_info"
     ];
-    version = "3.8.2";
+    version = "3.9.2";
   };
 
   discord = {
@@ -384,7 +408,7 @@
       "airflow.providers.discord"
       "airflow.providers.discord.get_provider_info"
     ];
-    version = "3.10.2";
+    version = "3.12.0";
   };
 
   docker = {
@@ -396,11 +420,13 @@
       "airflow.providers.docker"
       "airflow.providers.docker.get_provider_info"
     ];
-    version = "4.4.2";
+    version = "4.5.3";
   };
 
   edge3 = {
     deps = [
+      "aiofiles"
+      "aiohttp"
       "pydantic"
       "retryhttp"
     ];
@@ -408,7 +434,7 @@
       "airflow.providers.edge3"
       "airflow.providers.edge3.get_provider_info"
     ];
-    version = "1.2.0";
+    version = "3.2.0";
   };
 
   elasticsearch = {
@@ -417,30 +443,36 @@
       "airflow.providers.elasticsearch"
       "airflow.providers.elasticsearch.get_provider_info"
     ];
-    version = "6.3.2";
+    version = "6.5.0";
   };
 
   exasol = {
-    deps = [ "pandas" ];
+    deps = [
+      "pandas"
+      "sqlalchemy"
+    ];
     imports = [
       "airflow.providers.exasol"
       "airflow.providers.exasol.get_provider_info"
     ];
-    version = "4.8.2";
+    version = "4.10.0";
   };
 
   fab = {
     deps = [
       "blinker"
-      "connexion"
+      "cachetools"
       "flask"
       "flask-appbuilder"
       "flask-limiter"
       "flask-login"
       "flask-session"
+      "flask-sqlalchemy"
       "flask-wtf"
       "jmespath"
       "kerberos"
+      "marshmallow"
+      "msgpack"
       "werkzeug"
       "wtforms"
     ];
@@ -448,7 +480,7 @@
       "airflow.providers.fab"
       "airflow.providers.fab.get_provider_info"
     ];
-    version = "2.4.2";
+    version = "3.5.0";
   };
 
   facebook = {
@@ -457,7 +489,7 @@
       "airflow.providers.facebook"
       "airflow.providers.facebook.get_provider_info"
     ];
-    version = "3.8.2";
+    version = "3.9.2";
   };
 
   ftp = {
@@ -466,7 +498,7 @@
       "airflow.providers.ftp"
       "airflow.providers.ftp.get_provider_info"
     ];
-    version = "3.13.2";
+    version = "3.14.1";
   };
 
   git = {
@@ -475,7 +507,7 @@
       "airflow.providers.git"
       "airflow.providers.git.get_provider_info"
     ];
-    version = "0.0.7";
+    version = "0.2.4";
   };
 
   github = {
@@ -484,12 +516,11 @@
       "airflow.providers.github"
       "airflow.providers.github.get_provider_info"
     ];
-    version = "2.9.2";
+    version = "2.11.0";
   };
 
   google = {
     deps = [
-      "apache-beam"
       "asgiref"
       "dill"
       "gcsfs"
@@ -531,7 +562,6 @@
       "plyvel"
       "proto-plus"
       "pyarrow"
-      "pyopenssl"
       "python-slugify"
       "ray"
       "tenacity"
@@ -541,7 +571,7 @@
       "airflow.providers.google"
       "airflow.providers.google.get_provider_info"
     ];
-    version = "17.2.0";
+    version = "21.0.0";
   };
 
   grpc = {
@@ -554,7 +584,7 @@
       "airflow.providers.grpc"
       "airflow.providers.grpc.get_provider_info"
     ];
-    version = "3.8.2";
+    version = "3.9.2";
   };
 
   hashicorp = {
@@ -566,7 +596,7 @@
       "airflow.providers.hashicorp"
       "airflow.providers.hashicorp.get_provider_info"
     ];
-    version = "4.3.2";
+    version = "4.5.0";
   };
 
   http = {
@@ -580,7 +610,7 @@
       "airflow.providers.http"
       "airflow.providers.http.get_provider_info"
     ];
-    version = "5.3.4";
+    version = "6.0.0";
   };
 
   imap = {
@@ -589,7 +619,7 @@
       "airflow.providers.imap"
       "airflow.providers.imap.get_provider_info"
     ];
-    version = "3.9.2";
+    version = "3.11.0";
   };
 
   influxdb = {
@@ -601,7 +631,16 @@
       "airflow.providers.influxdb"
       "airflow.providers.influxdb.get_provider_info"
     ];
-    version = "2.9.3";
+    version = "2.10.2";
+  };
+
+  informatica = {
+    deps = [ ];
+    imports = [
+      "airflow.providers.informatica"
+      "airflow.providers.informatica.get_provider_info"
+    ];
+    version = "0.1.1";
   };
 
   jdbc = {
@@ -610,7 +649,7 @@
       "airflow.providers.jdbc"
       "airflow.providers.jdbc.get_provider_info"
     ];
-    version = "5.2.3";
+    version = "5.4.1";
   };
 
   jenkins = {
@@ -619,7 +658,7 @@
       "airflow.providers.jenkins"
       "airflow.providers.jenkins.get_provider_info"
     ];
-    version = "4.1.2";
+    version = "4.2.3";
   };
 
   keycloak = {
@@ -628,12 +667,11 @@
       "airflow.providers.keycloak"
       "airflow.providers.keycloak.get_provider_info"
     ];
-    version = "0.1.0";
+    version = "0.6.0";
   };
 
   microsoft_azure = {
     deps = [
-      "adal"
       "adlfs"
       "azure-batch"
       "azure-cosmos"
@@ -641,6 +679,7 @@
       "azure-identity"
       "azure-keyvault-secrets"
       "azure-kusto-data"
+      "azure-mgmt-compute"
       "azure-mgmt-containerinstance"
       "azure-mgmt-containerregistry"
       "azure-mgmt-cosmosdb"
@@ -666,7 +705,7 @@
       "airflow.providers.microsoft.azure"
       "airflow.providers.microsoft.azure.get_provider_info"
     ];
-    version = "12.7.0";
+    version = "13.0.1";
   };
 
   microsoft_mssql = {
@@ -678,7 +717,7 @@
       "airflow.providers.microsoft.mssql"
       "airflow.providers.microsoft.mssql.get_provider_info"
     ];
-    version = "4.3.2";
+    version = "4.5.0";
   };
 
   microsoft_psrp = {
@@ -687,7 +726,7 @@
       "airflow.providers.microsoft.psrp"
       "airflow.providers.microsoft.psrp.get_provider_info"
     ];
-    version = "3.1.2";
+    version = "3.2.3";
   };
 
   microsoft_winrm = {
@@ -696,7 +735,7 @@
       "airflow.providers.microsoft.winrm"
       "airflow.providers.microsoft.winrm.get_provider_info"
     ];
-    version = "3.11.0";
+    version = "3.14.0";
   };
 
   mongo = {
@@ -708,7 +747,7 @@
       "airflow.providers.mongo"
       "airflow.providers.mongo.get_provider_info"
     ];
-    version = "5.2.2";
+    version = "5.3.3";
   };
 
   mysql = {
@@ -720,7 +759,7 @@
       "airflow.providers.mysql"
       "airflow.providers.mysql.get_provider_info"
     ];
-    version = "6.3.4";
+    version = "6.5.0";
   };
 
   neo4j = {
@@ -729,7 +768,7 @@
       "airflow.providers.neo4j"
       "airflow.providers.neo4j.get_provider_info"
     ];
-    version = "3.10.1";
+    version = "3.11.3";
   };
 
   odbc = {
@@ -738,7 +777,7 @@
       "airflow.providers.odbc"
       "airflow.providers.odbc.get_provider_info"
     ];
-    version = "4.10.2";
+    version = "4.12.0";
   };
 
   openai = {
@@ -747,7 +786,7 @@
       "airflow.providers.openai"
       "airflow.providers.openai.get_provider_info"
     ];
-    version = "1.6.2";
+    version = "1.7.2";
   };
 
   openfaas = {
@@ -756,16 +795,19 @@
       "airflow.providers.openfaas"
       "airflow.providers.openfaas.get_provider_info"
     ];
-    version = "3.8.2";
+    version = "3.9.2";
   };
 
   openlineage = {
-    deps = [ "attrs" ];
+    deps = [
+      "attrs"
+      "sqlalchemy"
+    ];
     imports = [
       "airflow.providers.openlineage"
       "airflow.providers.openlineage.get_provider_info"
     ];
-    version = "2.7.0";
+    version = "2.12.0";
   };
 
   opensearch = {
@@ -774,7 +816,7 @@
       "airflow.providers.opensearch"
       "airflow.providers.opensearch.get_provider_info"
     ];
-    version = "1.7.2";
+    version = "1.8.4";
   };
 
   opsgenie = {
@@ -783,7 +825,7 @@
       "airflow.providers.opsgenie"
       "airflow.providers.opsgenie.get_provider_info"
     ];
-    version = "5.9.2";
+    version = "5.10.1";
   };
 
   oracle = {
@@ -795,7 +837,7 @@
       "airflow.providers.oracle"
       "airflow.providers.oracle.get_provider_info"
     ];
-    version = "4.2.0";
+    version = "4.5.1";
   };
 
   pagerduty = {
@@ -804,7 +846,7 @@
       "airflow.providers.pagerduty"
       "airflow.providers.pagerduty.get_provider_info"
     ];
-    version = "5.0.2";
+    version = "5.2.3";
   };
 
   papermill = {
@@ -818,7 +860,7 @@
       "airflow.providers.papermill"
       "airflow.providers.papermill.get_provider_info"
     ];
-    version = "3.11.2";
+    version = "3.12.1";
   };
 
   pgvector = {
@@ -827,7 +869,7 @@
       "airflow.providers.pgvector"
       "airflow.providers.pgvector.get_provider_info"
     ];
-    version = "1.5.2";
+    version = "1.7.0";
   };
 
   pinecone = {
@@ -836,7 +878,7 @@
       "airflow.providers.pinecone"
       "airflow.providers.pinecone.get_provider_info"
     ];
-    version = "2.3.4";
+    version = "2.4.2";
   };
 
   postgres = {
@@ -846,24 +888,27 @@
       "polars"
       "psycopg"
       "psycopg2-binary"
+      "sqlalchemy"
     ];
     imports = [
       "airflow.providers.postgres"
       "airflow.providers.postgres.get_provider_info"
     ];
-    version = "6.3.0";
+    version = "6.6.1";
   };
 
   presto = {
     deps = [
       "pandas"
       "presto-python-client"
+      "psycopg2-binary"
+      "sqlalchemy"
     ];
     imports = [
       "airflow.providers.presto"
       "airflow.providers.presto.get_provider_info"
     ];
-    version = "5.9.2";
+    version = "5.11.0";
   };
 
   qdrant = {
@@ -872,7 +917,7 @@
       "airflow.providers.qdrant"
       "airflow.providers.qdrant.get_provider_info"
     ];
-    version = "1.4.3";
+    version = "1.5.3";
   };
 
   redis = {
@@ -881,7 +926,7 @@
       "airflow.providers.redis"
       "airflow.providers.redis.get_provider_info"
     ];
-    version = "4.3.0";
+    version = "4.4.2";
   };
 
   salesforce = {
@@ -893,7 +938,7 @@
       "airflow.providers.salesforce"
       "airflow.providers.salesforce.get_provider_info"
     ];
-    version = "5.11.3";
+    version = "5.12.3";
   };
 
   samba = {
@@ -902,7 +947,7 @@
       "airflow.providers.samba"
       "airflow.providers.samba.get_provider_info"
     ];
-    version = "4.11.0";
+    version = "4.12.3";
   };
 
   segment = {
@@ -911,7 +956,7 @@
       "airflow.providers.segment"
       "airflow.providers.segment.get_provider_info"
     ];
-    version = "3.8.2";
+    version = "3.9.2";
   };
 
   sendgrid = {
@@ -923,7 +968,7 @@
       "airflow.providers.sendgrid"
       "airflow.providers.sendgrid.get_provider_info"
     ];
-    version = "4.1.3";
+    version = "4.2.1";
   };
 
   sftp = {
@@ -931,12 +976,13 @@
       "asyncssh"
       "paramiko"
       "pysftp"
+      "sshfs"
     ];
     imports = [
       "airflow.providers.sftp"
       "airflow.providers.sftp.get_provider_info"
     ];
-    version = "5.4.0";
+    version = "5.7.1";
   };
 
   singularity = {
@@ -945,31 +991,35 @@
       "airflow.providers.singularity"
       "airflow.providers.singularity.get_provider_info"
     ];
-    version = "3.8.2";
+    version = "3.9.2";
   };
 
   slack = {
-    deps = [ "slack-sdk" ];
+    deps = [
+      "asgiref"
+      "slack-sdk"
+    ];
     imports = [
       "airflow.providers.slack"
       "airflow.providers.slack.get_provider_info"
     ];
-    version = "9.2.0";
+    version = "9.8.0";
   };
 
   smtp = {
-    deps = [ ];
+    deps = [ "aiosmtplib" ];
     imports = [
       "airflow.providers.smtp"
       "airflow.providers.smtp.get_provider_info"
     ];
-    version = "2.3.1";
+    version = "2.4.3";
   };
 
   snowflake = {
     deps = [
       "pandas"
       "pyarrow"
+      "setuptools"
       "snowflake-connector-python"
       "snowflake-sqlalchemy"
     ];
@@ -977,7 +1027,7 @@
       "airflow.providers.snowflake"
       "airflow.providers.snowflake.get_provider_info"
     ];
-    version = "6.5.3";
+    version = "6.11.0";
   };
 
   sqlite = {
@@ -986,11 +1036,12 @@
       "airflow.providers.sqlite"
       "airflow.providers.sqlite.get_provider_info"
     ];
-    version = "4.1.2";
+    version = "4.3.0";
   };
 
   ssh = {
     deps = [
+      "asyncssh"
       "paramiko"
       "sshtunnel"
     ];
@@ -998,7 +1049,7 @@
       "airflow.providers.ssh"
       "airflow.providers.ssh.get_provider_info"
     ];
-    version = "4.1.3";
+    version = "4.3.2";
   };
 
   standard = {
@@ -1007,7 +1058,7 @@
       "airflow.providers.standard"
       "airflow.providers.standard.get_provider_info"
     ];
-    version = "1.9.0";
+    version = "1.12.1";
   };
 
   tableau = {
@@ -1016,7 +1067,7 @@
       "airflow.providers.tableau"
       "airflow.providers.tableau.get_provider_info"
     ];
-    version = "5.2.0";
+    version = "5.3.3";
   };
 
   telegram = {
@@ -1025,16 +1076,16 @@
       "airflow.providers.telegram"
       "airflow.providers.telegram.get_provider_info"
     ];
-    version = "4.8.2";
+    version = "4.9.2";
   };
 
   teradata = {
-    deps = [ ];
+    deps = [ "sqlalchemy" ];
     imports = [
       "airflow.providers.teradata"
       "airflow.providers.teradata.get_provider_info"
     ];
-    version = "3.2.1";
+    version = "3.5.0";
   };
 
   trino = {
@@ -1043,16 +1094,19 @@
       "airflow.providers.trino"
       "airflow.providers.trino.get_provider_info"
     ];
-    version = "6.3.3";
+    version = "6.5.0";
   };
 
   vertica = {
-    deps = [ "vertica-python" ];
+    deps = [
+      "sqlalchemy"
+      "vertica-python"
+    ];
     imports = [
       "airflow.providers.vertica"
       "airflow.providers.vertica.get_provider_info"
     ];
-    version = "4.1.2";
+    version = "4.3.0";
   };
 
   weaviate = {
@@ -1065,16 +1119,16 @@
       "airflow.providers.weaviate"
       "airflow.providers.weaviate.get_provider_info"
     ];
-    version = "3.2.3";
+    version = "3.3.1";
   };
 
   yandex = {
-    deps = [ ];
+    deps = [ "grpcio" ];
     imports = [
       "airflow.providers.yandex"
       "airflow.providers.yandex.get_provider_info"
     ];
-    version = "4.2.0";
+    version = "4.4.0";
   };
 
   ydb = {
@@ -1083,7 +1137,7 @@
       "airflow.providers.ydb"
       "airflow.providers.ydb.get_provider_info"
     ];
-    version = "2.2.2";
+    version = "2.5.0";
   };
 
   zendesk = {
@@ -1092,7 +1146,7 @@
       "airflow.providers.zendesk"
       "airflow.providers.zendesk.get_provider_info"
     ];
-    version = "4.10.2";
+    version = "4.11.1";
   };
 
 }

pkgs/by-name/ap/apache-airflow/python-package.nix

@@ -88,13 +88,13 @@
   enabledProviders,
 }:
 let
-  version = "3.1.7";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "airflow";
     tag = version;
-    hash = "sha256-qFgI65wAttERPCHn7ezSdNGB0sclEV7zYIBqaC0Gs4A=";
+    hash = "sha256-jwWxH9fTTCFdLAaAN18/FUAbN0cTCPkkk9+0ZMYNXek=";
   };
 
   pnpm = pnpm_10;
@@ -119,7 +119,7 @@ let
         pnpm
         ;
       fetcherVersion = 3;
-      hash = "sha256-zPIql9rP4EkE0Y3ihP4MkWTTYCIDr8d1LpE6vePiNdU=";
+      hash = "sha256-OkSDQoWsHQ6w1vIoX5W9zXHghV0obvL6Wji0HYN6CSs=";
     };
 
     buildPhase = ''
@@ -148,7 +148,7 @@ let
       pname = "simple-auth-manager-ui";
       inherit sourceRoot src version;
       fetcherVersion = 3;
-      hash = "sha256-ccLGYaAYJWSgegO+IfVZv1WdZ5YjhYYTZivqtDjdoOk=";
+      hash = "sha256-uQIVHzX0BcJuxgbPp6wqKhALbsfACSJjiMOdmrpuzOk=";
     };
 
     buildPhase = ''
@@ -206,10 +206,12 @@ let
       # remove cyclic dependency
       sed -i -E 's/"apache-airflow-task-sdk[^"]+",//' pyproject.toml
 
-      substituteInPlace pyproject.toml \
-        --replace-fail "GitPython==3.1.45" "GitPython" \
-        --replace-fail "hatchling==1.27.0" "hatchling" \
-        --replace-fail "trove-classifiers==2025.9.11.17" "trove-classifiers"
+      # relax dependencies
+      sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+      sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+      sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
+      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+      sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
 
       # Copy built UI assets
       cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
@@ -289,13 +291,6 @@ let
       uvicorn
     ]
     ++ (map buildProvider requiredProviders);
-
-    pythonRelaxDeps = [
-      # Temporary to fix CI only:
-      # https://github.com/apache/airflow/commit/c474be9ff06cf16bf96f93de9a09e30ffc476bee
-      "fastapi"
-      "universal-pathlib"
-    ];
   };
 
   taskSdk = buildPythonPackage {
@@ -308,6 +303,15 @@ let
     postPatch = ''
       # resolve cyclic dependency
       sed -i -E 's/"apache-airflow-core[^"]+",//' pyproject.toml
+
+      # relax dependencies
+      sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+      sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+      sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+
+      # task-sdk needs config.yml from core subpackage
+      mkdir -p src/airflow/config_templates
+      cp ../airflow-core/src/airflow/config_templates/* src/airflow/config_templates/
     '';
 
     build-system = [
@@ -323,6 +327,7 @@ let
       greenback
       httpx
       jinja2
+      jsonschema
       methodtools
       msgspec
       pendulum
@@ -345,10 +350,10 @@ buildPythonPackage rec {
   pyproject = true;
 
   postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "GitPython==3.1.45" "GitPython" \
-      --replace-fail "hatchling==1.27.0" "hatchling" \
-      --replace-fail "trove-classifiers==2025.9.11.17" "trove-classifiers"
+    # relax dependencies
+    sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
+    sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
+    sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
   '';
 
   nativeBuildInputs = [ writableTmpDirAsHomeHook ];

pkgs/by-name/ap/apache-airflow/update-providers.py

@@ -27,6 +27,7 @@ PKG_PREFERENCES = {
     "protobuf": "protobuf",
     "pydantic": "pydantic",
     "requests_toolbelt": "requests-toolbelt",
+    "sqlalchemy": "sqlalchemy",
 }
 
 # Requirements missing from the airflow provider metadata

pkgs/by-name/ap/apple-sdk/metadata/versions.json

@@ -17,10 +17,10 @@
   },
   "26": {
     "urls": [
-      "https://swcdn.apple.com/content/downloads/27/62/093-35114-A_AAH24ZZQB5/yn87ru9qe9225m8hwq2ic3hjy5yc5vw7h9/CLTools_macOSNMOS_SDK.pkg",
-      "https://web.archive.org/web/20250915230423/https://swcdn.apple.com/content/downloads/27/62/093-35114-A_AAH24ZZQB5/yn87ru9qe9225m8hwq2ic3hjy5yc5vw7h9/CLTools_macOSNMOS_SDK.pkg"
+      "https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg",
+      "https://web.archive.org/web/20260406133131/https://swcdn.apple.com/content/downloads/32/53/047-96692-A_OAHIHT53YB/ybtshxmrcju8m2qvw3w5elr4rajtg1x3y3/CLTools_macOSNMOS_SDK.pkg"
     ],
-    "version": "26.0",
-    "hash": "sha256-54UtisDXHCxs7vO4fZSWOYwxLbdouLxWwGisez+tlAc="
+    "version": "26.4",
+    "hash": "sha256-7nrbCv1pNlpzEqwZWVfUPCvDfXEJJNOl7ApkeFpIOC0="
   }
 }

pkgs/by-name/at/at-spi2-core/package.nix

@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.58.3";
+  version = "2.60.1";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-sPq+psl0LtqMnGdfm4wdG6u6HagtoD6hEDcQIzcXwbA=";
+    hash = "sha256-+ZuH48FnT1+8QXzJwdniYcDymqsFUK1jaYBQMdEvaFI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/at/atf/package.nix

@@ -45,6 +45,18 @@ stdenv'.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  configureFlags =
+    lib.optionals stdenv.hostPlatform.isDarwin [
+      "ATF_SHELL=${darwin.bootstrapStdenv.shell}"
+    ]
+    # When cross-compiling, autoconf cannot run test programs on the build host.
+    # Pre-set cache variables so configure skips those AC_RUN_IFELSE checks.
+    ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      "kyua_cv_getopt_plus=yes"
+      "kyua_cv_attribute_noreturn=yes"
+      "kyua_cv_getcwd_works=yes"
+    ];
+
   enableParallelBuilding = true;
 
   makeFlags = [

pkgs/by-name/av/avahi/package.nix

@@ -140,6 +140,44 @@ stdenv.mkDerivation rec {
       url = "https://github.com/avahi/avahi/commit/366e3798bdbd6b7bf24e59379f4a9a51af575ce9.patch";
       hash = "sha256-9AdhtzrimmcpMmeyiFcjmDfG5nqr/S8cxWTaM1mzCWA=";
     })
+    # https://github.com/avahi/avahi/pull/662 merged 2025-06-19
+    # NOTE: CVE-2024-52615 is mitigated by the default NixOS configuration.
+    # NOTE: CVE-2025-59529 is introduced by 4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942.
+    /*
+      (fetchpatch {
+        name = "CVE-2024-52615.patch"; # AKA GHSA-x6vp-f33h-h32g
+        url = "https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942.patch";
+        hash = "sha256-rW6jmKg9oH44rRZow0zE4z6lfTlD8wpFUC8DaI/gruA=";
+      })
+    */
+    # https://github.com/avahi/avahi/pull/806 merged 2025-12-17
+    (fetchpatch {
+      name = "CVE-2025-68276.patch"; # AKA GHSA-mhf3-865v-g5rc
+      url = "https://github.com/avahi/avahi/commit/0c013e2e819be3bda74cecf48b5f64956cf8a760.patch";
+      hash = "sha256-kNOwl2DC2FR7CFvPQBBEYaSUSbFnR/ETH9JNGMwzzLE=";
+    })
+    (fetchpatch {
+      name = "CVE-2025-68468.patch"; # AKA GHSA-cp79-r4x9-vf52
+      url = "https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a.patch";
+      hash = "sha256-HkbKSN2LYqPfVnij1/n6ToN4vKugex3ZPxjHz6pN8eA=";
+    })
+    (fetchpatch {
+      name = "CVE-2025-68471.patch"; # AKA GHSA-56rf-42xr-qmmg
+      url = "https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1.patch";
+      hash = "sha256-V0OiC0UkZXhUnOUcrPZ+Xvph7MJMQ9DEXgVafoshSi4=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-24401.patch"; # AKA GHSA-h4vp-5m8j-f6w3
+      url = "https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524.patch";
+      hash = "sha256-Iq7ghHS8gTJ5OeD6Bemis+wPJzKXb2P44qbtTaAaWZI=";
+    })
+    # https://github.com/avahi/avahi/pull/891 merged 2026-04-01
+    (fetchpatch {
+      name = "CVE-2026-34933.patch"; # AKA GHSA-w65r-6gxh-vhvc
+      url = "https://github.com/avahi/avahi/compare/0ccadca425af151ebb67f276e5cc88e50266a8e6%5E%5E...0ccadca425af151ebb67f276e5cc88e50266a8e6.patch";
+      hash = "sha256-yi40iuQmTAW+nLsOIJhh7kg4vG/lqT/PCaSEBPfF2mw=";
+    })
+
   ];
 
   depsBuildBuild = [
@@ -222,6 +260,8 @@ stdenv.mkDerivation rec {
       ln -s avahi-compat-libdns_sd/dns_sd.h "$dev/include/dns_sd.h"
     '';
 
+  enableParallelBuilding = true;
+
   passthru.tests = {
     smoke-test = nixosTests.avahi;
     smoke-test-resolved = nixosTests.avahi-with-resolved;
@@ -241,5 +281,10 @@ stdenv.mkDerivation rec {
       DNS") and DNS-SD (for "DNS-Based Service Discovery")
       protocols.
     '';
+
+    knownVulnerabilities = [
+      # NOTE: CVE-2024-52615 mitigated by the default NixOS configuration.
+      # "CVE-2024-52615: Avahi Wide-Area DNS Uses Constant Source Port"
+    ];
   };
 }

pkgs/by-name/aw/aws-c-event-stream/package.nix

@@ -15,13 +15,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-c-event-stream";
   # nixpkgs-update: no auto update
-  version = "0.5.7";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "aws-c-event-stream";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-JvjUrIj1bh5WZEzkauLSLIolxrT8CKIMjO7p1c35XZI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jMtLJjKC7TuNZ0c0Nc3+KRh226RBl0omkiKNXXBltoc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/aw/awscli2/package.nix

@@ -70,6 +70,7 @@ py.pkgs.buildPythonApplication rec {
       --replace-fail 'awscrt==' 'awscrt>=' \
       --replace-fail 'distro>=1.5.0,<1.9.0' 'distro>=1.5.0' \
       --replace-fail 'docutils>=0.10,<0.20' 'docutils>=0.10' \
+      --replace-fail 'jmespath>=0.7.1,<1.1.0' 'jmespath>=0.7.1' \
       --replace-fail 'prompt-toolkit>=3.0.24,<3.0.52' 'prompt-toolkit>=3.0.24' \
       --replace-fail 'ruamel_yaml>=0.15.0,<=0.19.1' 'ruamel_yaml>=0.15.0' \
       --replace-fail 'ruamel_yaml_clib>=0.2.0,<=0.2.15' 'ruamel_yaml_clib>=0.2.0' \

pkgs/by-name/ba/baobab/package.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "baobab";
-  version = "49.1";
+  version = "50.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/baobab/${lib.versions.major finalAttrs.version}/baobab-${finalAttrs.version}.tar.xz";
-    hash = "sha256-YkPJIAK+fpH13s0klhL6zipKEtN0Kv2IsIapS4dd/+A=";
+    hash = "sha256-VzyE8V9fljpEBQD29DQSySisIzX2tp3LWPGh/lIBAks=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/bazaar/package.nix

@@ -5,6 +5,7 @@
   blueprint-compiler,
   desktop-file-utils,
   meson,
+  python3,
   ninja,
   pkg-config,
   wrapGAppsHook4,
@@ -18,9 +19,12 @@
   libdex,
   libglycin,
   libglycin-gtk4,
+  libproxy,
   libsoup_3,
   libxmlb,
+  libxml2,
   libyaml,
+  malcontent,
   md4c,
   webkitgtk_6_0,
   libsecret,
@@ -29,22 +33,37 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.7.8";
+  version = "0.7.15";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  outputs = [
+    "out"
+    # for libbge
+    "lib"
+    "dev"
+  ];
 
   src = fetchFromGitHub {
-    owner = "kolunmi";
+    owner = "bazaar-org";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s3NKRh1xUcLXVGWm0oYY4fVX7t7+bZIZ2jAYe1W0LKA=";
+    hash = "sha256-+52W2iU8rdzN4cCxjkKe80qAbvyeqkvDYRRIiBB5yCg=";
   };
 
   nativeBuildInputs = [
     blueprint-compiler
     desktop-file-utils
+    libxml2
     meson
     ninja
     pkg-config
     wrapGAppsHook4
+    (python3.withPackages (p: [
+      p.babel
+      p.pygobject3
+    ]))
   ];
 
   buildInputs = [
@@ -58,19 +77,31 @@ stdenv.mkDerivation (finalAttrs: {
     libglycin
     libglycin-gtk4
     glycin-loaders
+    libproxy
     libsoup_3
     libxmlb
     libyaml
+    malcontent
     md4c
     webkitgtk_6_0
     libsecret
   ];
 
-  # bazaar needs bazaar-dl-worker in path
+  postInstall = ''
+    moveToOutput bin/bge-demo $dev
+  '';
+
   preFixup = ''
     gappsWrapperArgs+=(
+      # bazaar needs bazaar-dl-worker in path
       --prefix PATH : $out/bin
+      --prefix LD_LIBRARY_PATH : $lib/lib
+      # gsettings schemas are moved to $lib
+      --prefix XDG_DATA_DIRS : $lib/share
     )
+
+    # isn't automatically picked out for some reason, while $dev/bin/bge-demo is...
+    wrapGApp $out/bin/bazaar
   '';
 
   passthru = {

pkgs/by-name/bl/bleur/package.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  pkg-config,
+  openssl,
+  rustPlatform,
+  fetchgit,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bleur";
+  version = "0.0.7";
+  __structuredAttrs = true;
+
+  src = fetchgit {
+    url = "https://git.oss.uzinfocom.uz/bleur/bleur.git";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-bFpOvnC2MILr3b+KdVOAvDGmEZM8LDlwGd04csk2l18=";
+  };
+
+  cargoHash = "sha256-edeegm0QeXqj0E46+BHcmJMU1Ewn6p9hi3WArDtyVnI=";
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+  strictDeps = true;
+
+  meta = {
+    description = "Template manager & buddy for bleur templates by Orzklv";
+    platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "bleur";
+    homepage = "https://bleur.uz/";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [
+      orzklv
+      bahrom04
+      wolfram444
+    ];
+  };
+})

pkgs/by-name/bl/blueprint-compiler/package.nix

@@ -12,6 +12,7 @@
   testers,
   wrapGAppsNoGuiHook,
   xvfb-run,
+  gnome,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "blueprint-compiler";
@@ -67,17 +68,22 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postCheck
   '';
 
-  passthru.tests = {
-    version = testers.testVersion {
-      package = finalAttrs.finalPackage;
+  passthru = {
+    tests = {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+      # regression test that `blueprint-compiler` can be used in a standalone
+      # context outside of nix builds, and doesn't rely on the setup hooks of
+      # its propagated inputs for basic functionality.
+      # see https://github.com/NixOS/nixpkgs/pull/400415
+      standalone = runCommand "blueprint-compiler-test-standalone" { } ''
+        ${lib.getExe finalAttrs.finalPackage} --help && touch $out
+      '';
+    };
+    updateScript = gnome.updateScript {
+      packageName = "blueprint-compiler";
     };
-    # regression test that `blueprint-compiler` can be used in a standalone
-    # context outside of nix builds, and doesn't rely on the setup hooks of
-    # its propagated inputs for basic functionality.
-    # see https://github.com/NixOS/nixpkgs/pull/400415
-    standalone = runCommand "blueprint-compiler-test-standalone" { } ''
-      ${lib.getExe finalAttrs.finalPackage} --help && touch $out
-    '';
   };
 
   meta = {
@@ -89,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
       benediktbroich
       ranfdev
     ];
+    teams = [ lib.teams.gnome ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/bl/bluez/lreadline.patch

@@ -0,0 +1,91 @@
+# Adjusted version of https://lore.kernel.org/linux-bluetooth/20250703182908.2370130-1-hi@alyssa.is/raw
+diff --git a/Makefile.tools b/Makefile.tools
+index 2080f0978..885371de9 100644
+--- a/Makefile.tools
++++ b/Makefile.tools
+@@ -19,7 +19,7 @@ client_bluetoothctl_SOURCES = client/main.c \
+ 					client/telephony.h client/telephony.c
+ client_bluetoothctl_LDADD = lib/libbluetooth-internal.la \
+ 			gdbus/libgdbus-internal.la src/libshared-glib.la \
+-			$(GLIB_LIBS) $(DBUS_LIBS) -lreadline
++			$(GLIB_LIBS) $(DBUS_LIBS) $(READLINE_LIBS)
+ endif
+ 
+ if ZSH_COMPLETIONS
+@@ -385,7 +385,7 @@ tools_meshctl_SOURCES = tools/meshctl.c \
+ 				tools/mesh-gatt/onoff-model.c
+ tools_meshctl_LDADD = gdbus/libgdbus-internal.la src/libshared-glib.la \
+ 				lib/libbluetooth-internal.la \
+-				$(GLIB_LIBS) $(DBUS_LIBS) -ljson-c -lreadline
++				$(GLIB_LIBS) $(DBUS_LIBS) -ljson-c $(READLINE_LIBS)
+ 
+ EXTRA_DIST += tools/mesh-gatt/local_node.json tools/mesh-gatt/prov_db.json
+ endif
+@@ -404,7 +404,7 @@ tools_mesh_cfgclient_SOURCES = tools/mesh-cfgclient.c \
+ 				mesh/crypto.h mesh/crypto.c
+ 
+ tools_mesh_cfgclient_LDADD = lib/libbluetooth-internal.la src/libshared-ell.la \
+-						$(ell_ldadd) -ljson-c -lreadline
++						$(ell_ldadd) -ljson-c $(READLINE_LIBS)
+ 
+ bin_PROGRAMS +=  tools/mesh-cfgtest
+ 
+@@ -512,7 +512,7 @@ noinst_PROGRAMS += tools/btmgmt tools/obex-client-tool tools/obex-server-tool \
+ tools_obex_client_tool_SOURCES = $(gobex_sources) $(btio_sources) \
+ 						tools/obex-client-tool.c
+ tools_obex_client_tool_LDADD = lib/libbluetooth-internal.la \
+-			       src/libshared-glib.la $(GLIB_LIBS) -lreadline
++			       src/libshared-glib.la $(GLIB_LIBS) $(READLINE_LIBS)
+ 
+ tools_obex_server_tool_SOURCES = $(gobex_sources) $(btio_sources) \
+ 						tools/obex-server-tool.c
+@@ -523,16 +523,16 @@ tools_bluetooth_player_SOURCES = tools/bluetooth-player.c client/print.c \
+ 				client/player.c
+ tools_bluetooth_player_LDADD = gdbus/libgdbus-internal.la \
+ 				src/libshared-glib.la \
+-				$(GLIB_LIBS) $(DBUS_LIBS) -lreadline
++				$(GLIB_LIBS) $(DBUS_LIBS) $(READLINE_LIBS)
+ 
+ tools_obexctl_SOURCES = tools/obexctl.c
+ tools_obexctl_LDADD = gdbus/libgdbus-internal.la src/libshared-glib.la \
+-			$(GLIB_LIBS) $(DBUS_LIBS) -lreadline
++			$(GLIB_LIBS) $(DBUS_LIBS) $(READLINE_LIBS)
+ 
+ tools_btmgmt_SOURCES = tools/btmgmt.c src/uuid-helper.c client/display.c \
+ 			client/mgmt.c
+ tools_btmgmt_LDADD = lib/libbluetooth-internal.la src/libshared-glib.la \
+-				$(GLIB_LIBS) -lreadline
++				$(GLIB_LIBS) $(READLINE_LIBS)
+ if DEPRECATED
+ noinst_PROGRAMS += attrib/gatttool
+ 
+@@ -542,7 +542,7 @@ attrib_gatttool_SOURCES = attrib/gatttool.c attrib/att.c attrib/gatt.c \
+ 				attrib/utils.c src/log.c client/display.c \
+ 				client/display.h
+ attrib_gatttool_LDADD = lib/libbluetooth-internal.la \
+-			src/libshared-glib.la $(GLIB_LIBS) -lreadline
++			src/libshared-glib.la $(GLIB_LIBS) $(READLINE_LIBS)
+ 
+ endif
+ endif
+@@ -592,5 +592,5 @@ tools/btpclient.$(OBJEXT): src/libshared-ell.la ell/internal
+ 
+ tools_btpclientctl_SOURCES = tools/btpclientctl.c client/display.c
+ tools_btpclientctl_LDADD = src/libshared-mainloop.la src/libshared-glib.la \
+-				lib/libbluetooth-internal.la -lreadline
++				lib/libbluetooth-internal.la $(READLINE_LIBS)
+ endif
+diff --git a/configure.ac b/configure.ac
+index 52de7d665..f110ab103 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -338,8 +338,7 @@ AC_ARG_ENABLE(client, AS_HELP_STRING([--disable-client],
+ AM_CONDITIONAL(CLIENT, test "${enable_client}" != "no")
+ 
+ if (test "${enable_client}" != "no" || test "${enable_mesh}" = "yes"); then
+-        AC_CHECK_HEADERS(readline/readline.h, enable_readline=yes,
+-                AC_MSG_ERROR(readline header files are required))
++        PKG_CHECK_MODULES([READLINE], [readline], enable_readline=yes)
+ fi
+ AM_CONDITIONAL(READLINE, test "${enable_readline}" = "yes")
+ 

pkgs/by-name/bl/bluez/package.nix

@@ -8,7 +8,7 @@
   docutils,
   ell,
   enableExperimental ? false,
-  fetchurl,
+  fetchpatch2,
   glib,
   json_c,
   libical,
@@ -32,11 +32,19 @@ stdenv.mkDerivation (finalAttrs: {
   inherit (bluez-headers) version src;
 
   patches = [
-    (fetchurl {
-      name = "static.patch";
-      url = "https://lore.kernel.org/linux-bluetooth/20250703182908.2370130-1-hi@alyssa.is/raw";
-      hash = "sha256-4Yz3ljsn2emJf+uTcJO4hG/YXvjERtitce71TZx5Hak=";
+    # https://github.com/bluez/bluez/issues/1896
+    # Remove the following 2 in the next release
+    (fetchpatch2 {
+      name = "fix-btctl-noninteractive-regression";
+      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=b33e923b55e4d0e9d78a83cfcb541fd1f687ef54";
+      hash = "sha256-q7eN4ktw7DtdwMHHi7GU7fbvHAdMttKF1kDSWzZqa6A=";
     })
+    (fetchpatch2 {
+      name = "fix-btctl-noninteractive-regression-2";
+      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=21e13976f2e375d701b8b7032ba5c1b2e56c305f";
+      hash = "sha256-JrdmYiC+U0KeMP8oVg12Z8CvkMEKWBVgiiUACx0E7dY=";
+    })
+    ./lreadline.patch
   ];
 
   buildInputs = [

pkgs/by-name/bu/bubblewrap/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bubblewrap";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "bubblewrap";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sp5XYkTuoL778p5xQRDtFbX0ocdJuRbVxJCkKbEUgZs=";
+    hash = "sha256-MUjJMhJ8Q9sYQyGqA7zfMutYjMSZNmEHXs2H3WN4mbE=";
   };
 
   outputs = [

pkgs/by-name/ca/cacert/package.nix

@@ -20,7 +20,7 @@ let
     lib.concatStringsSep "\n\n" extraCertificateStrings
   );
 
-  version = "3.121";
+  version = "3.123";
   meta = {
     homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
     description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
         "https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
         "https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
       ];
-    hash = "sha256-O5jU4/9XoybZWHwzYzA5yMOpzwtV98pYHXWY/zKesfM=";
+    hash = "sha256-dxMO+RITdyhEVh+9OqMdQTslwqx/V2/qO8O7/375NIk=";
   };
 
   unpackPhase = ''

pkgs/by-name/ca/cambalache/package.nix

@@ -24,7 +24,7 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cambalache";
-  version = "0.99.3";
+  version = "1.0";
   pyproject = false;
 
   # Did not fetch submodule since it is only for tests we don't run.
@@ -33,7 +33,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     owner = "jpu";
     repo = "cambalache";
     tag = finalAttrs.version;
-    hash = "sha256-1X7fXYSIXoj8qhQLIfz2gMrCnNBZ7OJCeMykBSpnYD4=";
+    hash = "sha256-V1xiw6oGOlmLR1JOy82REIdoOTGfzXYMBJAAtjDJtfM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ch/chromaprint/package.nix

@@ -51,7 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
   hardeningDisable = [ "trivialautovarinit" ];
 
   cmakeFlags = [
-    (lib.cmakeBool "BUILD_EXAMPLES" withExamples)
     (lib.cmakeBool "BUILD_TOOLS" withTools)
   ]
   ++ lib.optionals (!finalAttrs.finalPackage.doCheck) [
@@ -64,7 +63,8 @@ stdenv.mkDerivation (finalAttrs: {
     tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
   };
 
-  doCheck = true;
+  # From some reason it dies at the end...
+  doCheck = !stdenv.hostPlatform.isDarwin;
   checkPhase =
     let
       exampleAudio = fetchurl {

pkgs/by-name/cl/claude-code/package.nix

@@ -9,6 +9,7 @@
   installShellFiles,
   makeBinaryWrapper,
   autoPatchelfHook,
+  alsa-lib,
   procps,
   ripgrep,
   bubblewrap,
@@ -56,7 +57,9 @@ stdenv.mkDerivation (finalAttrs: {
       --set-default FORCE_AUTOUPDATE_PLUGINS 1 \
       --set DISABLE_INSTALLATION_CHECKS 1 \
       --set USE_BUILTIN_RIPGREP 0 \
-      --prefix PATH : ${
+      ${lib.optionalString stdenv.hostPlatform.isLinux ''
+        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ alsa-lib ]} \
+      ''}--prefix PATH : ${
         lib.makeBinPath (
           [
             # claude-code uses [node-tree-kill](https://github.com/pkrumins/node-tree-kill) which requires procps's pgrep(darwin) or ps(linux)

pkgs/by-name/cl/clonehero/package.nix

@@ -24,18 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clonehero";
-  version = "1.0.0.4080";
+  version = "1.1.0.6085";
 
   src = fetchurl {
-    url = "https://github.com/clonehero-game/releases/releases/download/V${finalAttrs.version}/CloneHero-linux.tar.xz";
-    hash = "sha256-YWLV+wgQ9RfKRSSWh/x0PMjB6tFA4YpHb9WtYOOgZZI=";
+    url = "https://github.com/clonehero-game/releases/releases/download/v${finalAttrs.version}-final/Linux.x86_64-Standalone.tar";
+    hash = "sha256-xy7/3SDNgKw67ikA7CtRVK2gNrfjqx4cTDeRUkkSBKo=";
   };
 
-  outputs = [
-    "out"
-    "doc"
-  ];
-
   nativeBuildInputs = [ autoPatchelfHook ];
 
   buildInputs = [
@@ -73,17 +68,20 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 clonehero "$out/bin/clonehero"
-    install -Dm644 UnityPlayer.so "$out/libexec/clonehero/UnityPlayer.so"
+    install -Dm755 clonehero "$out/libexec/clonehero/clonehero"
+    install -Dm644 GameAssembly.so "$out/lib/clonehero/GameAssembly.so"
+    install -Dm644 UnityPlayer.so "$out/lib/clonehero/UnityPlayer.so"
 
-    mkdir -p "$out/share/icons/hicolor/128x128/apps"
+    mkdir -p "$out/share"
     cp -r clonehero_Data "$out/share/clonehero"
-    ln -s "$out/share/clonehero" "$out/bin/clonehero_Data"
-    ln -s "$out/share/clonehero/Resources/UnityPlayer.png" "$out/share/icons/hicolor/128x128/apps/clonehero.png"
     install -Dm644 "$desktopItem/share/applications/clonehero.desktop" "$out/share/applications/clonehero.desktop"
 
-    mkdir -p "$doc/share/doc/clonehero"
-    cp -r CLONE_HERO_MANUAL.{pdf,txt} Custom EULA.txt THIRDPARTY.txt "$doc/share/doc/clonehero"
+    mkdir -p "$out/bin" "$out/share/icons/hicolor/128x128/apps"
+    ln -s "$out/libexec/clonehero/clonehero" "$out/bin/clonehero"
+    ln -s "$out/lib/clonehero/GameAssembly.so" "$out/libexec/clonehero/GameAssembly.so"
+    ln -s "$out/lib/clonehero/UnityPlayer.so" "$out/libexec/clonehero/UnityPlayer.so"
+    ln -s "$out/share/clonehero" "$out/libexec/clonehero/clonehero_Data"
+    ln -s "$out/share/clonehero/Resources/UnityPlayer.png" "$out/share/icons/hicolor/128x128/apps/clonehero.png"
 
     runHook postInstall
   '';
@@ -114,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
       --add-needed libXrandr.so.2 \
       --add-needed libXss.so.1 \
       --add-needed libXxf86vm.so.1 \
-      "$out/libexec/clonehero/UnityPlayer.so"
+      "$out/lib/clonehero/UnityPlayer.so"
   '';
 
   meta = {

pkgs/by-name/co/comigo/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "comigo";
+  version = "1.2.30";
+
+  src = fetchFromGitHub {
+    owner = "yumenaka";
+    repo = "comigo";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JS+KgXmYEx3V5FnFqcDwFonxRHg5f5n8uH4MtpT0e3g=";
+  };
+
+  vendorHash = "sha256-OUmqbev7Eq79co8RdmwOF6fqcOWwwm6Kx4fbvd2DJU4=";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Simple and Efficient Comic Reader";
+    homepage = "https://github.com/yumenaka/comigo";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ zendo ];
+    mainProgram = "comigo";
+  };
+})

pkgs/by-name/cu/cups/package.nix

@@ -23,15 +23,18 @@
   nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cups";
-  version = "2.4.16";
+  version = "2.4.19";
 
   src = fetchurl {
-    url = "https://github.com/OpenPrinting/cups/releases/download/v${version}/cups-${version}-source.tar.gz";
-    hash = "sha256-AzlYcgS0+UKN0FkuswHewL+epuqNzl2WkNVr5YWrqS0=";
+    url = "https://github.com/OpenPrinting/cups/releases/download/v${finalAttrs.version}/cups-${finalAttrs.version}-source.tar.gz";
+    hash = "sha256-ggmEsSpn+YcFeFquLdE0f+CsCXgoAB1Fg/9kV0rtY4k=";
   };
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   outputs = [
     "out"
     "lib"
@@ -183,4 +186,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/cu/curlMinimal/package.nix

@@ -84,7 +84,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.19.0";
+  version = "8.20.0";
 
   src = fetchurl {
     urls = [
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-TrQUiXkNGeGQ16x+GOgoV83Wivj05mspLO1WLTM/Ed8=";
+    hash = "sha256-Y/4twUi6DOromSLvg49+XJRicsLni3xZ+rS3nTziuJY=";
   };
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
@@ -188,8 +188,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2))
     (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl))
     (lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2))
-    # TODO: Clean up on `staging`.
-    "--without-wolfssl"
   ]
   ++ lib.optional gssSupport "--with-gssapi=${lib.getDev libkrb5}"
   # For the 'urandom', maybe it should be a cross-system option

pkgs/by-name/d-/d-spy/package.nix

@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "d-spy";
-  version = "49.2";
+  version = "50.0";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/d-spy/${lib.versions.major finalAttrs.version}/d-spy-${finalAttrs.version}.tar.xz";
-    hash = "sha256-uBT/J9goqrzacvLGLxtB1iA190PQb9mn48XJhsSHmmk=";
+    hash = "sha256-G93IbYos9ntPZS3EYczYNTES8Ih1NCADfHX1RU3qrRA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/da/dash/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dash";
-  version = "0.5.13.2";
+  version = "0.5.13.3";
 
   src = fetchurl {
     url = "http://gondor.apana.org.au/~herbert/dash/files/dash-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5xNoJrHu1s4xk+iv+i9wsbK5Fo3ZH/p9209G6eYgVP4=";
+    hash = "sha256-qDcnwSmaxMPZ1Dl5OTs6TrACddVjauAlJueXnVHW+9E=";
   };
 
   strictDeps = true;

pkgs/by-name/db/dbus_cplusplus/package.nix

@@ -74,6 +74,8 @@ stdenv.mkDerivation rec {
     "--disable-examples"
   ];
 
+  enableParallelBuilding = true;
+
   meta = {
     homepage = "https://dbus-cplusplus.sourceforge.net";
     description = "C++ API for D-BUS";

pkgs/by-name/de/decibels/package.nix

@@ -17,11 +17,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "decibels";
-  version = "49.0";
+  version = "49.6.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/decibels/${lib.versions.major finalAttrs.version}/decibels-${finalAttrs.version}.tar.xz";
-    hash = "sha256-KbebouKWfmkUHjnwrSxnfjj+P/ufug+lx1MflNP2c8o=";
+    hash = "sha256-mme6FN8jUXyEn8/ep2THOiQeWQVSmbEl6YrqsqeAGtU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/do/dolphin-emu/package.nix

@@ -9,7 +9,7 @@
   qt6,
   wrapGAppsHook3,
   # darwin-only
-  xcbuild,
+  re-plistbuddy,
 
   # buildInputs
   bzip2,
@@ -72,6 +72,11 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
+  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin) ''
+    substituteInPlace CMake/DolphinInjectVersionInfo.cmake \
+      --replace-fail "/usr/libexec/PlistBuddy" "PlistBuddy"
+  '';
+
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -81,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGAppsHook3
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    xcbuild # for plutil
+    re-plistbuddy # for plutil as well
   ];
 
   buildInputs = [

pkgs/by-name/eo/eog/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   meson,
   ninja,
   gettext,
@@ -34,7 +33,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eog";
-  version = "49.1";
+  version = "50.1";
 
   outputs = [
     "out"
@@ -44,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/eog/${lib.versions.major finalAttrs.version}/eog-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+t0S4UupzSvmmJ37zvQAAWRbY0QM7tjgSGewdYewZtw=";
+    hash = "sha256-b17m11ZUi4jiWph+DQbavDxsMlmPt99J+wiUXB/pSlU=";
   };
 
   patches = [
@@ -52,12 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     # We patch gobject-introspection to hardcode absolute paths but
     # our Meson patch will only pass the info when install_dir is absolute as well.
     ./fix-gir-lib-path.patch
-
-    # Switch to girepository-2.0
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/eog/raw/939eee56e5b72b02a8c0f4f867431cf6426adb9e/f/libpeas1_pygobject352.patch";
-      hash = "sha256-5QIkxxUvGKzb0cMCIcfuu7FX9XuY+RrKNunSvRDEDRc=";
-    })
   ];
 
   nativeBuildInputs = [

pkgs/by-name/ep/epiphany/package.nix

@@ -39,11 +39,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "epiphany";
-  version = "49.2";
+  version = "50.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${lib.versions.major finalAttrs.version}/epiphany-${finalAttrs.version}.tar.xz";
-    hash = "sha256-s7o9aCE+h/gfFzPoVQDDe4K1k4+QCeT+iZlJY9X7K44=";
+    hash = "sha256-Hib5kB8PCL/pQ6pwFjyVMzTH7D1K78jTVOipwUCzNKc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/et/ethtool/package.nix

@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ethtool";
-  version = "6.19";
+  version = "7.0";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/ethtool/ethtool-${finalAttrs.version}.tar.xz";
-    hash = "sha256-HCEUq24MDSqmfWmZYOsR3080HiQDE5zfKK6dqFimAl8=";
+    hash = "sha256-Zgv5clp4cTQ6DSMgaKdjT7z7abbC+O/0VYJ/rvsM0WI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ev/evince/package.nix

@@ -138,6 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
   passthru = {
     updateScript = gnome.updateScript {
       packageName = "evince";
+      # 49.alpha bumps API and breaks sushi.
+      freeze = true;
     };
   };
 

pkgs/by-name/ev/evolution-data-server/hardcode-gsettings.patch

@@ -1,8 +1,8 @@
 diff --git a/src/addressbook/libebook/e-book-client.c b/src/addressbook/libebook/e-book-client.c
-index c31f3ef..9ebb5f2 100644
+index 12fc59c..3fc80a5 100644
 --- a/src/addressbook/libebook/e-book-client.c
 +++ b/src/addressbook/libebook/e-book-client.c
-@@ -1926,7 +1926,18 @@ e_book_client_get_self (ESourceRegistry *registry,
+@@ -1944,7 +1944,18 @@ e_book_client_get_self (ESourceRegistry *registry,
  
  	*out_client = book_client;
  
@@ -22,7 +22,7 @@ index c31f3ef..9ebb5f2 100644
  	uid = g_settings_get_string (settings, SELF_UID_KEY);
  	g_object_unref (settings);
  
-@@ -1994,7 +2005,18 @@ e_book_client_set_self (EBookClient *client,
+@@ -2012,7 +2023,18 @@ e_book_client_set_self (EBookClient *client,
  	g_return_val_if_fail (
  		e_contact_get_const (contact, E_CONTACT_UID) != NULL, FALSE);
  
@@ -42,7 +42,7 @@ index c31f3ef..9ebb5f2 100644
  	g_settings_set_string (
  		settings, SELF_UID_KEY,
  		e_contact_get_const (contact, E_CONTACT_UID));
-@@ -2030,8 +2052,20 @@ e_book_client_is_self (EContact *contact)
+@@ -2048,8 +2070,20 @@ e_book_client_is_self (EContact *contact)
  	 * unfortunately the API doesn't allow that.
  	 */
  	g_mutex_lock (&mutex);
@@ -130,7 +130,7 @@ index 9d986d2..d63902a 100644
  	g_object_unref (settings);
  
 diff --git a/src/addressbook/libedata-book/e-book-meta-backend.c b/src/addressbook/libedata-book/e-book-meta-backend.c
-index 2a95a75..950f430 100644
+index 60ff97f..8535dec 100644
 --- a/src/addressbook/libedata-book/e-book-meta-backend.c
 +++ b/src/addressbook/libedata-book/e-book-meta-backend.c
 @@ -148,7 +148,18 @@ ebmb_is_power_saver_enabled (void)
@@ -154,10 +154,10 @@ index 2a95a75..950f430 100644
  	if (g_settings_get_boolean (settings, "limit-operations-in-power-saver-mode")) {
  		GPowerProfileMonitor *power_monitor;
 diff --git a/src/calendar/backends/contacts/e-cal-backend-contacts.c b/src/calendar/backends/contacts/e-cal-backend-contacts.c
-index 9f8646a..079aba9 100644
+index b16756f..f3d2d6b 100644
 --- a/src/calendar/backends/contacts/e-cal-backend-contacts.c
 +++ b/src/calendar/backends/contacts/e-cal-backend-contacts.c
-@@ -1338,7 +1338,18 @@ e_cal_backend_contacts_init (ECalBackendContacts *cbc)
+@@ -1433,7 +1433,18 @@ e_cal_backend_contacts_init (ECalBackendContacts *cbc)
  		(GDestroyNotify) g_free,
  		(GDestroyNotify) contact_record_free);
  
@@ -178,7 +178,7 @@ index 9f8646a..079aba9 100644
  	cbc->priv->update_alarms_id = 0;
  	cbc->priv->alarm_enabled = FALSE;
 diff --git a/src/calendar/backends/file/e-cal-backend-file.c b/src/calendar/backends/file/e-cal-backend-file.c
-index 6318854..6b7a88c 100644
+index 2e2dd0b..b5f99ab 100644
 --- a/src/calendar/backends/file/e-cal-backend-file.c
 +++ b/src/calendar/backends/file/e-cal-backend-file.c
 @@ -3701,7 +3701,20 @@ e_cal_backend_file_receive_objects (ECalBackendSync *backend,
@@ -244,7 +244,7 @@ index 92d68e2..d1e1fa4 100644
  		g_signal_connect_object (
  			watcher->priv->desktop_settings,
 diff --git a/src/calendar/libedata-cal/e-cal-meta-backend.c b/src/calendar/libedata-cal/e-cal-meta-backend.c
-index 371f9bb..b0a661e 100644
+index 866afd1..e57d877 100644
 --- a/src/calendar/libedata-cal/e-cal-meta-backend.c
 +++ b/src/calendar/libedata-cal/e-cal-meta-backend.c
 @@ -160,7 +160,18 @@ ecmb_is_power_saver_enabled (void)
@@ -267,7 +267,7 @@ index 371f9bb..b0a661e 100644
  
  	if (g_settings_get_boolean (settings, "limit-operations-in-power-saver-mode")) {
  		GPowerProfileMonitor *power_monitor;
-@@ -2652,7 +2663,20 @@ ecmb_receive_object_sync (ECalMetaBackend *meta_backend,
+@@ -2617,7 +2628,20 @@ ecmb_receive_object_sync (ECalMetaBackend *meta_backend,
  			if (is_declined) {
  				GSettings *settings;
  
@@ -290,10 +290,10 @@ index 371f9bb..b0a661e 100644
  				g_clear_object (&settings);
  			}
 diff --git a/src/camel/camel-cipher-context.c b/src/camel/camel-cipher-context.c
-index 03b5129..3f4256a 100644
+index a830f89..b9abaa2 100644
 --- a/src/camel/camel-cipher-context.c
 +++ b/src/camel/camel-cipher-context.c
-@@ -1637,7 +1637,18 @@ camel_cipher_can_load_photos (void)
+@@ -1638,7 +1638,18 @@ camel_cipher_can_load_photos (void)
  	GSettings *settings;
  	gboolean load_photos;
  
@@ -314,7 +314,7 @@ index 03b5129..3f4256a 100644
  	g_clear_object (&settings);
  
 diff --git a/src/camel/camel-gpg-context.c b/src/camel/camel-gpg-context.c
-index c5ac40f..fb8ae19 100644
+index 94f0769..8de758b 100644
 --- a/src/camel/camel-gpg-context.c
 +++ b/src/camel/camel-gpg-context.c
 @@ -748,7 +748,18 @@ gpg_ctx_get_executable_name (void)
@@ -363,10 +363,10 @@ index 2c0b6ef..b354332 100644
  		G_CALLBACK (mi_user_headers_settings_changed_cb), NULL);
  	G_UNLOCK (mi_user_headers);
 diff --git a/src/camel/providers/imapx/camel-imapx-server.c b/src/camel/providers/imapx/camel-imapx-server.c
-index c3c2d7d..e1370db 100644
+index e605049..9961fea 100644
 --- a/src/camel/providers/imapx/camel-imapx-server.c
 +++ b/src/camel/providers/imapx/camel-imapx-server.c
-@@ -5671,7 +5671,18 @@ camel_imapx_server_do_old_flags_update (CamelFolder *folder)
+@@ -5666,7 +5666,18 @@ camel_imapx_server_do_old_flags_update (CamelFolder *folder)
  	if (do_old_flags_update) {
  		GSettings *eds_settings;
  
@@ -507,7 +507,7 @@ index 3738359..f9ce2d9 100644
  		g_object_unref (settings);
  
 diff --git a/src/libedataserver/e-oauth2-service.c b/src/libedataserver/e-oauth2-service.c
-index db775f9..fb524db 100644
+index c999d4d..e9cf7c5 100644
 --- a/src/libedataserver/e-oauth2-service.c
 +++ b/src/libedataserver/e-oauth2-service.c
 @@ -93,7 +93,18 @@ eos_default_guess_can_process (EOAuth2Service *service,
@@ -531,10 +531,10 @@ index db775f9..fb524db 100644
  	g_object_unref (settings);
  
 diff --git a/src/libedataserver/e-source-registry.c b/src/libedataserver/e-source-registry.c
-index bd9822d..3e021dd 100644
+index bcc2df7..42489da 100644
 --- a/src/libedataserver/e-source-registry.c
 +++ b/src/libedataserver/e-source-registry.c
-@@ -1781,7 +1781,19 @@ e_source_registry_init (ESourceRegistry *registry)
+@@ -1751,7 +1751,19 @@ e_source_registry_init (ESourceRegistry *registry)
  
  	g_mutex_init (&registry->priv->sources_lock);
  
@@ -556,10 +556,10 @@ index bd9822d..3e021dd 100644
  	g_signal_connect (
  		registry->priv->settings, "changed",
 diff --git a/src/libedataserverui/e-reminders-widget.c b/src/libedataserverui/e-reminders-widget.c
-index 980ceb1..02d9551 100644
+index 302aacf..ed4a7fa 100644
 --- a/src/libedataserverui/e-reminders-widget.c
 +++ b/src/libedataserverui/e-reminders-widget.c
-@@ -2132,7 +2132,19 @@ static void
+@@ -2133,7 +2133,19 @@ static void
  e_reminders_widget_init (ERemindersWidget *reminders)
  {
  	reminders->priv = e_reminders_widget_get_instance_private (reminders);
@@ -628,27 +628,3 @@ index d531cb9..c96f1d5 100644
  
  	switch (g_settings_get_int (settings, "proxy-type")) {
  		case 1:
-diff --git a/src/services/evolution-source-registry/evolution-source-registry.c b/src/services/evolution-source-registry/evolution-source-registry.c
-index 1c0a113..6b41423 100644
---- a/src/services/evolution-source-registry/evolution-source-registry.c
-+++ b/src/services/evolution-source-registry/evolution-source-registry.c
-@@ -181,7 +181,18 @@ main (gint argc,
- 
- reload:
- 
--	settings = g_settings_new ("org.gnome.evolution-data-server");
-+	{
-+		g_autoptr(GSettingsSchemaSource) schema_source;
-+		g_autoptr(GSettingsSchema) schema;
-+		schema_source = g_settings_schema_source_new_from_directory("@EDS@",
-+									    g_settings_schema_source_get_default(),
-+									    TRUE,
-+									    NULL);
-+		schema = g_settings_schema_source_lookup(schema_source,
-+							 "org.gnome.evolution-data-server",
-+							 FALSE);
-+		settings = g_settings_new_full(schema, NULL, NULL);
-+	}
- 
- 	if (!opt_disable_migration && !g_settings_get_boolean (settings, "migrated")) {
- 		g_settings_set_boolean (settings, "migrated", TRUE);

pkgs/by-name/ev/evolution-data-server/package.nix

@@ -50,7 +50,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evolution-data-server";
-  version = "3.58.3";
+  version = "3.60.1";
 
   outputs = [
     "out"
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor finalAttrs.version}/evolution-data-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-2hNtEZDZ6LCUmUUvYFjiTu5rd/RBqMdp90pSRRvzefE=";
+    hash = "sha256-M/ktO4gi66BMMTeWwHeMu2Who4Ry6FftxfmIVMyps0w=";
   };
 
   patches = [

pkgs/by-name/ev/evolution-ews/hardcode-gsettings.patch

@@ -1,5 +1,5 @@
 diff --git a/src/EWS/camel/camel-ews-utils.c b/src/EWS/camel/camel-ews-utils.c
-index 9dcc5b1..9588be3 100644
+index a976b2e..c15e6f3 100644
 --- a/src/EWS/camel/camel-ews-utils.c
 +++ b/src/EWS/camel/camel-ews-utils.c
 @@ -1562,7 +1562,7 @@ ews_utils_save_category_changes (GHashTable *old_categories, /* gchar *guid ~> C
@@ -32,7 +32,7 @@ index 9dcc5b1..9588be3 100644
  
  	for (ii = 0; strv && strv[ii]; ii++) {
 diff --git a/src/Microsoft365/camel/camel-m365-store.c b/src/Microsoft365/camel/camel-m365-store.c
-index a4997c7..94be919 100644
+index 6c1ebd6..4b7de44 100644
 --- a/src/Microsoft365/camel/camel-m365-store.c
 +++ b/src/Microsoft365/camel/camel-m365-store.c
 @@ -311,7 +311,7 @@ m365_store_save_category_changes (GHashTable *old_categories, /* gchar *id ~> Ca
@@ -93,10 +93,10 @@ index cec5417..38f1a87 100644
  		if (g_settings_get_boolean (settings, "use-system-timezone"))
  			location = e_cal_util_get_system_timezone_location ();
 diff --git a/src/common/e-ews-common-utils.c b/src/common/e-ews-common-utils.c
-index f388e3b..ed57213 100644
+index 1cc5a58..05b3610 100644
 --- a/src/common/e-ews-common-utils.c
 +++ b/src/common/e-ews-common-utils.c
-@@ -208,10 +208,21 @@ e_ews_common_utils_get_configured_icaltimezone (void)
+@@ -167,10 +167,21 @@ e_ews_common_utils_get_configured_icaltimezone (void)
  	ICalTimezone *zone = NULL;
  	gchar *location = NULL;
  

pkgs/by-name/ev/evolution-ews/package.nix

@@ -23,11 +23,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evolution-ews";
-  version = "3.58.3";
+  version = "3.60.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-ews/${lib.versions.majorMinor finalAttrs.version}/evolution-ews-${finalAttrs.version}.tar.xz";
-    hash = "sha256-P274u2OJAT6EPiWM4dwxeokaNPh9eXgMmu8E0nQavJI=";
+    hash = "sha256-CiL4ZevrcOJnlSD9LZSqmXPEA8vk4DqojPjyPzWOi20=";
   };
 
   patches = [

pkgs/by-name/ex/expat/package.nix

@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.7.5";
+  version = "2.8.0";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-EDLf70/xf3BGSCfaooNpsg9lhNEIvDbxerFnbh7dL5E=";
+    hash = "sha256-o3v64KqXdb2FIevYXcRW1Ibw/zETj2yR/ZAupzJiRUI=";
   };
 
   strictDeps = true;

pkgs/by-name/fo/folks/fix-docs-build-with-eds-3.59.patch

@@ -0,0 +1,15 @@
+diff --git a/docs/meson.build b/docs/meson.build
+index 67c664513033dd8f892870836efaebcab3960af3..83a011f3852b240539fe0d41356ef74fe07a7887 100644
+--- a/docs/meson.build
++++ b/docs/meson.build
+@@ -39,6 +39,10 @@ if eds_backend_enabled
+     docs_common_valadoc_flags += ['-D', 'HAS_EDS_3_41']
+   endif
+ 
++  if eds_dep.version().version_compare('>=3.59.1')
++    docs_common_valadoc_flags += ['-D', 'HAS_EDS_3_60']
++  endif
++
+   valadoc_targets += {
+     'name': 'folks-eds',
+     'source_files': eds_backendlib_sources,

pkgs/by-name/fo/folks/package.nix

@@ -41,6 +41,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-IfROK9q7Huf45Bu5ltEKx9rzXHjEmBd9sMAPWAogqRQ=";
   };
 
+  patches = [
+    # https://gitlab.gnome.org/GNOME/folks/-/merge_requests/81
+    ./fix-docs-build-with-eds-3.59.patch
+  ];
+
   nativeBuildInputs = [
     gettext
     gobject-introspection

pkgs/by-name/fo/font-util/package.nix

@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "font-util";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "font";
     repo = "util";
     tag = "font-util-${finalAttrs.version}";
-    hash = "sha256-cv6Whex1s4+J7Ue4IOHdO9WtrarTgSpLEghWpbUl+0o=";
+    hash = "sha256-tB6A5ezfHwzhL3HsWPZjX3/d53Zkm4hBFbxOnTUgNZc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gd/gdb/package.nix

@@ -13,6 +13,7 @@
   buildPackages,
 
   # Run time
+  bashNonInteractive,
   readline,
   expat,
   libipt,
@@ -47,6 +48,7 @@
     (lib.getLib targetPackages.stdenv.cc.cc)
   ],
   writeScript,
+  versionCheckHook,
 }:
 
 let
@@ -109,9 +111,11 @@ stdenv.mkDerivation (finalAttrs: {
     texinfo
     perl
     setupDebugInfoDirs
-  ];
+  ]
+  ++ optional pythonSupport python3;
 
   buildInputs = [
+    bashNonInteractive # for shebangs of gcore, gdb-add-index, gstack
     ncurses
     readline
     expat
@@ -126,7 +130,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optional withTui ncurses
   ++ optional withMpfr mpfr
   ++ optional withGmp gmp
-  ++ optional pythonSupport python3
   ++ optional withGuile guile
   ++ optional enableDebuginfod (elfutils.override { enableDebuginfod = true; })
   ++ optional stdenv.hostPlatform.isDarwin libiconv;
@@ -135,6 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
+  strictDeps = true;
+
   enableParallelBuilding = true;
 
   # darwin build fails with format hardening since v7.12
@@ -182,9 +187,9 @@ stdenv.mkDerivation (finalAttrs: {
     (withFeature true "system-readline")
     (withFeature true "system-zlib")
     (withFeature true "expat")
-    (withFeatureAs true "libexpat-prefix" "${expat.dev}")
-    (withFeatureAs withGmp "gmp" "${gmp.dev}")
-    (withFeatureAs withMpfr "mpfr" "${mpfr.dev}")
+    (withFeatureAs true "libexpat-prefix" expat.dev)
+    (withFeatureAs withGmp "gmp" gmp.dev)
+    (withFeatureAs withMpfr "mpfr" mpfr.dev)
     (withFeature pythonSupport "python")
     (withFeature withGuile "guile")
     (enableFeature enableSim "sim")
@@ -207,6 +212,9 @@ stdenv.mkDerivation (finalAttrs: {
     rm -v $out/share/info/bfd.info
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   passthru = {
     updateScript = writeScript "update-gdb" ''
       #!/usr/bin/env nix-shell

pkgs/by-name/gd/gdk-pixbuf/package.nix

@@ -1,6 +1,7 @@
 {
   stdenv,
   fetchurl,
+  fetchpatch,
   nixosTests,
   fixDarwinDylibNames,
   meson,
@@ -28,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdk-pixbuf";
-  version = "2.44.5";
+  version = "2.44.6";
 
   outputs = [
     "out"
@@ -40,12 +41,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdk-pixbuf/${lib.versions.majorMinor finalAttrs.version}/gdk-pixbuf-${finalAttrs.version}.tar.xz";
-    hash = "sha256-abk+CRObgMDuZhUD1g3rWlh0oxdytRhLnNVGKkEAq2g=";
+    hash = "sha256-FAwtC4mfz4U+6SsmNzydwijbzeCCCkJGaT9DKKJ0Zvo=";
   };
 
   patches = [
     # Move installed tests to a separate output
     ./installed-tests-path.patch
+
+    # Fix loading of xpm module if built-in
+    # https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/267
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/62b8f9fd0bb3b862823cd34afce4b389fbd27569.patch";
+      hash = "sha256-ECEIt8lq/jBtDdBetErKpap2PWGav10vqCXKCpIQSyA=";
+    })
   ];
 
   # gdk-pixbuf-thumbnailer is not wrapped therefore strictDeps will work
@@ -83,6 +91,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
+    # https://gitlab.archlinux.org/archlinux/packaging/packages/gdk-pixbuf2/-/work_items/13
+    "-Dlegacy_xpm=enabled"
     "-Dgio_sniffing=false"
     "-Dandroid=disabled"
     "-Dglycin=disabled"

pkgs/by-name/gd/gdm/fix-paths.patch

@@ -1,16 +1,18 @@
-diff --git a/daemon/gdm-local-display-factory.c b/daemon/gdm-local-display-factory.c
-index ad2e65cf7..61fb78db8 100644
---- a/daemon/gdm-local-display-factory.c
-+++ b/daemon/gdm-local-display-factory.c
-@@ -272,7 +272,7 @@ struct GdmDisplayServerConfiguration {
-         { "wayland", GDM_KEY_WAYLAND_ENABLE, NULL, "wayland" },
- #endif
- #ifdef ENABLE_X11_SUPPORT
--        { "xorg", GDM_KEY_XORG_ENABLE, "/usr/bin/Xorg", "x11" },
-+        { "xorg", GDM_KEY_XORG_ENABLE, "@xorgserver@/bin/Xorg", "x11" },
- #endif
-         { NULL, NULL, NULL },
- };
+diff --git a/common/gdm-common.c b/common/gdm-common.c
+index edf702ec5..3a75af430 100644
+--- a/common/gdm-common.c
++++ b/common/gdm-common.c
+@@ -994,8 +994,8 @@ const char * const
+ gdm_find_x_server (void)
+ {
+         const char * const x_servers[] = {
+-                "/usr/bin/Xorg",
+-                "/usr/bin/X",
++                "@xorgserver@/bin/Xorg",
++                "@xorgserver@/bin/X",
+         };
+         const char *override = NULL;
+ 
 diff --git a/daemon/gdm-manager.c b/daemon/gdm-manager.c
 index 457dcf88d..a71b89ba8 100644
 --- a/daemon/gdm-manager.c

pkgs/by-name/gd/gdm/gdm-x-session_session-wrapper.patch

@@ -1,40 +1,33 @@
 diff --git a/daemon/gdm-x-session.c b/daemon/gdm-x-session.c
-index 88fe96f..b1b140a 100644
+index ed01fbe52..de3a6e647 100644
 --- a/daemon/gdm-x-session.c
 +++ b/daemon/gdm-x-session.c
-@@ -664,18 +664,34 @@ spawn_session (State        *state,
-                                                           state->session_command,
-                                                           NULL);
-         } else {
-+                char const *session_wrapper;
-+                char *eff_session_command;
-                 int ret;
-                 char **argv;
+@@ -670,12 +670,27 @@ spawn_session (State        *state,
+                 g_subprocess_launcher_setenv (launcher, "WINDOWPATH", vt, TRUE);
+         }
  
--                ret = g_shell_parse_argv (state->session_command,
-+                session_wrapper = g_getenv("GDM_X_SESSION_WRAPPER");
-+                if (session_wrapper != NULL) {
-+                        char *quoted_wrapper = g_shell_quote(session_wrapper);
-+                        eff_session_command = g_strjoin(" ", quoted_wrapper, state->session_command, NULL);
-+                        g_free(quoted_wrapper);
-+                } else {
-+                        eff_session_command = state->session_command;
-+                }
++        char const *session_wrapper;
++        char *eff_session_command;
++        session_wrapper = g_getenv ("GDM_X_SESSION_WRAPPER");
++        if (session_wrapper != NULL) {
++                char *quoted_wrapper = g_shell_quote (session_wrapper);
++                eff_session_command = g_strjoin (" ", quoted_wrapper, state->session_command, NULL);
++                g_free (quoted_wrapper);
++        } else {
++                eff_session_command = state->session_command;
++        }
 +
-+                ret = g_shell_parse_argv (eff_session_command,
-                                           NULL,
-                                           &argv,
-                                           &error);
+         subprocess = g_subprocess_launcher_spawn (launcher,
+                                                   &error,
+                                                   GDMCONFDIR "/Xsession",
+-                                                  state->session_command,
++                                                  eff_session_command,
+                                                   NULL);
  
-+                if (session_wrapper != NULL) {
-+                        g_free(eff_session_command);
-+                }
++        if (session_wrapper != NULL) {
++                g_free (eff_session_command);
++        }
 +
-                 if (!ret) {
-                         g_debug ("could not parse session arguments: %s", error->message);
-                         goto out;
-                 }
-+
-                 subprocess = g_subprocess_launcher_spawnv (launcher,
-                                                            (const char * const *) argv,
-                                                            &error);
+         if (subprocess == NULL) {
+                 g_debug ("could not start session: %s", error->message);
+                 goto out;

pkgs/by-name/gd/gdm/package.nix

@@ -25,6 +25,7 @@
   audit,
   gobject-introspection,
   plymouth,
+  polkit,
   coreutils,
   xorg-server,
   dbus,
@@ -43,7 +44,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdm";
-  version = "49.2";
+  version = "50.0";
 
   outputs = [
     "out"
@@ -52,14 +53,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdm/${lib.versions.major finalAttrs.version}/gdm-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mBNjH59fD4YOoUpDeGbmDvx77TAjt8O3Zcxd4d5ZegY=";
+    hash = "sha256-ZG9T1o8tLRRxRv+uuFBH3ti4E9yxwQTY8Ow2ymCetb8=";
   };
 
   mesonFlags = [
     "-Dgdm-xsession=true"
     # TODO: Setup a default-path? https://gitlab.gnome.org/GNOME/gdm/-/blob/6fc40ac6aa37c8ad87c32f0b1a5d813d34bf7770/meson_options.txt#L6
     "-Dinitial-vt=1"
-    "-Dudev-dir=${placeholder "out"}/lib/udev/rules.d"
     "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
     "-Dsystemduserunitdir=${placeholder "out"}/lib/systemd/user"
     "--sysconfdir=/etc"
@@ -92,6 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
     libselinux
     pam
     plymouth
+    polkit
     systemd
   ];
 
@@ -133,11 +134,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
-    # Upstream checks some common paths to find an `X` binary. We already know it.
-    echo #!/bin/sh > build-aux/find-x-server.sh
-    echo "echo ${lib.getBin xorg-server}/bin/X" >> build-aux/find-x-server.sh
-    patchShebangs build-aux/find-x-server.sh
-
     # Reverts https://gitlab.gnome.org/GNOME/gdm/-/commit/b0f802e36ff948a415bfd2bccaa268b6990515b7
     # The gdm-auth-config tool is probably not too useful for NixOS, but we still want the dconf profile
     # installed (mostly just because .passthru.tests can make use of it).

pkgs/by-name/gd/gdm/reset-environment.patch

@@ -1,20 +1,24 @@
+diff --git a/daemon/gdm-wayland-session.c b/daemon/gdm-wayland-session.c
+index 3ca2d1496..cb9e96101 100644
 --- a/daemon/gdm-wayland-session.c
 +++ b/daemon/gdm-wayland-session.c
-@@ -285,6 +285,7 @@ spawn_session (State        *state,
+@@ -287,6 +287,7 @@ spawn_session (State        *state,
+                                                     "XAUTHORITY",
                                                      "WAYLAND_DISPLAY",
                                                      "WAYLAND_SOCKET",
-                                                     "GNOME_SHELL_SESSION_MODE",
 +                                                    "__NIXOS_SET_ENVIRONMENT_DONE",
                                                      NULL };
- 
-         g_debug ("Running wayland session");
+         /* The environment variables listed below are those we have set (or
+          * received from our own execution environment) only as a fallback to
+diff --git a/daemon/gdm-x-session.c b/daemon/gdm-x-session.c
+index ed01fbe52..06efac2df 100644
 --- a/daemon/gdm-x-session.c
 +++ b/daemon/gdm-x-session.c
-@@ -610,6 +610,7 @@ spawn_session (State        *state,
+@@ -603,6 +603,7 @@ spawn_session (State        *state,
+                                                      "XAUTHORITY",
                                                       "WAYLAND_DISPLAY",
                                                       "WAYLAND_SOCKET",
-                                                      "GNOME_SHELL_SESSION_MODE",
 +                                                     "__NIXOS_SET_ENVIRONMENT_DONE",
                                                       NULL };
- 
-         g_debug ("Running X session");
+         /* The environment variables listed below are those we have set (or
+          * received from our own execution environment) only as a fallback to

pkgs/by-name/ge/geoclue2/package.nix

@@ -49,6 +49,8 @@ stdenv.mkDerivation (finalAttrs: {
     ./add-option-for-installation-sysconfdir.patch
   ];
 
+  separateDebugInfo = true;
+
   nativeBuildInputs = [
     pkg-config
     intltool

pkgs/by-name/ge/gexiv2/package.nix

@@ -79,6 +79,7 @@ stdenv.mkDerivation rec {
     updateScript = gnome.updateScript {
       packageName = pname;
       versionPolicy = "odd-unstable";
+      freeze = true;
     };
   };
 

pkgs/by-name/gh/ghex/package.nix

@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ghex";
-  version = "48.3";
+  version = "50.0";
 
   outputs = [
     "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/ghex/${lib.versions.major finalAttrs.version}/ghex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-y8hEJ7Kt6pQDUCoSXzZrnyiIE/cugb9rGRVGBvFZ3Tk=";
+    hash = "sha256-gyXKSx+nU3XPiVHmL4Z/pqhCgiwt1aRqmHc2CBizAhI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gh/ghostscript/package.nix

@@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ghostscript${lib.optionalString x11Support "-with-X"}";
-  version = "10.06.0";
+  version = "10.07.0";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${
       lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
     }/ghostscript-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZDUmSMLAgcip+xoS3Bll4B6tfFf1i3LRtU9u8c7zxWE=";
+    hash = "sha256-3azk4XIflnpVA5uv9WSEAiXguqHU9UMiR8oczRRzt8E=";
   };
 
   patches = [
@@ -165,10 +165,10 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   configureFlags = [
+    "CFLAGS=-std=gnu17"
     "--with-system-libtiff"
     "--without-tesseract"
   ]
-  ++ lib.optional stdenv.cc.isClang "CFLAGS=-std=gnu17" # FIXME: make it unconditional
   ++ lib.optionals dynamicDrivers [
     "--enable-dynamic"
     "--disable-hidden-visibility"

pkgs/by-name/gi/git/package.nix

@@ -61,7 +61,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.53.0";
+  version = "2.54.0";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [
     CGI
@@ -103,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
         }.tar.xz"
       else
         "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    hash = "sha256-WBi9fYCwYbu9/sikM9YJ3IgYoFmR9zH/xKVh4soYxlM=";
+    hash = "sha256-9okWI2TBDeee+Jqo2/SHMesFfjTtu9IKylEM4BVGgaM=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";
@@ -123,6 +123,14 @@ stdenv.mkDerivation (finalAttrs: {
     ./git-sh-i18n.patch
     # Do not search for sendmail in /usr, only in $PATH
     ./git-send-email-honor-PATH.patch
+    # The 'total N' header from ls -l is unstable on ZFS and similar
+    # filesystems, causing spurious failures.
+    # https://github.com/NixOS/nixpkgs/issues/498789
+    (fetchurl {
+      name = "t7703-ignore-ls-total.patch";
+      url = "https://lore.kernel.org/git/20260504101429.340123-1-joerg@thalheim.io/raw";
+      hash = "sha256-44EPfEJ39LjPWjqjFb52EKNaJGzYxZzJaJOis8QnazU=";
+    })
     # Address test failure (new in 2.52.0) caused by `git-gui--askyesno` being
     # installed by `make install`.
     (fetchurl {
@@ -130,13 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://lore.kernel.org/git/20251201031040.1120091-1-brianmlyles@gmail.com/raw";
       hash = "sha256-vvhbvg74OIMzfksHiErSnjOZ+W0M/T9J8GOQ4E4wKbU=";
     })
-    # Fix build failure on Darwin when building Keychain integration
-    # See https://github.com/git/git/pull/2188 and https://github.com/Homebrew/homebrew-core/pull/266961
-    (fetchurl {
-      name = "osxkeychain-define-build-targets-in-toplevel-Makefile.patch";
-      url = "https://lore.kernel.org/git/pull.2046.v2.git.1770775169908.gitgitgadget@gmail.com/raw";
-      hash = "sha256-7jTiMM5XFRDj/srtVf8olW62T/mesqLcyRp3NZJcid8=";
-    })
   ]
   ++ lib.optionals rustSupport [
     # The above patch doesn’t work with Rust support enabled.
@@ -168,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {
   + lib.optionalString (rustSupport && (stdenv.buildPlatform != stdenv.hostPlatform)) ''
     substituteInPlace Makefile \
       --replace-fail "RUST_TARGET_DIR = target/" \
-                     "RUST_TARGET_DIR = target/${stdenv.hostPlatform.rust.rustcTargetSpec}/"
+                     "RUST_TARGET_DIR = target/${stdenv.hostPlatform.rust.cargoShortTarget}/"
   '';
 
   nativeBuildInputs = [

pkgs/by-name/gi/gixy/package.nix

@@ -40,8 +40,9 @@ python.pkgs.buildPythonApplication rec {
     # Migrate tests to pytest
     # https://github.com/yandex/gixy/pull/146
     (fetchpatch2 {
-      url = "https://github.com/yandex/gixy/compare/6f68624a7540ee51316651bda656894dc14c9a3e...b1c6899b3733b619c244368f0121a01be028e8c2.patch";
-      hash = "sha256-6VUF2eQ2Haat/yk8I5qIXhHdG9zLQgEXJMLfe25OKEo=";
+      name = "migrate-tests-to-pytest.patch";
+      url = "https://github.com/yandex/gixy/compare/6f68624a7540ee51316651bda656894dc14c9a3e...b1c6899b3733b619c244368f0121a01be028e8c2.diff?full_index=1";
+      hash = "sha256-qIKKTC65ewZqiKiNLcaglKEdFh0SBZMJgIvY41/7WUc=";
     })
     ./python3.13-compat.patch
   ];

pkgs/by-name/gj/gjs/disable-introspection-test.patch

@@ -1,12 +1,10 @@
-diff --git a/installed-tests/js/meson.build b/installed-tests/js/meson.build
-index 07759690..43c87c59 100644
 --- a/installed-tests/js/meson.build
 +++ b/installed-tests/js/meson.build
-@@ -34,7 +34,6 @@ jasmine_tests = [
+@@ -37,7 +37,6 @@ jasmine_tests = [
+     'GObjectInterface',
+     'GObjectValue',
      'GTypeClass',
-     'Importer',
-     'Importer2',
 -    'Introspection',
-     'Lang',
-     'LegacyByteArray',
-     'LegacyClass',
+     'Namespace',
+     'ParamSpec',
+     'Print',

pkgs/by-name/gj/gjs/disable-umlaut-test.patch

@@ -1,10 +1,8 @@
-diff --git a/installed-tests/js/testGIMarshalling.js b/installed-tests/js/testGIMarshalling.js
-index b94aa7c8..8f79fe71 100644
 --- a/installed-tests/js/testGIMarshalling.js
 +++ b/installed-tests/js/testGIMarshalling.js
-@@ -2931,7 +2931,7 @@ describe('Filename tests', function () {
+@@ -3013,7 +3013,7 @@ describe('Filename tests', function () {
      });
- 
+
      it('various types of path existing', function () {
 -        const paths = ['foo-2', 'öäü-3'];
 +        const paths = ['foo-2'];

pkgs/by-name/gj/gjs/fix-paths.patch

@@ -1,12 +1,10 @@
-diff --git a/installed-tests/debugger-test.sh b/installed-tests/debugger-test.sh
-index 0d118490..54c5507e 100755
 --- a/installed-tests/debugger-test.sh
 +++ b/installed-tests/debugger-test.sh
 @@ -6,7 +6,7 @@
  if test "$GJS_USE_UNINSTALLED_FILES" = "1"; then
      gjs="$TOP_BUILDDIR/gjs-console"
  else
--    gjs=gjs-console
+-    gjs="gjs-console"
 +    gjs=@gjsConsole@
  fi
  

pkgs/by-name/gj/gjs/installed-tests-path.patch

@@ -1,5 +1,3 @@
-diff --git a/installed-tests/js/meson.build b/installed-tests/js/meson.build
-index 98475f7d..942d9eca 100644
 --- a/installed-tests/js/meson.build
 +++ b/installed-tests/js/meson.build
 @@ -10,7 +10,7 @@ jsunit_resources_files = gnome.compile_resources('jsunit-resources',
@@ -20,7 +18,7 @@ index 98475f7d..942d9eca 100644
      }
      configure_file(configuration: test_description_subst,
          input: '../minijasmine.test.in',
-@@ -122,7 +122,7 @@ foreach test : dbus_tests
+@@ -122,7 +122,7 @@ endif
  
  dbus_test_description_subst = {
      'name': 'testGDBus.js',
@@ -29,7 +27,7 @@ index 98475f7d..942d9eca 100644
  }
  configure_file(
      configuration: dbus_test_description_subst,
-@@ -159,7 +159,7 @@ foreach test : modules_tests
+@@ -166,7 +166,7 @@ foreach test : modules_tests
  
      esm_test_description_subst = {
          'name': 'test@0@.js'.format(test),
@@ -37,9 +35,7 @@ index 98475f7d..942d9eca 100644
 +        'installed_tests_execdir': installed_tests_execdir,
      }
      configure_file(configuration: esm_test_description_subst,
-         input: '../minijasmine-module.test.in',
-diff --git a/installed-tests/meson.build b/installed-tests/meson.build
-index 7a7c48ab..52508c2c 100644
+         input: '../minijasmine-legacy-importer.test.in',
 --- a/installed-tests/meson.build
 +++ b/installed-tests/meson.build
 @@ -34,7 +34,7 @@ foreach test : simple_tests
@@ -51,7 +47,7 @@ index 7a7c48ab..52508c2c 100644
      }
      configure_file(configuration: test_description_subst,
          input: 'script.test.in', output: 'test@0@.sh.test'.format(test),
-@@ -123,7 +123,7 @@ foreach test : debugger_tests
+@@ -88,7 +88,7 @@ foreach test : debugger_tests
  
      test_description_subst = {
          'name': '@0@.debugger'.format(test),
@@ -60,19 +56,15 @@ index 7a7c48ab..52508c2c 100644
      }
      configure_file(configuration: test_description_subst,
          input: 'debugger.test.in',
-diff --git a/installed-tests/script.test.in b/installed-tests/script.test.in
-index debefc4c..96a91b88 100644
---- a/installed-tests/script.test.in
-+++ b/installed-tests/script.test.in
-@@ -3,5 +3,5 @@
+@@ -122,7 +122,7 @@ foreach test : module_debugger_tests
  
- [Test]
- Type=session
--Exec=sh @prefix@/@installed_tests_execdir@/scripts/@name@
-+Exec=sh @installed_tests_execdir@/scripts/@name@
- Output=TAP
-diff --git a/meson.build b/meson.build
-index bbfe8bc8..e6f87dc3 100644
+     test_description_subst = {
+         'name': '@0@.debugger'.format(filename),
+-        'installed_tests_execdir': prefix / installed_tests_execdir,
++        'installed_tests_execdir': installed_tests_execdir,
+     }
+     configure_file(configuration: test_description_subst,
+         input: 'debugger.test.in',
 --- a/meson.build
 +++ b/meson.build
 @@ -25,8 +25,8 @@ datadir = get_option('datadir')
@@ -86,7 +78,7 @@ index bbfe8bc8..e6f87dc3 100644
  
  ### Check for conflicting build options ########################################
  
-@@ -577,9 +577,9 @@ install_data('installed-tests/extra/gjs.supp', install_dir: gjsjsdir / 'valgrind
+@@ -605,9 +605,9 @@ install_data('installed-tests/extra/gjs.supp', install_dir: gjsjsdir / 'valgrind
  install_data('installed-tests/extra/lsan.supp', install_dir: gjsjsdir / 'lsan')
  
  if get_option('installed_tests')
@@ -98,8 +90,6 @@ index bbfe8bc8..e6f87dc3 100644
  endif
  
  ### Generate pkg-config file ###################################################
-diff --git a/meson_options.txt b/meson_options.txt
-index fe425efd..29325756 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
 @@ -24,3 +24,5 @@ option('skip_gtk_tests', type: 'boolean', value: false,

pkgs/by-name/gj/gjs/package.nix

@@ -8,7 +8,6 @@
   pkg-config,
   gnome,
   gtk3,
-  gtk4,
   atk,
   gobject-introspection,
   spidermonkey_140,
@@ -31,7 +30,8 @@
 let
   testDeps = [
     gtk3
-    gtk4
+    # FIXME: Gtk4Warnings fails
+    # gtk4
     atk
     pango.out
     gdk-pixbuf
@@ -41,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gjs";
-  version = "1.86.0";
+  version = "1.88.0";
 
   outputs = [
     "out"
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Y0SPeleATUwqjQx/XpDiJNBNTrLVYBQsB2xlqO2gB5k=";
+    hash = "sha256-MKC58zF+jmCxiW2ykDxw6LDNM9+VPDKHVYA6dRkdxFM=";
   };
 
   patches = [

pkgs/by-name/gl/glib/package.nix

@@ -82,7 +82,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.86.3";
+  version = "2.88.1";
 
   outputs = [
     "bin"
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-syEdjTS5313KBXh+8K1dfKdd7JmLlw4aqwAB0imXfGU=";
+    hash = "sha256-UauATFb26rPlBFx3TRKQrF5Mkj1Pmj2OMxI77kXBhA4=";
   };
 
   patches =